Generated by All in One SEO Pro v5.0.0.1, this is an llms-full.txt file, used by LLMs to index the site. # Techuisitive Little Different Inquisitive ## Posts ### [Blog](https://techuisitive.com/blog/) **Published:** March 27, 2023 **Author:** Equebal Ahmad --- ### [How to Enable Windows SSO in Firefox Using Microsoft Intune](https://techuisitive.com/enabling-windows-sso-in-firefox-using-intune/) **Published:** April 21, 2026 **Author:** Equebal Ahmad **Content:** Firefox Windows SSO enables users to seamlessly authenticate to supported enterprise web applications in Firefox using their existing Windows or Microsoft Entra ID credentials. This guide explains how Firefox Windows SSO works and how administrators can configure it using enterprise policies. ## What Is Firefox Windows SSO and How Does It Work? Firefox Windows SSO (Single Sign-On) allows users to access supported Microsoft and enterprise web applications in Firefox using their existing Windows or Microsoft Entra ID credentials, without repeatedly entering their username and password. When configured by an administrator, Firefox can use Windows integrated authentication to pass the user’s logged-in identity to supported services, providing a more seamless sign-in experience. In managed environments, this functionality can be configured through Firefox enterprise policies, making it suitable for organizations using Intune or other device management solutions. ## Why Enable Firefox Windows SSO? Firefox Windows SSO can improve the sign-in experience for users in managed enterprise environments while helping administrators maintain a consistent authentication experience across browsers. It can reduce repeated credential prompts and the associated user support requests, particularly in organizations that use Microsoft Entra ID for identity and access management. For organizations supporting multiple browsers, enabling SSO in Firefox also helps provide a similar authentication experience to what users may already have in Microsoft Edge or Google Chrome. From a security perspective, the configuration works with the existing Windows and Microsoft Entra ID authentication infrastructure, including Primary Refresh Token (PRT)-based authentication on supported Windows configurations. ### **Key benefits include:** - Reduced repeated sign-in prompts - Better user experience across managed browsers - Fewer authentication-related helpdesk requests - Integration with Microsoft Entra ID - Use of existing Windows authentication mechanisms ## Prerequisites & Device Licensing You need to ensure the following prerequisites are met before enabling Windows SSO in Firefox, - **Operating System**: Windows 10 or Windows 11. - **Firefox Version**: Version 91 or newer. - **Accounts**: Microsoft, work, or school accounts linked to Windows. - **Administrative Rights**: Required if deploying via Intune or Group Policy. ## Manually Configure SSO on a Device You can manually configure SSO in Mozilla Firefox by following the steps below. This is useful when your organization has not configured SSO for Firefox, and you want to enable that. Please note that you will not be able to change this option if your organization has enabled or disabled Windows SSO for Firefox through Microsoft Intune or Group Policies. - **Open Firefox**. - Click the **menu button (≡)** located at the top-right corner of the browser window. - Select **Settings** from the dropdown menu. - Navigate to the **Privacy & Security** panel on the left sidebar. - Scroll down to the **Logins and Passwords** section. - Check the box next to **Allow Windows single sign-on for Microsoft, work, and school accounts** to enable the feature. - Close the settings tab. - Restart Firefox to apply the changes and ensure the SSO feature is active. ![Enable Windows SSO in Firefox](https://techuisitive.com/wp-content/uploads/2026/04/image-9-1024x530.png)## Deploy Firefox Windows SSO via Intune Imported ADMX Templates Follow the steps below to configure Windows SSO in Firefox for managed devices using Microsoft Intune. #### Step 1: Download and Import Firefox AMDX templates Download the latest **Firefox ADMX templates** from the [official Mozilla website](https://github.com/mozilla/policy-templates/releases). The Firefox policy template depends on both the **Mozilla.admx** and **Windows.admx** files, so make sure these required ADMX templates are also imported into Microsoft Intune before configuring Firefox policies. ![Import Firefox ADMX in Intune](https://techuisitive.com/wp-content/uploads/2026/04/image-10.png)#### Step 2: Create Configuration Profile - Open the **Intune Admin Portal** and navigate to **Devices > Windows > Configuration profiles**. - Click **Create profile** and select **Windows 10 and later** as the platform. - Choose **Templates > Imported Administrative Templates (Preview)** to create a new policy. - Provide an appropriate name & description for the policy and click on Next to create the profile. ![ Imported Administrative Templates (Preview) ](https://techuisitive.com/wp-content/uploads/2026/04/image-11-1024x432.png) #### Step 3: Add Firefox Setting - In the profile wizard, click **Add settings**. - Search for **Firefox** (appears after ADMX import). - Search for **Windows SSO** and select the policy **Windows SSO** from the results. - Select **Enabled** and click on Ok to turn on the settings. - Select Next. ![Mozilla Firefox Windows SSO Setting catalog in Intune](https://techuisitive.com/wp-content/uploads/2026/04/image-12-1024x418.png) #### Step 4: Assign the Profile Assign the profile to the target All Devices, All users, Entra ID groups. You can also use [Assignment filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/ "Intune Filters – Assign Microsoft Store App policy using Filters") for granular targeting of the deployment. Monitor deployment status and troubleshoot any issues via Intune reporting tools. ## How to Verify Policy Application on Endpoints Once Windows SSO is enabled in Firefox: - Users accessing Microsoft 365 services such as Outlook, Teams, and SharePoint will be automatically signed in using their Windows credentials. - Users will no longer be prompted repeatedly for usernames and passwords, streamlining access. - This seamless authentication improves productivity and reduces login friction in enterprise environments. Open Firefox on the device and follow the steps below to verify the policy. - **Open Firefox**. - Click the **menu button (≡)** located at the top-right corner of the browser window. - Select **Settings** from the dropdown menu. - Navigate to the **Privacy & Security** panel on the left sidebar. - Scroll down to the **Logins and Passwords** section. - Check the box next to **Allow Windows single sign-on for Microsoft, work, and school accounts** to enable the feature. You can notice that the **“Allow Windows Single Sign-on for Microsoft, work, and school accounts”** option is now enabled and grayed out. The policy is now applied through Intune, and users won’t be able to change the settings. ![Allow Windows Single Sign-on for Microsoft, work, and school accounts](https://techuisitive.com/wp-content/uploads/2026/04/image-13.png)## Troubleshooting Firefox Windows SSO If Firefox Windows SSO is not working as expected, check the following areas before troubleshooting the individual application. ### 1. Verify Device Registration Confirm that the Windows device is **Microsoft Entra joined or Microsoft Entra hybrid joined**. The device’s Entra registration and Windows sign-in context are important for the authentication token to be passed successfully to supported applications. You can verify the device registration status by running: ``` dsregcmd /status ``` Check the **Device State** section for `AzureAdJoined` or `DomainJoined` status. ![Dsregcmd check device registration](https://techuisitive.com/wp-content/uploads/2026/04/device-registration-dsregcmd.jpg)### 2. Verify the Firefox Policy If Windows SSO is configured through Intune, confirm that the Firefox ADMX policy has reached the client. In Firefox, open: ``` about:policies ``` Under **Active**, verify that the `WindowsSSO` policy is listed without errors. You can also check the Windows Registry for the Firefox policy configuration under: ``` HKLM\SOFTWARE\Policies\Mozilla\Firefox ``` ![](https://techuisitive.com/wp-content/uploads/2026/04/Windows-sso-firefox-registry-1024x298.jpg)If the policy is not present, check the Intune assignment and initiate a policy sync from the affected device. ### 3. Check the Windows Authentication Broker Firefox Windows SSO depends on the Windows authentication broker and the user’s Microsoft Entra authentication state. If the device does not have a valid authentication token, the broker is disabled, or broker functionality is blocked by policy, Firefox cannot complete the SSO handshake. #### I. Verify the Primary Refresh Token (PRT) Status The Windows broker needs a valid **Primary Refresh Token (PRT)** from Microsoft Entra ID to provide the user’s authentication context to supported applications. Open **Command Prompt as administrator** and run: ``` dsregcmd /status ``` Under **SSO State**, check: ``` AzureAdPrt : YES ``` ![](https://techuisitive.com/wp-content/uploads/2026/04/Windows-SSO-state-1024x335.jpg)If `AzureAdPrt` shows `NO`, investigate the device’s Microsoft Entra registration and authentication state before troubleshooting Firefox. #### II. Check the Web Account Manager (TokenBroker) Service Windows uses **Web Account Manager (WAM)** to manage authentication tokens for applications. If the service has been disabled or restricted by an optimization script or security configuration, SSO may not work. Open **Services** (`services.msc`) and locate **Web Account Manager** (`TokenBroker`). Verify that the service is not disabled and can start when required. Its normal startup configuration is **Manual**. ![](https://techuisitive.com/wp-content/uploads/2026/04/WAM-Service-status-1024x212.jpg) #### III. Check Whether WAM Is Blocked by Policy Security baselines or legacy Group Policies can sometimes restrict Windows account authentication. Open **Registry Editor** (`regedit`) and check: ``` HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin ``` Look for values such as `DisableAADWAM` or `BlockAADWorkplaceJoin`. If either value is configured as `1`, review the policy responsible for the setting, as it may prevent Windows authentication broker functionality required for SSO. ![](https://techuisitive.com/wp-content/uploads/2026/04/Workplace-Join.jpg)#### IV. Verify Firefox’s Windows SSO Setting Finally, verify that Firefox is configured to allow Windows SSO. Open: ``` about:config ``` Search for: ``` network.http.windows-sso.enabled ``` The value should be **true**. If it is set to `false`, review the Firefox enterprise policy configuration and check `about:policies` to confirm that the expected policy has been applied. If the PRT is healthy, WAM is available, no policy is blocking it, and Firefox’s Windows SSO setting is enabled, the issue is more likely related to the target application’s authentication flow or its support for Windows SSO. ### 4. Restart Firefox and Test Again After correcting the configuration, completely close and reopen Firefox and test a supported Microsoft, work, or school account sign-in again. **Quick checklist:** - Device is Entra joined or Hybrid Entra joined. - `WindowsSSO` Policy is successfully applied. - `about:policies` Shows the policy as active. - Firefox policy exists under the expected Registry path. - Windows account/broker functionality is available. - Firefox is restarted after policy changes. ## Conclusion Enabling Windows SSO in Firefox streamlines authentication for Microsoft, work, and school accounts, providing users with a more seamless sign-in experience and reducing the need to repeatedly enter credentials. It is particularly useful in managed enterprise environments where users access Microsoft Entra ID–based applications across multiple browsers. Whether configured manually or deployed centrally through Microsoft Intune, Firefox Windows SSO can improve productivity, reduce authentication-related user friction, and provide a consistent sign-in experience while leveraging the organization’s existing Windows and Microsoft identity infrastructure. ## Frequently Asked Questions (FAQs) ### **Which Firefox versions support Windows SSO?** Firefox version 91 and newer support this feature. ### **Does this work on macOS or Linux?** No, Windows SSO is exclusive to Windows 10 and Windows 11 operating systems. ### **Can administrators enforce this setting?** Yes, administrators can enforce Windows SSO using Intune or Group Policy with the ADMX templates. ### **What types of accounts are supported?** Microsoft, work, and school accounts that are linked to Windows credentials. ### **Is a browser extension required?** No, the Windows SSO feature is built directly into Firefox and does not require any extensions. ## Related Posts - [How to Allow Copilot in Microsoft Edge Using Intune](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/) - [Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Manage Microsoft Edge Favorites with Intune for Windows 10/11](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Enabling Azure Single Sign-On in Google Chrome with Intune: Don’t Miss This Key Setting](https://techuisitive.com/enabling-azure-single-sign-on-in-google-chrome-with-intune-dont-miss-this-key-setting/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Guides --- ### [Bulk Add Devices to Entra ID Group from CSV File](https://techuisitive.com/powershell-script-add-device-to-entra-id-group-from-csv-file/) **Published:** June 25, 2025 **Author:** Equebal Ahmad **Content:** This PowerShell script adds devices to an Entra ID group via a CSV file, streamlining device management. It reads a CSV containing device name, authenticates to Entra ID, and processes each entry, assigning devices to the specified group. For an Intune admin, this script eliminates manual data entry, reducing errors and saving valuable time. It ensures consistency in device grouping, enhances policy enforcement, and simplifies large-scale deployments. By automating routine tasks, admins can focus on strategic IT initiatives rather than tedious administrative work. ## Use Cases This script is especially useful in scenarios where automation and scale matter: - **Bulk Group Assignment:** Add hundreds of devices to a security or configuration group without manually retrieving Object IDs. - **Simplified CSV Input:** Instead of requiring **Object IDs** (as in the Intune portal import option), admins can simply provide **device names** in the CSV file. This makes preparation faster and less error-prone. - **Policy Targeting:** Automatically assign devices to groups for **conditional access**, **compliance policies**, or **application deployments**. - **Dynamic Onboarding:** New devices can be added to the CSV and rerun through the script, ensuring they are grouped correctly during onboarding. ## Prerequisites Before running the PowerShell script to add devices to an Entra ID group from a CSV file, ensure the following: - **Permissions:** - You must have **Global Administrator**, **Intune Administrator**, or **Privileged Role Administrator** rights in Entra ID. - **Modules:** - Install and import the **Microsoft Graph PowerShell SDK** (`Microsoft.Graph` module). - **Authentication:** - Sign in to Microsoft Graph with sufficient privileges (`Connect-MgGraph`). - **CSV File:** - Prepare a CSV file with a header row (`DeviceName`) and the list of device names. - **Consistent Naming Convention:** - Ensure device names match exactly with those registered in Intune/Entra ID. - **Execution Policy:** - PowerShell execution policy should allow running custom scripts (`Set-ExecutionPolicy RemoteSigned`). ## CSV File The **CSV file** should contain the list of device names that you want to add to the Entra ID group. Make sure the file includes a header row and that each device name is listed on a separate line. Keep the CSV file in the script directory. **Example format:** ``` DeviceName EQUEBAL-LAPTOP DT-430882 WIN11_VM2 ``` ## PowerShell Script to Add Devices to Entra ID Group **Use the PowerShell script below to seamlessly add devices to an Entra ID group by referencing their names from a CSV file.** This approach eliminates the need to manually look up and provide Object IDs, making bulk group assignments faster, more intuitive, and less error-prone. By preparing a simple CSV with device names, administrators can automate group membership updates and ensure consistent policy targeting across large environments. ``` $csvFilePath = "$PSScriptRoot\devices.csv" $groupName = "Test-Group" $logFilePath = "$PSScriptRoot\DeviceGroupAdd.log" $transcriptPath = "$PSScriptRoot\Transcript.log" # Start transcript Start-Transcript -Path $transcriptPath -Append # Check if required module is installed $graphModule = Get-Module -ListAvailable -Name Microsoft.Graph if (-not $graphModule) { Write-Host "Required module is missing:" -ForegroundColor Red Write-Host " - Microsoft.Graph" -ForegroundColor Yellow Write-Host "`nPlease install the missing module before running this script." -ForegroundColor Cyan Write-Host "Example:" -ForegroundColor Cyan Write-Host " Install-Module Microsoft.Graph -Scope CurrentUser" -ForegroundColor Green Stop-Transcript Exit } Write-Host "Microsoft.Graph module is installed. Proceeding..." -ForegroundColor Green # Connect to Microsoft Graph with required scopes Connect-MgGraph -Scopes "Group.ReadWrite.All","Device.Read.All" $devices = Import-Csv -Path $csvFilePath # Get group by display name $group = Get-MgGroup -Filter "displayName eq '$groupName'" if (-not $group) { Write-Host "Error: Group '$groupName' not found in Entra ID." -ForegroundColor Red Stop-Transcript Exit } $groupId = $group.Id $totalDevices = ($devices).Count $sn = 1 Write-Host "Total Devices: $totalDevices" -ForegroundColor Yellow # Initialize log file "=== Device Group Assignment Log ===" | Out-File -FilePath $logFilePath foreach ($device in $devices) { try { $deviceName = $device.DeviceName # Get all devices with same display name (handles duplicates) $deviceInfo = Get-MgDevice -Filter "displayName eq '$deviceName'" | Select-Object Id if ($deviceInfo) { foreach ($d in $deviceInfo) { $deviceGUID = $d.Id Write-Host -NoNewline "Device:$sn of $totalDevices, Device Name: $deviceName, ObjectID: $deviceGUID, Group Name: $groupName, ObjectID: $groupId, Status:" -ForegroundColor Cyan # Add device to group New-MgGroupMember -GroupId $groupId -DirectoryObjectId $deviceGUID Write-Host "Success" -ForegroundColor Green # Log success "SUCCESS: DeviceName=$deviceName, ObjectID=$deviceGUID added to Group=$groupName" | Out-File -FilePath $logFilePath -Append } } else { Write-Host "Error: Device not found - $deviceName" -ForegroundColor Red "ERROR: DeviceName=$deviceName not found in Entra ID" | Out-File -FilePath $logFilePath -Append } } catch { $message = $_.Exception.Message Write-Host "Error: $message" -ForegroundColor Red "ERROR: DeviceName=$deviceName failed with message: $message" | Out-File -FilePath $logFilePath -Append } $sn += 1 } # Stop transcript Stop-Transcript ``` ## Script Output & Logs The *Add Devices to Entra Group* script produces clear, user‑friendly output that indicates whether a device was successfully added, already a member, or encountered an unexpected error. All execution details—including timestamps, group and device IDs, and success or failure messages—are captured in both a log file and a PowerShell transcript stored in the script folder. These records provide a complete trail of activity, making it easy to verify results and troubleshoot any issues by reviewing the saved logs and transcripts. ![Add Device to Entra Group PowerShell script](https://techuisitive.com/wp-content/uploads/2025/06/image-1024x400.png)## Download Script [BulkAddDeviceToEntraGroup](https://techuisitive.com/wp-content/uploads/2026/08/BulkAddDeviceToEntraGroup.zip)[Download](https://techuisitive.com/wp-content/uploads/2026/08/BulkAddDeviceToEntraGroup.zip) ## Related Posts - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, PowerShell **Tags:** Automation Graph API, Intune Automation, PowerShell --- ### [Check OS Version Compliance with Intune Compliance Policy](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/) **Published:** September 20, 2021 **Author:** Equebal Ahmad **Content:** Microsoft Intune compliance policies can be used to check whether Windows devices are running a supported operating system version. By configuring a minimum OS version requirement, you can mark devices running older Windows versions as noncompliant and notify users so they can take corrective action. In this guide, we will create an Intune compliance policy and configure notifications to alert users when their devices are running a non-compliant OS version. ## What is a Device Compliance Policy? Microsoft Intune device compliance policies define the requirements that managed devices must meet to be considered compliant. These policies can evaluate device health, security settings, operating system versions, and other conditions. Intune supports compliance policies for the following platforms: - Android Device Administrator - Android AOSP - Android Enterprise - iOS/iPadOS - Linux – Ubuntu Desktop, versions 20.04 LTS and 22.04 LTS - macOS - Windows 10/11 In this guide, we will use a **Windows 10/11 device compliance policy** to check the device’s OS version and notify the user when the device does not meet the required OS version. ## How to **Create a Notification** for Device Compliance Policy To alert users when their device is running a non‑compliant OS version, you first need to create an email notification template in the Microsoft Intune admin center. This template will later be linked to your device compliance policy and automatically trigger an email when a device fails to meet the minimum OS version requirement. **Steps:** Sign in to the **Microsoft Intune admin center**. Navigate to **Devices > Compliance policies > Notifications**. Select **Create notification**. ![Intune notification template setup ](https://techuisitive.com/wp-content/uploads/2023/04/image-95.jpeg)On the **Basics** page of the notification setup, provide the following details to ensure your email notification is branded and informative: - **Name**: Enter a clear policy name (e.g., *OS Version Compliance Notification*). - **Email Header**: Toggle **Enable** and include your **company logo** for professional branding. - **Email Footer – Company Name**: Toggle **Enable** to display your organization’s name. - **Email Footer – Contact Information**: Toggle **Enable** to add IT support or helpdesk contact details. - **Company Portal Website Link**: Toggle **Enable** if you want users to access the **Company Portal app** to install updates or applications that make their device compliant. ![intune device compliance notification](https://techuisitive.com/wp-content/uploads/2023/04/image-96.jpeg)On the **Notification message templates** page, enter the required details to customize the email that will be sent to users when their device is non‑compliant. This ensures the message is clear, branded, and actionable. ![intune create device noncompliance notification](https://techuisitive.com/wp-content/uploads/2023/04/image-97.jpeg)**Update:** Intune release 2312 introduced support for variables in noncomplaint email notifications. You can use variables in the subject line and body of the message to create a personalized email with dynamic content. The variables are replaced with the actual value when notification is sent. See the below table for supported variables. Variable nameToken to useDescriptionUser name{{UserName}}Insert primary user name for the noncompliant device. Example: Test user1Device name{{DeviceName}}Insert the name of the noncompliant device as it’s recorded in Microsoft Intune. Example: Test iPad1Device ID{{DeviceId}}Insert the Intune device ID that belongs to the noncompliant device. Example: 1234-5678-910111213Device OS version{{OSAndVersion}}Insert the operating system and version of the noncompliant device. Example: iPhone 17.1.2On the **Review + create** tab, carefully review all the details you’ve configured for the notification template. Confirm that the **name, header, footer, contact information, and Company Portal link** are correct and aligned with your compliance requirements. Once verified, click **Create** to finalize the notification. This action will generate a **user notification template** that can be linked to your Intune device compliance policy. You can find and manage this notification under the **Notifications blade** in the Intune admin center. ![Send notifications to noncompliant devices](https://techuisitive.com/wp-content/uploads/2023/04/image-98.jpeg)Notes: You can create multiple email notification templates and use them in a single compliance policy. For example, you can send the first notification immediately as soon as a device is marked as non-compliant. The second and third notifications can be sent on week 2 and week 3, respectively. ## How to **Create an Intune Device Compliance Policy** ### Create an Intune Compliance Policy for OS Version Enforcement To detect devices running an [OS version](https://techuisitive.com/windows-10-11-operating-system-build-versions/ "How to Check Windows Build Version | OS Version | Release Information") lower than **Windows 10 21H1**, you need to create a new compliance policy in Microsoft Intune. This policy will help identify non‑compliant machines and enforce minimum OS version requirements. **Steps:** Sign in to the **Microsoft Endpoint Manager admin center**. Go to **Devices > Compliance policies**. Click on **Create policy**. ![ Intune compliance policy creation](https://techuisitive.com/wp-content/uploads/2023/04/image-99.jpeg)### Configure Basics for the Intune Compliance Policy On the **Basics** tab, provide the required details to define your compliance policy: **Policy Name**: Enter a clear, descriptive name (e.g., *Windows 10 OS Version Compliance*). Review the information to ensure accuracy. Click **Next** to proceed to the compliance settings configuration ![Device compliance policy basics tab](https://techuisitive.com/wp-content/uploads/2023/04/image-100.jpeg)### Configure Compliance Settings On the **Compliance settings** tab, expand **Device properties** and enter the required details to enforce OS version compliance: - **Minimum OS Version**: Set the value to **Windows 10 21H1** (*OS version 10.0.19043.1237*). - Any device running an OS version **lower than Windows 10 21H1** will be automatically reported as **Non‑compliant**. This ensures that only devices meeting the minimum supported OS version remain compliant, helping maintain security and compatibility across your environment. Click on **Next** to move to the next tab. ![Configure compliance settings minimum OS version](https://techuisitive.com/wp-content/uploads/2023/04/image-101.jpeg)### Configure Actions for Non‑Compliant Devices On the **Actions for noncompliance** tab, define what should happen when a device fails to meet the minimum OS version requirement: - **Mark device noncompliant**: - Set to **immediately** or specify a number of days. - This is the default action and cannot be removed. - If you set a grace period (e.g., 7 days), the device is still flagged as non‑compliant but can continue accessing company resources until the grace period expires. - **Send email to end user**: - **Schedule days**: Set to **Immediately**. - **Message template**: Select the notification message template you created earlier. - **Additional recipients**: Add an **Azure AD distribution group** if you want IT admins or managers copied on the email. - **Retire noncompliant device**: - Configure to **120 days**. - After this period, devices that remain non‑compliant will be retired from Intune management. Click on **Next** Note: You can add multiple “Send email to end user” action to send reminders to users. You can use the same or different email notification template. ![Actions for noncompliance tab in Intune](https://techuisitive.com/wp-content/uploads/2023/04/image-102.jpeg)### Assign the Compliance Policy On the **Assignments** tab, choose the **Azure Active Directory (Azure AD) group** where you want to apply this compliance policy. Targeting specific groups ensures that only the intended users or devices are evaluated against the minimum OS version requirement. Once the group is selected, click **Next** to proceed to the final **Review + create** tab. ![Assignments tab Azure AD group selection](https://techuisitive.com/wp-content/uploads/2023/04/image-103.jpeg)### Review and Create the Intune Compliance Policy On the **Review + create** tab, carefully review all the settings you’ve configured for the compliance policy, including: - **Policy name** - **Minimum OS version requirement** - **Actions for noncompliance** (notifications, grace period, and retire settings) - **Assignments to Azure AD groups** Once you’ve verified the details, click **Create** to finalize the policy. This will generate a new **Intune compliance policy** that enforces OS version requirements and automatically notifies users when their devices are non‑compliant ![Review + create compliance policy in Intune](https://techuisitive.com/wp-content/uploads/2023/04/image-104.jpeg)The Intune compliance policy has now been created. You can view the newly created device compliance policy under the **Devices > Compliance policies** blade in the Microsoft Endpoint Manager admin center. ![Endpoint Manager | Device compliance Policy | Status](https://techuisitive.com/wp-content/uploads/2023/04/image-105.jpeg)Once the compliance policy has been evaluated on the client device, you can view the compliance status in the **Devices > Compliance policies** blade of Microsoft Intune. ![Endpoint Manager | Device compliance Policy | Status](https://techuisitive.com/wp-content/uploads/2023/04/image-106.jpeg) ## **End‑User Experience with Intune Compliance Notifications** As soon as a **non‑compliant device** is detected, Microsoft Intune automatically sends an **email notification** to the user. The email informs them of the device’s non‑compliance status and provides guidance on how to resolve the issue. You can customize the notification to include: - **Upgrade instructions**: Direct users to contact the IT help desk for assistance. - **Self‑service resources**: Share a link to a step‑by‑step upgrade guide or the **Company Portal app** for remediation. - **Support details**: Add contact information so users know where to seek help. This proactive communication ensures users are aware of compliance requirements and can take immediate action to bring their devices back into compliance. **Sample Email Notification (from Intune Notification Service during testing):** *Subject:* Your Device is Non-compliant *Body:* Your device does not have the latest Windows 10 operating system installed. Please contact the helpdesk to schedule an upgrade on your device at the earliest. ![End‑user noncompliance email notification sample](https://techuisitive.com/wp-content/uploads/2023/04/image-107.jpeg)## Conclusion By creating and assigning an **Intune device compliance policy** with OS version enforcement, you ensure that all managed devices meet your organization’s minimum security and compatibility standards. Configuring notifications and actions for non‑compliant devices provides users with clear guidance while giving IT admins control over remediation and retirement timelines. This proactive approach strengthens endpoint security, improves compliance visibility, and helps maintain a consistent, reliable device environment across your enterprise. ## **Related Posts** - [Block USB Device with Exception](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows 10 /11 Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Edge Chromium favorites with Endpoint Manager | Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Configure Edge Chromium Homepage & ](https://www.techuisitive.com/post/intune-configure-edge-chromium-homepage-startup-page)[Startup ](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/)[Page](https://www.techuisitive.com/post/intune-configure-edge-chromium-homepage-startup-page) - [Configure Microsoft Edge Sleeping Tabs using Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Configure Google Chrome settings using Administrative templates | Intune](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Check OS Version Compliance with Device Compliance Policy & Notify User | Microsoft Intune](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Compliance & Conditional Access](https://techuisitive.com/microsoft-intune/#Device-Compliance-and-Conditional-Access "Device Compliance & Conditional Access")** – Explore more guides on device compliance and Conditional Access, including compliance policies, device health, access controls, and securing access to organizational resources. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Device Compliance and CA --- ### [Collect Device Inventory Using Intune Properties Catalog](https://techuisitive.com/collect-device-inventory-using-intune-properties-catalog/) **Published:** March 12, 2025 **Author:** Equebal Ahmad **Content:** Managing devices effectively requires accurate and detailed inventory data. Microsoft Intune makes this easier with the **Properties Catalog**, a powerful feature that allows IT admins to collect and report on hardware and software details directly from enrolled endpoints. By leveraging **Intune device inventory** through the Properties Catalog, organizations can track compliance, monitor configurations, and generate insights for troubleshooting and reporting. This guide walks you through how to set up and use the **Intune Properties Catalog** to strengthen your overall **Intune reporting** strategy. ## Available Intune Properties Catalog categories **Intune Properties Catalog provides a centralized way to collect detailed hardware, software, operating system, and security-related inventory information from managed Windows devices.** You can select specific property categories based on your inventory requirements instead of relying only on the standard device hardware information available in Intune. Property CategoryWhat it provides**Application Properties**Provides detailed information about applications installed on Windows devices, including app name, version, publisher, architecture, and installation scope.**Registry**Provides information from selected Windows Registry data that can be used for device inventory and configuration visibility.**Battery**Provides battery-related information that can help identify battery status and hardware details on supported devices.**BIOS Info**Provides BIOS information such as the BIOS identifier and related software element details, useful for hardware and firmware inventory.**CPU**Provides processor information that can be used to identify and inventory the CPU hardware in Windows devices.**Disk Drive**Provides information about physical disks, including drive identifiers and other disk hardware details.**Encryptable Volume**Provides information about encryptable volumes, including BitLocker protection status, encryption method, and encryption percentage.**Local AI Agent (Preview)**Helps identify local AI agents running on Windows devices. Microsoft specifically documents this category for discovering local AI agents such as OpenClaw.**Logical Drive**Provides information about logical drives and their identifiers, helping with storage inventory.**Memory Info**Provides information about the device’s installed memory, useful for hardware inventory and capacity analysis.**Network Adapter**Provides information about network adapters and their identifiers, useful for network hardware inventory and troubleshooting.**OS Version**Provides operating system version information for Windows devices, useful for tracking Windows versions and build information.**SIM Info**Provides information about supported SIM/eSIM hardware, including the Windows eSIM ID.**System Enclosure**Provides information about the physical system enclosure, including the device serial number.**System Info**Provides general system information such as the computer name, hardware manufacturer, hardware model, processor architecture, and system UUID.**Time**Provides basic time-related information from the Windows device.**TPM**Provides information about the device’s Trusted Platform Module (TPM), useful for hardware and security inventory.**Video Controller**Provides information about the device’s video/graphics controller for hardware inventory.**Windows QFE**Provides information about installed Windows Quick Fix Engineering (QFE) updates/hotfixes, including the hotfix ID.## How to Check Device Inventory for a Device from Intune You can view detailed device properties in Intune by navigating to the **Device Resource Explorer** under *Devices > Windows > \[Device Name\] > Monitor > Device Inventory*. This blade provides hardware and software inventory data for individual endpoints, helping administrators track compliance and troubleshoot effectively. ![Intune Device Inventory](https://techuisitive.com/wp-content/uploads/2025/03/image-25-1024x444.png)## Supported platforms & Requirements Device Inventory is currently supported on devices running Windows 10 and later. Inventory is only supported on the following minimum [Windows versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/ "How to Check Windows Build Version | OS Version | Release Information"): - Windows 11, version 24H2 - Windows 11, version 23H2 (22631.2506 or later) with KB5031455 - Windows 11, version 22H2 (22621.2215 or later) with KB5029351 - Windows 11, version 21H2 (22000.2713 or later) with KB5034121 - Windows 10, version 22H2 (19045.3393 or later) with KB5030211 - Windows 10, version 21H2 (19044.3393 or later) with KB5030211 The device inventory feature is part of the core Intune plan and doesn’t require any additional license. ## Step by Step: Create an Intune Properties Catalog Profile To enable inventory collection, you must create an Intune Properties Catalog profile and assign the policy to the devices from which you want to gather inventory data Follow the steps below to create a profile for the Intune properties catalog. - On the Microsoft Intune admin center, navigate to **Devices> Windows > Configuration** - Click on **+Create** link - Select the following details in the **Create a profile** flyer window. - **Platform:** Windows 10 and later - **Profile type**: Properties catalog - Click on **Create** ![Intune create properties catalog profile](https://techuisitive.com/wp-content/uploads/2025/02/image-1024x516.png)- Enter the following details in **the Basics** page. - **Name:** Enter a meaningful name for the profile - **Description:** Enter a meaningful description to easily understand the purpose of the profile. - Click on **Next** ![Intune properties catalog Basics page](https://techuisitive.com/wp-content/uploads/2025/02/image-1.png)- On the **Configuration properties** page, select **Add properties** - Expand the categories in the **Properties picker** page - Select the properties you would like to collect the inventory for - Click on **Select** For each category, the mandatory properties will be selected automatically when you select any property in that category. For example, the **Instance name** in the Battery category will be selected automatically when you select the Serial number. ![Intune properties catalog Properties picker](https://techuisitive.com/wp-content/uploads/2025/02/image-2-1024x536.png)- You are now back to the **Configuration Properties** page. Review the details and click on **Next** ![Intune Configuration properties](https://techuisitive.com/wp-content/uploads/2025/02/image-3.png)If you selected **Registry** under Configuration, you’ll see an additional screen where you can specify the registry details to collect. ![Intune properties catalog registry](https://techuisitive.com/wp-content/uploads/2025/03/image-26.png)On the **Assignments** page, assign the profile to an Entra ID User or Device Group / All Users / All Devices as per your requirements. Click on **Next** to move to the next page. ![Intune properties catalog Assignments page](https://techuisitive.com/wp-content/uploads/2025/02/image-4.png)On the **Review + create** page, review the details and select **Create** to complete the policy creation process. ![Intune profile Review + create](https://techuisitive.com/wp-content/uploads/2025/02/image-5.png)The policy is now created and applied to the devices. It may take up to 24 hours before the initial device inventory is collected from the devices. You will see the information in the Device Resource Explorer once inventory data is reported to Microsoft Intune. ## How Intune Device Inventory Works Behind the Scenes When device inventory collection is enabled in Intune, the **Microsoft Device Inventory Agent** is automatically installed on managed endpoints. This agent runs as a Windows service, visible in the Services console, and is responsible for gathering hardware and software inventory data for reporting and compliance. ![Microsoft Device inventory Agent service](https://techuisitive.com/wp-content/uploads/2025/03/image-24.png)When the Microsoft Device Inventory Agent is installed, it creates a folder at `C:\Program Files\Microsoft Device Inventory Agents`. Within this directory, log files are stored under the `Logs` sub-folder. Administrators can review these logs to troubleshoot issues related to Intune device inventory collection. In addition, the same logs are automatically included as part of Intune Diagnostics, making them accessible for deeper analysis and support. ![Microsoft device inventory agent folder and logs](https://techuisitive.com/wp-content/uploads/2025/03/image-23-1024x320.png)## Conclusion Collecting device inventory through the Intune Properties Catalog provides IT admins with a reliable way to track hardware and software details across managed endpoints. By enabling this feature, organizations gain deeper visibility into compliance, configuration, and troubleshooting data without requiring additional licensing. With step‑by‑step setup and built‑in reporting, the Properties Catalog strengthens Intune’s role as a central hub for modern device management. ## Frequently Asked Questions (FAQs) ### **What is the Intune Properties Catalog used for?** The Properties Catalog allows administrators to collect detailed hardware and software inventory data from enrolled Windows devices, improving compliance monitoring and troubleshooting. ### **Which platforms support device inventory collection?** Inventory is supported on **Windows 10 (21H2 and 22H2)** and **Windows 11 (21H2, 22H2, 23H2, and 24H2)**, provided the required cumulative updates (KBs) are installed. ### **Do I need an extra license to use this feature?** No. Device inventory collection is included in the **core Intune plan** and does not require any additional licensing. ### **How long does it take for inventory data to appear?** After creating and assigning a Properties Catalog profile, it may take **up to 24 hours** for the initial inventory data to be collected and reported. ### **Where can I view collected inventory data?** You can access inventory details via the **Device Resource Explorer** in the Intune admin center under *Devices > Windows > Device Name > Monitor > Device Inventory*. ### **How can I troubleshoot inventory collection issues?** Check the **Microsoft Device Inventory Agent service** on the endpoint and review logs located at: `C:\Program Files\Microsoft Device Inventory Agents\Logs`. ## Related Posts - [How to Create Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) - [How to Configure Google Chrome settings using Administrative templates | Intune](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Collect Device Inventory Using Intune Properties Catalog](https://techuisitive.com/collect-device-inventory-using-intune-properties-catalog/ "Collect Device Inventory Using Intune Properties Catalog") ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Configuration Device Settings, Intune Guides --- ### [Microsoft Intune LOB vs Win32 Apps: Which Application Type Should You Use?](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) **Published:** January 22, 2022 **Author:** Equebal Ahmad **Excerpt:** Line of Business Application (LOB) is legacy application deployment method in Microsoft Intune. The LOB applications support single file format such as .msi, .msix, .appx etc. They only support simple installation. An MSI with a transform file (MST) cannot be deployed using this method. The LOB objects have limited capabilities and they don't support few rich capabilities of Configuration Manager Application Model such as Detection methods & Dependencies. **Content:** Microsoft Intune provides several ways to deploy applications to managed Windows devices. Two commonly used application types are Line-of-Business (LOB) apps and Win32 apps. Although both can be used to deploy applications to Windows devices, they differ significantly in packaging, installation options, detection, requirements, dependencies, and application lifecycle management. This guide compares Intune LOB and Win32 apps and explains when to use each app type. ## What is a **Line of Business Application (LOB)** Line of Business Application (LOB) is a legacy application deployment method in Microsoft Intune. The LOB applications support a single file format such as .msi, .msix, .appx, etc. They only support simple installation. An MSI with a transform file (MST) cannot be deployed using this method. The LOB objects have limited capabilities, and they don’t support a few rich capabilities of the Configuration Manager Application Model, such as Detection methods & Dependencies. Intune LOB applications are deployed through the Windows 10 / Windows 11 built-in MDM agent. ![Intune LOB and Win32 Apps](https://techuisitive.com/wp-content/uploads/2022/01/image-1024x458.png)## What is **Windows Apps (Win32)** Win32 apps provide us greater control over the deployment of apps. The Win32 apps support deployment of multiple files via the IntuneWin wrapper ([intuneWinAppUtil.exe](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool)). The IntuneWin Wrapper can be used to deploy multiple files, such as an MSI with a transform (MST). The Win32 app also supports the deployment of .EXE files by converting them to .intunewin format. The Win32 apps also allow us to configure additional parameters similar to Configuration Manager application model features such as [Requirements Rules](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/), [Detection methods](https://techuisitive.com/intune-understanding-win32-app-detection-rules/), [Dependencies ](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/)& [Supersedence](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/). The Win32 apps installation is handled by the Intune Management Extension. The Intune Management Extension is installed automatically when a PowerShell script or Win32 app is assigned to the user or device. ## LOB vs Win32 comparison table FeatureLOB AppWin32 AppMSIYesYesEXENoYesMultiple installation filesLimitedYesMST/TransformNoYesCustom installation commandsLimitedYesRequirementsLimitedYesDetection rulesLimitedYesDependenciesNoYesSupersedenceNoYesCustom uninstall commandLimitedYesReturn codesLimitedYesInstallation contextAvailable options varySystem/UserIntune Management ExtensionNoYesBest suited forSimple MSI-based appsComplex application deployments## When should you use an Intune LOB app? - Simple MSI application - No custom installation logic required - No dependencies - No sophisticated detection requirements - Application can be installed using the supported LOB package format ## When should you use an Intune Win32 app? - EXE installer - MSI requiring MST - Multiple installation files - Custom installation parameters - Custom detection logic - Dependencies - Supersedence - Complex installation/uninstallation requirements ## **Why Win32 Apps Are Generally Preferred for Complex Applications** For simple MSI-based applications, a LOB app may be sufficient. For applications requiring custom installation commands, detection logic, dependencies, or application lifecycle management, Win32 apps generally provide greater flexibility. Deploying the Win32 app from Intune has the following advantages: - You can now deploy .exe files by converting them to the .intunewin format. - Detection logic can be used to install the app only if it’s not detected as per the detection logic rule. - Requirement rule can be used to install the app if defined criteria are met. - Dependencies can be used to install the app along with dependent applications. This setting enables you to determine the sequence in which the app would be installed. - Supersedence relationship can be used to supersede an older version of the application with a newer version. ## **Related Posts** - [](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/)[How to Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune win32 App Guides --- ### [CMG Setup Error: Failed to Grant Contributor Permission to Azure AD App](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) **Published:** April 30, 2021 **Author:** Equebal Ahmad **Content:** When [setting up a Cloud Management Gateway (CMG)](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/ "setting up a Cloud Management Gateway (CMG)") in Microsoft Configuration Manager, you may encounter an error while Configuration Manager attempts to grant the **Contributor** role to the Microsoft Entra application for the Azure resource group. The Configuration Manager console may display an error similar to **“Error occurred when granting Contributor permission to the Azure AD app for the resource group”**. The `SmsAdminUI.log` file can provide additional details, including an `InvalidAuthenticationTokenTenant` error indicating that the authentication token was issued by a different Microsoft Entra tenant than the tenant associated with the Azure subscription. This article explains the error, the relevant `SmsAdminUI.log` entries, and the troubleshooting steps that resolved the issue during CMG setup. ## Error: Unable to Grant Contributor Permission **Error occurred when granting Contributor permission to the Azure AD app for the resource group . For more information see SmsAdminUI.log** ![CMG Setup Error | Contributor permission](https://techuisitive.co.in/wp-content/uploads/2023/04/image-77.jpeg)To investigate the error, review the `SmsAdminUI.log` file on the Configuration Manager console computer. By default, the log is located at: `[16, PID:3448][04/29/2021 15:54:18] :Hyak.Common.CloudException\r\nInvalidAuthenticationTokenTenant: The access token is from the wrong issuer 'https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-5f571e91255a/'. It must match the tenant 'https://sts.windows.net/e6d66549-5275-4d02-89d4-c9f495bae48b/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/e6d66549-5275-4d02-89d4-c9f495bae48b' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later.\r\n at Microsoft.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)` ![SCCM CMG Setup | Contributor Permission](https://techuisitive.co.in/wp-content/uploads/2023/04/image-78.jpeg)## Understanding the Error **“The access token is from the wrong issuer”** The error indicates a **tenant mismatch between the authentication token and the Azure subscription**. This is particularly important because Microsoft currently documents scenarios where the Microsoft Entra tenant and the Azure subscription hosting the CMG can be different. In those scenarios, Configuration Manager needs to onboard the appropriate tenant(s). In this case, the initial CMG configuration involved selecting a resource group in a different Azure region from the selected CMG region. However, the log specifically reported an `InvalidAuthenticationTokenTenant` error. Therefore, the tenant mismatch should be investigated first rather than assuming that the resource-group region was the cause. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-79.jpeg)## Resolution In my case, the issue was resolved by closing and reopening the Configuration Manager console and starting the CMG setup again. Before retrying the deployment, verify that the selected Azure subscription, Microsoft Entra tenant, and CMG resource group are correct. Also confirm that the Microsoft Entra server application has the required Contributor permission on the resource group. If the error persists, review `SmsAdminUI.log` for `InvalidAuthenticationTokenTenant` or other authentication-related errors. These messages can indicate that Configuration Manager is requesting an access token from a different Microsoft Entra tenant than the tenant associated with the Azure subscription. If the Azure subscription or tenant relationship was recently changed, allow time for the change to propagate before retrying the CMG deployment. ## Troubleshooting Checklist 1. **Verify the Azure subscription** - Confirm that the subscription selected during CMG setup is the intended subscription. 2. **Verify the Microsoft Entra tenant** - Confirm that the tenant configured in Configuration Manager corresponds to the tenant associated with the Azure subscription, or that the required multi-tenant configuration is in place. 3. **Verify the CMG server/web app** - Confirm that the correct Microsoft Entra application is being used. 4. **Verify Contributor permissions** - Check the resource group’s **Access control (IAM)** settings. - Confirm that the CMG web/server application has the required Contributor role. Microsoft specifically documents that, for ARM-based CMG deployment, the web application gets Contributor permission at the **resource-group level**. 5. **Restart the Configuration Manager console** - Close the MECM/Configuration Manager console completely. - Reopen it. - Start the CMG configuration again. 6. **Allow Azure configuration changes to propagate** - If the subscription or tenant relationship was recently changed, wait and retry. ## **Related Posts:** - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop-down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [SCCM Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/ "SCCM Cloud Management Gateway (CMG) Setup Guide") - [Configure SCCM Software Update Point for SSL](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting --- ### [Endpoint Administrator Associate: MD-102 Quiz - Set 02](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) **Published:** May 2, 2023 **Author:** Equebal Ahmad **Content:** This modern device management quiz includes multiple-choice questions to help you enhance your knowledge about device management. You can use this to practice for exams such as Modern Desktop Management – MD-101 or MD-102. **Welcome to Techuisitive Quiz. Please submit your response to see your score and explanations. Enter your email ID if you want to receive quiz result on your email.** Name (Required) Email (Optional) 1. You install a feature update on a computer that runs Windows 10. How many days do you have to roll back the update? 10 30 60 90 None 2. You have a Windows 10 laptop enrolled in Intune. You apply same setting in a Device Configuration policy and a Device compliance policy. Which setting will wins? Device Configuration Policy setting wins Device Compliance Policy setting wins Most restrictive setting wins Less restrictive setting wins None 3. You are Microsoft Endpoint Manager administrator at Techuisitive. You are managing Windows 10 devices enrolled to Microsoft Intune. There are hundreds of Windows 10 professional devices in organization. You have been asked to upgrade all Windows 10 Professional devices to Windows 10 Enterprise. What should you do? Create a device configuration profile Create a device compliance policy Create a provisioning package None of these None 4. What is the name of Microsoft API that helps Intune integrate with other management console? JSON API Windows API REST API Microsoft Graph API None 5. You have a Windows 10 laptop enrolled in Intune. You apply the same setting in two device compliance policies targeted to same devices. Which policy wins? Most restrictive wins Least restrictive wins Last policy applied wins Neither wins None 6. You are Microsoft Endpoint Manager administrator at Techuisitive. The company has recently installed 5 computers in common area to allow employee to check their personal emails or access other websites which should not be accessed from secure networks. You have been asked to ensure employee can access Microsoft Edge browser without having to sign in. The employees should also prevented from accessing any other applications from these computers. Which device configuration profile type should be used? Device Restriction Administrative Templates Endpoint Protection Kiosk None 7. You are managing Windows 10 devices enrolled to Microsoft Intune. You have been asked to ensure that Microsoft Exchange online can be access from known locations only. What should you configure to meet the requirement? A Device compliance policy A Conditional access policy A Device configuration policy A Device restriction policy None 8. You are Microsoft Endpoint Manager admin at Techuisitive. You have been asked to configure AutoPilot deployment profile for all Windows 10 computers configured through AutoPilot. You need to assign the same policy to all computers. Which two action should you perform? Join the computers to Microsoft Azure Active Directory (Azure AD) Assign a Windows Autopilot deployment profile to a group Create a AAD group that has dynamic membership rules and uses the operatingSystem tag Create a AAD group that has dynamic membership rules and uses the ZTDID tag 9. You are working as Endpoint Manager admin at Techuisitive. The company has a Microsoft 365 subscription.You are using Microsoft Intune to manage devices. The company use conditional access to restrict access to Microsoft 365 services if devices do not comply with company security policies. You need to identify which devices will be prevented from accessing Microsoft 365 services. What should you use? Device > Desktop Analytics Windows Defender security center Report > Device Compliance Device > Compliance Policies None 10. Intune is a component of which offering? Microsoft Managed Desktop Windows Autopilot Microsoft Visual Studio Microsoft Enterprise Mobility + Security None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel ## Related Quiz - [Configuration Manager | SCCM Quiz – Set 01](https://techuisitive.com/configuration-manager-sccm-quiz-01/) - [Configuration Manager | SCCM Quiz – Set 02](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) - [Modern Device Management – MD 102 – Quiz – Set 01](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) - [Modern Device Management – MD 102 – Quiz – Set 02](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) **DISCLAIMER:** The information contained in this quiz is for general guidance. While we have made every attempt to ensure that the information contained in this quiz has been obtained from reliable sources, Techuisitive is not responsible for any errors or omissions, or for the results obtained from the use of this information. All information in this quiz is provided “as is”, with no guarantee of completeness and accuracy. ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Search keywords:** SCCM Quiz , ConfigMgr Quiz , MECM Quiz , Intune Quiz , Exam practice set , MD 101 Quiz , MD 101 Practice set , MD-100 Practice set , Endpoint Manager quiz , Free quiz , Free practice set, Free exam practice set, MDM Quiz, MAM Quiz, Modern Desktop Management , MD-101 Quiz , MD-102 Quiz, MDT , Windows Autopilot, OSD, Windows 10 , MD 101 dumps **Categories:** Modern Device Management Quiz, Quiz **Tags:** MD-102 Quiz, Quiz --- ### [Endpoint Administrator Associate: MD-102 Quiz - Set 01](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) **Published:** April 15, 2021 **Author:** Equebal Ahmad **Content:** This **Microsoft 365 Certified: Endpoint Administrator Associate (MD-102)** quiz includes multiple-choice questions to help you enhance your Microsoft Intune/SCCM knowledge. You can use this to practice for various exams, such as Modern Desktop Management – MD-102. Please submit the quiz to receive the result in your email. You can retake the quiz as many times as you wish for practice. **Welcome to Techuisitive Quiz. Please submit your response to see your score and explanations. Enter your email ID if you want to receive quiz result on your email.** --- Name (Required) Email (Optional) 1. You are Intune administrator at Techuisitive. Your network contains Active Directory domain. You are managing Windows 10 devices with Microsoft Intune. Microsoft updates are deployed by Windows update for business. You need to ensure that updates are deployed on sales department computers between 1:00 AM to 5:00 AM any day. The computer must be rebooted after install. Which setting should you modify to achieve this? Servicing Channel Microsoft Product Updates Quality Update Deferral period Automatic update behavior None 2. You are Microsoft Endpoint Manager administrator at Techuisitive. A remote user purchased a Windows 10 Professional laptop for company use. You need to configure the laptop to meet company standards: -> Upgrade Windows 10 to Windows 10 Enterprise edition -> Join the laptop to Techuisitive.com domain -> Remove pre-installed software’s The solution must minimize the configuration time. Which of below option you will go for? Use Windows AutoPilot to re-purpose device Create a provisioning package and share the file with user via email / Share drive Create a custom Windows image and upload to Microsoft Intune Create a Sysprep unattended file and email to user None 3. You are working as Intune Admin at Techuisitive. A user who was using a Windows 10 computer recently left the company. You want to repurpose the computer and assign that to new user. You need to repurpose the computer using Windows AutoPilot. Which three actions should you perform in sequence? I)Generate a CSV file that contains computer hardware hash. II) Upload the file using azcopy.exe III) Reset the computer I)Generate a JSON file that contains the computer information II) Upload the file using Intune III) Reset the computer I)Generate a CSV file that contains computer hardware hash. II) Upload the file using Intune. III) Reset the computer None of these None 4. You are Microsoft Endpoint Manager administrator at Techuisitive. You are using Microsoft Endpoint Configuration Manager (MECM) to manage on-premises computers. You configure Techuisitive.com for co-management and deploy Windows 10 devices. The devices are joined to Azure AD and enrolled in Microsoft Intune. You need to ensure that devices are co-managed. What should you create in Intune first. A Device configuration profile An app configuration profile A device compliance policy An app for the Endpoint Configuration Manager client None 5. Question # 7 You are Microsoft Endpoint Manager administrator at Techuisitive. You have Microsoft 365 tenant that uses Microsoft Intune for mobile device management. You purchased an application named App1 from Microsoft store for business. You need to ensure that application can be deployed by Intune. What should you do? Assoicate Microsoft Store for Business account with Intune Sync purchased apps from the Microsoft store for business Create an app category in Intune Create an app category in Microsoft store for business 6. You are Microsoft Endpoint Manager administrator at Techuisitive. You manage Windows 10 computers which are enrolled to Intune. All Windows 10 computers are member of Entra ID Group "Windows 10 computers". The Device Category for all training room computers are set to "Trainings Computers". You need to deploy an application App1 to to all Windows 10 training devices. The solution must discourage creation of new Entra ID groups. Which of below option you will go for? Create Intune Filter for training devices and target app directly on Intune filter Create a new Entra ID Group for training devices and target the app on group. Create Intune Filter for training devices, Target app on Windows 10 computer Entra ID group and INCLUDE filter created for training devices Create Intune Filter for training devices, Target app on Windows 10 computer Entra ID group and EXCLUDE filter created for training devices None 7. You are Microsoft Endpoint Manager administrator at Techuisitive. You have Microsoft 365 tenant that uses Microsoft Intune for Windows 10 provisioning through Windows Autopilot. You need to provision a new laptop for recently joined employee through Windows Autopilot. You have exported hardware hash of laptop. What should you do next? Go to Devices > Windows Enrollment > Deployment Profiles and create deployment profile Go to Devices > Windows Enrollment > Windows Autopilot Deployment Program – Devices and upload CSV file containing hardware hash Create a Device configuration profile Configure Automatic Enrollment from Device > Windows Enrollment None 8. You are Microsoft Endpoint Manager administrator at Techuisitive. You manage Windows 10 computers which are enrolled to Intune. You manage the servicing channel settings of the computers by using Intune. You need to review the servicing status of a computer. What should you do? From Software updates, view the Per update ring deployment state. From Software updates, view the audit logs. From Device compliance, view the device compliance. From Device configuration- Profiles, view the device status. None 9. You are managing Windows 10 computers which are joined to Azure AD and enrolled in Microsoft Intune. You need to configure the following device restrictions: -> Scan all scriptis loaded into Microsoft Edge. -> Block users from browsing to suspicious websites. Which two settings should you configure in Device restrictions? (Click on Show Image to see screenshot) Microsoft Edge Browser Windows Defender SmartScreen Windows Spotlight Windows Defender Antivirus 10. You have a Windows 10 computer that is joined to on-premise Active Directory Domain. You apply same setting in a GPO and in an Intune Device configuration policy. Which setting will take precedence? GPO Intune Most Restrictive Less Restrictive None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel ## Related Quiz - [Configuration Manager | SCCM Quiz – Set 01](https://techuisitive.com/configuration-manager-sccm-quiz-01/) - [Configuration Manager | SCCM Quiz – Set 02](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) - [Modern Device Management – MD 102 – Quiz – Set 01](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) - [Modern Device Management – MD 102 – Quiz – Set 02](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) **DISCLAIMER:** The information contained in this quiz is for general guidance. While we have made every attempt to ensure that the information contained in this quiz has been obtained from reliable sources, Techuisitive is not responsible for any errors or omissions, or for the results obtained from the use of this information. All information in this quiz is provided “as is”, with no guarantee of completeness and accuracy. ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Modern Device Management Quiz **Tags:** Exam Practice Sets, MD-102 Quiz, Quiz --- ### [How to Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) **Published:** May 29, 2023 **Author:** Equebal Ahmad **Excerpt:** You may have a requirement to reboot SCCM client computers which have not been rebooted for n number of days. This process can be used to schedule a reboot using PowerShell script deployed as SCCM application. The PowerShell script will check if machine was rebooted in last n number of days. If not it will return exit code 3010 instructing SCCM client agent that a soft reboot is required. **Content:** You may have a requirement to reboot SCCM client computers which have not been rebooted for n number of days. This process can be used to schedule a reboot using PowerShell script deployed as SCCM application. Table Of Contents 1. [Schedule SCCM Client Reboot – Process overview](#schedule-sccm-client-reboot-process-overview) 2. [Limitation of Process](#limitation-of-process) 3. [PowerShell Script](#powershell-script) 4. [Computer Agent Settings](#computer-agent-settings) 5. [Global Conditions to Add an Extra Safety Layer](#global-conditions-to-add-an-extra-safety-layer) 6. [Create ConfigMgr Application](#create-configmgr-application) 7. [Create a Deployment](#create-a-deployment) 8. [Log File to View Script Actions](#log-file-to-view-script-actions) 9. [Related Posts:](#related-posts) 10. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## Schedule SCCM Client Reboot – Process overview - The [PowerShell](https://techuisitive.com/tag/powershell/) script will check if machine was rebooted in last n number of days. If not it will return exit code 3010 instructing SCCM client agent that a soft reboot is required. - The script need to be deployed as ConfigMgr Application using ‘Fake path’ as file detection rule to re-execute the script at each application evaluation cycle. - The reboot behavior will be controller by SCCM client agent “Computer restrart” settings. If 4 hours deadline time given in Computer restart settings, user will get 4 hours time to reboot the computer. The reboot will be forced after that. - Global condtion and Requirements rule are used to restrict script executes only on laptops. You can update this as per your requirements. ## Limitation of Process You can’t control the exact reboot time of client computer with this method. ## **PowerShell Script** The below PowerShell script will check computer last boot time. If the last reboot age will be more than specified number of days then it will return exit code 3010. We will deploy this script through SCCM application and SCCM client initiate a reboot if exit code is 3010. ``` function Write-Log { [CmdletBinding()] param( [Parameter()] [ValidateNotNullOrEmpty()] [string]$Message, [Parameter()] [ValidateNotNullOrEmpty()] [ValidateSet('Information','Warning','Error')] [string]$Severity = 'Information' ) [pscustomobject]@{ Time = (Get-Date -f g) Message = $Message Severity = $Severity } | Export-Csv -Path "c:\windows\Temp\SCCMClientReboot.csv" -Append -NoTypeInformation } $LastBootupTime = (gcim win32_operatingsystem).LastBootupTime $LastBootAge = ((Get-Date) - (gcim win32_operatingsystem).LastBootupTime).Days If ($LastBootAge -gt 15) { $msg = "Last Bootup time: $LastBootupTime - Last bootup Age (days): $LastBootAge - Exit Code 3010. ConfigMgr client will handle reboot." Write-Host $msg Write-Log -Message $msg -Severity Information Exit (3010) } else { $msg = "Last Bootup time: $LastBootupTime - Last bootup Age (days): $LastBootAge - Exit Code 0. Reboot is not required" Write-Host $msg Write-Log -Message $msg -Severity Information Exit (0)} ``` ## **Computer Agent Settings** When SCCM client initiate a reboot, the final reboot count down time will be based on Computer Restart client settings “**Specify the amount of time after the deadline before a device get restarted”**. In the below example, user will see 4 hour count down timer and computer will be forcefully rebooted after 4 hours. You can adjust this as per your requirement. However keep in mind that it will also change the bahavior for restart initiated by Software Update deployment / other applications. ![SCCM | ConfigMgr Computer Agent Settings | Schedule SCCM Client Reboot](https://techuisitive.com/wp-content/uploads/2023/04/image-190.png)## **Global Conditions** to Add an Extra Safety Layer In Configuration Manager, global conditions are rules that represent business or technical conditions that you can use to specify how an application is provided and deployed to client devices. You can create a Global Conditions from **Software Library / Global Conditions** blade. Global conditions are used in Requirement rules while creating an application. Here, we will create a Global condition to identify the PC type such as Desktop, Laptop or Server. We will use this Global condition in requirement rule of Application to ensure script will only executes on laptops. This will add an additional layer of security as SCCM application will applicable for laptops only. ![SCCM Global Conditions](https://techuisitive.com/wp-content/uploads/2023/05/image-4.png)Create a Global condition with below details. - **Global condition name:** PC System Type - **Description:** Possible values: 1 (Desktop), 2 (Mobile), 3 (Workstation), 4 (Enterprise Server), 5 (SOHO Server), 6 (Appliance PC), 7 (Performance Server), 8 (Maximum), 0 (Unknown) - **Device type:** Windows - **Condition type:** Settings - **Setting type:** WQL query - **Namespace :** root\\cimv2 - **Class:** Win32\_ComputerSystem - **Property:** PCSystemType ![SCCM Global Conditions](https://techuisitive.com/wp-content/uploads/2023/04/image-191.png) ## Create ConfigMgr Application Use the following configuration when creating SCCM application. These are not the complete steps to create an application. The assummption here is that you are already well familiar with Configuration Manager application model. **User Experience:** - **Installation behavior:** Install for system - **Logon requirement:** Whether or not a user is logged on - **Installation program visibility:** Hidden Select “**Determine behaviour based on return codes**” at bottom of screen. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-192.png)**Detection Rule:** Create [Detection Rule](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) with the following details. - **Setting Type:** File System - **Type:** File - **Path :** C:\\FakePath - **File or folder name**: FakeFile - Select “**The file system setting must exists on the target system to indicate presense of this application**“ ![SCCM Detection Rule](https://techuisitive.com/wp-content/uploads/2023/04/image-193.png)**Requirements:** In the [Requirements](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) tab, add the Global Condition which you created earlier. The value should be 2 to restrict the execution on laptops only. This will add an additional layer of security. If someone mistakenly deployed the application on Servers then application will not execute. ![SCCM Application Requirements rule.](https://techuisitive.com/wp-content/uploads/2023/04/image-194.png)## Create a Deployment Create a SCCM collection for all Laptops and deploy the application on that collection. You can refer [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) if you need any help in creating the collection for Laptop / Desktops. Ensure that you hide the deployment from Software Center. The way we have used the detection rule to ensure script execute at each application evaluation, the appenforce.log will show that application was not detected after installation. The user will see application status as failed in Software Center and may raise issue to IT team. Hence, it’s better to hide the deployment from Software center. ## Log File to View Script Actions The script will create a log file on client computer in c:\\windows\\temp folder. This can be checked to review the execution history and reboot action triggered by script. ![Log File](https://techuisitive.com/wp-content/uploads/2023/04/image-195.png)## **Related Posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM, Step by Step Guides **Tags:** SCCM Collections & Device Management --- ### [Manage Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) **Published:** October 26, 2021 **Author:** Equebal Ahmad **Content:** On Windows 10 and Windows 11 desktops, the wallpaper (background) is the image displayed behind icons, folders, and applications. Users can personalize this through Windows settings, choosing photos, solid colors, or even slideshows. In enterprise environments, however, IT administrators often need to enforce a standard wallpaper or lock screen for branding, compliance, or security. This is where **Microsoft Intune device configuration policies** come in. Using Intune personalization CSPs, organizations can centrally set and manage wallpapers across enrolled Windows devices, ensuring consistent branding and user experience without relying on traditional Group Policy Objects (GPOs). **Intune wallpaper management allows IT administrators to centrally set and enforce desktop backgrounds and lock screen images on Windows 10 and Windows 11 devices.** Using Intune personalization CSPs, organizations can apply consistent branding, improve compliance, and deliver a uniform user experience without relying on traditional Group Policy Objects (GPOs). ## TL;DR Use Intune’s **Device restriction** profile to push desktop and lock screen wallpapers via publicly‑accessible image URLs. The feature works on Windows 10/11 Enterprise and Education — users can’t modify it once applied. ## Prerequisites To configure desktop and lock screen wallpapers using Intune, you’ll need **two publicly accessible image URLs**—one for the **desktop background** and one for the **lock screen wallpaper**. These images must be hosted in a location that can be accessed by all enrolled devices. You can achieve this by: - Uploading the images to **Azure Blob Storage** and generating **public access links**, or - Using any **web-accessible image URL** that’s reachable from the target Windows 10/11 devices. 📌 Make sure the URLs point directly to the image files (e.g., `.jpg`, `.png`), and that the hosting platform doesn’t require authentication or redirects. ## Configure Desktop Wallpaper Using Intune Device Configuration Policies In this guide, you’ll learn how to **configure desktop and lock screen wallpapers on Windows 10 and Windows 11 devices using Microsoft Intune**. We’ll use the **Intune Device Restriction Policy** to enforce custom wallpapers as part of your organization’s branding and compliance standards. **Microsoft Intune device restriction policies** allow IT administrators to manage and secure settings across Windows, Android, macOS, and iOS platforms. These policies provide granular control over features and system behaviors to help protect corporate resources and enforce compliance. In this example, we’ll configure the following settings through a device restriction policy in Intune: - **Desktop background picture URL** (applies to desktop only) - **Lock screen picture URL** (applies to desktop only) Once deployed, **users will not be able to change the wallpaper manually**—this is by design when using Intune’s device restriction settings. > ⚠️ **Important Note:** These wallpaper settings are supported **only on Windows 10/11 Enterprise and Education editions**. If applied to devices running **Windows 10 or 11 Professional**, the policy will return a **“Not applicable”** status under the profile installation report. Let’s understand how to configure Windows 10 / Windows 11 Desktop wallpaper using Microsoft Intune Device Restriction Policy. [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") device restriction policies help administrators control Windows, Android, Mac, and [iOS ](https://techuisitive.com/tag/intune-ios/ "iOS ")devices. These device restrictions let you control a wide range of settings and features to protect your organization’s resources. ### Step‑by‑Step Guide to Creating a Wallpaper Policy Follow the steps below to configure desktop wallpaper on Windows 10 and Windows 11 devices using a Microsoft Intune device restriction policy. - On the **Microsoft Intune admin center**, Select **Devices | Configuration profiles** and click on **Create a profile**. - Select the following details in the “**Create a profile**” window and click on **Create**. - **Platform**: Windows 10 and later - **Profile type**: Templates - **Template name**: Device Restrictions ![Intune wallpaper policy Windows 11 | Intune desktop wallpaper](https://techuisitive.com/wp-content/uploads/2023/03/Intune_Device_Configuration_Wallpaper_01-1024x472.png)- Expand **Locked Screen Experience** settings. - In the **Locked Screen Experience settings** of your Intune policy, you can configure the **Windows 10 lock screen wallpaper** to enforce a consistent corporate look across managed devices. For **Windows 10 desktops**, select the option **Locked screen picture URL (Desktop only)**. You must provide a **publicly accessible image URL** that points to the lock screen wallpaper. In a **corporate environment**, this URL should be hosted on a secure and reliable location such as **Azure Blob Storage** or a company web server, ensuring that the image is accessible from the **corporate network**. By applying this **Intune lock screen wallpaper policy**, IT administrators can standardize the user experience, reinforce **corporate branding**, and maintain compliance across **Windows 10 and Windows 11 devices**. ![Intune Device Configuration Profiles | Desktop Wallpaper Locked screen experience](https://techuisitive.com/wp-content/uploads/2023/03/Intune_Device_Configuration_Wallpaper_02.png)- Scroll down and expand the **Personalization settings** in your Intune configuration profile. - Under this section, provide the **Desktop background picture URL (Desktop only)**, which points to the image you want to use as the **Intune desktop wallpaper**. Make sure the wallpaper image is hosted on a location that is publicly accessible or available through your **corporate network** (such as Azure Blob Storage) so devices can retrieve it without issues. - Once the desktop wallpaper URL is entered, click Next to proceed to the Assignment page, where you can target the policy to specific Entra ID groups, user groups, or device groups. ![Intune deploy wallpaper via | Intune wallpaper management](https://techuisitive.com/wp-content/uploads/2023/03/Intune_Device_Configuration_Wallpaper_03.png)- On the **Assignment** page, select the appropriate **Microsoft Entra ID group (formerly Azure Active Directory)** that you want to target with the **Intune desktop wallpaper policy**, then click **Next** to continue. You can assign the wallpaper configuration to a **User group**, **Device group**, **All Users**, or **All Devices**, depending on your deployment needs. For more granular targeting, you can also leverage **[Intune Assignment Filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/ "Intune Filters – Assign Microsoft Store App policy using Filters")** to narrow the scope of the policy and ensure that the **desktop wallpaper settings** apply only to specific devices or user segments ![Intune Device Configuration Profiles | Desktop Wallpaper](https://techuisitive.com/wp-content/uploads/2023/03/Intune_Device_Configuration_Wallpaper_04.png)- On the **Review + Create** page in the Intune portal, carefully review all the configured settings for your **Intune desktop wallpaper policy**. Once you confirm the configuration details, click on **Create** to deploy the wallpaper policy to targeted **Windows 10 and Windows 11 devices**. This ensures that your **Intune desktop wallpaper** configuration is applied consistently across managed endpoints, enforcing corporate branding and compliance requirements. ![Intune Device Configuration Profiles | Desktop Wallpaper | bg Windows](https://techuisitive.com/wp-content/uploads/2023/03/Intune_Device_Configuration_Wallpaper_05.png)The **Intune device restriction policy** has now been successfully created. To verify deployment, check the **notifications area** in the Intune admin center or on the **Windows 10/Windows 11 device** to confirm that the **desktop wallpaper and lock screen settings** have been applied. Monitoring notifications ensures that your **Intune desktop wallpaper policy** is active and that the configuration has been pushed to the targeted **Entra ID groups, user groups, or device groups** without errors. ### How to Check the Policy Status for a Device from Intune You can validate the **Intune desktop wallpaper policy** by checking the **per‑setting status** of a device in the **Device blade**. Follow the steps below to confirm whether the wallpaper and lock screen configurations have been applied successfully: - Navigate to **Devices > Configuration Profiles** in the Intune admin center. - Select the relevant **device configuration profile**. - Click on **Per‑setting status** to view detailed compliance information. Here, you will see the deployment status for the following **Intune personalization CSP settings**: - **Locked screen picture URL (Desktop only)** - **PersonalizationLockScreenImageStatus** - **PersonalizationDesktopImageStatus** - **Desktop background picture URL (Desktop only)** By reviewing these settings, IT administrators can confirm whether the **Intune lock screen wallpaper** and **Intune desktop wallpaper** policies have been successfully enforced across **Windows 10 and Windows 11 devices**. This validation step is critical for troubleshooting and ensuring consistent **corporate branding** across managed endpoints. ![PersonalizationLockScreenImageStatus PersonalizationDesktopImageStatus](https://techuisitive.com/wp-content/uploads/2023/03/Intune_Device_Configuration_Wallpaper_06.png)### How to Check the Policy Status for a Device Registry Keys Once the **Intune device restriction policy** is successfully applied to a **Windows 10 or Windows 11 device**, you can validate its effectiveness by checking the **Windows Registry**. This step is particularly useful for **troubleshooting Intune desktop wallpaper policies** when the expected wallpaper or lock screen image is not appearing. In the Registry, you will find detailed entries created by the **Personalization CSP (Configuration Service Provider)**, which controls wallpaper and lock screen settings. Reviewing these registry values helps IT administrators confirm whether the **Intune desktop wallpaper** and **Intune lock screen wallpaper** configurations have been correctly enforced. For more technical details and reference, you can explore the official documentation on **[PersonalizationCSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/personalization-csp "PersonalizationCSP")**, which explains how Intune applies and manages these settings across managed endpoints. **Registry key:** HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\PersonalizationCSP ![PersonalizationCSP Registry keys on windows 10 / Windows 11 to validate wallpaper policy](https://techuisitive.com/wp-content/uploads/2023/03/Intune_Device_Configuration_Wallpaper_07.png)### **End User Experience** Once the policy is successfully applied, end users will notice the following: - The **desktop background and/or lock screen wallpaper** will automatically update to the image specified in the Intune policy. - Users will **not be able to change the wallpaper manually** through system settings. The “Background” and “Lock screen” options under **Settings → Personalization** will appear **grayed out or disabled**. - No visible prompts or notifications are shown to the user during the wallpaper change — the update happens **silently in the background**. - If the device is **not connected to the internet** at the time of policy deployment, the wallpaper change will occur once the device regains connectivity and syncs with Intune. > 💡 *Tip:* If you’re applying both lock screen and desktop wallpapers, make sure the images are visually distinct so that end users can easily recognize the change. **Desktop Wallpaper:** ![Intune Desktop Wallpaper windows background](https://techuisitive.com/wp-content/uploads/2023/03/Desktop_wallpaper-1024x574.png)**Lock Screen:** ![](https://techuisitive.com/wp-content/uploads/2021/10/1000347740-1024x683.jpg "1000347740") The Intune setting catalog policies can be used to configure thousands of settings to manage Windows 10/11 components, Microsoft Edge, Microsoft 365, and other apps. Check out [how to disable Copilot in Windows 11 using the Intune setting catalog](https://techuisitive.com/disable-copilot-via-intune-settings-catalog/ "how to disable Copilot in Windows 11 using the Intune setting catalog") to have a better understanding of Intune setting catalog policies. ## Frequently Asked Questions (FAQs) ### **Can Microsoft Intune set the desktop wallpaper on Windows 10 Pro?** Yes, Intune can configure wallpaper policies, but certain personalization CSPs may not apply to **Windows 10 Pro** editions. For full support, use **Windows 10 Enterprise** or **Windows 11 Enterprise**. ### **How do I enforce a company wallpaper using Intune?** You can create a **device configuration profile** in Intune, use the **Personalization CSP**, and specify the **desktop background image URL** hosted on **Azure Blob Storage** or another accessible location. ### **What’s the difference between Group Policy and Intune for wallpaper management?** **Group Policy Objects (GPOs)** are traditional on‑premises tools, while **Intune policies** provide cloud‑based, modern management for **hybrid or remote devices**. Intune is more scalable and integrates with **Microsoft Entra ID**. ### **Can Intune also configure lock screen wallpaper?** Yes, Intune supports both **desktop background** and **lock screen images** through **device restriction policies**. ### **Why is my Intune wallpaper policy not applying?** Common causes include: - Device edition mismatch (Pro vs Enterprise) - Incorrect **CSP path or registry settings** - Wallpaper image not accessible via URL - Policy conflicts with other configuration profiles ## **Related Posts** - [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) - [Manage Edge Chromium favorites with Endpoint Manager | Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Configure Edge Chromium Homepage & Startup Page](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) - [Configure Microsoft Edge Sleeping Tabs using Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Configure Google Chrome settings using Administrative templates | Intune | Endpoint Manager](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Block USB Device with Exception](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows 10 /11 Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Local Admin Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) Tags: [Device Configuratin Featured](https://techuisitive.com/tag/device-configuratin-featured/), [Device Configuration](https://techuisitive.com/tag/device-configuration/), [Device Configuration Getting Started](https://techuisitive.com/tag/device-configuration-getting-started/), [Intune Guides](https://techuisitive.com/tag/intune-guides/), [Windows Experience](https://techuisitive.com/tag/windows-experience/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Configuratin Featured, Device Configuration, Device Configuration Getting Started, Intune Guides, Windows Experience --- ### [Deploy Win32 App Using Intune Enterprise App Catalog [Step-by-step Guide]](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) **Published:** February 20, 2025 **Author:** Equebal Ahmad **Excerpt:** Microsoft Intune Enterprise App Management makes it simple to discover, deploy, and keep applications up to date using the Enterprise App Catalog. The catalog is a curated collection of both Microsoft and non‑Microsoft Win32 applications, packaged and hosted by Microsoft for seamless deployment. **Content:** Microsoft Intune Enterprise App Catalog makes it easy for IT admins to find, deploy, and keep applications updated. The catalog includes a curated list of Microsoft and third‑party Win32 apps, packaged and hosted by Microsoft for smooth deployment. With the Enterprise App Catalog, admins save time and reduce maintenance. Many apps are self‑updating, so Intune checks the installed version against a minimum requirement while the vendor handles updates. This ensures devices stay secure and compliant without extra manual work. ## When to Use the Enterprise App Catalog vs. the Win32 Package App ### Use Enterprise App Catalog When: - You want to provide a curated app store experience for users. - Deploying modern apps or simple MSI installers. - You want users to self-serve and install apps on demand. - Managing apps that are available in the Microsoft Store for Business. ### Use Win32 Package App When: - Deploying legacy or complex Win32 applications. - You need to run custom installation scripts or commands. - Managing apps with complex dependencies or configurations. - You require precise detection and uninstall behavior. ## Deploy Win32 App Using Intune Enterprise App Catalog Let’s walk through how to **deploy a Win32 application using the Intune Enterprise app catalog**. In this example, we’ll deploy **Notepad++** from the catalog. Follow these steps to deploy an application from the **Intune Enterprise app catalog**: - Open the Microsoft Intune admin portal - Navigate to **Windows > Windows apps** and click on **+Add** - On the **Select app type** flyer window, select the following - **App type:** Enterprise App Catalog app - Click on **Select** ![Intune Enterprise App Catalog app](https://techuisitive.com/wp-content/uploads/2025/02/image-13-1024x473.png)On the **App Information** page in the **Intune Admin Center**, click **Search the Enterprise App Catalog** and enter the name of the application you want to deploy. From the search results, select the desired application. For example, in this walkthrough, we have selected **Notepad++** from the catalog. Once selected, you can proceed to configure the **deployment settings**, including assignments, requirements, and detection rules, before publishing the app to targeted devices or users. ![Intune Enterprise app catalog](https://techuisitive.com/wp-content/uploads/2025/02/image-15-1024x347.png)On the **Configuration** page, select the **package name** you want to deploy and click **Select**. You may see multiple packages listed if more than one **version**, **architecture** (x64/x86), or **language package** is available in the **Intune Enterprise App Catalog**. Choose the package that best matches your deployment requirements to ensure compatibility with target devices. ![Deploy Win32 app from Intune Enterprise catalog](https://techuisitive.com/wp-content/uploads/2025/02/image-16.png)As shown in the screenshot below for **WinRAR**, multiple packages are available in the **Intune Enterprise App Catalog**. These packages may differ by **version**, **architecture** (x64/x86), or **language**. Administrators should choose the package that best matches their deployment requirements to ensure compatibility with target devices. ![Intune enterprise catalog WINRAR](https://techuisitive.com/wp-content/uploads/2025/02/image-30.png)You can see that all information is pre-populated on the **App information** page. Similarly, the information is pre-filled in the other tabs ( Program, [Requirements](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/ "Understanding Win32 App Requirements Rule in Microsoft Intune"), [detection rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune")). You can update the information in these tabs if required. However, Microsoft recommends using the pre-populated fields containing specific commands and rules. Click on **Next** to move to the **Program** page. ![Windows catalog app - Add App](https://techuisitive.com/wp-content/uploads/2025/02/image-17-1024x852.png)On the **Program** page, review the pre‑filled details provided by the **Intune Enterprise App Catalog**. This includes important information such as: - **Install command** - **Uninstall command** - **Estimated installation time** - Other configuration details Click **Next** to proceed. You can make adjustments to these settings if needed, based on your **deployment requirements** or organizational policies. This flexibility ensures that the **Win32 app deployment** aligns with your environment’s standards and compatibility needs. ![Windows catalog app - Program](https://techuisitive.com/wp-content/uploads/2025/02/image-18.png)On the **Requirements** page, review the pre‑filled details and click **Next** to move to the **Detection Rules** page. As mentioned earlier, you can update the values as needed to match your deployment standards. For example, you can add additional requirements such as: - **Minimum disk space required** – 5 GB - **Physical memory required** – 8 GB These requirements ensure that the **Win32 app deployment** only targets devices that meet the necessary hardware specifications, reducing installation failures and improving compliance. 👉 Check out this article for a detailed explanation of Intune Win32 app requirement rules: [**Win32 App Requirements in Intune**.](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/ "Win32 App Requirements in Intune.") ![Win32 App Requirements | Enterprise App Catalog](https://techuisitive.com/wp-content/uploads/2025/02/image-19.png)On the **Detection Rules** page, review the pre‑filled details and click **Next** to continue. You can update the detection rules if required, but **Microsoft recommends using the default pre‑configured information**, which typically includes **command lines or detection rules** tailored for the selected application. These detection rules help Intune determine whether the application is already installed on a device, ensuring accurate **Win32 app deployment** and preventing duplicate installations. Please check out the article below if you want to know more about Intune [Win32 app detection rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune"). ![Intune Enterprise app catalog detection rules](https://techuisitive.com/wp-content/uploads/2025/02/image-20.png)On the **Assignments** page, you can configure how the application will be delivered to users or devices. Intune allows you to assign the app to: - **All Users** - **All Devices** - Specific **user groups** or **device groups** You can choose to deploy the application as either: - **Required** – The app will be automatically installed on targeted devices. - **Available** – The app will be published in the **Company Portal**, allowing users to install it on demand. After selecting the appropriate assignment type, click **Next** to continue with the deployment process. ![Win32 App | Assignment](https://techuisitive.com/wp-content/uploads/2025/02/image-21-1024x567.png)On the **Review + Create** page, carefully review all the configuration details for your **Win32 app deployment**. This includes information such as **app metadata, requirements, detection rules, and assignments**. Once you’ve confirmed the settings, click **Add App** to create and publish the application in **Microsoft Intune**. The app will then be available to the targeted users or devices based on the assignment type you selected (Required or Available). ![Intune win32 app Review + create](https://techuisitive.com/wp-content/uploads/2025/02/image-22-1024x686.png)Once the configuration is complete, the application is successfully added to **Microsoft Intune**. You will see a **notification confirming the app creation**. To verify deployment, you can check the **application status** from the **Apps > Windows apps** blade in the **Intune Admin Center**. This view provides details such as installation progress, assignment status, and compliance, helping administrators ensure that the **Win32 app deployment** is working as expected. ![Intune Windows Apps](https://techuisitive.com/wp-content/uploads/2025/02/image-26-1024x271.png)Since the application was assigned as an **Available deployment**, it is now published in the **Company Portal** for **self‑service installation** by end users. This means users can open the **Company Portal app** or website, browse the list of available applications, and install **Notepad++ (or any other deployed Win32 app)** on demand. This deployment method provides flexibility, allowing users to install applications when needed without forcing installation across all devices. ![Intune Company Portal app](https://techuisitive.com/wp-content/uploads/2025/02/image-23-1024x599.png)## **Win32 App Report in Intune Enterprise App Catalog** **Microsoft Intune** includes a built‑in report called **Win32 App – Intune Enterprise App Catalog with Update**. This report provides details of applications that have a **newer version available** and are **not superseded**. Administrators can use this report to: - Identify apps in the environment that are outdated. - Track which Win32 applications have newer versions published in the **Enterprise App Catalog**. - Plan updates and deployments to ensure devices remain compliant and secure. This reporting capability simplifies **Win32 app lifecycle management** in Intune, helping IT teams maintain consistency across devices while reducing manual checks. ![Intune report | Win32 App Intune Enterprise App Catalog](https://techuisitive.com/wp-content/uploads/2025/02/image-32-1024x373.png)## Use Intune Win32 App Report to Identify Non‑Self‑Updating Applications The **Win32 App – Intune Enterprise App Catalog report** can also be used to identify applications that are **not self‑updating**. This is particularly useful for administrators who need to track apps that require manual updates to maintain compliance and security. When a newer version of an application is available in the **Enterprise App Catalog**, you can: - **Add the newer version** of the application to Intune. - Configure the **Supersedence relationship** so that the newer version automatically **supersedes the older version**. This ensures that outdated apps are replaced seamlessly, reducing manual intervention and keeping devices aligned with the latest supported versions. ![Win32 App Intune Enterprise App Catalog update report](https://techuisitive.com/wp-content/uploads/2025/02/image-31-1024x456.png)## Frequently Asked Questions (FAQ) ### **What is the Intune Enterprise App Catalog?** The Enterprise App Catalog is a curated library of popular Win32 applications that Microsoft packages and maintains. It allows admins to deploy common apps without creating custom Win32 packages. ### **Can I add my own Win32 apps to the Enterprise App Catalog?** No. The catalog only includes apps packaged and published by Microsoft. For custom or line‑of‑business Win32 apps, you must use the **Win32 app packaging tool** and upload them manually. ### **Is the Enterprise App Catalog available to all Intune tenants?** Yes, but the availability of specific apps may vary by region or licensing. Ensure your tenant is on Windows 10/11 and Intune is properly licensed. ### **How does deploying from the Enterprise App Catalog differ from custom Win32 app deployment?** Catalog apps are pre‑packaged and maintained by Microsoft, saving time and effort. Custom Win32 apps require you to create `.intunewin` packages, define install/uninstall commands, and manage updates yourself. ### **Can I monitor deployment status for catalog apps?** Yes. Deployment status can be tracked in the **Intune admin center → Apps → Monitor** section, just like other Intune applications. ## Related Posts - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** App Deployment Featured, App Management Getting Started, intune apps, Intune Getting Started, Intune Guides, Intune win32 App Guides --- ### [How to Configure Enrollment Status Page (ESP) in Microsoft Intune](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) **Published:** March 30, 2022 **Author:** Equebal Ahmad **Excerpt:** The Enrollment Status Page (ESP) shows the progress of device provisioning when a new device enrolled to Intune or a new user sign in to the device. You can show ESP during the default out-of-box experience (OOBE) for Azure AD join, Windows Autopilot scenarios or when new user sign into the device for the first time. In this article, we will create a new Enrollment Status Page profile for Windows Autopilot devices. **Content:** The Enrollment Status Page (ESP) in Microsoft Intune provides users with real-time visibility into device setup during Windows Autopilot or Entra ID join. By configuring ESP, IT admins can control whether devices are blocked until apps, policies, and profiles are installed, ensuring a smoother onboarding experience and reducing support calls. This guide walks you through creating and customizing ESP profiles step by step ## Enrollment Status Page Profiles and Priority in Intune You can assign multiple Enrollment Status Page (ESP) profiles in Intune to a single device. When this occurs, the ESP profile with the highest priority will take precedence. During the device setup phase, the Enrollment Status Page monitors key configuration items, including: - Security policies - Certificate profiles - Network connectivity - Applications For more detailed guidance, refer to the [official Microsoft documentation](https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-status "official Microsoft documentation") You can deploy multiple Enrollment status page Intune profiles to a device. However, the ESP with the highest priority will take precedence. The enrollment status page tracks these items during the device setup phase: ## **Create a new Enrollment Status Page ( ESP ) profile** ### Create Enrollment Status Page Follow these steps to configure an Enrollment Status Page profile in Intune: - In the **Microsoft Intune admin center** (formerly Endpoint Manager), navigate to: **Devices > Windows > Windows enrollment** - Select **Enrollment Status Page**. ![Intune autopilot Enrollment Status Page](https://techuisitive.com/wp-content/uploads/2023/03/image-52.png)- On the Enrollment Status Page screen, Click **+ Create** to begin setting up a new ESP profile ![Intune Enrollment Status Page autopilot](https://techuisitive.com/wp-content/uploads/2023/03/image-53.png)On the **Create Profile – Basics** page: - Enter the required basic information: - **Name**: Provide a descriptive name for the ESP profile. - **Description**: Add a meaningful description to explain the purpose of the profile. - Click **Next** to continue with the configuration ![Intune Create Profile | enrollment status page autopilot](https://techuisitive.com/wp-content/uploads/2023/03/image-55.png)On the **Create profile** – **Settings** page**,** configure the following settings: - **Show app and profile configuration progress**: - **No**: Select this option if you don’t want to show the Enrollment Status Page to users during device setup. - **Yes**: Select this option if you want to show the Enrollment Status Page to users during device setup. ![Intune Enrollment Status Page autopilot | Intune ESP](https://techuisitive.com/wp-content/uploads/2023/03/image-54.png)### Configure ESP Settings in Intune Once you select **Yes** in the previous screen, all available **Enrollment Status Page (ESP) settings** will be displayed. These settings allow you to configure how devices behave during the enrollment process, including blocking access until required apps, policies, and profiles are installed ![Intune Enrollment Status Page - Settings](https://techuisitive.com/wp-content/uploads/2023/03/image-56.png)### **Available Settings in the Enrollment Status Page (ESP)** When configuring the ESP profile in Intune, the following settings are available: - **Show an error when installation takes longer than the specified number of minutes** - Default timeout: **60 minutes** - Increase if apps require more time during enrollment. - **Show a custom message when the time limit or an error occurs** - Add a custom message for users. - Include contact details for support during Autopilot deployment. - **Turn on the log collection and diagnostics page for end users** - Helps with troubleshooting enrollment issues. - **Only show the page to devices provisioned by Out-of-Box Experience (OOBE)** - **No**: Show ESP to all Intune-managed/co-managed devices during OOBE and first sign-in. - **Yes**: Show ESP only to devices provisioned via OOBE. - **Block device use until all apps and profiles are installed** - **No**: Users can leave ESP before configuration finishes. - **Yes**: Users must wait until the configuration completes. - **Allow users to reset the device if an installation error occurs** - **Yes**: Users can reset the device when installation fails. - **Allow users to use the** device if an **installation error occurs** - **Yes**: Users can bypass ESP and use the device. - **No**: Users must wait until installation succeeds. - **Block device use until required apps are installed** - Restricts device usage until mandatory apps are installed. - Option to enforce **all apps** or **selected apps only**. ### Assign ESP Profile to Device Groups On the **Assignments** page: Click **Add groups**. Select the group where you want to deploy the Autopilot Enrollment Status Page (ESP) profile. Review the selected group name to confirm accuracy. Click **Next** to proceed. ![Assign Intune Enrollment Status Page](https://techuisitive.com/wp-content/uploads/2023/03/image-57.png)Leave default settings in the **Scope tags** page and click on **Next**. ### Review and Create the ESP Profile On the **Review + Create** page: Carefully review all the ESP profile settings you configured in the previous steps. Confirm that the profile name, description, assignments, and configuration options are correct. Click **Create** to finalize and deploy the Enrollment Status Page (ESP) profile ![Autopilot Enrollment Status Page intune | ESP intune](https://techuisitive.com/wp-content/uploads/2023/03/image-58.png)The **Enrollment Status Page (ESP) profile** is now created and will appear in the **ESP profile list** within Intune. If multiple ESP profiles are assigned to a device, the profile with the **highest priority** will take precedence during enrollment. This ensures that the most critical configuration is applied consistently. ![Intune - Enrollment Status Page - Profiles order](https://techuisitive.com/wp-content/uploads/2023/03/image-59.png)## ESP Profile Visibility During Autopilot Provisioning The next time you **provision a device using Windows Autopilot**, the configured **Enrollment Status Page (ESP) profile** will automatically appear after the **Out-of-Box Experience (OOBE)**. This ensures that users see the enrollment progress and that required apps, policies, and profiles are installed before the device becomes available for use. ![Windows 10 - Enrollment Status Page (ESP) Device preparation , Device Setup and Account Setup screen](https://techuisitive.com/wp-content/uploads/2023/03/image-51.png)## Frequently Asked Questions (FAQs) ### **What is the Enrollment Status Page (ESP) in Intune?** The ESP provides users with real‑time visibility into the device setup process during Windows Autopilot or Microsoft Entra ID join. It ensures that required apps, policies, and profiles are installed before the device becomes available. ### **Can I assign multiple ESP profiles to a device?** You can deploy multiple ESP profiles to a device, but the profile with the **highest priority** will take precedence. ### **When does the ESP appear during Autopilot provisioning?** The ESP is displayed immediately after the **Out‑of‑Box Experience (OOBE)** when a device is provisioned using Windows Autopilot. ### **What happens if installation takes longer than expected?** By default, ESP shows an error if installation exceeds **60 minutes**. You can increase this timeout if apps or policies require more time. ### **Can users bypass the ESP if an installation fails?** Yes, depending on your configuration. You can allow users to either: - **Reset the device** if installation fails, or - **Bypass ESP and use the device** even if errors occur. ### **How can I troubleshoot ESP issues?** Enable **log collection and diagnostics** in the ESP settings. This provides detailed logs that help identify and resolve enrollment problems. ### **Does ESP apply only to Autopilot devices?** Not necessarily. You can configure ESP to show for **all Intune‑managed and co‑managed devices** during OOBE, or restrict it to **Autopilot devices only**. ### **Can I block device use until required apps are installed?** Yes. ESP allows you to block device usage until **all mandatory apps** (or selected apps) are installed, ensuring compliance before users access the device. ## **Related Posts:** - [How to Fix Autopilot error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/ "How to Fix Autopilot error 80070002") - [Windows Autopilot Device Preparation – Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/ "Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide") - [Windows 10 Autopilot Deployment Guide | Intune](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) - [Intune – Configure Enrollment Status Page (ESP)](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Bulk enrollment of Windows 10/ 11 Device to Intune using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Enroll Windows 11 Device to Intune through Azure AD Join method](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Windows 11 enrollment with Provisioning package failed with error code 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/). ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides, Windows Autopilot **Tags:** Autopilot Featured, Autopilot Guides, Intune Guides --- ### [Configuration Manager | SCCM Quiz - Set 01](https://techuisitive.com/configuration-manager-sccm-quiz-01/) **Published:** April 7, 2023 **Author:** Equebal Ahmad **Content:** This SCCM quiz includes multiple choice questions to help you enhance your SCCM knowledge. You can use this to practice for various exams such as Modern Desktop Management – MD-101. You will be able to see the result after submitting your response. You can re-take the quiz to practice as many time as you wish. **Welcome to Techuisitive Quiz. Please submit your response to see your score and explanations. Enter your email ID if you want to receive quiz result on your email.** Name (Required) Email (Optional) 1. What is the purpose of Global condition in Configuration Manager? Global conditions are conditions used for dynamic collections Global conditions are used for maintenance windows Global conditions are used for Inventory Global conditions are use by requirement rules None 2. You have to deploy App1 on Collection1 which includes all Windows 10 computers. You have another collection Sales1 and you need to exclude all computers in Sales1 collection from the deployment. Which of below is best option to achieve this. Add an Exclude Rule in collection1 for Sales1 Add an Include Rule in collection1 for Sales1 Create a static collection and exclude all computers in Sales1 Create a static collection and include all computers in Sales1 None 3. You have to deploy an application App1 version 2.0 through application deployment in Microsoft Endpoint Configuration Manager. You need to ensure all previous version (if exists) are uninstalled. Which of below feature can be used for uninstallation of previous version? Requirements Dependencies Supersedence Uninstallation None 4. Which log file will record details about software update deployment on ConfigMgr client? Execmgr.log UpdateDeployment.log WUAHandler.log ccmexec.log None 5. Which log file record installation errors for ConfigMgr application deployment (Application model)? Execmgr.log Appdiscovery.log AppEnforce.log CAS.log None 6. For which purpose Update Group used in Configuration Manager? Client Upgrade Application Deployment Software update deployment Compliance Baseline None 7. Which of below can be a detection method in application deployment? Windows Installer Product Code File Registry PowerShell Script 8. Which of below discovery method also called heartbeat discovery? Data Discovery Record Network Discovery AD User Discovery AD System Discovery None 9. Which one is top most site in Configuration Manager (SCCM) hierarchy? Primary Site Secondary Site CAS ConfigMgr have flat hierarchy None 10. Which of below are type of Deployment in Configuration Manager? Available Required Both Available & Required None of these None 11. You are using Configuration Manager for Software Distribution and Patch Management. You have to install ConfigMgr client on 100+ geographically distributed workstations where you don't have admin rights. The site server Network access account also don't have admin perimission on those workstations. Which of below methods you can use for client installation. Client Push installation Group Policy based installation Software Update Point based installation Manual installation ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel ## Related Quiz - [Configuration Manager | SCCM Quiz – Set 01](https://techuisitive.com/configuration-manager-sccm-quiz-01/) - [Configuration Manager | SCCM Quiz – Set 02](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) - [Modern Device Management – MD 102 – Quiz – Set 01](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) - [Modern Device Management – MD 102 – Quiz – Set 02](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) **DISCLAIMER:** The information contained in this quiz is for general guidance. While we have made every attempt to ensure that the information contained in this quiz has been obtained from reliable sources, Techuisitive is not responsible for any errors or omissions, or for the results obtained from the use of this information. All information in this quiz is provided “as is”, with no guarantee of completeness and accuracy. ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Search keywords:** SCCM Quiz , ConfigMgr Quiz , MECM Quiz , Intune Quiz , Exam practice set , MD 101 Quiz , MD 101 Practice set , MD-100 Practice set , Endpoint Manager quiz , Free quiz , Free practice set, Free exam practice set, MDM Quiz , MAM Quiz, Modern Desktop Management , MD-101 Quiz , MDT , Windows Autopilot, OSD, Windows 10 , MD 101 dumps. **Categories:** Modern Device Management Quiz **Tags:** Exam Practice Sets, Quiz, sccm quiz --- ### [Configuration Manager | SCCM Quiz - Set 02](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) **Published:** April 25, 2023 **Author:** Equebal Ahmad **Content:** This SCCM quiz includes multiple choice questions to help you enhance your SCCM knowledge. You can use this to practice for various exams such as Modern Desktop Management – MD-101. You will be able to see the result after submitting your response. You can re-take the quiz to practice as many time as you wish. **Welcome to Techuisitive Quiz. Please submit your response to see your score and explanations. Enter your email ID if you want to receive quiz result on your email.** --- Name (Required) Email (Optional) 1. You have Windows 10 64 bit and Windows 8 32-bit operating system in your organization. You need to install an application. **– The 64-bit version of application must be installed on Windows 10 machines** **– The 32-bit version of application must be installed on Windows 8 machines** **Select the best solution from below.** Create an application for 64-bit deployment. Deploy the application to query based collection which includes Windows 10 64-bit computers Create an application for 32-bit deployment. Deploy the application to query based collection which includes Windows 8 32-bit computers Create separate application for 32-bit and 64-bit with their own requirement rule Create one application with two deployment types. Configure a requirement rule for both deployment type. 2. Which tool can you use to view ConfigMgr client logs in real time? Notepad ccmlog CMTrace CMTroubleshoot None 3. Which site system role is used for client communication in ConfigMgr? Management Point Reporting Point Software Update Point Distribution Point None 4. Which one of below cannot be a boundary in ConfigMgr? IP Subnets IP Range Active Directory Sites Active Directory OU’s None 5. Which of the following are features of ConfigMgr? Collecting hardware and software inventory Deploying Applications Managing virtualization hosts and storage resource Deploying Software Updates 6. Global conditions are rules that represent business or technical conditions that you can use to specify how an application is provided and deployed to client devices. You are installing Microsoft Visio Viewer 2016 on 1000+ workstations. You need to create a requirement rule to ensure application install only on machines with > 5GB free space. Which tab (see image) you will go to create the requirement rule? Program Detection Method Requirements Dependencies None 7. You are ConfigMgr administrator at Techuisitive. The company purchased a new application named App1. The application need to be installed on the machines which met below criteria. OS – Windows 10 Enterprise Memory >= 8 GB Free Space >= 100 GB Select the appropriate option which you can use for Application Deployment? A query based collection A Requirement Rule Supersedence Relationship Dependencies 8. You have created a deployment to install Microsoft Office 2016 on 1000+ clients. Few user reported that they are not seeing the application installed on their machine. You checked the issue for client1 in MECM report and found that installation was failed. You need to confirm if client1 started downloading the content. Which log file you will review? Contenttransfermanager.log Execmgr.log Locationservices.log Policy.log None 9. You are ConfigMgr administrator at techuisitive.com. You have to create an application. Which option you will select in ConfigMgr console. Software Library Asset and Compliance Administration Monitoring None 10. Which port is used by SQL Service Broker? TCP Port 4022 UDP Port 4022 TCP Port 445 ICMP None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel ## Related Quiz - [Configuration Manager | SCCM Quiz – Set 01](https://techuisitive.com/configuration-manager-sccm-quiz-01/) - [Configuration Manager | SCCM Quiz – Set 02](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) - [Modern Device Management – MD 102 – Quiz – Set 01](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) - [Modern Device Management – MD 102 – Quiz – Set 02](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) **DISCLAIMER:** The information contained in this quiz is for general guidance. While we have made every attempt to ensure that the information contained in this quiz has been obtained from reliable sources, Techuisitive is not responsible for any errors or omissions, or for the results obtained from the use of this information. All information in this quiz is provided “as is”, with no guarantee of completeness and accuracy. ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Search keywords:** SCCM Quiz , ConfigMgr Quiz , MECM Quiz , Intune Quiz , Exam practice set , MD 101 Quiz , MD 101 Practice set , MD-100 Practice set , Endpoint Manager quiz , Free quiz , Free practice set, Free exam practice set, MDM Quiz , MAM Quiz, Modern Desktop Management , MD-101 Quiz , MDT , Windows Autopilot, OSD, Windows 10 , MD 101 dumps **Categories:** Modern Device Management Quiz, Quiz **Tags:** Quiz, sccm quiz --- ### [Mastering Windows Autopilot: Quick Quiz Challenge](https://techuisitive.com/mastering-windows-autopilot-quick-quiz-challenge/) **Published:** July 9, 2026 **Author:** Equebal Ahmad **Content:** This quick set of 10 multiple-choice questions is designed to test your knowledge of Windows Autopilot—covering deployment modes, identity integration, requirements, and management workflows. Each question comes with a brief explanation to help reinforce the correct answer, making it perfect for both revision and hands-on learning. **Welcome to Techuisitive Quiz!** Answer each question as you go. Once you reach the final page, click **‘Submit’** to view your overall score and detailed explanations. You can also enter your email if you’d like to receive your quiz results directly in your inbox. --- Name (Required) Email (Optional) 1. What is the role of Intune in Autopilot deployments? Provides OS installation media Manages device policies, apps, and compliance after enrollment Acts as a replacement for Azure AD Handles BIOS updates None 2. Which of the following best describes Windows Autopilot? A tool for creating custom Windows images A cloud-based deployment service for provisioning new devices A virtualization platform for running Windows in the cloud A patch management solution None 3. Which Autopilot deployment mode is best suited for kiosks or shared devices? User-driven mode Self-deploying mode Pre-provisioned deployment Hybrid mode None 4. Which deployment option allows Autopilot devices to join on-premises AD while also registering with Azure AD? Hybrid Azure AD Join Self-deploying mode Pre-provisioned deployment User-driven mode None 5. What is the primary identity service used with Autopilot? Active Directory (on-premises) Azure Active Directory (Azure AD) LDAP Directory Services Local SAM database None 6. Which requirement is essential for Autopilot to function? Devices must have TPM 2.0 enabled Devices must be registered with Autopilot service using hardware IDs Devices must run Windows Server OS Devices must be joined to on-premises AD only None 7. In user-driven Autopilot deployment, who completes the setup process? IT administrator End user OEM vendor Microsoft support None 8. What happens when a device is reset using Autopilot Reset? The device is wiped and removed from Azure AD The device is reset but remains enrolled in Intune and Azure AD The device is downgraded to Windows 7 The device loses all management policies None 9. What is the main benefit of using Autopilot compared to traditional imaging? Faster OS installation Eliminates the need for custom images by using OEM-provided Windows builds Provides offline deployment without internet Requires fewer licenses None 10. Which Autopilot deployment mode allows devices to be pre-provisioned by IT before handing them to end users? User-driven mode Self-deploying mode Pre-provisioned deployment (formerly White Glove) Hybrid Azure AD Join None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel ## Related Quiz - [Configuration Manager | SCCM Quiz – Set 01](https://techuisitive.com/configuration-manager-sccm-quiz-01/) - [Configuration Manager | SCCM Quiz – Set 02](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) - [Modern Device Management – MD 102 – Quiz – Set 01](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) - [Modern Device Management – MD 102 – Quiz – Set 02](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) **DISCLAIMER:** The information contained in this quiz is for general guidance. While we have made every attempt to ensure that the information contained in this quiz has been obtained from reliable sources, Techuisitive is not responsible for any errors or omissions, or for the results obtained from the use of this information. All information in this quiz is provided “as is”, with no guarantee of completeness and accuracy. ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Modern Device Management Quiz, Quiz **Tags:** Autopilot Quiz, Quiz --- ### [Microsoft Intune - Windows Update Quiz 1](https://techuisitive.com/microsoft-intune-software-update-quiz-1/) **Published:** May 31, 2025 **Author:** Equebal Ahmad **Content:** Windows Update is a service that keeps devices secure and up to date by delivering patches, feature enhancements, and security improvements. Microsoft Intune streamlines software updates by providing automated deployment, compliance enforcement, and flexible update scheduling for Windows, macOS, iOS, and Android devices. Intune ensures updates are applied efficiently, reducing downtime and security vulnerabilities. To check your understanding, try the **Microsoft Intune Software Update quiz** **from Techusitive**! These questions are also useful for certification exams like **MD-102**, helping you prepare with real-world scenarios. Keep learning and mastering Intune update management! Programming MCQ Quiz Question 1 of 20 Loading question… Next QuestionThanks for trying Techuisitive Learn Quiz! Your Score: 0/20 Retry Quiz ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Modern Device Management Quiz, Quiz **Tags:** Intune Quiz --- ### [Microsoft Intune – Security and Update Enforcement - Quiz 1](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-1/) **Published:** June 18, 2025 **Author:** Equebal Ahmad **Content:** Microsoft Intune plays a crucial role in **security and update enforcement**, ensuring devices meet compliance standards and receive timely updates. It allows administrators to enforce **minimum OS versions**, **BitLocker encryption**, and **Windows Defender settings** to protect corporate data. **Update rings** enable gradual rollouts, minimizing disruptions while ensuring stability. **Deadline enforcement** guarantees critical patches are installed within a defined timeframe, preventing security risks. **Conditional Access** works alongside compliance policies to restrict access to corporate resources for non-compliant devices. **Peer-to-peer caching** optimizes bandwidth for efficient update delivery. **Active hours configuration** helps schedule updates without interrupting workflows. **Security baselines** provide recommended configurations for improved protection. **Reporting tools** offer insights into update status and compliance tracking. **Techuisitive Quiz** helps professionals evaluate their knowledge of Intune’s security policies, enabling them to apply best practices effectively. Let’s try this quiz. Programming MCQ Quiz Question 1 of 20 Loading question… Next QuestionThanks for trying Techuisitive Learn Quiz! Your Score: 0/20 Retry Quiz ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Modern Device Management Quiz, Quiz **Tags:** Intune Quiz --- ### [Mastering Intune Configuration Profiles: Admin Essentials Quiz 01](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz/) **Published:** November 7, 2025 **Author:** Equebal Ahmad **Content:** **Welcome to the Intune Configuration Profiles Quiz!** This quiz tests your understanding of how Microsoft Intune manages device settings through configuration profiles, including profile types, deployment strategies, applicability rules, and conflict resolution. Each multiple-choice question focuses on practical, real-world scenarios, helping IT admins, learners, and curious readers sharpen their endpoint management skills. Take your time, think through each option, and see how well you know Intune’s configuration capabilities—ready to prove your profile prowess? Let’s begin. **Welcome to Techuisitive Quiz!** Answer each question as you go. Once you reach the final page, click **‘Submit’** to view your overall score and detailed explanations. You can also enter your email if you’d like to receive your quiz results directly in your inbox. --- Name (Required) Email (Optional) 1. How can configuration profiles be assigned in Intune? To individual users only To device groups or user groups To email addresses To IP ranges None 2. What is the benefit of using the Settings Catalog in Intune? It allows importing third-party apps It provides granular access to individual settings It disables device compliance It removes all default policies None 3. What is the role of scope tags in Intune configuration profiles? To assign licenses To filter audit logs To control visibility and access for admins To block device enrollment None 4. What are security baselines in Intune used for? To configure Wi-Fi settings To apply recommended security settings To block app installations To manage user passwords None 5. How does Intune resolve conflicts between multiple configuration profiles? It applies the most recently created profile It ignores all conflicting settings It uses a priority-based system It applies the most restrictive setting None 6. Which profile type allows administrators to define custom OMA-URI settings? Settings Catalog Templates Custom Security Baseline None 7. Which platforms are supported when creating configuration profiles in Intune? Windows, iOS/iPadOS, macOS, Android Linux only Windows only Android only None 8. What does the 'Applicability Rules' feature in Intune profiles do? It blocks all non-compliant devices It defines conditions for profile deployment It deletes old profiles It resets device settings None 9. What is the first step when creating a configuration profile in Intune? Assigning groups Selecting platform and profile type Setting compliance rules Enabling audit logging None 10. What is the main purpose of creating a configuration profile in Microsoft Intune? To install applications To enforce device settings and policies To monitor user activity To manage licenses None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel ## Device Management Quizzes - [Mastering Intune Configuration Profiles: Admin Essentials Quiz 01](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz/) - [Mastering Intune Configuration Profiles: Admin Essentials Quiz 02](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz-02/) - [Microsoft Intune – Security and Update Enforcement – Quiz 1](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-1/) - [Microsoft Intune – Security and Update Enforcement – Quiz 2](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-2/) - [Microsoft Intune – Windows Update Quiz 1](https://techuisitive.com/microsoft-intune-software-update-quiz-1/) - [Modern Desktop Management: MD-101 Quiz – Set 01](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) - [Modern Device Management: MD-101 Quiz – Set 02](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) - [Configuration Manager | SCCM Quiz – Set 01](https://techuisitive.com/configuration-manager-sccm-quiz-01/) - [Configuration Manager | SCCM Quiz – Set 02](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) ## Frequently Asked Questions – Intune Configuration Profiles Quiz **Q1. Who should take this quiz?** This quiz is designed for IT administrators, Intune practitioners, and learners who want to strengthen their knowledge of configuration profiles. **Q2. What topics are covered?** The quiz focuses on Intune configuration profile essentials, including profile types, deployment scenarios, troubleshooting basics, and best practices for device management. **Q3. How many questions are included?** Each quiz set contains multiple-choice questions with detailed explanations to help you understand the correct answers. **Q4. Can I retake the quiz?** Yes, you can retake the quiz as many times as you like to improve your score and reinforce your learning. **Q5. Is this quiz useful for certification or exam preparation?** Absolutely. While it’s not an official Microsoft exam, the quiz aligns with Intune admin essentials and helps you prepare for certification paths like MD‑102 (Endpoint Administrator). **Q6. Will I get explanations for wrong answers?** Yes, each question includes explanations so you can learn the reasoning behind the correct answer. **Q7. Can I receive my results via email?** Yes, you can enter your email before submission to receive your quiz results directly in your inbox. ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Modern Device Management Quiz, Quiz **Tags:** Intune Quiz, Quiz --- ### [Mastering Intune Configuration Profiles: Admin Essentials Quiz 02](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz-02/) **Published:** December 18, 2025 **Author:** Equebal Ahmad **Content:** **Welcome to the Intune Configuration Profiles Quiz!** This follow‑up quiz challenges you to dive deeper into Microsoft Intune’s configuration profiles and how they shape device management. You’ll encounter questions on profile types, deployment methods, applicability rules, and resolving conflicts—mirroring the real decisions IT admins face every day. Designed for learners, professionals, or anyone curious about endpoint management, each multiple‑choice scenario sharpens your practical skills. Think carefully, apply your knowledge, and see how confidently you can navigate Intune’s configuration landscape. Ready for round two? Let’s get started Programming MCQ Quiz Question 1 of 20 Loading question… Next QuestionThanks for trying Techuisitive Learn Quiz! Your Score: 0/20 Retry Quiz ## Device Management Quizzes - [Mastering Intune Configuration Profiles: Admin Essentials Quiz 01](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz/) - [Mastering Intune Configuration Profiles: Admin Essentials Quiz 02](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz-02/) - [Microsoft Intune – Security and Update Enforcement – Quiz 1](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-1/) - [Microsoft Intune – Security and Update Enforcement – Quiz 2](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-2/) - [Microsoft Intune – Windows Update Quiz 1](https://techuisitive.com/microsoft-intune-software-update-quiz-1/) - [Modern Desktop Management: MD-101 Quiz – Set 01](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) - [Modern Device Management: MD-101 Quiz – Set 02](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) - [Configuration Manager | SCCM Quiz – Set 01](https://techuisitive.com/configuration-manager-sccm-quiz-01/) - [Configuration Manager | SCCM Quiz – Set 02](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) ## Frequently Asked Questions – Intune Configuration Profiles Quiz **Q1. Who should take this quiz?** This quiz is designed for IT administrators, Intune practitioners, and learners who want to strengthen their knowledge of configuration profiles. **Q2. What topics are covered?** The quiz focuses on Intune configuration profile essentials, including profile types, deployment scenarios, troubleshooting basics, and best practices for device management. **Q3. How many questions are included?** Each quiz set contains multiple-choice questions with detailed explanations to help you understand the correct answers. **Q4. Can I retake the quiz?** Yes, you can retake the quiz as many times as you like to improve your score and reinforce your learning. **Q5. Is this quiz useful for certification or exam preparation?** Absolutely. While it’s not an official Microsoft exam, the quiz aligns with Intune admin essentials and helps you prepare for certification paths like MD‑102 (Endpoint Administrator). **Q6. Will I get explanations for wrong answers?** Yes, each question includes explanations so you can learn the reasoning behind the correct answer. **Q7. Can I receive my results via email?** Yes, you can enter your email before submission to receive your quiz results directly in your inbox. ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Modern Device Management Quiz, Quiz **Tags:** Intune Quiz, Quiz --- ### [Microsoft Intune – Security and Update Enforcement – Quiz 2](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-2/) **Published:** December 27, 2025 **Author:** Equebal Ahmad **Content:** Microsoft Intune plays a pivotal role in safeguarding corporate devices and ensuring compliance with organizational standards. This section focuses on **security policies and update enforcement**, helping professionals evaluate their knowledge and apply best practices effectively **Techuisitive Quiz** helps professionals evaluate their knowledge of Intune’s security policies, enabling them to apply best practices effectively. Programming MCQ Quiz Question 1 of 20 Loading question… Next QuestionThanks for trying Techuisitive Learn Quiz! Your Score: 0/20 Retry Quiz ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Quiz **Tags:** Intune Quiz, Quiz --- ### [Microsoft Intune Windows Update Quiz – Test Your Admin Skills](https://techuisitive.com/microsoft-intune-windows-update-quiz-2/) **Published:** January 7, 2026 **Author:** Equebal Ahmad **Content:** Managing Windows updates effectively is a critical skill for IT administrators working with Microsoft Intune. This quiz is designed to test your knowledge of Intune’s update management capabilities, including deadline settings, servicing profiles, compliance enforcement, and best practices for deploying updates across diverse devices. Whether you’re preparing for certification, brushing up on Intune fundamentals, or simply challenging yourself, this quiz offers practical scenarios that reflect real-world update management challenges. ### 1. In Microsoft Intune, what does ‘deadline settings’ control? 1. Maximum time for the update installation 2. Time taken to download an update 3. Exact date of update release 4. Speed of deployment Show Answer**✅ Answer:** A) Maximum time for update installation ### 2. How does Microsoft Intune handle update rollbacks? 1. Provides rollback functionality for feature updates 2. Deletes previous update files 3. Forces updates to reinstall 4. Does not support rollback Show Answer**✅ Answer:** B) Provides rollback functionality for feature updates ### 3. What is a benefit of using Microsoft Intune for software updates? 1. Manual installation only 2. Limited security patches 3. Automatic deployment and control 4. No monitoring options Show Answer**✅ Answer:** C) Automatic deployment and control ### 4. Which devices can receive software updates via Microsoft Intune? 1. Windows and macOS 2. iOS and Android 3. All of the above 4. None of the above Show Answer**✅ Answer:** C) All of the above ### 5. What is the purpose of ‘Servicing Profiles’ in Microsoft Intune? 1. Optimize Windows feature updates 2. Remove outdated software 3. Block updates permanently 4. Track user activity Show Answer**✅ Answer:** A) Optimize Windows feature updates ### 6. How does Microsoft Intune ensure compliance with software updates? 1. Enforcing update deadlines 2. Disabling updates for selected devices 3. Allowing unlimited delays 4. Requiring users to manually check Show Answer**✅ Answer:** A) Enforcing update deadlines ### 7. Can Microsoft Intune manage driver updates? 1. Yes 2. No 3. Only for Windows devices 4. Only for mobile devices Show Answer**✅ Answer:** A) Yes ### 8. What is the purpose of ‘quality updates’ in Windows Update via Intune? 1. Reduce update failures 2. Improve security and performance 3. Introduce beta features 4. Block feature updates Show Answer**✅ Answer:** A) Improve security and performance ### 9. How does Intune handle updates for enrolled corporate devices? 1. Requires manual installation 2. Allows updates via USB 3. Automatically pushes updates 4. Prevents all updates Show Answer**✅ Answer:** C) Automatically pushes updates ### 10. What is the recommended best practice for managing updates in Intune? 1. Using update rings for gradual deployment 2. Blocking non-critical updates 3. Allowing users to decide when to install 4. Deleting previous updates Show Answer**✅ Answer:** A) Using update rings for gradual deployment ## Explore More – Intune Quiz Test and strengthen your Microsoft Intune knowledge with quizzes covering device management, application deployment, policies, security, and troubleshooting. - **[Microsoft Intune Quiz](https://techuisitive.com/quiz/)** – Test your knowledge with practical Intune questions and scenarios. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. **Categories:** Microsoft Intune, Modern Device Management Quiz, Quiz **Tags:** Intune Quiz, Quiz --- ### [Powershell Script to Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) **Published:** September 26, 2020 **Author:** Equebal Ahmad **Content:** \# Retrieve Active Directory computer properties such as LastLogonDate. \# The list of machine need to be added in hosts.txt file in script folder \# The result will be saved to Output.csv file in script folder. ``` Import-Module ActiveDirectory $invocation = (Get-Variable MyInvocation).Value $directorypath = Split-Path $invocation.MyCommand.Path $input = $directorypath + "\host.txt" $output = $directorypath + "\output.csv" Get-Content $input | ForEach-Object { Get-ADComputer $_ -Properties * | Select-Object Name,LastLogonDate,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion,WhenCreated,Description }   | Export-Csv $output ``` ## **Related Posts:** - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell **Tags:** Active Directory, Automation Device Management, PowerShell --- ### [Powershell Script to Add Bulk Users / Computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) **Published:** April 30, 2017 **Author:** Equebal Ahmad **Content:** Managing **Active Directory (AD) groups** manually can be tedious and error‑prone, especially when dealing with large numbers of users or computers. With **PowerShell automation**, administrators can quickly bulk‑add accounts to AD groups using a simple script and a CSV file. This guide walks you through the process step‑by‑step, showing how to import users or computers, run the script, handle errors, and verify group membership—all while saving time and ensuring consistency across your environment. ## How to Use Script See the example below. To view full help, type the script name and press **Enter**. When adding users or computers to an **Active Directory group**, you must provide either the **computer NetBIOS name** or the **user’s SAM account name** in a text file that the script can read. **Add computer to AD Group** `.\AddObjectsToADGroup.ps1 -FileName Computers.txt -ADGroupName "TestGroup" -ObjectType Computer` **Add user to AD group** `.\AddObjectsToADGroup.ps1 -FileName Computers.txt -ADGroupName "TestGroup" -ObjectType User` ## PowerShell Script ``` #Version: 1.0 #Author: Equebal Ahmad [CmdletBinding()] Param( [Parameter(Mandatory=$True)] [string]$FileName, [Parameter(Mandatory=$True)] [string]$ADGroupName, [Parameter(Mandatory=$True)] [ValidateSet('Computer','User')] [string]$ObjectType ) #Import modules Import-Module ActiveDirectory #Delcare variables $TargetGroup = Get-ADGroup -Filter {Name -eq $ADGroupName} $TargetGroup $invocation = (Get-Variable MyInvocation).Value $directorypath = Split-Path $invocation.MyCommand.Path $input = $directorypath + "\" + $FileName if($ObjectType -eq "Computer"){ Get-Content $input | ForEach-Object{ $computer = Get-ADComputer $_ Add-ADGroupMember -identity $TargetGroup -Members $computer.DistinguishedName}} else{ Get-Content $input | ForEach-Object { $User = Get-ADUser $_ Add-ADGroupMember -Identity $TargetGroup -Members $User.DistinguishedName}} ``` ## Script Download Download the script from the link below to get started. [AddObjectsToADGroup](http://techuisitive.com/wp-content/uploads/2023/04/AddObjectsToADGroup_PS.zip) ## **Related Posts:** - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell **Tags:** Automation Device Management --- ### [PowerShell Script: Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) **Published:** September 26, 2020 **Author:** Equebal Ahmad **Content:** This PowerShell script copies all members from a source Active Directory group to a target Active Directory group. Before running the script, update the **source** and **target** group names to match your Active Directory environment. ``` Import-Module ActiveDirectory $gsource =Get-ADGroup "Test Group1" $gtarget = Get-ADGroup "Test Group2" Get-ADGroupMember -Identity $gsource | foreach {Add-ADGroupMember -Identity $gtarget -Members $($_.DistinguishedName)} ``` ## Related Posts - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell **Tags:** Automation Device Management --- ### [PowerShell Script: Validate if a computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) **Published:** September 1, 2020 **Author:** Equebal Ahmad **Content:** The script below will let you quickly validate whether given computers exist in Active Directory. Please keep both script and Computer.txt in the same location. Add the computer NetBIOS name in the text file, separated by a new line. The result will be saved in the Output.csv file in the script folder. ``` $File = "$PSScriptRoot\Computers.txt"  $LogFile = "$PSScriptRoot\Output.csv"  # Function to WriteLog File  Function WriteLog($Msg)  {      $Text = $Msg      Add-Content -Path $LogFile  $text       Write-Host $Text  }  $ComputerList = Get-Content -Path $File  $TotalRecord = ($ComputerList).Count  foreach ($computer in $ComputerList){      $error.clear()      try{$ADComputer = Get-ADComputer $computer -Properties *}      catch{ WriteLog "$computer,Does not Exists in AD"}      if (!$error) {  WriteLog "$computer,Computer exists in AD"}  } ``` ## **Related Posts:** - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell **Tags:** Automation Device Management, PowerShell --- ### [PowerShell Script to List AD OU and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) **Published:** September 26, 2020 **Author:** Equebal Ahmad **Content:** This PowerShell script searches Active Directory for all Organizational Units (OUs) whose names contain a specified keyword and lists each matching OU along with the Group Policy Objects (GPOs) linked to it. **Example:** The command below searches for all OUs with names containing **“Test”** and displays the details of every GPO linked to those OUs. **Usage Example:** .\\Get-OUList.ps1 –OUName “Test” ``` #Script [CmdletBinding()] Param( [Parameter(Mandatory=$True)] [string]$OUName   ) $invocation = (Get-Variable MyInvocation).Value $directorypath = Split-Path $invocation.MyCommand.Path $outputfile = $directorypath + "\Result.csv" $OUName = "*" + $OUName + "*" $Results = @() $OUList=Get-ADOrganizationalUnit -Filter * | Where-Object -FilterScript {$PSItem.distinguishedname -like $OUName} foreach($OU in $OUList){ $LinkedGPOs = Get-ADOrganizationalUnit -Identity $OU | select -ExpandProperty LinkedGroupPolicyObjects foreach($LinkedGPO in $LinkedGPOs) {             $GPO = [adsi]"LDAP://$LinkedGPO" | select * $properties = @{         OUName=$OU.DistinguishedName         GPOName=$GPO.displayName.Value         GPOGUID=$GPO.Guid         GPOWhenCreated=$gpo.whenChanged.Value         GPOWhenChanged = $gpo.whenChanged.Value         } $Results += New-Object psobject -Property $properties      } }        $Results | Select-Object OUName,GPOName,GPOGUID,GPOWhenCreated,GPOWhenChanged | Export-Csv -notypeinformation -Path $outputfile ``` ## **Related Posts:** - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell **Tags:** Active Directory, Automation Device Management, PowerShell --- ### [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/) **Published:** January 18, 2026 **Author:** Equebal Ahmad **Content:** If you want a reliable, scalable way to trigger device sync across your Intune fleet, the Microsoft Graph PowerShell SDK is your best route. This post walks you through a practical, step‑by‑step guide with ready‑to‑use PowerShell examples using the SDK—so you can automate sync requests without worrying about raw REST calls. Along the way, you’ll see how to handle duplicate device names, loop through results efficiently, and capture success or failure for each sync operation. ## Prerequisites - **Intune licensing:** Devices must be enrolled in Intune. - **Permissions:** You need the Graph permission **DeviceManagementManagedDevices.PrivilegedOperations.All**. - **Auth model:** Either delegated (sign in as an admin) or application (app registration + client secret/cert). - **PowerShell environment:** PowerShell 7+ recommended for better performance; 5.1 also works. --- ## Method: PowerShell Microsoft Graph SDK #### 1. Install and sign in - **Install SDK:**` Install-Module Microsoft.Graph -Scope CurrentUser` - **Connect with delegated permissions:**` Connect-MgGraph -Scopes "DeviceManagementManagedDevices.PrivilegedOperations.All"` You will see a permission request prompt asking for consent on behalf of your organization. If you don’t have the required rights, contact a Global Administrator (or equivalent role) to grant admin consent for the **`DeviceManagementManagedDevices.PrivilegedOperations.All`** permission in the Microsoft Entra ID Graph Enterprise Application. ![Graph API Consent](https://techuisitive.com/wp-content/uploads/2026/01/image.png)#### 2. PowerShell Script to Trigger sync for each device Use the script below to initiate bulk device sync. You need to enter the device name in the ‘Devices.csv’ file. The column header should be ‘DeviceName’. ``` # Get the script directory $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path # Build the full path to Devices.csv $csvPath = Join-Path $scriptDir "Devices.csv" # Import the CSV into $devices (CSV has only DeviceName column) $devices = Import-Csv -Path $csvPath # Connect to Microsoft Graph with delegated permissions Connect-MgGraph -Scopes "DeviceManagementManagedDevices.PrivilegedOperations.All" # Initialize results array $results = @() # Loop through each device name in CSV foreach ($d in $devices) { $deviceName = $d.DeviceName try { # Query Graph for all devices with this name (beta endpoint) $uri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$filter=deviceName eq '$deviceName'" $matchedDevices = Invoke-MgGraphRequest -Method GET -Uri $uri -ErrorAction Stop if ($matchedDevices.value.Count -eq 0) { Write-Host "No devices found with name: $deviceName" -ForegroundColor Red continue } foreach ($md in $matchedDevices.value) { $syncUri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$($md.id)/syncDevice" Write-Host "Requesting sync for device: $($md.deviceName) (Id: $($md.id))" -ForegroundColor Cyan try { # POST request to Graph to trigger sync Invoke-MgGraphRequest -Method POST -Uri $syncUri -ErrorAction Stop # Build success object $results += [pscustomobject]@{ DeviceName = $md.deviceName Id = $md.id OperatingSystem = $md.operatingSystem Status = "Requested" RequestedDateTime = (Get-Date) LastSyncDateTime = $md.lastSyncDateTime } } catch { # Build failure object $results += [pscustomobject]@{ DeviceName = $md.deviceName Id = $md.id Status = "Failed" Error = $_.Exception.Message } } } } catch { Write-Host "Graph query failed for device name: $deviceName" -ForegroundColor Red $results += [pscustomobject]@{ DeviceName = $deviceName Id = $null Status = "Failed" Error = $_.Exception.Message } } } # Output results in table format $results | Format-Table -AutoSize ``` ## 3. Results Once the script completes, you’ll see a clear table output showing each device name, its ID, operating system, and the sync status. Successful requests are marked as *Requested* along with the timestamp, while any failures are flagged with the error message for quick troubleshooting. This makes it easy to confirm which devices were synced and identify any that need further attention. ![How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/wp-content/uploads/2026/01/image-1-1024x315.png)## 4. Download Bulk Device Sync Script > [Intune Bulk Device Sync Script Download](https://techuisitive.com/downloads/intune-bulk-device-sync-script/) ## Practical tips - **Graph profile:** If your tenant exposes the endpoint on v1.0, use it; otherwise, use `beta` with caution. - **Least privilege:** Grant only the needed permission and consent appropriately. - **Device readiness:** Offline devices will queue the sync and execute on the next check-in. - **Error visibility:** Review [`IntuneManagementExtension.log`](https://IntuneManagementExtension.log) on clients if you suspect issues with policy/app processing after sync. --- ## Related Posts - [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) - [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/ "How to Bulk Sync Intune Devices with Microsoft Graph") - [Get AAD Group Members Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [Install PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Automation Graph API, Graph API, Intune Automation, PowerShell --- ### [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) **Published:** January 24, 2026 **Author:** Equebal Ahmad **Content:** Exporting Azure AD group members at scale is a common need for IT administrators, whether for auditing, reporting, or compliance. This PowerShell script uses the Microsoft Graph API to automate bulk group membership exports. By reading group names from a CSV file and generating individual CSV reports for each group, the script simplifies Azure Active Directory management and ensures accurate, repeatable results. With built‑in support for overwriting existing files, it’s ideal for scenarios like Azure AD reporting, bulk group membership export, and Microsoft Graph automation. ## Prerequisites Before running the script, ensure the following: - **PowerShell 5.1 or later** (or PowerShell Core). - **Microsoft Graph PowerShell SDK** installed: - **Permissions**: You must have delegated or application permissions for: - `Group.Read.All` - `User.Read.All` - **Input CSV file** with a header `GroupName` and group display names listed. - **Connectivity**: Ability to authenticate to Microsoft Graph (interactive login or service principal). ## Use Cases This PowerShell script for **Azure AD group export** using the **Microsoft Graph API** is versatile and can support multiple IT and business needs: - A**uditing & Compliance**: Generate CSV reports of Azure AD group members to meet security and compliance requirements. - **IT Administration**: Quickly verify group membership details without navigating the Azure portal, saving time for admins. - **Reporting & Analytics**: Provide HR, management, or security teams with bulk group membership exports for analysis. - **Migration Projects**: Capture Azure Active Directory group members before restructuring or migrating workloads to ensure accuracy. - **Automation & Scheduling**: Integrate into scheduled tasks to produce regular Azure AD reporting snapshots for ongoing monitoring. - **Troubleshooting Access Issues**: Identify which users belong to specific groups to resolve Azure AD access problems faster. ## PowerShell Script to Bulk Export Entra ID Group Members ``` .\Export-AADGroupMembers.ps1 Exports members of all groups listed in Groups.csv to individual CSV files. .NOTES Requires Microsoft.Graph PowerShell SDK. Install with: Install-Module Microsoft.Graph -Scope CurrentUser Permissions required: Group.Read.All, User.Read.All #> # Requires Microsoft.Graph PowerShell SDK # Install if not already: Install-Module Microsoft.Graph -Scope CurrentUser # Connect to Graph (interactive login) Connect-MgGraph -Scopes "Group.Read.All","User.Read.All" # Get the script directory $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path # Input CSV file containing group names (one per line, header: GroupName) $InputFile = Join-Path $scriptDir "Groups.csv" # Read group names $Groups = Import-Csv -Path $InputFile foreach ($Group in $Groups) { $GroupName = $Group.GroupName Write-Host "Processing group: $GroupName" -ForegroundColor Cyan # Get group object by display name $GroupObj = Get-MgGroup -Filter "displayName eq '$GroupName'" if ($GroupObj) { # Get members of the group $Members = Get-MgGroupMember -GroupId $GroupObj.Id -All # Prepare export data $ExportData = $Members | Select-Object ` @{Name="DisplayName";Expression={$_.AdditionalProperties.displayName}}, @{Name="UserPrincipalName";Expression={$_.AdditionalProperties.userPrincipalName}}, @{Name="Id";Expression={$_.Id}}, @{Name="ObjectType";Expression={$_.ODataType}} # Output CSV file named after group $OutFile = Join-Path $scriptDir "${GroupName}.csv" if (Test-Path $OutFile) { Remove-Item $OutFile -Force} $ExportData | Export-Csv -Path $OutFile -NoTypeInformation -Encoding UTF8 Write-Host "Exported $($ExportData.Count) members to $OutFile" } else { Write-Warning "Group '$GroupName' not found." } } ``` ## **Output & Reports** After execution, the script generates a separate **CSV file for each Azure AD group** listed in the input file. Each output file is named after the group (e.g., *HR Team.csv*) and contains member details such as **DisplayName, UserPrincipalName, Id, and ObjectType**. Existing files are overwritten to ensure the export always reflects the latest membership data. This provides administrators with clear, ready‑to‑use reports for auditing, compliance, or troubleshooting. ![](https://techuisitive.com/wp-content/uploads/2026/01/image-2-1024x207.png)## Download Bulk Group Export Script > [Bulk Export Entra ID Group Members Script Download](https://techuisitive.com/downloads/bulk-export-entra-id-group-members-script-download/) ## Related Posts - [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) - [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/ "How to Bulk Sync Intune Devices with Microsoft Graph") - [Get AAD Group Members Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [Install PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Automation Graph API, Graph API, Intune Automation, PowerShell --- ### [SQL Query to Get Maintenance Window for member of specific collection | SCCM | ConfigMgr](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) **Published:** April 30, 2017 **Author:** Equebal Ahmad **Content:** In Configuration Manager, a Maintenance Window allows client configuration changes at a specific time defined in the Maintenance Window. You can use Maintenance Window to define when Configuration Manager can deploy software updates, applications, or other configuration change tasks. The below SQL query will provide the details of the Maintenance Window with the collection name for all members in the given collection. The SQL query can be executed from SQL Server Management Studio. Remember to replace **YourCollectionID** in bold with the actual Collection ID. ``` select fcm.Name as 'Server Name',sw.CollectionID,col.Name as 'Collection Name',sw.Name as 'MW Name',sw.Description,sw.StartTime,sw.Duration,sw.IsEnabled from v_ServiceWindow SWinner join v_FullCollectionMembership fcm on fcm.CollectionID = sw.Collection inner join v_Collection col on col.CollectionID = sw.CollectionIDwhere fcm.name in (select name from v_FullCollectionMembership where collectionID = 'YourCollectionID') ``` ## **Related Posts:** - [SCCM SQL Query to list Desktop & Laptop Devices](https://techuisitive.com/sccm-sql-query-to-list-desktop-laptop-devices/ "SCCM SQL Query to list Desktop & Laptop Devices") - [SCCM SQL Query for Windows 10 / 11 Version Summary](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) - [SQL Query to Get Maintenance Window for member of specific collection | SCCM](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [Understanding SCCM SQL Views](https://techuisitive.com/understanding-sccm-sql-views/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM SQL Queries --- ### [SCCM SQL Query to Summarize Windows 10/11 Versions and Device Counts](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) **Published:** May 12, 2023 **Author:** Equebal Ahmad **Content:** The below SCCM SQL query will summarize the list of Windows 10 / 11 versions along with the total device count. This will help in understanding the demographics of each Windows build version in your environment, and you can plan a Windows upgrade accordingly. This SQL query can be used to create a report as well. To run this SQL query, you need to launch Microsoft SQL Server Management Studio and connect to the SCCM Site database. ## SCCM SQL Query to Summarize Windows Version `select v_R_System.Operating_System_Name_and0 as 'Operating System',v_GS_OPERATING_SYSTEM.BuildNumber0 as 'Build Number',casewhen v_GS_OPERATING_SYSTEM.BuildNumber0 = '22621' then 'Windows 11 22H2'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '22000' then 'Windows 11 21H2'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '19045' then 'Windows 10 22H2'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '19044' then 'Windows 10 21H2'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '19043' then 'Windows 10 21H1'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '19042' then 'Windows 10 20H2'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '19041' then 'Windows 10 2004'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '18363' then 'Windows 10 1909'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '18362' then 'Windows 10 1903'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '17763' then 'Windows 10 1809'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '17134' then 'Windows 10 1803'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '16299' then 'Windows 10 1709'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '15063' then 'Windows 10 1703'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '14393' then 'Windows 10 1607'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '10586' then 'Windows 10 1511'when v_GS_OPERATING_SYSTEM.BuildNumber0 = '10240' then 'Windows 10 1507'End as 'Windows 10 Version', Count(*) as 'Total Devices'from v_r_systeminner join v_gs_operating_systemon v_R_System.ResourceID=v_GS_OPERATING_SYSTEM.ResourceIDwhere v_R_System.Operating_System_Name_and0 like '%Microsoft Windows NT Workstation 10.0%'Group by v_R_System.Operating_System_Name_and0,v_GS_OPERATING_SYSTEM.BuildNumber0Order by [Build Number] Desc` ## Sample Query Output ![SCCM SQL Querry Windows version build number summary](https://techuisitive.com/wp-content/uploads/2023/05/image-3.png)## **Related Posts:** - [SCCM SQL Query to list Desktop & Laptop Devices](https://techuisitive.com/sccm-sql-query-to-list-desktop-laptop-devices/ "SCCM SQL Query to list Desktop & Laptop Devices") - [SCCM SQL Query for Windows 10 / 11 Version Summary](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) - [SQL Query to Get Maintenance Window for member of specific collection | SCCM](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [Understanding SCCM SQL Views](https://techuisitive.com/understanding-sccm-sql-views/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM SQL Queries, SQL Query --- ### [SCCM SQL Query to list Desktop & Laptop Devices](https://techuisitive.com/sccm-sql-query-to-list-desktop-laptop-devices/) **Published:** July 4, 2023 **Author:** Equebal Ahmad **Content:** As an SCCM administrator, you often need custom reports that go beyond the built‑in options. One common requirement is distinguishing between desktops, laptops, mini PCs, and Surface devices in your environment. With the right SQL query, you can pull this information directly from the Configuration Manager database and even use it to build SSRS reports. In this guide, we’ll share a ready‑to‑use SQL query that helps you quickly identify device types and client status, making hardware inventory and reporting more efficient Use the SQL query below to retrieve details of all devices, including their type (Laptop, Desktop, Mini PC, and Surface), directly from the Configuration Manager database. This query can also be leveraged to build a custom SCCM SSRS report. To run this SQL query, launch [SQL Server Management Studio](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/), open a new query, copy and paste the query below, and click on Run. ``` select r.ResourceID,r.Netbios_Name0 ,bios.SerialNumber0,comp.Model0,comp.Manufacturer0,enc.ChassisTypes0, case when ch.ClientActiveStatus= '1' then 'Active' when ch.ClientActiveStatus='0' then 'Inactive' END as 'ClientStatus', case when enc.ChassisTypes0 in ( '8','10', '11', '12', '14', '18', '21' ) then 'Laptop' when enc.ChassisTypes0 in( '3', '4', '5', '6', '7', '15', '16' ) then 'Desktop' when enc.ChassisTypes0 in( '35' ) then 'Mini PC' when (enc.ChassisTypes0=9 and comp.Model0 like 'Surface%') then 'Microsoft Surface' end as 'Type' from v_R_System r left join v_GS_PC_BIOS bios on bios. ResourceID=r.ResourceID left join v_CH_ClientSummary ch on ch.ResourceID=r.ResourceID left join v_GS_SYSTEM_ENCLOSURE enc on enc.ResourceID=r.ResourceID left join v_GS_COMPUTER_SYSTEM comp on comp.ResourceID=r.ResourceID where r.Operating_System_Name_and0 like 'Microsoft Windows NT Workstation%' ``` ## Related Posts - [SCCM SQL Query to list Desktop & Laptop Devices](https://techuisitive.com/sccm-sql-query-to-list-desktop-laptop-devices/ "SCCM SQL Query to list Desktop & Laptop Devices") - [SCCM SQL Query for Windows 10 / 11 Version Summary](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) - [SQL Query to Get Maintenance Window for member of specific collection | SCCM](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [Understanding SCCM SQL Views](https://techuisitive.com/understanding-sccm-sql-views/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM SQL Queries --- ### [How to Run script in SCCM without creating a package / application](https://techuisitive.com/how-to-run-a-script-without-creating-a-package-application-in-sccm-configmgr/) **Published:** August 14, 2023 **Author:** Equebal Ahmad **Excerpt:** Configuration Manager has an integrated ability to run PowerShell scripts. This can be used to build custom tools to perform quick actions on client machines. With this integration in Configuration Manager, you can use the Run Scripts functionality to run script in SCCM without creating a package. **Content:** Configuration Manager has an integrated ability to run PowerShell scripts. This can be used to build custom tools to perform quick actions on client machines. With this integration in Configuration Manager, you can use the *Run Scripts* functionality to run script in SCCM without creating a package. You can perform following tasks using Run script option. - Create and edit scripts for use with Configuration Manager. - Manage script usage through roles and security scopes. - Run scripts on collections or individual on-premises managed Windows PCs. - Get rapid aggregated script results from client devices. - Monitor script execution and view reporting results from script output. ## Run Script Authors and Approvers Run Scripts uses the concept of **script authors** and **script approvers** as separate roles for implementation and execution of a script. This is the default option and add an additional layer of security as all scripts must go through review and approval process. If you want to allow script authors to approve their own script then you need to uncheck **Script authors required additional script approver** option available in site hierarchy settings. It’s better to leave this option enabled if you have multiple SCCM Administrator’s in your environment. ![SCCM | Hierarchy Settings | General tab](https://techuisitive.com/wp-content/uploads/2023/08/image.png) ## Create a Script Follow the below steps to create / add a script in SCCM console. In the Configuration Manager console, navigate to **Software Library / Scripts** workspace, right click on the **Scripts** and select **Create Script**. ![SCCM | Create Script](https://techuisitive.com/wp-content/uploads/2023/08/image-1.png)In the **Script Details** page, Enter the **script name** and copy & paste PowerShell scripts in code editor. As of now only PowerShell script language is supported. You can also import the script by clicking on **Import** button. If your script includes parameters then next screen will allow you to modify script parameters. ![SCCM | Create Script](https://techuisitive.com/wp-content/uploads/2023/08/image-11.png)In the Script Parameters page, click on Edit to add the values for a parameter. ![SCCM | Create Script Parameters](https://techuisitive.com/wp-content/uploads/2023/08/image-12.png)You can provide following details in Script Parameters Properties: - **Required:** True / False (Mandatory or Optional) - **Hidden** : True / False - **Data Type**: String, Integer, List, Boolean. You can use wildcard to limit the argument which can be passed to the script when using String Data type. It’s not recommended to leave it open to accept any values as argument. Whenever possible use the List Data type to ensure only listed values can be selected. ![Script parameters properties](https://techuisitive.com/wp-content/uploads/2023/08/image-13.png)Click on **Ok** to go back to previous screen. Click on **Next** to go to **Summary** page. Review the details and click on **Next** to complete script creation process. ![Script summary](https://techuisitive.com/wp-content/uploads/2023/08/image-14.png) ## Approve a Script Once script is created, you can find the same under Scripts node. By default the script will be in **Waiting for approval** state. The script must be approved to available for execution. If **Script authors required additional script approver** option is enabled then **Approve/Deny** button will be grayed out for script author. Other SCCM admins need to approve the script. Click on **Approve/Deny** button to start script approval process. ![SCCM | Approve script](https://techuisitive.com/wp-content/uploads/2023/08/image-3-1024x409.png)In the S**cript Details** page, review the script and click on **Next** to go to **Script Parameters** page. ![Approve script](https://techuisitive.com/wp-content/uploads/2023/08/image-15.png)Verify the script parameters / values and click on **Next**. ![Approve script](https://techuisitive.com/wp-content/uploads/2023/08/image-16.png)In the **Script Approval** page, select **Approve** and click on **Next** to go through Summary, Progress and Completion pages. ![SCCM | Approve script](https://techuisitive.com/wp-content/uploads/2023/08/image-17.png) ## Run Script in SCCM To run script in SCCM , Right click on a **device** or **collection** and select **Run Script**. ![SCCM | Run script in SCCM](https://techuisitive.com/wp-content/uploads/2023/08/image-6-1024x336.png)In the **Run Script** page, select the script which you want to run and click on **Next**. ![SCCM | Run script](https://techuisitive.com/wp-content/uploads/2023/08/image-18.png)If your script required parameters then you need to provide the same in next screen. Select / enter the parameters value as necessary and click on Next. As you can see, we have used List data type for SCCM client action and String data type for Temp file cleanup. Hence, we are getting an option to select the value from list for first parameters while second parameter value in open ended where anything can be entered as value. ![SCCM | Run script](https://techuisitive.com/wp-content/uploads/2023/08/image-19.png)In the **Summary** page, review the details and click on **Next** to run the script. ![SCCM | Run script](https://techuisitive.com/wp-content/uploads/2023/08/image-20.png)**Script Status Monitoring** page will show Script execution status. ![SCCM | Run Script | Script Status Monitoring](https://techuisitive.com/wp-content/uploads/2023/08/image-9.png) ## Monitoring the Script Execution You can monitor the script status from **Monitoring > Script** Status pane. ![](https://techuisitive.com/wp-content/uploads/2023/08/image-10-1024x222.png)On the client machine, the script execution details are recorded in Scripts.log file. You can refer this log file in case any troubleshooting is required. ![](https://techuisitive.com/wp-content/uploads/2023/08/image-21-1024x476.png)## Related Posts - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Software Deployment](https://techuisitive.com/tag/sccm-software-deployment/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Software Deployment --- ### [How to Configure and Approve User Application Requests in SCCM](https://techuisitive.com/how-to-configure-and-approve-user-application-requests-in-sccm/) **Published:** August 26, 2023 **Author:** Equebal Ahmad **Excerpt:** SCCM allows application deployment in way that it goes through approval process. Users requests the application in Software Center, and then an administrator review and approve user application requests. The feature is named Approve application requests for user per device and it's not enabled by default in Configuration Manager. **Content:** SCCM allows application deployment in way that it goes through approval process. Users requests the application in Software Center, and then an administrator review and approve user application requests. The feature is named **Approve application requests for user per device** and it’s not enabled by default in Configuration Manager. We will explore this feature and steps required to deploy application which goes through approval process. Table Of Contents 1. [Enable Optional Features](#enable-optional-features) 2. [Configure Email Notifications for Alerts in SCCM](#configure-email-notifications-for-alerts-in-sccm) 3. [Create Custom RBAC Role](#create-custom-rbac-role) 4. [Setup Application Deployment](#setup-application-deployment) 5. [Request an Application from Software Center (End User)](#request-an-application-from-software-center-end-user) 6. [Approve User Application Requests from SCCM Console](#approve-user-application-requests-from-sccm-console) 7. [Approve User Application Request from Email Notification](#approve-user-application-request-from-email-notification) 8. [Explore More SCCM Guides](#explore-more-sccm-guides) ## Enable Optional Features The feature to approve user application requests is not enabled by default in ConfigMgr. You need to enable the feature if you want to use the same. Follow the below process to enable the option. - In the ConfigMgr console, navigates to **Administration / Updates and Servicing / Features** - Right click on **Approve application requests for user per device** and select **Turn On** ![SCCM | Approve application requests for users per device](https://techuisitive.com/wp-content/uploads/2023/08/image-24-1024x270.png)## Configure Email Notifications for Alerts in SCCM SCCM has an ability to sent an email for triggered alerts. The email notification can also configured for subscribing SCCM reports periodically. An admin needs to approve the application requested by the user. A SCCM administrator can approve the application request from ConfigMgr console. However this method may not be convenient if you want to delegate the approval of an application to application owner or someone from business / Helpdesk rather than SCCM team own the approval task. We have an option to configure the email notification for each application. Once user request an application, email will be sent to respective email address to approve or deny the request. The email recipient can approve or deny the application by clicking on Approve / Deny button in the email. The person must have necessary access in SCCM to approve / deny application requests. Please refer to custom RBAC role section of this article. To receive an email from SCCM you must configured email notifications. If you are using report subscriptions then this must be in place already. Follow the below steps if this is not configured. - In the SCCM console, navigates to **Monitoring / Alerts / Subscription** - Click on **Configure Email Notification** in ribbon ![SCCM | Configure Email Notification](https://techuisitive.com/wp-content/uploads/2023/08/image-22.png)- Configure the following options the Email Notification Components Properties window. You can get in touch with your Exchange / Mail server team to get necessary details. - **Enable email notification for alerts :** Provide outgoing SMTP server details to send email - **Sender address for email alerts:** Provider sender email address for email alerts ![SCCM | Configure Alert Notification](https://techuisitive.com/wp-content/uploads/2023/08/image-23.png)## Create Custom RBAC Role In Configuration Manager, role-based administration combines security roles, security scopes, and assigned collections to define the administrative scope for each administrative user. An administrative scope includes the objects that an administrative user can view in the Configuration Manager console and the tasks related to those objects that they have permission to do. This step is required if you want to delegate the application approval tasks to Application Owner or someone else who is not a Configuration Manager administrator. You can assign this role to an Active Directory Group for better management. - To create a custom RBAC role for application approval: - navigates to **Administration / Security / Security Roles** - Right click on **Read only Analyst** role and select **Copy** ![SCCM | Custom RBAC Role](https://techuisitive.com/wp-content/uploads/2023/08/image-37-1024x348.png)- Provide a name for new security role, Expand **Application** in **Permissions** list and select **Approve**. - Click on **Ok** to close the Window. ![Security Role](https://techuisitive.com/wp-content/uploads/2023/08/image-38.png)The new security role is now created. Now, we need to assign the administrative user’s / groups to newly created security role. Navigates to Administrative Users node, right click on the desired user / group and select properties. ![SCCM | Administrative Roles](https://techuisitive.com/wp-content/uploads/2023/08/image-40.png)In the **Security Roles** tab, click on **Add**, Select newly created security role and click on **Ok** to assign the role to administrative user. ![SCCM Security Roles](https://techuisitive.com/wp-content/uploads/2023/08/image-39.png)## Setup Application Deployment The next step is to setup an application deployment. We will setup a deployment as ‘Available’ to user’s collection. The user’s can see the application in Software Center and request application installation from there. If the administrator approves the request, the user is only able to install the application on that device. The user must submit another request to install the application on another device. Let’s understand how we can setup a deployment and configure approval requirements. We will not discuss the steps to create an application. We assume that you are well familiar with SCCM application creation and deployment process. ### Create User Collection Since the application need to be deployed on User collection, let’s create user collection first. - In the Configuration Manager console, navigates for Assets and Compliance / User Collection - Right Click on User Collections and select Create User Collection ![SCCM User Collection](https://techuisitive.com/wp-content/uploads/2023/08/image-41.png)- In the Create User Collection Wizard, General page, enter **Collection Name**, **Limiting collection** and click on **Next**. ![SCCM User Collection](https://techuisitive.com/wp-content/uploads/2023/08/image-25.png)- Click on **Add Rule** and select **Direct Rule**. We will add a test user directly in this collection. You can also user Query Rule, Device Category Rule, Include and Exclude collection Rule to populate collection membership dynamically. ![SCCM User Collection Wizard](https://techuisitive.com/wp-content/uploads/2023/08/image-26.png)- In the Search for Resources page, enter the user name which you want to search and click on Next. ![SCCM User Collection](https://techuisitive.com/wp-content/uploads/2023/08/image-27.png)- In the Select Resource page, select the user’s which you want to add to collection and click on Next. - Click on Next few more times to go through Summary, progress and Completion page. ![SCCM User Collection Wizard](https://techuisitive.com/wp-content/uploads/2023/08/image-28.png)You can now see that collection created and membership populated. ![](https://techuisitive.com/wp-content/uploads/2023/08/image-29-1024x77.png)### Deploy Application to User Collection Now we need to deploy the application to user collection. We will deploy 7 Zip application to the user collection we created in previous steps. - Right click on the Application which you want to deploy and select **Deploy** from context menu. - In the Deploy Software Wizard General page, select the Software and Collection. Click on Next. ![SCCM Deploy Software Wizard](https://techuisitive.com/wp-content/uploads/2023/08/image-30.png)- In the Deployment Settings, make sure following settings are configured: - **Action :** Install - **Purpose :** Available - Select **An administrator must approve a request for this application on the device** - Enter **Approver email address** - Click on **Next** and configure **Scheduling**, **User Experience** options as per your requirements. - Click on **Next** few more times to go through Summary, Progress and Completion page to complete deployment setup process. Please note that you must select **An administrator must approve a request for this application on the device** check box. Otherwise the approval process will not enforced for the deployment. ![SCCM Software Deployment Settings](https://techuisitive.com/wp-content/uploads/2023/08/image-31.png)The deployment setup is now completed and application will be visible to user’s in Software Center. ## Request an Application from Software Center (End User) User can now see the application in Software Center. Once user click on the application, they see will below screen. User can click on **Request** button to submit application installation request. ![SCCM Approve User application request software center 7 zip](https://techuisitive.com/wp-content/uploads/2023/08/image-32.png)If user submitted the request in error, they will also have an option to cancel the request. ![SCCM Approve User application request software center 7 zip](https://techuisitive.com/wp-content/uploads/2023/08/image-33.png)## Approve User Application Requests from SCCM Console The Configuration Manager administrators can see the application requests in SCCM console. To view all requests, you need to navigates to **Software Library / Application Management / Application Requests** To approve or deny an application request, simply select the application and click on Approve / Deny button from ribbon. ![Approve User Application Requests from SCCM Console](https://techuisitive.com/wp-content/uploads/2023/08/image-34-1024x389.png)## Approve User Application Request from Email Notification If you have configured the SCCM environment for email notification alerts and provided an approver’s email address while creating the deployment, then approver’s will receive below email notification to approve or deny the request. The below link will work from internal network only and SCCM server should be accessible from approver’s machine. If you have Cloud Management Gateway (CMG) configured in your SCCM environment, then you can also configure approval from Internet. Check out [this Microsoft article](https://learn.microsoft.com/en-us/mem/configmgr/apps/deploy-use/app-approval#to-take-action-from-internet) for more details. ![Approve User Application Request from Email Notification](https://techuisitive.com/wp-content/uploads/2023/08/image-35-1024x404.png)Once approver click on the Approve / Deny link, he / she can see a confirmation message whether approval or rejection was succeeded. ![Approve User Application Request from Email Notification](https://techuisitive.com/wp-content/uploads/2023/08/image-36.png)### Related Posts - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Applications](https://techuisitive.com/tag/sccm-applications/), [SCCM Software Deployment](https://techuisitive.com/tag/sccm-software-deployment/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Applications, SCCM Software Deployment --- ### [Location of smsts.log file during SCCM OSD](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) **Published:** February 6, 2018 **Author:** Equebal Ahmad **Content:** The smsts.log is the primary source for troubleshooting SCCM task sequence failures. The smsts.log records all the activities during SCCM operating system deployment (OSD), and it should be the first log you should review for SCCM OSD troubleshooting. The location of smsts.log keeps changing depending on the deployment phase and OS architecture, and administrators often struggle to find it quickly. This guide provides a complete list of smsts.log locations across different stages of OSD, helping you streamline diagnostics and resolve SCCM OSD issues faster. ## Location of smsts Log PhaseLog LocationWindowsPE, before HDD formatx:\\windows\\temp\\smstslog\\smsts.logWindowsPE, after HDD formatx:\\smstslog\\smsts.logWindows, SCCM agent not installedc:\\\_SMSTaskSequence\\Logs\\Smstslog\\smsts.logWindows, SCCM agent installedc:\\windows\\system32\\ccm\\logs\\Smstslog\\smsts.logWindows x64, SCCM agent installedc:\\windows\\sysWOW64\\ccm\\logs\\Smstslog\\smsts.logTask Sequence completedc:\\windows\\system32\\ccm\\logs\\smsts.logTask Sequence completed x64c:\\windows\\sysWOW64\\ccm\\logs\\smsts.log## CMTrace Log Viewer You can view **smsts.log** using **CMTrace**, which is Microsoft’s preferred log viewer for SCCM/ConfigMgr. CMTrace formats logs in real time, highlights errors and warnings, and makes troubleshooting much easier compared to Notepad. ### **Where to find CMTrace**: - It’s included in the **SCCM installation media** under: `SMSSETUP\TOOLS\CMTrace.exe` - On newer SCCM versions, CMTrace is automatically copied to the client during OSD and can be found in: `C:\Windows\CCM\CMTrace.exe` 👉 In practice, once you locate the **smsts.log** file (depending on the OSD phase), open it with CMTrace to quickly identify task sequence failures. ![](https://techuisitive.com/wp-content/uploads/2018/02/image.png)**Sample smsts.log**## Related Posts - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [PXE-E99: Unexpected network error – SCCM OSD]() - [Location of smsts.log file during SCCM OSD](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [Configuration Manager OSD task sequence fails with error code 0x80004005](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management --- ### [SCCM Dynamic Collection for Windows 10 / 11 Devices | ConfigMgr](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) **Published:** October 6, 2022 **Author:** Equebal Ahmad **Content:** In ConfigMgr , a dynamic collection membership is based on query rules. A dynamic or query based collection can have multiple query rules and collection membership updates at each collection evaluation cycle. In this blog post, we will discuss about collection queries for Windows 10 and later devices. Table Of Contents 1. [What are Collection Queries](#what-are-collection-queries) 2. [Create SCCM Collection for all Windows 11 22H2 devices](#create-sccm-collection-for-all-windows-11-22h2-devices) 3. [Create SCCM Collection for all Windows 10 21H2 devices](#create-sccm-collection-for-all-windows-10-21h2-devices) 4. [Create SCCM Collection for all Windows 10 Devices which OS Version is 20H2 or Earlier](#create-sccm-collection-for-all-windows-10-devices-which-os-version-is-20h2-or-earlier) 5. [Windows 10 / 11 Build Versions](#windows-10-11-build-versions) 6. [Related Posts:](#related-posts) 7. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **What are Collection Queries** The collection queries are WQL Query (WMI Query Language Query) which request the information from SMS Provider. The information are pulled from ConfigMgr site database by SMS provider and return the result to WQL client. WQL queries are used in query based collection to populate the collection membership dynamically. You can find few examples and sample query based on Windows OS build versions below. ## **Create SCCM Collection for all Windows 11 22H2 devices** The below WQL query can be used to create a collection for all Windows 11 version 22H2 computers. ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.Version = "​10.0.22621" ``` ## **Create SCCM Collection for all Windows 10 21H2 devices** The below WQL query can be used to create a collection for all Windows 10 version 21H2 devices. ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.Version = "10.0.19044" ``` ## **Create SCCM Collection for all Windows 10 Devices which OS Version is 20H2 or Earlier** ``` select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.Version **Categories:** Microsoft Intune **Tags:** SCCM Collections & Device Management --- ### [How to Create SCCM Dynamic Collection Based on Device Type](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) **Published:** October 9, 2022 **Author:** Equebal Ahmad **Excerpt:** Want to simplify device targeting in SCCM? This guide shows how to create dynamic collections based on device type—virtual machines, laptops, and desktops—using tested WQL queries. Whether you're managing hybrid environments or refining deployment scopes, these queries help automate collection membership with precision. A dynamic or query based collection reduce the efforts required to manage a deployment as devices are automatically included or excluded in a collection based on query rules. **Content:** Want to simplify device targeting in SCCM? This guide shows how to create dynamic collections based on device type—virtual machines, laptops, and desktops—using tested WQL queries. Whether you’re managing hybrid environments or refining deployment scopes, these queries help automate collection membership with precision. A dynamic or query-based collection reduces the efforts required to manage a deployment as devices are automatically included or excluded in a collection based on query rules. In this blog post, we’ll explore **dynamic collection queries in SCCM** for different device types—**virtual machines, desktops, and laptops**. You’ll find sample WQL queries that have been tested with **System Center Configuration Manager (Current Branch, version 2111)**. These queries can be directly used in your collections to automate membership and achieve precise targeting for deployments. --- **Related post:** If you are looking for a step-by-step process to create a dynamic/query-based collection, then follow this article: [How to Create Dynamic Collection in SC](https://www.techuisitive.com/post/create-dynamic-collections-in-sccm-for-different-attribute-classes)[CM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) **Other posts in this series:** - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Collection Queries for Operating System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Device Collection Based on Computer Hardware Details](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) --- Table Of Contents 1. [SCCM Collection Query for Virtual Machines:](#sccm-collection-query-for-virtual-machines) - [SCCM Collection Query for Virtual Machines (Client & Server OS)](#sccm-collection-query-for-virtual-machines-client-server-os) - - [SCCM Collection Query for Virtual Machines (Client OS)](#sccm-collection-query-for-virtual-machines-client-os) 2. [SCCM Dynamic Collection Query for Laptops & Desktops](#sccm-dynamic-collection-query-for-laptops-desktops) - [Win32\_SystemEnclsoure Class](#win32-systemenclsoure-class) - - [SCCM Collection Query for Laptops](#sccm-collection-query-for-laptops) - - [SCCM Device Collection Query for Desktops](#sccm-device-collection-query-for-desktops) - - [SCCM Device Collection Query for Desktops (Without virtual machines)](#sccm-device-collection-query-for-desktops-without-virtual-machines) 3. [Conclusion](#conclusion) 4. [Related Posts:](#related-posts) 5. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **SCCM Collection Query for Virtual Machines:** ### **SCCM Collection Query for Virtual Machines (Client & Server OS)** The following WMI Query Language ( WQL ) query will include all virtual machines in a collection. ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_COMPUTER_SYSTEM.Model like "%virtual%" ``` ### **SCCM Collection Query for Virtual Machines (Client OS)** If you want to further limit this only for workstations operating system ( e.g Windows 111 / Windows 10 / Windows 7 etc.), then the below query can be used. ``` select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_COMPUTER_SYSTEM.Model like "%virtual%" and SMS_R_System.OperatingSystemNameandVersion like "%Workstation%" ``` ## **SCCM Dynamic Collection Query for Laptops & Desktops** As seen in the earlier example, the **WQL query for selecting virtual machines** is relatively straightforward—you can simply filter by the *Model* property to get the desired results. However, when it comes to **physical devices**, the *Model* field represents the actual hardware model (e.g., *Dell Latitude 5420* or *Lenovo ThinkPad T490*). Because of this variation, a different approach is required to accurately query desktops and laptops. ### **Win32\_SystemEnclsoure Class** The **Win32\_SystemEnclosure WMI class** exposes properties associated with a physical system enclosure. One of the most useful attributes here is the **ChassisType**, which helps differentiate between desktops, laptops, and other physical form factors. You can quickly check this information using PowerShell: ``` Get-WmiObject -Class Win32_SystemEnclosure | Select-Object Caption,ChassisTypes ``` ![Chassis Type | Dynamic Collection](https://techuisitive.com/wp-content/uploads/2023/04/image-65.png)The SystemEnclosure information collected from clients is stored on SMS\_G\_SYSTEM\_SYSTEM.ENCLOSURE class in SCCM. The ChassisTypes field can be used to identify if a device is a desktop, a laptop, or a tablet. Follow this [article ](https://www.techuisitive.com/post/enclosure-chassis-types-value-description-configmgr-sccm)to know more about ChassisTypes and their values. ### **SCCM Collection Query for Laptops** To build a dynamic collection for all laptops, you can filter by **ChassisType** values in the `SMS_G_System_SYSTEM_ENCLOSURE.ChassisTypes` property. These values correspond to physical form factors, allowing SCCM to accurately identify laptops. Below is a complete **WQL query** example that can be used in a collection to automatically include all laptops: ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SYSTEM_ENCLOSURE on SMS_G_System_SYSTEM_ENCLOSURE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_SYSTEM_ENCLOSURE.ChassisTypes in ( "8", "9", "10","11", "12", "14","18","21") ``` To create a collection for all laptops, we can look for all chassis types for laptops in SMS\_G\_System\_SYSTEM.ENCLOSURE.ChassisTypes. See the complete WQL query below. This query can be used in a collection query to include all desktops in the collection. ### **SCCM Device Collection Query for Desktops** For creating a collection for all desktops, we can look for all chassis types for laptops in SMS\_G\_System\_SYSTEM.ENCLOSURE.ChassisTypes. See the complete WQL query below. This query can be used in a collection query to include all laptops in the collection. ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SYSTEM_ENCLOSURE on SMS_G_System_SYSTEM_ENCLOSURE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_SYSTEM_ENCLOSURE.ChassisTypes in ("3","4","5","6","7","15","16") ``` ### **SCCM Device Collection Query for Desktops (Without virtual machines)** The Chassis Type value 3 includes a virtual machine as well. If you want to exclude virtual machines from the collection, then the above WQL can be modified to exclude virtual machine. Please see the complete WQL below. ``` select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_SYSTEM_ENCLOSURE on SMS_G_System_SYSTEM_ENCLOSURE.ResourceID = SMS_R_System.ResourceId inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SYSTEM_ENCLOSURE.ChassisTypes in ("2","3","5","6","7","35","15","4") and SMS_G_System_COMPUTER_SYSTEM.Model not like "%Virtual%" ``` ## Conclusion Dynamic collections in **System Center Configuration Manager (SCCM)** provide administrators with powerful automation for targeting devices based on type—whether **virtual machines, desktops, or laptops**. By leveraging **WQL queries** and properties such as *Win32\_SystemEnclosure.ChassisType*, you can ensure accurate grouping and streamlined deployments. These tested queries not only save time but also improve precision in managing diverse environments. Implementing them in your SCCM collections helps maintain consistency, optimize software distribution, and simplify device management across your organization. ## **Related Posts:** - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management --- ### [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) **Published:** October 29, 2022 **Author:** Equebal Ahmad **Excerpt:** A chassis or cabinet is a physical enclosure that houses the internal components of a computer system. In SCCM, Enclosure Chassis Types Values can be used to create reports, queries and collection for specific type of device such as Desktop, Laptop or Tablets. As a Configuration Manager | SCCM administrator, you may have a requirement to create collection , query or report for different device types such as Laptop, Desktop or Tablet. This article explains about Enclosure Chassis types value which can be used to identify Desktops or Laptops. **Content:** In **Configuration Manager (ConfigMgr/SCCM)**, the **Enclosure Chassis Types** attribute provides valuable insights into the physical form factor of client devices. Whether you’re managing desktops, laptops, tablets, or virtual machines, understanding chassis type values helps administrators build dynamic collections, apply policies more effectively, and streamline hardware inventory reporting. This guide explains the different **chassis type values**, their descriptions, and how you can leverage them in SCCM queries. As a **Configuration Manager (ConfigMgr/SCCM) administrator**, you may often need to create **collections, queries, or reports** based on different device types such as laptops, desktops, or tablets. The **Enclosure Chassis Types** attribute provides a reliable way to distinguish between these hardware categories. By using chassis type values, you can easily identify and group devices—for example, separating desktops from laptops—making it simpler to apply targeted policies, deployments, or compliance checks. ## How to Check **Chassis Type using PowerShell** The Win32\_SystemEnclosure WMI class represents the properties that are associated with a physical system enclosure. You can check Chassis Type information using the PowerShell Get-WmiObject cmdlet. ``` Get-WmiObject -class win32_systemenclosure | select Caption,chassisTypes ``` ``` ``` ![Enclosure Chassis Types](https://techuisitive.com/wp-content/uploads/2023/04/image-32.png)## How to Check Chassis Type from SCCM The SystemEnclosure information collected from clients during hardware inventory is stored on SMS\_G\_SYSTEM\_SYSTEM.ENCLOSURE class in SCCM. ### Steps to Check Chassis Type in SCCM Resource Explorer 1. **Open the Configuration Manager Console** Launch the SCCM console on your admin workstation. 2. **Navigate to Assets and Compliance** - Go to **Assets and Compliance** → **Devices**. - Search for and select the device you want to inspect. 3. **Open Resource Explorer** - Right‑click on the device. - Choose **Start → Resource Explorer**. 4. **Expand Hardware Section** - In Resource Explorer, expand **Hardware**. - Look for **System Enclosure** or **Enclosure Chassis Types**. 5. **View Chassis Type Value** - The **Chassis Type** field will display a numeric value (e.g., 3, 8, 9). - This value corresponds to the physical form factor (e.g., Desktop, Portable, Laptop). ![SCCM Resource Explorer - System Enclosure Chassis Type](https://techuisitive.com/wp-content/uploads/2023/04/image-33.png)Below are the details of all Enclosure types as per the Microsoft article. We can use this [enclosure chassis type to create a collection for Laptops and Desktops](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/ "enclosure chassis type to create a collection for Laptops and Desktops"). ## **Enclosure Chassis Types, Value & Description** **​Chassis Type****​Chassis Type Value****​Chassis Type Related To**Other1​Unknown2​Desktop3Desktop (Including virtual machines)Low Profile Desktop4DesktopPizza Box5DesktopMini tower6DesktopTower7Desktop​Portable8Laptop​Laptop9LaptopNotebook10Laptop​Hand Held11LaptopDocking Station12Laptop​All in One13​​Sub Notebook14Laptop​Space-Saving15DesktopLunch Box16DesktopMain System Chassis17ServersExpansion Chassis18LaptopSub Chassis19​Bus Expansion Chassis20​Peripheral Chassis21LaptopStorage Chassis22​Rack Mount Chassis23ServersSealed-Case PC24​Tablet30TabletConvertible31​Laptop or Tablet. For example, ThinkPad Yoga 370 will have a value of 31 since it can convert from a Notebook form factor to a Tablet form factor by rotating its screen on the 360 degree Yoga hinge.Detachable32​IoT Gateway​33​Embedded PC34​Mini PC35​​Stick PC​36​## Frequently Asked Questions (FAQs) ### What are Enclosure Chassis Types in ConfigMgr/SCCM? Enclosure Chassis Types are **numeric values collected during hardware inventory**. It describes the physical form factor of a device (e.g., desktop, laptop, tablet, server). They help administrators distinguish between device categories for reporting and policy targeting. ### Why are Chassis Type values important for SCCM administrators? **Dynamic Collections:** Easily group laptops vs. desktops. **Targeted Policies:** Apply compliance baselines or deployments only to specific hardware types. **Inventory Reporting:** Streamline hardware reports by filtering on chassis type. ### How can I check a device’s Chassis Type using PowerShell? Run the following command: Get-WmiObject -Class Win32\_SystemEnclosure | Select Caption, ChassisTypes This retrieves the enclosure information directly from WMI. ### Can Chassis Type values be used in SCCM queries? Yes. You can use **SMS\_G\_SYSTEM\_SYSTEMENCLOSURE** class in SCCM queries to filter devices by chassis type. For example, create a collection of laptops by querying for values **8, 9, 10, 13, 14**. ### Are virtual machines identified differently? Yes. Virtual machines typically report as **Chassis Type 3 (Desktop)**, so admins should be cautious when separating physical desktops from VMs. ### Can I customize or override Chassis Type values? No. These values are **standardized by Microsoft WMI classes**. However, admins can build logic in SCCM queries to interpret or group them as needed. ## **Related Posts:** - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/), [SCCM Guides](https://techuisitive.com/tag/sccm-guides/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management, SCCM Guides --- ### [Create Dynamic Collections in SCCM for Different Attribute Classes | ConfigMgr](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) **Published:** December 10, 2022 **Author:** Equebal Ahmad **Content:** Dynamic collections in Microsoft Configuration Manager (SCCM/ConfigMgr) allow administrators to automate device grouping using WQL queries. Instead of manually adding systems, you can build collections that update automatically based on attributes like hardware model, OS version, or Active Directory OU. In this guide, we’ll walk through creating dynamic collections step by step and explore key attribute classes you can leverage for smarter deployments. Table Of Contents 1. [How to Create a Dynamic / Query-Based Collection](#how-to-create-a-dynamic-query-based-collection) 2. [Different Attribute Classes and Attribute Names for Dynamic Collections](#different-attribute-classes-and-attribute-names-for-dynamic-collections) 3. [Other posts in this series](#other-posts-in-this-series) 4. [Conclusion](#conclusion) 5. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) - [What is a dynamic collection in SCCM?](#what-is-a-dynamic-collection-in-sccm) - - [What is the role of a limiting collection?](#what-is-the-role-of-a-limiting-collection) - - [Can I use multiple attribute classes in one query?](#can-i-use-multiple-attribute-classes-in-one-query) - - [What are incremental updates in SCCM collections?](#what-are-incremental-updates-in-sccm-collections) - - [Where can I find ready‑to‑use queries?](#where-can-i-find-readytouse-queries) 6. [Related Posts:](#related-posts) 7. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## How to Create a Dynamic / Query-Based Collection In the Configuration Manager console, navigate to **Asset and Compliance**. Right‑click **Device Collections**, and then select **Create Device Collection**. ![SCCM Collection](https://techuisitive.co.in/wp-content/uploads/2023/04/image-193.jpeg)On the **General** page, enter a **Name** for your collection. Next, click **Browse** under **Limiting Collection**, and select the collection you want to use as the membership boundary for your new collection. A **limiting collection** defines the boundary for membership. Any query‑based collection you create will only include devices that are already part of the limiting collection. In other words, your new collection becomes a **subset** of the limiting collection. ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-194.jpeg)On the **Membership Rules** page, click on **Add Rule** and select **Query Rule** from the drop-down list. ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-195.jpeg)On the Query Rule Properties dialog box, enter a name for the query rule and then click on **Edit Query Statement**. ![SCCM Collection query wizard | Dynamic Collections](https://techuisitive.co.in/wp-content/uploads/2023/04/image-196.jpeg)In the **Query Statement Properties** dialog box, select the **Criteria** tab and click on **Add** (Yellow Start) to add a new query rule. ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-197.jpeg)In the **Criterion Properties** dialog box, select the following. **Criterion Type**: Simple value **Where**: Click on **Select…** ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-198.jpeg)In the **Select Attribute** dialog box, select the following **Attribute class:** System Resource **Attribute:** System OU Name Click on **Ok** to return to the previous dialog box. ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-199.jpeg)Back to the **Criterion Properties** dialog box, select the following **Operator**: is like **Value:** Click on **Value…** ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-200.jpeg)In the **Values** dialog box, you will see the list of all Active Directory OUs that have been discovered as part of Active Directory system discovery. Select the desired OU and click on **Ok** to return to the previous window. ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-201.jpeg)Back on the **Criterion Properties** dialog box, verify the query rule and click on **Ok**. ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-202.jpeg)You are now back to the **Query Statement Properties** dialog box. Click on **Ok** to close the dialog box. ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-203.jpeg)On the Query Rule Properties dialog box, click on Ok to return to the **Create Device Collection Wizard**. ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-204.jpeg)On the **Membership Rules page**, select **Use incremental updates for this collection** if you want to enable incremental updates. Click on **Next** ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-205.jpeg)On the **Summary** page, review the collection details and click **Next**. The collection will be created, and you will then see the **Progress** and **Completion** pages confirming the process. ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-206.jpeg)## **Different Attribute Classes and Attribute Names for Dynamic Collection**s In the demonstration above, we used the **System Resource** class with the **System OU Name** attribute. This allows the collection membership to be populated dynamically based on the Active Directory Organizational Unit (OU) name. **Attribute class:** System Resource **Attribute Name:** System OU Name ![SCCM Collection query wizard](https://techuisitive.co.in/wp-content/uploads/2023/04/image-207.jpeg)SCCM provides many **SMS Provider WMI Server classes** (also called *attribute classes*) that you can use to build device collections based on different criteria. By selecting the appropriate class and attribute, you can dynamically group devices according to hardware details, operating system properties, Active Directory information, or other configuration data ## **Other posts in this series** The following blog posts provide detailed coverage of the **attribute classes most commonly used** when creating dynamic collections or SCCM queries. The process for creating a dynamic collection remains the same as described above—you simply select the appropriate **Attribute Class** and **Attribute Name** based on your requirements. Each post also includes **complete WQL queries** that you can copy and paste directly into the Query Editor to quickly build your collections. Explore these related guides to build dynamic collections and queries more effectively: - **[Operating System Attribute Queries](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/ "Operating System Attribute Queries")** – Learn how to target collections based on OS version and edition. - **[Computer System Attribute Queries](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/ "Computer System Attribute Queries")** – Create collections filtered by hardware model or manufacturer. - **[Software Attribute Queries](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/ "Software Attribute Queries")** – Identify devices with specific installed applications or software versions. - **[SCCM Device Collection Based on Computer Hardware Details](https://www.techuisitive.com/post/sccm-device-collection-based-on-computer-hardware-details-configmgr "SCCM Device Collection Based on Computer Hardware Details")** – Target collections using manufacturer, model, or chassis type. - **[SCCM Collection Based on OS Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/ "SCCM Collection Based on OS Optional Features")** – Query devices by Windows optional features such as .NET Framework or Hyper‑V. ## Conclusion Dynamic collections in SCCM (ConfigMgr) are a powerful way to automate device grouping and streamline deployments. By leveraging SMS Provider WMI Server classes and attributes, administrators can build collections that adapt to organizational changes—whether based on Active Directory OUs, hardware models, or operating system versions. Using limiting collections ensures proper scoping, while incremental updates keep memberships fresh without heavy server load. With the examples and queries provided in this series, you can quickly create collections tailored to your environment, saving time and improving accuracy in your configuration management workflows ## Frequently Asked Questions (FAQs) ### **What is a dynamic collection in SCCM?** A dynamic collection is a device or user collection in SCCM that automatically updates its membership based on query rules (WQL). This ensures that devices meeting specific criteria are always included without manual intervention. ### **What is the role of a limiting collection?** A limiting collection defines the boundary for membership. Any new query‑based collection you create will only include devices that are already part of the limiting collection, making it a subset. ### **Can I use multiple attribute classes in one query?** Yes. You can combine different attribute classes (such as Operating System, Computer System, or System Resource) to refine your query and target devices more precisely. ### **What are incremental updates in SCCM collections?** Incremental updates allow SCCM to refresh collection membership more frequently without running a full update cycle. This helps keep collections current while reducing load on the site server. ### **Where can I find ready‑to‑use queries?** This blog series includes complete WQL queries for common scenarios. You can copy and paste them directly into the Query Editor to quickly build collections. ## **Related Posts:** - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM, Step by Step Guides **Tags:** SCCM Collections & Device Management --- ### [How to Create SCCM Collection based on System Resource Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) **Published:** December 10, 2022 **Author:** Equebal Ahmad **Excerpt:** The SMS_R_System Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration Manager. This class contains discovery data for all discovered system resource. In the Query / Collection Query wizard, the friendly name of SMS_R_System is System Resource and it's referred as Attribute Class. This class can be used to create collection based on OU , Resource creation date , SCCM client version etc. **Content:** Creating dynamic collections in SCCM often requires precise queries against system attributes. The **SMS\_R\_System** class provides a rich set of properties—such as name, domain, operating system, and resource type—that can be leveraged to build targeted collections. In this guide, we’ll explore practical query examples using SMS\_R\_System to help administrators efficiently group devices, streamline deployments, and improve reporting accuracy. The **SMS\_R\_System** Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration Manager. This class contains discovery data for all discovered system resource. In the Query / Collection Query wizard, the friendly name of SMS\_R\_System is **System Resource,** and it’s referred as **Attribute Class**. ![Attribute Class and Name in Query Designer / WMI Class - SMS_R_System in Query Editor | SCCM Collection](https://techuisitive.com/wp-content/uploads/2023/04/image-69.jpeg)--- **Related post:** If you are looking for step by step process to create a dynamic/query-based collection, then follow this article: How to Create a [Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) **Other posts in this series:** - [SCCM Device Collection Based on Computer Hardware Details](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) --- Table Of Contents 1. [SCCM device collection based on Active Directory site ( AD site )](#sccm-device-collection-based-on-active-directory-site-ad-site) 2. [SCCM device collection based on AD OU](#sccm-device-collection-based-on-ad-ou) 3. [SCCM device collection based on the system resource creation date](#sccm-device-collection-based-on-the-system-resource-creation-date) - [SCCM Collection Query / WQL Query for System Resource created after a specific date](#sccm-collection-query-wql-query-for-system-resource-created-after-a-specific-date) - - [SCCM Collection Query / WQL Query for System Resource created before a specific date](#sccm-collection-query-wql-query-for-system-resource-created-before-a-specific-date) - - [SCCM Collection Query / WQL Query for System Resource created between two dates](#sccm-collection-query-wql-query-for-system-resource-created-between-two-dates) - - [SCCM Collection Query / WQL Query for System Resource created in the last n number of days](#sccm-collection-query-wql-query-for-system-resource-created-in-the-last-n-number-of-days) 4. [SCCM device collection based on SCCM Client Version](#sccm-device-collection-based-on-sccm-client-version) 5. [SCCM device collection based on computer naming convention/nomenclature](#sccm-device-collection-based-on-computer-naming-conventionnomenclature) 6. [SCCM Collection Query / WQL Query for Windows 10 Devices without SCCM Client](#sccm-collection-query-wql-query-for-windows-10-devices-without-sccm-client) 7. [SCCM Collection Based on Active Directory Group](#sccm-collection-based-on-active-directory-group) 8. [Related Posts:](#related-posts) 9. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **SCCM device collection based on Active Directory site ( AD site )** The query below can be used to create a dynamic collection for all computers based on the Active Directory site. If you are using the query designer, then select the attribute class and attribute name below. Otherwise, you can also copy the below WQL query and paste it directly in query editor. Save and update the membership for collection to see the result. #### **Attributes to select from the Query Designer** **Attribute Class:** System Resource **Attribute Name:** Active Directory Site Name #### **SCCM Collection Query / WQL Query** *`select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System where SMS_R_System.ADSiteName = "HEADQUARTER"`* ## **SCCM device collection based on AD OU** The query below can be used to create a dynamic collection for all computers based on the Active Directory Organizational Unit. If you are using the query designer, then select the attribute class and attribute name below. Otherwise, you can also copy the below WQL query and paste it directly in query editor. Do remember to change the OU name as per your requirements. #### **Attributes to select from the Query Designer** **Attribute Class:** System Resource **Attribute Name:** System OU Name #### **SCCM Collection Query / WQL Query** *`select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System where SMS_R_System.SystemOUName = "TECHUISITIVEL.LOCAL/COMPUTERS"`* ## **SCCM device collection based on the system resource creation date** The System Resource – Creation Date attribute class/attribute name can be used to create a dynamic collection based on system resource creation date. A record is created in Configuration Manager when a resource is discovered for the first time (e.g, a system discovered through Active Directory system discovery). #### **Attributes to select from the Query Designer** **Attribute Class:** System Resource **Attribute Name:** Creation Date ### **SCCM Collection Query / WQL Query for System Resource created after a specific date** *`select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.CreationDate > "10/01/2022"`* ### **SCCM Collection Query / WQL Query for System Resource created before a specific date** *`select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.CreationDate < "10/30/2022"`* ### **SCCM Collection Query / WQL Query for System Resource created between two dates** The query below cannot be directly created in the query designer. You need to edit the query rules in the query editor. *`select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.CreationDate BETWEEN "10/01/2022" AND "10/31/2022"`* ### **SCCM Collection Query / WQL Query for System Resource created in the last n number of days** The below WQL query will include all devices whose records were created in SCCM in the last n number of days. The query uses SQL function DateDiff and GetDate to compare the current date and resource creation date to identify the resource created in the last n number of days. The query below cannot be directly created in the query designer. You need to edit the query rules in the query editor. *`SELECT SMS_R_System.ResourceID,SMS_R_System.ResourceType,SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client FROM SMS_R_System WHERE (DateDiff(day, CreationDate, GetDate()) < 30)`* ## **SCCM device collection based on SCCM Client Version** #### **Attributes to select from Query Designer** **Attribute Class :** System Resource **Attribute Name :** Client Version #### **SCCM Collection Query / WQL Query for specific SCCM client version** *`select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System where SMS_R_System.ClientVersion = "5.00.9068.1008"`* ## **SCCM device collection based on computer naming convention/nomenclature** #### **Attributes to select from Query Designer** **Attribute Class:** System Resource **Attribute Name:** NetBIOS Name #### **SCCM Collection Query / WQL Query for computer name starting with HQ** The below WQL query can be used to create a device collection for the computers which name start with specific characters. Many organizations use a prefix based on locations to name the computers. That can be used to identify the machines for a specific location or business units. The % wildcard in SQL is used to represent zero or more characters. So anything after HQ will be picked. *`select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System where SMS_R_System.NetbiosName like "HQ%"`* #### **SCCM Collection Query / WQL Query for computer name ending with 1, 2, or 3** This can be useful for a deployment to target on small batches of computers. Let’s say that the computer name in your organization ends with a number. You can have a similar query-based collection to split the devices into different groups. These approaches can be followed for devices ending with an alphabet as well. *`select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System where (SMS_R_System.NetbiosName like "%1" OR SMS_R_System.NetbiosName like "%2" OR SMS_R_System.NetbiosName like "%3")`* The same result can be achieved using wild card as well. The \[ \] wildcard in SQL is used to represent any one character inside brackets. So any devices which name ending with 1,2 or 3 will be included in this collection. *`select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.NetbiosName like "%[123]"`* ## **SCCM Collection Query / WQL Query for Windows 10 Devices without SCCM Client** #### **Attributes to select from the Query Designer** **Attribute Class:** System Resource **Attribute Name**: Operating System Name and Version **Attribute Class 2:** System Resource **Attribute Name 2:** Client The WQL query below will include Windows 10 devices without the SCCM client in the device collection. Please note that most of the time we use the Operating System (SMS\_G\_System\_Operating\_System) WMI class for OS related query. However, that is an inventory class, and information will not be in the database until the SCCM client is installed and sent full hardware inventory. Hence, this query will utilize the SMS\_R\_System discovery class to achieve the desired result. *`select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like "%Workstation 10.0%" and SMS_R_System.Client is Null`* ## **SCCM Collection Based on Active Directory Group** #### **Attributes to select from the Query Designer** **Attribute Class:** System Resource **Attribute Name:** System Group The SCCM collection membership based on Active Directory Group is widely used to delegate day-to-day application installation requests to the Service Desk. An Active Directory group is created for each application, and SCCM collection membership updates are based on the AD group. The service desk simply adds the user device to the AD group to push the application. The WQL query below will include all computers in the given AD group to the SCCM collection. *`select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.SystemGroupName = "Domain\\SW-VisioViewer-Professional-2016-X64"`* ## **Related Posts:** - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management --- ### [How to Create SCCM Collection Based on Operating System Attribute Class | ConfigMgr](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) **Published:** December 21, 2022 **Author:** Equebal Ahmad **Excerpt:** SCCM collects operating system details from client as part of inventory. We can create SCCM collection based on operating system attribute class such as OS Name, Build or version number, OS architecture, OS last reboot time and many more such attributes. **Content:** Creating device collections in **Configuration Manager (ConfigMgr/SCCM)** based on operating system attributes is a powerful way to target deployments, compliance policies, and reporting. By leveraging the **SMS\_G\_System\_OPERATING\_SYSTEM** WMI class, admins can dynamically group devices using OS name, version, build number, or architecture. This guide walks through practical WQL queries you can use to build collections tailored to your environment. A collection or query created in Configuration Manager uses WMI Query Language (WQL) to request objects from the SMS Provider WMI Schema, which in turn retrieves the data from the site database. The **SMS\_G\_System\_OPERATING\_SYSTEM** Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration Manager. This class contains inventory information for the operating system. In the Query / Collection Query wizard, the friendly name of **SMS\_G\_System\_OPERATING\_SYSTEM** is **Operating System,** and it’s referred to as Attribute Class. In this blog post, we will discuss the most commonly used collection queries related with Operating System attribute class with examples and sample queries. ![SCCM collection based on operating system attribute class](https://techuisitive.com/wp-content/uploads/2023/04/image-136.png)**Related post:** If you are looking for step by step process to create a dynamic/query-based collection, then follow this article: How to Create a [Dynamic Collection in SCCM](https://www.techuisitive.com/post/create-dynamic-collections-in-sccm-for-different-attribute-classes) **Other posts in this series:** - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://www.techuisitive.com/post/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class) - [SCCM Device Collection Based on Computer Hardware Details](https://www.techuisitive.com/post/sccm-device-collection-based-on-computer-hardware-details-configmgr) Table Of Contents 1. [SCCM collection based on Operating System Name](#sccm-collection-based-on-operating-system-name) - [Attributes to select from the Query Designer](#attributes-to-select-from-the-query-designer) - - [SCCM Collection Query / WQL Query for All Windows 10 devices](#sccm-collection-query-wql-query-for-all-windows-10-devices) - - [SCCM Collection Query / WQL Query for All Windows 11 devices](#sccm-collection-query-wql-query-for-all-windows-11-devices) 2. [SCCM collection based on Operating System Version](#sccm-collection-based-on-operating-system-version) - [Attributes to select from the Query Designer](#attributes-to-select-from-the-query-designer) - - [SCCM Collection Query / WQL Query for Windows 11 22H2 devices](#sccm-collection-query-wql-query-for-windows-11-22h2-devices) 3. [SCCM collection based on Operating System Install Date](#sccm-collection-based-on-operating-system-install-date) - [Attributes to select from the Query Designer](#attributes-to-select-from-the-query-designer) - - [SCCM Collection Query / WQL Query for Operating System installed after specific date](#sccm-collection-query-wql-query-for-operating-system-installed-after-specific-date) - - [SCCM Collection Query / WQL Query for Operating System installed before a specific date](#sccm-collection-query-wql-query-for-operating-system-installed-before-a-specific-date) - - [SCCM Collection Query / WQL Query for Operating System installed between two dates](#sccm-collection-query-wql-query-for-operating-system-installed-between-two-dates) - - [SCCM Collection Query / WQL Query for Operating System installed in the last n number of days](#sccm-collection-query-wql-query-for-operating-system-installed-in-the-last-n-number-of-days) 4. [SCCM device collection based on Computer Last Boot-up time](#sccm-device-collection-based-on-computer-last-boot-up-time) - [Attributes to select from the Query Designer](#attributes-to-select-from-the-query-designer) - - [SCCM Collection Query / WQL Query for computers not rebooted in the last n number of days](#sccm-collection-query-wql-query-for-computers-not-rebooted-in-the-last-n-number-of-days) 5. [Related Posts:](#related-posts) 6. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **SCCM collection based on Operating System Name** The query below can be used to create a dynamic collection for all computers based on the Windows OS caption. If you are using the query designer, then select the attribute class and attribute name below. Otherwise, you can also copy the below WQL query and paste it directly in query editor. ### **Attributes to select from the Query Designer** **Attribute Class:** Operating System **Attribute Name:** Caption ### **SCCM Collection Query / WQL Query for All Windows 10 devices** *`select distinct SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.Caption like "Windows 10%"`* ### **SCCM Collection Query / WQL Query for All Windows 11 devices** *`select distinct SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.Caption like "Windows 11%"`* The above WQL query used the V\_GS\_System base WMI Class, which contains the information for hardware and software inventory. If you need to create a device collection for Windows 10 / 11 devices where the SCCM client is not yet installed, then you can use the SMS\_R\_System WMI class. Check out this article for more details about the System Resource Discovery class. ## **SCCM collection based on Operating System Version** The **Version** or **Build Number** attributes of the Operating System class can be used to create query based collection for sepecific OS version / Build number. ### **Attributes to select from the Query Designer** **Attribute Class:** Operating System **Attribute Name:** Version / Build Number ### **SCCM Collection Query / WQL Query for Windows 11 22H2 devices** Please find the WQL query example below to create a collection for Windows 11 Version 22H2 computers. *`select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.Version ="​10.0.22621"`* We have more examples for device collection based on OS Version in another blog post, [SCCM dynamic collection for Windows 10 / 11 devices](https://www.techuisitive.com/post/sccm-dynamic-collection-for-windows-10-11-devices). You can also find the details of Windows 10 / 11 OS build versions in our post [Windows 10 / 11 Operating System Build Versions](https://www.techuisitive.com/post/windows-10-11-operating-system-build-versions). ## **SCCM collection based on Operating System Install Date** The Operating System – Install Date attribute can be used to create a dynamic query-based collection based on OS install date. ### **Attributes to select from the Query Designer** **Attribute Class:** Operating System **Attribute Name:** Install Date ### **SCCM Collection Query / WQL Query for Operating System installed after specific date** *`select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.InstallDate >= "06/29/2022"`* ### **SCCM Collection Query / WQL Query for Operating System installed before a specific date** *`select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_OPERATING_SYSTEM.InstallDate **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management --- ### [How to Create SCCM Device Collection Based on Computer Hardware Details | ConfigMgr](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) **Published:** February 8, 2023 **Author:** Equebal Ahmad **Excerpt:** SCCM Computer hardware classes can be used to create dynamic query based device collection. There are different classes such as Computer System , PC_BIOS , System Enclosure , TPM etc which can be used for queries. A collection or query created in Configuration Manager uses WMI Query Language (WQL) to request objects from the SMS Provider WMI Schema, which in turn retrieves the data from site database. **Content:** Creating SCCM device collections based on computer hardware details allows administrators to target deployments, compliance settings, and reporting more effectively. This step‑by‑step guide explains how to build collections using attributes such as processor type, memory, disk size, and other hardware inventory data in Configuration Manager. By leveraging WQL queries and hardware inventory, you can design dynamic collections that simplify management and improve precision in your SCCM environment.” Below are the most commonly used hardware attribute classes for SCCM queries and dynamic device collections in Configuration Manager. These attributes help administrators build collections based on computer hardware details such as processor, memory, disk size, and model. **Computer System:** The Computer System attribute class (SMS\_G\_System\_COMPUTER\_SYSTEM) Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration Manager. This class contains hardware information (Model, Manufacturer, etc) of the computer system. The information is collected by hardware inventory. **PC BIOS:** The PC BIOS attribute class (SMS\_G\_System\_PC\_BIOS) Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration Manager. This class contains hardware information (BIOS Version, BIOS Serial Number, etc.) of the computer. The information is collected by hardware inventory. **System Enclosure:** The System Enclosure attribute class (SMS\_G\_System\_SYSTEM\_ENCLOSURE**)** Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration Manager. This class contains System Enclosure information (Chassis Types, Manufacturer, Model, etc.) of the computer. **TPM**: The TPM attribute class (SMS\_G\_System\_TPM) Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration Manager. This class contains information about the Trusted Platform Module ( TMP ) manufacturer, version, activation status, etc. **Firmware**: The Firmware attribute class (SMS\_G\_System\_firmware**)** Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration Manager. This class contains information about firmware, such as secure boot. **Memory**: The Memory attribute class (SMS\_G\_System\_X86\_PC\_MEMORY**)** Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration Manager. This class contains information about the physical memory of computers. **Related post:** If you are looking for a step-by-step process to create a dynamic/query-based collection, then follow this article: [How to Create Dynamic Collection in SCCM](https://www.techuisitive.com/post/create-dynamic-collections-in-sccm-for-different-attribute-classes) **Other posts in this series:** - [SCCM Collection Queries for Operating System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) Table Of Contents 1. [SCCM device collection based on Hardware Model](#sccm-device-collection-based-on-hardware-model) 2. [SCCM device collection based on Device Manufacturer](#sccm-device-collection-based-on-device-manufacturer) 3. [SCCM device collection for all computers with a specific BIOS version](#sccm-device-collection-for-all-computers-with-a-specific-bios-version) 4. [SCCM device collection based on Device Types (Laptops or Desktops)](#sccm-device-collection-based-on-device-types-laptops-or-desktops) 5. [SCCM Device collection for the computers with TPM 2.0](#sccm-device-collection-for-the-computers-with-tpm-20) 6. [SCCM Device collection for all computers with legacy BIOS](#sccm-device-collection-for-all-computers-with-legacy-bios) 7. [SCCM Device collection for all computers where SecureBoot is not enabled](#sccm-device-collection-for-all-computers-where-secureboot-is-not-enabled) 8. [SCCM Device collection for all computers where the total RAM is less than or Equal to 4 GB](#sccm-device-collection-for-all-computers-where-the-total-ram-is-less-than-or-equal-to-4-gb) 9. [SCCM Device collection for all computers that are compatible with Windows 11](#sccm-device-collection-for-all-computers-that-are-compatible-with-windows-11) 10. [Related Posts:](#related-posts) 11. [Explore More SCCM Guides](#explore-more-sccm-guides) ## **SCCM device collection based on Hardware Model** The following WQL query will add all workstations in the device collection whose computer hardware model is HP ProDesk 400 G5 Desktop Mini. If you are using the query designer, then select the attribute class and attribute name below. Otherwise, you can also copy the below WQL query and paste it directly into the query editor. Save and update the membership for collection to see the result. ### **Attributes to select from the Query Designer** **Attribute Class:** Computer System **Attribute Name:** Model ### **SCCM Collection Query / WQL Query** ``` select distinct SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_COMPUTER_SYSTEM.Model = "HP ProDesk 400 G5 Desktop Mini" ``` ## **SCCM device collection based on Device Manufacturer** The query below can be used to create a dynamic collection for all computer hardware based on device manufacturers such as HP, Dell, Lenovo, etc. If you are using the query designer, then select the attribute class and attribute name below. Otherwise, you can also copy the below WQL query and paste it directly into the query editor. ### **Attributes to select from the Query Designer** **Attribute Class:** Computer System **Attribute Name:** Manufacturer ### **SCCM Collection Query / WQL Query** Collection membership query to include all HP computers in the device collection. ``` select distinct SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_COMPUTER_SYSTEM.Manufacturer = "HP" ``` ## **SCCM device collection for all computers with a specific BIOS version** The query below can be used to create a dynamic collection for all computers with specific BIOS versions. The PC BIOS attribute class (SMS\_G\_System\_PC\_BIOS WMI class contains this information. The query below will include all computers whose BIOS version is “HPQOEM – 0, R23 Ver. 02.03.00, HP – 20300” in the collection. ### **Attributes to select from the Query Designer** **Attribute Class:** PC BIOS **Attribute Name:** BIOS Version ### **SCCM Collection Query / WQL Query** ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_PC_BIOS on SMS_G_System_PC_BIOS.ResourceId = SMS_R_System.ResourceId where SMS_G_System_PC_BIOS.BIOSVersion = "HPQOEM - 0, R23 Ver. 02.03.00, HP - 20300" ``` ## **SCCM device collection based on Device Types (Laptops or Desktops)** The System Enclosure attribute class can be used to identify device type (Desktop, Laptop, Tablet, etc.) The information can be used to create a collection for Laptops or Desktops. You can find more details about System Enclosure Chassis Types in our post[-Enclosure](https://www.techuisitive.com/post/enclosure-chassis-types-value-description-configmgr-sccm)[ Chassis Types Value & Description](https://www.techuisitive.com/post/enclosure-chassis-types-value-description-configmgr-sccm) The WQL query below will add all laptops to the device collection. You can find more examples for laptop, desktop, and virtual machine device collection in another post, [SCCM Dynamic Collection Based on Device Type](https://www.techuisitive.com/post/sccm-dynamic-collection-based-on-device-type-collection-queries) ### **Attributes to select from the Query Designer** **Attribute Class:** System Enclosure **Attribute Name:** Chassis Types ### **SCCM Collection Query / WQL Query** ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SYSTEM_ENCLOSURE on SMS_G_System_SYSTEM_ENCLOSURE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_SYSTEM_ENCLOSURE.ChassisTypes in("8","9","10","11","12","14","18","21") ``` ## **SCCM Device collection for the computers with TPM 2.0** The below collection membership query will include all computers with TMP version 2.0 \* in the device collection. ### **Attributes to select from the Query Designer** **Attribute Class:** TPM **Attribute Name:** Spec Version ### **SCCM Collection Query / WQL Query** ``` select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_TPM on SMS_G_System_TPM.ResourceID = SMS_R_System.ResourceId where SMS_G_System_TPM.SpecVersion like "2.0%" ``` ## **SCCM Device collection for all computers with legacy BIOS** The below collection membership query will include all computers with legacy BIOS in the device collection. ### **Attributes to select from the Query Designer** **Attribute Class:** Firmware **Attribute Name:** UEFI ### **SCCM Collection Query / WQL Query** ``` select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_FIRMWARE on SMS_G_System_FIRMWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_FIRMWARE.UEFI = "0" ``` ## **SCCM Device collection for all computers where SecureBoot is not enabled** ### **Attributes to select from the Query Designer** **Attribute Class:** Firmware **Attribute Name:** Secure Boot ### **SCCM Collection Query / WQL Query** ``` select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_FIRMWARE on SMS_G_System_FIRMWARE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_FIRMWARE.SecureBoot = "0" ``` ## **SCCM Device collection for all computers where the total RAM is less than or Equal to 4 GB** ### **Attributes to select from the Query Designer** **Attribute Class:** Memory **Attribute Name:** Total Physical Memory (KB) ### **SCCM Collection Query / WQL Query** ``` select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_X86_PC_MEMORY on SMS_G_System_X86_PC_MEMORY.ResourceId = SMS_R_System.ResourceId where SMS_G_System_X86_PC_MEMORY.TotalPhysicalMemory **Categories:** ConfigMgr | SCCM, Step by Step Guides **Tags:** SCCM Collections & Device Management --- ### [Create SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) **Published:** February 22, 2023 **Author:** Equebal Ahmad **Excerpt:** SCCM collect software information from client using different methods such as Software inventory , software file scan, and hardware inventory. These information can be used to create dynamic collection for devices. **Content:** Creating dynamic device collections in SCCM (Configuration Manager) is a powerful way to manage software deployments, compliance, and reporting. Whether you need to identify machines with a specific application installed, target updates, or audit software usage, SCCM provides multiple inventory methods—software inventory, file scanning, and hardware inventory—that can be leveraged to build precise queries. In this guide, we’ll walk through how to create collections based on installed software products and inventoried files, using WQL queries for maximum flexibility A collection or query created in Configuration Manager uses WMI Query Language (WQL) to request objects from the SMS Provider WMI Schema, which in turn retrieves the data from the site database. 1. [Attribute Classes for Software Products](#attribute-classes-for-software-products) 2. [SCCM device collection based on Inventoried Software File](#sccm-device-collection-based-on-inventoried-software-file) 3. [SCCM device collection based on Installed Software Products](#sccm-device-collection-based-on-installed-software-products) 4. [SCCM device collection based on Software Registered in Add / Remove Programs](#sccm-device-collection-based-on-software-registered-in-add-remove-programs) 5. [SCCM device collection based on 32-bit and 64-bit Applications](#sccm-device-collection-based-on-32-bit-and-64-bit-applications) 6. [Related Posts:](#related-posts) 7. [Explore More SCCM Guides](#explore-more-sccm-guides) ## Attribute Classes for Software Products The following attribute classes can be used to create an SCCM collection based on installed software products and inventoried files. ### **Software Files** Software Files Attribute class uses SMS Provider WMI Server class SMS\_G\_System\_SoftwareFiles to query information from the SCCM site database. This class contains information about all software files that were inventoried on the client computer. ### **Software Products** The Software products attribute class uses the SMS Provider WMi server class SMS\_G\_System softwareProduct to query information from the SCCM site database. This class contains information about all software product files that contain resource strings. ### **Installed Software** Installed Software attribute class uses the SMS provider WMI server class SMS\_G\_System\_INSTALLED\_SOFTWARE to query information from the SCCM site database. The installed software details comes from Asset Intelligence (AI). AI uses the Add Remove Programs as a major source of information. However, it also performs some normalization based on the information from other sources to present the final software list. ### **Installed Applications** Installed Applications attribute class uses the SMS provider WMI server class SMS\_G\_System\_ADD\_REMOVE\_PROGRAMS to query information from the site database. The Installed Application details come directly from Add/Remove Programs from inventory machines. ### **Installed Applications (64)** The Installed Applications (64) attribute class uses the SMS provider WMI server class SMS\_G\_System\_ADD\_REMOVE\_PROGRAMS\_64 to query information from the site database. The Installed Applications details come directly from Add/Remove Programs (x64)from inventory machines. In this blog post, we will discuss the most commonly used collection queries related to Software Files & Software Products. ![SCCM Query Editor | Software Products query for collection](https://techuisitive.com/wp-content/uploads/2023/04/image-137.png)Software Files attribute class | SMS\_G\_System\_SoftwareFile **Related post:** If you are looking for step by step process to create a dynamic / query-based collection, then follow this article: [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) **Other posts in this series:** - [SCCM Collection Queries for Operating System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) ## **SCCM device collection based on Inventoried Software File** To create a device collection based on software file, version or path, the software inventory must be configured to collect the inventory information about respective executables from client computers. ### **SCCM Device Collection based on File Name & Version** The below WQL query will include all workstations in the device collection that have reported McsClient.exe version lower than 4.18.215. The version of this file can be used to check the Sophos Antivirus version on a client. Sophos Management Communications System (McsClien.exe) is part of Sophos Endpoint security software. #### **Attributes to select from the Query Designer** **Attribute Class:** Software File **Attribute Name:** File Name & File Version #### **SCCM Collection Query / WQL Query** ``` select * from SMS_R_System inner join SMS_G_System_SoftwareFile on SMS_G_System_SoftwareFile.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SoftwareFile.FileName = "McsClient.exe" and SMS_G_System_SoftwareFile.FileVersion < "4.18.215" ``` ### **SCCM device collection based on Software File Name & Path** The below WQL query will include all devices in the SCCM collection where McsClient.exe file is present in “C:\\Program files (x86)\\sophos\\Management Communication System\\Endpoint” folder. #### **Attributes to select from the Query Designer** **Attribute Class:** Software File **Attribute Name:** File Name & File Path #### **SCCM Collection Query / WQL Query** ``` select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_SoftwareFile on SMS_G_System_SoftwareFile.ResourceID = SMS_R_System.ResourceId where SMS_G_System_SoftwareFile.FileName = "McsClient.exe" and SMS_G_System_SoftwareFile.FilePath = "C:\\Program Files (x86)\\Sophos\\Management Communications System\\Endpoint\\" ``` ## **SCCM device collection based on Installed Software** Products As explained above, the installed software details come from Asset Intelligence, and AI uses Add Remove Programs as a major source of information. This attribute class may include the applications that are not registered in Add / Remove Programs. Let’s see a few sample WQL queries to understand how you can use the Installed Software attribute class to create a collection based on installed software. ### **SCCM Device Collection for computers where application X is installed** The WQL query below will include all computers where Google Chrome is installed in the device collection. #### **Attributes to select from the Query Designer** **Attribute Class:** Installed Software **Attribute Name:** Product Name #### **SCCM Collection Query / WQL Query** ``` select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ProductName like "Google Chrome%" ``` ### **SCCM Device Collection for computers where application X is not installed** The WQL query below will include all computers where Sophos Endpoint Agent is not installed in the device collection. Please note that a subset query needs to be used when you are trying to create a collection for a product not installed. #### **Attributes to select from the Query Designer** **Attribute Class:** Installed Software **Attribute Name:** Product Name #### **SCCM Collection Query / WQL Query** ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ResourceId not in (select SMS_R_System.ResourceId from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ProductName like "Sophos Endpoint Agent") ``` ### **SCCM Device Collection for computers where Microsoft Visual Studio Professional is installed** The WQL query below will include all computers in the device collection where Microsoft Visual Studio Professional is installed. #### **Attributes to select from the Query Designer** **Attribute Class:** Installed Software **Attribute Name:** Product Name #### **SCCM Collection Query / WQL Query** ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ProductName like "Microsoft Visual Studio Professional%" ``` ### **SCCM Device Collection for computers where Microsoft SQL Server Management Studio is installed** The WQL query below will include all computers in the device collection where Microsoft SQL Server Management Studio is installed. #### **Attributes to select from the Query Designer** **Attribute Class:** Installed Software **Attribute Name:** Product Name #### **SCCM Collection Query / WQL Query** ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ProductName like "Microsoft SQL Server Management Studio%" ``` ## **SCCM device collection based on Software Registered in Add / Remove Programs** As explained above, the Installed Application attribute class contains the information about software registered in Add / Remove Programs. The Installed Application details comes directly from Add/Remove Programs from inventory machines. ### **SCCM Device Collection for computers where application X is registered in Add / Remove Programs** **Attributes to select from the Query Designer** **Attribute Class:** Installed Application **Attribute Name:** Product Name #### **SCCM Collection Query / WQL Query** The query below will add computers in collection where Adobe Acrobat DC is registered in the Add/Remove Programs. ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceId = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "Adobe Acrobat DC" ``` ### **SCCM Device Collection for computers where the** application X **is not registered in Add / Remove Programs** **Attributes to select from the Query Designer** **Attribute Class:** Installed Application **Attribute Name:** Product Name #### **SCCM Collection Query / WQL Query** ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ResourceId not in (select SMS_R_SYSTEM.ResourceID from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceId = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "Adobe Acrobat DC") ``` ## SCCM device collection based on 32-bit **and 64-bit Applications** As explained above, the Installed Applications and Installed Applications (64) attribute class contains the information about software registered in Add/Remove Programs for 32-bit and 64-bit applications, respectively. The Installed Applications details comes directly from Add/Remove Programs from inventory machines. ### **SCCM Device Collection for computers where Microsoft Office 32-bit is installed** **Attributes to select from the Query Designer** **Attribute Class:** Installed Applications **Attribute Name:** Display Name #### **SCCM Collection Query / WQL Query** ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId where (SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like "Microsoft Office Professional%" OR SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like "Microsoft Office Enterprise%" OR SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like "Microsoft Office Standard%") ``` ### **SCCM Device Collection for computers where Microsoft Office 64-bit is installed** **Attributes to select from the Query Designer** **Attribute Class:** Installed Applications (64) **Attribute Name:** Display Name #### **SCCM Collection Query / WQL Query** ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS_64 on SMS_G_System_ADD_REMOVE_PROGRAMS_64.ResourceID = SMS_R_System.ResourceId where (SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName like "Microsoft Office Professional%" OR SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName like "Microsoft Office Enterprise%" OR SMS_G_System_ADD_REMOVE_PROGRAMS_64.DisplayName like "Microsoft Office Standard%") ``` ### **SCCM Device Collection for computers where Microsoft Office 64-bit is installed (Using Office Product Info attribute class)** While the Installed Applications / Installed Applications (64) attribute classes can be used to create a collection for any 32-bit or 64-bit applications, there is another attribute class dedicated to Microsoft Office Products Information. The “Office Product Info” (SMS\_G\_System\_OFFICE\_PRODUCTINFO) attribute class can also be used to create query based collection for Office products based on versions, architecture and other criteria. Let’s see the example below to create a device collection for all computers where Office Professional 64-bit is installed. **Attributes to select from the Query Designer** **Attribute Class:** Office Product Info **Attribute Name:** Display Name / Architecture #### **SCCM Collection Query / WQL Query** ``` select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OFFICE_PRODUCTINFO on SMS_G_System_OFFICE_PRODUCTINFO.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OFFICE_PRODUCTINFO.ProductName like "Microsoft Office Professional%" and SMS_G_System_OFFICE_PRODUCTINFO.Architecture = "x64" ``` ## **Related Posts:** - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM, Step by Step Guides **Tags:** SCCM Collections & Device Management --- ### [SCCM Collection Based on Operating System Optional Features | ConfigMgr](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) **Published:** March 8, 2023 **Author:** Equebal Ahmad **Content:** Win32\_OptionalFeature WMI class represents the status of the optional features that are present on the operating system. In ConfigMgr, this class is represented by Server side WMI class SMS\_G\_System\_OPTIONAL\_FEATURE. This WMI class contains the data related with Operating System Optional features. This server class can be used to create SCCM query and collections based on OS optional features. ![SCCM Collection Operating System Optional Features](https://techuisitive.com/wp-content/uploads/2023/11/image-2.png)**Related post:** If you are looking for step by step process to create a dynamic / query based collection then follow this article : [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) **Other posts in this series:** - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Device Collection Based on Computer Hardware Details](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Based on operating System optional features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) Table Of Contents 1. [SMS\_G\_System\_OPTIONAL\_FEATURE – Install State](#sms-g-system-optional-feature-install-state) 2. [SCCM Collection for Computers Where Microsoft .Net Framework 3.5 is Not Enabled](#sccm-collection-for-computers-where-microsoft-net-framework-35-is-not-enabled) 3. [SCCM Collection for Computers Where Microsoft .Net Framework 3.5 is Enabled](#sccm-collection-for-computers-where-microsoft-net-framework-35-is-enabled) 4. [SCCM Collection for Computers Where SMB 1.0 / CIFS File Sharing Support Feature is Enabled](#sccm-collection-for-computers-where-smb-10-cifs-file-sharing-support-feature-is-enabled) 5. [SCCM Collection for Computers Where Telnet Client is Enabled](#sccm-collection-for-computers-where-telnet-client-is-enabled) 6. [Related Posts:](#related-posts) 7. [Explore More SCCM Guides](#explore-more-sccm-guides) ## **SMS\_G\_System\_OPTIONAL\_FEATURE – Install State** When you get the details about install states of operating system optional features, the details are pulled from the SMS\_G\_System\_OPTIONAL\_FEATURE wmi server class. On a client machine these information stored in win32\_OptionalFeature WMI class. **InstallState** Data type: **uint32** Access type: Read-only Identifies the state of the optional feature. The following states are possible: **Enabled** (1) **Disabled** (2) **Absent** (3) **Unknown** (4) ## **SCCM Collection for Computers Where Microsoft .Net Framework 3.5 is Not Enabled** ### **Attributes to select from Query Designer** **Attribute Class :** Optional Features **Attribute Name :** Caption / Install State ### **SCCM Collection Query / WQL Query** *`select distinct SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPTIONAL_FEATURE on SMS_G_System_OPTIONAL_FEATURE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_OPTIONAL_FEATURE.Caption = ".NET Framework 3.5 (includes .NET 2.0 and 3.0)" and SMS_G_System_OPTIONAL_FEATURE.InstallState = "2" order by SMS_R_System.Name`* ## **SCCM Collection for Computers Where Microsoft .Net Framework 3.5 is Enabled** ### **Attributes to select from Query Designer** **Attribute Class :** Optional Features **Attribute Name :** Caption / Install State ### **SCCM Collection Query / WQL Query** *`select distinct SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPTIONAL_FEATURE on SMS_G_System_OPTIONAL_FEATURE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_OPTIONAL_FEATURE.Caption = ".NET Framework 3.5 (includes .NET 2.0 and 3.0)" and SMS_G_System_OPTIONAL_FEATURE.InstallState = "1" order by SMS_R_System.Name`* ## **SCCM Collection for Computers Where SMB 1.0 / CIFS File Sharing Support Feature is Enabled** ### **Attributes to select from Query Designer** **Attribute Class :** Optional Features **Attribute Name :** Caption / Install State ### **SCCM Collection Query / WQL Query** *`select distinct SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from SMS_R_System inner join SMS_G_System_OPTIONAL_FEATURE on SMS_G_System_OPTIONAL_FEATURE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPTIONAL_FEATURE.Caption = "SMB 1.0/CIFS File Sharing Support" and SMS_G_System_OPTIONAL_FEATURE.InstallState = "2" order by SMS_R_System.Name`* ## **SCCM Collection for Computers Where Telnet Client is Enabled** ### **Attributes to select from Query Designer** **Attribute Class :** Optional Features **Attribute Name :** Caption / Install State ### **SCCM Collection Query / WQL Query** *`select SMS_R_System.NetbiosName, SMS_G_System_OPTIONAL_FEATURE.Caption, SMS_G_System_OPTIONAL_FEATURE.InstallState, SMS_G_System_OPTIONAL_FEATURE.Status from SMS_R_System inner join SMS_G_System_OPTIONAL_FEATURE on SMS_G_System_OPTIONAL_FEATURE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_OPTIONAL_FEATURE.Caption = "Telnet Client" and SMS_G_System_OPTIONAL_FEATURE.InstallState = "1"`* ## **Related Posts:** - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [Query Based Collections](https://techuisitive.com/tag/query-based-collections/), [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM, Step by Step Guides **Tags:** Query Based Collections, SCCM Collections & Device Management --- ### [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) **Published:** May 25, 2023 **Author:** Equebal Ahmad **Content:** The `SMS_AppDeploymentAssetDetails` Windows Management Instrumentation (WMI) class is an SMS Provider server class in Configuration Manager that represents asset-level details about the deployment. The properties of SMS\_AppDeploymentAssetDetails class can be used to create dynamic query based collection using app deployment status. **`AppStatusType`** Application status type, Possible values are: ValueApplication status1Success2InProgress3RequirementsNotMet4Unknown5Error**`StatusType`** Status type, Possible values are: ValueStatus type1Success2InProgress3RequirementsNotMet4Unknown5Error**Related Post:** If you are looking for step by step process to create a dynamic / query based collection then follow this article : [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) ## Find Application Assignment ID To create a collection based on application deployment status, we need the Assignment ID of the application. Perform the steps below to find the Assignment ID. - Navigate to Monitoring > Deployment, right-click on the column header, and select Assignment ID to add the column. - Note down the Assignment ID of the application for which you need to create a dynamic query-based collection. ![ConfigMgr Deployment | Add a column](https://techuisitive.com/wp-content/uploads/2023/05/image-2-1024x121.png)## App Deployment Status – Success The below WQL query will include all computers in the collection where the respective software deployment succeeded. `select SYS.ResourceID,SYS.ResourceType,SYS.Name,SYS.SMSUniqueIdentifier,SYS.ResourceDomainORWorkgroup,SYS.Client from sms_r_system AS sys INNER JOIN SMS_AppDeploymentAssetDetails as APP on App.MachineName = sys.name WHERE AssignmentID = '16777971' AND StatusType = 1 AND AppStatusType = 1` ## App Deployment Status – Failed The WQL query below will include all computers in the collection where the respective deployment failed. This is helpful when you need to troubleshoot application deployment failure. You can quickly identify online machines and view SCCM client logs to understand the issues. `select SYS.ResourceID,SYS.ResourceType,SYS.Name,SYS.SMSUniqueIdentifier,SYS.ResourceDomainORWorkgroup,SYS.Client from sms_r_system AS sys INNER JOIN SMS_AppDeploymentAssetDetails as APP on App.MachineName = sys.name WHERE AssignmentID = '`16777971`' AND StatusType = 5 AND AppStatusType = 5` ## App Deployment Status – In Progress The below WQL query will include all computers in the collection where the respective deployment status is In Progress. This is helpful when you need to troubleshoot application deployment on the computers where the status got stuck at the In Progress stage. `select SYS.ResourceID,SYS.ResourceType,SYS.Name,SYS.SMSUniqueIdentifier,SYS.ResourceDomainORWorkgroup,SYS.Client from sms_r_system AS sys INNER JOIN SMS_AppDeploymentAssetDetails as APP on App.MachineName = sys.name WHERE AssignmentID = '`16777971`' AND StatusType = 2 AND AppStatusType = 2` ## App Deployment Status – Unknown The below WQL query includes all computers in the collection whose deployment status is still unknown. As per Microsoft documentation, StatusType =4 should return the list of all computers with unknown deployment status. However, that is not the case. I have noticed this earlier as well when working on Software Update Compliance status. Hence, the follow different approach to identify unknown computers. The below WQL query will use subset query to identify the computers with Success, In Progress, Requirement Not Met and Failed and the computers not in this list will be considered as unknown. `select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ResourceId not in ( select SYS.ResourceID from sms_r_system AS sys INNER JOIN SMS_AppDeploymentAssetDetails as APP on App.MachineName = sys.name WHERE AssignmentID = '`16777971`' AND StatusType IN ('1','2','3','5') AND AppStatusType IN ('1','2','3','5'))` ## Related Posts - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management --- ### [How to Check Software Center Business Hours of Remote Computer | ConfigMgr](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) **Published:** June 1, 2023 **Author:** Equebal Ahmad **Content:** Troubleshooting software update deployments in ConfigMgr often requires checking whether Software Center business hours are correctly configured. While it’s easy to verify on a local machine, doing the same on a remote computer can be tricky. In this guide, we’ll walk through how to quickly check Software Center business hours remotely using PowerShell, explore log-based validation, and highlight compliance settings for remediation. ## Check Software Center Business Hours with PowerShell With this PowerShell script, you can easily check the SCCM Software Center business hours configured on remote or local computers. ``` `$computer = "Desktop01"$cmClientUserSettings = [WmiClass]"\\$computer\ROOT\ccm\ClientSDK:CCM_ClientUXSettings"$businessHours = $cmClientUserSettings.GetBusinessHours()$businessHoursCI = [string]$businessHours.StartTime + "," + [string]$businessHours.EndTime + "," + [string]$businessHours.WorkingDays#Return $businessHoursCIWrite-Host "Business Hours"Write-Host "--------------"Write-Host "Start Time : $($businessHours.StartTime)"Write-Host "End Time : $($businessHours.EndTime)"Write-Host "Working Days : $($businessHours.WorkingDays)"Write-Host ""Write-Host "Days of the week are calculate with this table : Sun=1, Mon=2, Tue=4, Wed=8, Thu=16, Fri=32, Sat=64"Write-Host "Monday – Friday is calculated as 2+4+8+16+32 = 62"` ``` ## Remediate with SCCM Compliance Settings The article below offers a detailed walkthrough for checking Software Center business hours with PowerShell and resolving misconfigurations through Compliance Settings. ## Validate Business Hours in UpdatesDeployment.log You can also identify the Software Center business hours for a given day by reviewing the *UpdatesDeployment.log* file on the client computer. Look for the `SERVICEWINDOWEVENT START` and `SERVICEWINDOWEVENT END` entries. For example, the log may show that the service window (non‑business hours) started at 22:00 and ended at 05:00. During this window, all required software updates will be installed. ![SCCM UpdateDeployment.log | Software Center Business Hours](https://techuisitive.com/wp-content/uploads/2023/05/image-17-1024x364.png)## **Related Posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management --- ### [How to Create SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) **Published:** June 27, 2023 **Author:** Equebal Ahmad **Content:** Compliance Settings are business or technical conditions to assess compliance of a device. There may be a requirement to quickly identify compliant or non compliant devices to perform quick troubleshooting or other activities and a SCCM dynamic collection is much helpful in this scenario. You can follow the below steps to create dynamic collection based on configuration baseline compliance status. Table Of Contents 1. [WMI Server Class for Configuration Baseline Compliance Status](#wmi-server-class-for-configuration-baseline-compliance-status) - [Attributes to select from Query Designer](#attributes-to-select-from-query-designer) 2. [How to find Baseline CI Unique ID](#how-to-find-baseline-ci-unique-id) - [SCCM Dynamic Collection Query for Non Compliant Devices for a Configuration baseline](#sccm-dynamic-collection-query-for-non-compliant-devices-for-a-configuration-baseline) - - [SCCM Collection Query for Compliant Devices for a Configuration baseline](#sccm-collection-query-for-compliant-devices-for-a-configuration-baseline) 3. [Related Posts](#related-posts) 4. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) **Note:** We will cover about WQL queries to create collection based on compliance baselines. If you are looking for step by step process to create a dynamic / query based collection then follow this article : [How to Create Dynamic Collection in SCCM](https://www.techuisitive.com/post/create-dynamic-collections-in-sccm-for-different-attribute-classes) ## WMI Server Class for Configuration Baseline Compliance Status SMS\_G\_System\_DCMDeploymentState is a WMI server class which store information about SCCM Configuration baseline compliance status. The name DCM stands for Desired Configuration Manager which was earlier name for Compliance Settings. The WQL query can be created from Configuration Manager Query Designer or you can simply copy the query provided below and paste the same directly in query editor. ### **Attributes to select from Query Designer** If you are using Collection query designer then select the below Attribute class. The Attributes need to be selected as per your requirements. Otherwise, you can copy and use the WQL queries provided below. **Attribute Class :** DCM Deployment State **Attributes**: - Baseline CI Unique ID - Collection ID - Compliance State - Resource ID - Resource Name ## How to find Baseline CI Unique ID - In the Configuration Manager console, navigate to **Asset and Compliance > Compliance Settings > Configuration Baseline** - Right click on the column header and select **CI Unique ID** column - Note down the CI Unique ID for Configuration baseline which collection you want to create ![SCCM Configuration Baseline | SCCM Dynamic Collection](https://techuisitive.com/wp-content/uploads/2023/05/image-16-1024x153.png)### **SCCM Dynamic Collection Query for Non Compliant Devices for a Configuration baseline** The below WQL query will include all computer in collection which are non-compliant against a baseline. You simply need to update the Baseline Unique ID in below query. `select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_DCMDeploymentState on SMS_G_System_DCMDeploymentState.ResourceId = SMS_R_System.ResourceId where SMS_G_System_DCMDeploymentState.BaselineID = "ScopeId_C7759691-9263-5AE1-9DFD-F1A9327838A7/Baseline_85409a7c-0ae1-434e-b3e3-ef40f6ac654" and SMS_G_System_DCMDeploymentState.ComplianceState != "1"` ### **SCCM Collection Query for Compliant Devices for a Configuration baseline** The below WQL query will include all computers in collection which are compliant against a baseline. You need to update the CI Unique ID in below query. `select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_DCMDeploymentState on SMS_G_System_DCMDeploymentState.ResourceId = SMS_R_System.ResourceId where SMS_G_System_DCMDeploymentState.BaselineID = "ScopeId_C7759691-9263-5AE1-9DFD-F1A9327838A7/Baseline_85409a7c-0ae1-434e-b3e3-ef40f6ac654" and SMS_G_System_DCMDeploymentState.ComplianceState "1"` ## Related Posts - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management --- ### [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/) **Published:** September 14, 2023 **Author:** Equebal Ahmad **Excerpt:** A Configuration Manager maintenance windows restrict the deployments on SCCM client during specified timeframe. The SCCM Maintenance Windows ensure that client configuration changes occur during specified time frame only and that don't affect productivity. A maintenance window can be configured with an effective date, a start and end time, and a recurrence pattern. **Content:** A Configuration Manager maintenance window restricts the deployments on the SCCM client during a specified timeframe. The SCCM Maintenance Windows ensure that client configuration changes occur during a specified time frame only and don’t affect productivity. A maintenance window can be configured with an effective date, a start and end time, and a recurrence pattern. The following tasks support maintenance windows: - Application and package deployments - Software update deployments - Compliance settings deployment and evaluation - OS and custom task sequence deployments By default, computer restarts caused by a deployment aren’t allowed outside of a maintenance window, but you can override the default. Maintenance windows affect only the time when the deployment runs. Deployments that you configure to download and run locally can download content outside of the window. When a client is a member of a device collection that has an SCCM maintenance window, a deployment runs only if its maximum allowed run time doesn’t exceed the duration of the window. If the deployment fails to run, the client generates an alert. It then reruns the deployment during the next scheduled maintenance window that has available time. Table Of Contents 1. [How to Create SCCM Maintenance Window from ConfigMgr Console](#how-to-create-sccm-maintenance-window-from-configmgr-console) 2. [How to Check SCCM Maintenance Windows Using ConfigMgr Report](#how-to-check-sccm-maintenance-windows-using-configmgr-report) 3. [How to Check SCCM Maintenance Window using SQL Query](#how-to-check-sccm-maintenance-window-using-sql-query) 4. [How to use PowerShell ConfigMgr cmdlets to check the SCCM Maintenance Window for a collection](#how-to-use-powershell-configmgr-cmdlets-to-check-the-sccm-maintenance-window-for-a-collection) 5. [How to Use Maintenance Windows as a Safety Window for Servers & Critical Workstations](#how-to-use-maintenance-windows-as-a-safety-window-for-servers-critical-workstations) 6. [How to Organize SCCM Maintenance Windows](#how-to-organize-sccm-maintenance-windows) 7. [Conclusion](#conclusion) 8. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) 9. [Related Posts](#related-posts) 10. [Explore More SCCM Guides](#explore-more-sccm-guides) ## How to Create SCCM Maintenance Window from ConfigMgr Console SCCM Maintenance Windows can be created from the collection properties > Maintenance Windows tab. Follow the steps below to create a maintenance window. In the **Configuration Manager console**, navigate to **Asset and Compliance / Device Collection**, right-click on the desired collection, and select **Properties**. Click on the yellow start button under the Maintenance Windows section. ![SCCM Collection Properties | SCCM Maintenance Windows](https://techuisitive.com/wp-content/uploads/2023/08/image-44.png)In the New Schedule dialogue box, provide the following information. - **Name**: Enter a name for the SCCM Maintenance Window. Use a naming convention that helps you to quickly identify the schedule and purpose of the maintenance window. - **Effective Date:** The date when the maintenance window will be effective. - **Start / End:** Start and end times of MW. - **Duration:** Will be calculated automatically based on the start/end time. - **Coordinated Universal Time (UTC):** Select this check box if you want to have a maintenance window based on UTC time rather than client’s local time. - **Recurrence Pattern:** Select a recurrence pattern. The maintenance window can be for one time or recurring. The recurring pattern can be daily, weekly or monthly. In the **Apply This Schedule to:** drop-down list, select the deployment type where you want the maintenance window to apply. The options available are: All Deployment, Application Deployment, and Software Update Deployment. ![SCCM Maintenance Windows Schedule | - ConfigMgr deployment scheduling ](https://techuisitive.com/wp-content/uploads/2023/08/image-45.png)Click on **Ok** to complete the MW creation process. You can see the maintenance window in the list now. ![SCCM Maintenance Windows | C configuration Manager | ConfigMgr](https://techuisitive.com/wp-content/uploads/2023/08/image-46.png)### SCCM **Maintenance Windows Offset** / SCCM patch Tuesday offset One of the challenges a ConfigMgr admin used to face was aligning the patch deployment schedule with Patch Tuesday. Let’s say an admin wants to configure the MW on the first Saturday after Patch Tuesday for pilot deployment. Starting Configuration Manager version 2303, you can now offset monthly maintenance window schedules to better align deployments with the release of monthly security updates. For example, using a maximum offset of seven days after the second Tuesday of the month sets the maintenance window for next Monday. ### **Set the Maintenance window to the first Friday after patch Tuesday.** ![SCCM Maintenance Windows Offset | Align with patch tuesday](https://techuisitive.com/wp-content/uploads/2023/08/image-47.png)## How to Check SCCM Maintenance Windows Using ConfigMgr Report The SCCM report “**Maintenance windows available to a specified client**” provides the list of all maintenance windows configured for a client. ![SCCM Report | SCCM Maintenance Window Report](https://techuisitive.com/wp-content/uploads/2023/08/image-49-1024x607.png)## How to Check SCCM Maintenance Window using SQL Query If you want to see the SCCM maintenance windows available for all members of a collection, then you can use the SQL query. You need to run the query from SQL Management Studio. You can also use this query to create an SCCM SSRS report. ``` select fcm.Name as 'Server Name',sw.CollectionID,col.Name as 'Collection Name',sw.Name as 'MW Name',sw.Description,sw.StartTime,sw.Duration,sw.IsEnabled from v_ServiceWindow SW inner join v_FullCollectionMembership fcm on fcm.CollectionID = sw.Collection inner join v_Collection col on col.CollectionID = sw.CollectionID where fcm.name in (select name from v_FullCollectionMembership where collectionID = 'CollectionID') ``` ## How to use PowerShell ConfigMgr cmdlets to check the SCCM Maintenance Window for a collection You can use **Get-CMMaintenanceWindow** PowerShell cmdlet to get the list of available MW for a collection. ### List Maintenance Window for a collection ``` Get-CMMaintenanceWindow -CollectionName "Test servers" ``` ![Check SCCM Maintenance Windows PowerShell](https://techuisitive.com/wp-content/uploads/2023/08/image-52-1024x250.png)## How to Use Maintenance Windows as a Safety Window for Servers & Critical Workstations When you create a Maintenance Window for a collection, it restricts the deployment on members during the defined maintenance windows. However, the Software Updates / Deployment may get installed again and trigger a reboot in the following scenarios. - The Maintenance Windows expired. - Servers or critical machines were not members of the collection where maintenance windows were applied. This may lead to an outage. To avoid this situation, we can create a safety maintenance window to by default, block all deployments on servers and critical machines through SCCM. This can be achieved by creating a maintenance window that will occur in the future. Let’s say we created an MW for 2033, which is 10 years from now. Apply this MW to a collection with all Windows servers. This will block the deployment on all servers by default. To allow the deployments, you can create other MWs as per the actual deployment scheduled for different server groups. ![SCCM server safety window](https://techuisitive.com/wp-content/uploads/2023/09/image-16.png)## How to Organize SCCM Maintenance Windows ConfigMgr administrator follows a different approach for organizing SCCM collections. It’s very much a personal choice, and you can use it the way you like. My recommendation is to organize maintenance window collections separately rather than applying the maintenance windows directly to a deployment collection. This will give you more flexibility while managing the deployment. To add the members to MW collections, you can simply use the Include membership rule to add different deployment collections. The naming conventions of the MW collection should be easy enough to quickly identify the schedules by looking at the collection name. Otherwise, you may need to look into the reports every time you need to troubleshoot something in a larger environment. ![Organize SCCM collections](https://techuisitive.com/wp-content/uploads/2023/09/image-17.png)## Conclusion SCCM Maintenance Windows are a powerful way to control when deployments occur, ensuring minimal disruption to users and critical servers. By leveraging the ConfigMgr console, SQL queries, and PowerShell cmdlets, administrators can create flexible schedules, align patching with Microsoft’s Patch Tuesday, and implement safety windows to prevent accidental outages. Organizing collections separately for maintenance windows further enhances manageability and troubleshooting efficiency. With proper planning, SCCM Maintenance Windows become a cornerstone of reliable and secure enterprise IT operations. ## Frequently Asked Questions (FAQs) ### **What is the purpose of SCCM Maintenance Windows?** They restrict deployments to specific timeframes, ensuring updates and changes don’t disrupt productivity outside planned schedules. ### **Can SCCM Maintenance Windows prevent server outages?** Yes. By creating safety windows (e.g., far-future schedules), admins can block unintended deployments on critical servers until explicitly allowed. ### **How can I check the configured Maintenance Windows?** You can use ConfigMgr reports, SQL queries, or PowerShell cmdlets like `Get-CMMaintenanceWindow` to view available windows for collections. ### **Should Maintenance Windows be applied directly to deployment collections?** It’s recommended to organize them separately in dedicated collections for easier management and troubleshooting. ## Related Posts - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/), [SCCM Guides](https://techuisitive.com/tag/sccm-guides/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management, SCCM Guides --- ### [Understanding SCCM Incremental Collection , Evaluation and monitoring](https://techuisitive.com/understanding-sccm-incremental-collection-evaluation-and-monitoring/) **Published:** September 23, 2023 **Author:** Equebal Ahmad **Content:** System Center Configuration Manager (SCCM) uses collection evaluation to update membership based on defined rules. While full updates run on schedules, **incremental collection evaluation** allows faster updates without waiting for the full cycle. This guide explains how incremental updates work, their advantages and limitations, and how IT admins can monitor performance using SQL queries, PowerShell, and the SCCM console.” Configuration Manager uses the following threads to handle collection evaluation. The appropriate thread is executed depending on the evaluation type. For example, if the evaluation type is incremental, then the Express thread handle collection evaluation process. - **Primary** for scheduled collection updates - **Auxiliary** to manually update collections with dependent collections - **Single** to manually update collections with no dependent collections - **Express** for incremental collection updates The following evaluation type is available for SCCM collections. - **`Manual` (1):** An administrator manually triggers a membership update. - **`Periodic` (2):** The site does a full update on a schedule. - **`Continuous` (4):** The site periodically evaluates new resources and then adds new members. This type is also known as an *incremental update*. It doesn’t do a full update on a schedule. - **`Both` (6):** A combination of both `Periodic` and `Continuous`, with both incremental updates and a full update on a schedule. This blog post is primarily focused on incremental updates. Hence, we will discuss collection incremental update, its pros and cons, and how we can identify the collections where incremental update is enabled. Table Of Contents 1. [What is SCCM Incremental Collection Update](#what-is-sccm-incremental-collection-update) 2. [Adjusting SCCM Collection Incremental Update Schedule](#adjusting-sccm-collection-incremental-update-schedule) 3. [SQL Query to list Collection with Incremental Updates Enabled](#sql-query-to-list-collection-with-incremental-updates-enabled) 4. [PowerShell Command to list all Collections with Incremental Updates Enabled](#powershell-command-to-list-all-collections-with-incremental-updates-enabled) 5. [How to Enable or Disable Incremental Updates for a Collection](#how-to-enable-or-disable-incremental-updates-for-a-collection) 6. [How to Disable Incremental Update for a Collection via PowerShell](#how-to-disable-incremental-update-for-a-collection-via-powershell) 7. [Monitoring the performance of SCCM Incremental Collection](#monitoring-the-performance-of-sccm-incremental-collection) 8. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) 9. [Explore More SCCM Guides](#explore-more-sccm-guides) ## What is SCCM Incremental Collection Update An **incremental update** allows you to quickly add systems to a collection without performing a full membership evaluation. Configuration Manager continuously monitors and updates resource objects in all collections that are configured for incremental updates. While incremental updates enable more frequent and near‑real‑time collection refreshes, they should be used carefully to avoid a negative impact on **Configuration Manager site performance**. Microsoft recommends enabling incremental updates on a maximum of **200 collections** to maintain stability and efficiency Given the potential impacts of incremental collections, it’s important to have a policy or procedure for creating the collections and assigning update schedules. Examples of policy considerations might be: - Only use incremental updates for collections that are used for security scoping, client settings, and maintenance windows. These collection updates affect client behavior and access to resources. - For applications with no licensing approval, advertise applications to existing collections, and use global conditions to restrict availability. - Outline appropriate periods for other collections that have full collection updates scheduled. The incremental update can be configured from Collection **properties > Membership Rules** tab. ![SCCM incremental collection](https://techuisitive.com/wp-content/uploads/2023/08/image-42.png)## Adjusting SCCM Collection Incremental Update Schedule The **SCCM collection incremental update schedule** controls how frequently Configuration Manager evaluates collection membership. By default, this is set to **5 minutes**, which is recommended for most environments to balance responsiveness and performance. If needed, you can change the schedule by following these steps: - Navigate to **Administration > Overview > Site Configuration > Sites**. - Select your **primary site server**. - In the ribbon, choose **Configure Site Components > Collection Membership Evaluation**. - Adjust the **incremental update interval** as required. ![incremental update collection](https://techuisitive.com/wp-content/uploads/2023/08/image-51.png) ## SQL Query to list Collection with Incremental Updates Enabled The following **SQL query lists all SCCM collections with incremental updates enabled**. You can also use this query to generate a custom **report in Configuration Manager (SCCM)** for monitoring and auditing purposes: ``` Select CollectionID, Name, Comment, LastRefreshTime, CASE RefreshType WHEN 4 THEN 'Incremental Update only' WHEN 6 THEN 'Incremental AND Full Evaluation' Else 'Unknown' End AS RefreshType, CurrentStatus, MemberCount From V_Collection Where RefreshType = '4' or RefreshType = '6' and CollectionID NOT LIKE 'SMS%' ``` ## PowerShell Command to list all Collections with Incremental Updates Enabled The **PowerShell Configuration Manager cmdlets** can also be used to retrieve details of all collections where **incremental updates** are enabled. This is useful for admins who prefer scripting over SQL queries and want to quickly audit collection settings. To run the command: Launch **PowerShell from the SCCM console** using the **Connect via PowerShell** option. Execute the following command: ``` Get-CMCollection | Select-Object CollectionID, Name, RefreshType | Where-Object {($_.RefreshType -eq 4 -or $_.RefreshType -eq 6 )-and $_.CollectionID -NotLike "SMS*"} ``` ## How to Enable or Disable Incremental Updates for a Collection You can enable or disable **incremental updates** for a collection directly from the **Configuration Manager console**. Follow these steps: 1. In the **Configuration Manager console**, navigate to: **Asset and Compliance > Overview > Device Collections** or **User Collections**. 2. Right‑click the target collection and select **Properties**. 3. Go to the **Membership Rules** tab. 4. Check or uncheck **Use incremental updates for this collection** depending on your requirement. 5. Click **OK** to save the changes. ⚠️ **Best Practice:** Microsoft recommends enabling incremental updates only for critical collections and limiting them to **200 collections maximum** to avoid performance issues. ![SCCM console collection membership evaluation settings](https://techuisitive.com/wp-content/uploads/2023/08/image-42.png)## How to Disable Incremental Update for a Collection via PowerShell You can use **PowerShell Configuration Manager cmdlets** to change the **collection refresh type**. Setting the refresh type to **2 (Periodic)** disables incremental updates while keeping the periodic schedule intact. ``` Set-CMCollection -Name "All End User devices" -RefreshType 2 ``` ### PowerShell Command to Configure Recurring Collection Evaluation To **update or create a recurring schedule** for SCCM collection evaluation, use the **New‑CMSchedule** cmdlet. This cmdlet generates a **schedule token** in Configuration Manager, which can be applied to events with different frequencies such as **daily, weekly, or monthly**. For example, the following PowerShell commands set the **collection evaluation frequency to every 7 days**: ``` $schedtoken = New-CMSchedule -DurationInterval Days -DurationCount 0 -RecurInterval Days -RecurCount 7 Set-CMCollection -Name "All End User devices" -RefreshType 2 -RefreshSchedule $schedToken ``` ## Monitoring the performance of SCCM Incremental Collection You can monitor the performance of incremental collections from the **Monitoring > Collection Evaluation** pane. In the **Incremental Evaluation Status**, you can see all collections with incremental update enabled, membership last updated, and time taken to complete refresh. You can use this to understand which collection is taking more time to update. The **Incremental Evaluation Queue** will show the list of all SCCM incremental collections that are in the evaluation queue. ![SCCM collection incremental evaluation status](https://techuisitive.com/wp-content/uploads/2023/08/image-54.png)## Frequently Asked Questions (FAQs) ### 1. What is SCCM incremental collection evaluation? Incremental collection evaluation in **System Center Configuration Manager (SCCM)** allows collections to update membership more frequently without waiting for a full scheduled refresh. This ensures near real‑time updates for critical collections. ### 2. How often does SCCM run incremental updates by default? By default, SCCM runs incremental updates every **5 minutes**. Microsoft recommends keeping this default interval to balance responsiveness with site performance. ### 3. How many collections should have incremental updates enabled? Microsoft recommends enabling incremental updates for a maximum of **200 collections**. Exceeding this limit can negatively impact **Configuration Manager site performance**. ### 4. How can I monitor incremental collection performance in SCCM? You can monitor performance using: - **SCCM console** (Collection Membership Evaluation component). - **SQL queries** to list collections with incremental updates enabled. - **PowerShell cmdlets** (`Get-CMDeviceCollection`) for quick audits. ### 5. Can I disable incremental updates for collections? Yes. You can disable incremental updates by: - Editing collection properties in the SCCM console (Membership Rules tab). - Running a PowerShell command: Set-CMCollection -CollectionId -RefreshType 2 ### 6. How do I configure recurring schedules for collection evaluation? Use the **New‑CMSchedule** cmdlet in PowerShell to create recurring schedules (daily, weekly, monthly). For example, setting evaluation every 7 days: $Schedule = New-CMSchedule -Start (Get-Date) -RecurInterval Days -RecurCount 7 Set-CMCollection -CollectionId -RefreshSchedule $Schedule  ### Conclusion **Incremental collection evaluation** in SCCM is a powerful feature that helps administrators keep collections updated more frequently, ensuring accurate targeting for deployments and compliance policies. However, it must be used wisely—limiting incremental updates to critical collections and monitoring performance regularly. By combining **incremental updates** with well‑planned **periodic schedules** and leveraging **SQL queries and PowerShell scripts** for auditing, IT admins can strike the right balance between responsiveness and site stability. Following Microsoft’s best practices ensures your **Configuration Manager environment remains efficient, scalable, and reliable**. ### Related Posts - [How to Create Dynamic Collection in SCCM](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) - [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) - [ConfigMgr: Maintenance Window for member of specific collection – SQL Query](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [SCCM Dynamic Collection Based on Device Type | Collection Queries](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) - [SCCM Collection Based on Operating System Optional Features](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) - [SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) - [SCCM Device Collection Based on Computer Hardware Details ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) - [SCCM Collection Queries for Opearting System Attribute Class](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) - [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) - [SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) - [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/ "How to Create , View and Organize SCCM Maintenance Windows") - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Tags: [SCCM Collections & Device Management](https://techuisitive.com/tag/sccm-collections-and-device-management/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Collections & Device Management --- ### [How to Configure SCCM Management Point for HTTPS | ConfigMgr](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) **Published:** November 16, 2022 **Author:** Equebal Ahmad **Excerpt:** Microsoft deprecated HTTP-only communication in Configuration Manager to increase security. The HTTP-only communication will not be supported with first release after Oct 31, 2022. Hence, existing infrastructure should be configured for HTTPS based communication in ConfigMgr. The HTTPS communication can be enabled using PKI certificates. The HTTPS communication is also required for Management Point if you want to use Cloud Management Gateway (CMG) to support internet-based clients. If you are not ready for HTTPS based communication for all clients and need HTTPS management point for CMG only then dedicate a management point for CMG and configure that one for HTTPS. **Content:** Microsoft deprecated HTTP-only communication in Configuration Manager to increase security. The HTTP-only communication will not be supported with first release after Oct 31, 2022. Hence, existing infrastructure should be configured for HTTPS-based communication in ConfigMgr. The HTTPS communication can be enabled using PKI certificates. The HTTPS communication is also required for Management Point if you want to use Cloud Management Gateway (CMG) to support internet-based clients. If you are not ready for HTTPS based communication for all clients and need HTTPS management point for CMG only then dedicate a SCCM management point for CMG and configure that one for HTTPS. In this blog post, we will walk through the SSL requirements and configuration for SCCM management point. We will use SSL certificates from Microsoft Public Key Infrastructure (PKI) --- **Related Post:** [Configure Software Update Point for SS](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/)[L | ConfigMgr | SCCM](https://www.techuisitive.com/post/configure-management-point-for-https-configmgr-sccm) [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) --- Table Of Contents 1. [Create AD Group for ConfigMgr IIS Servers](#create-ad-group-for-configmgr-iis-servers) 2. [Issue Server Authentication Certificate for SCCM IIS Site System Servers](#issue-server-authentication-certificate-for-sccm-iis-site-system-servers) 3. [Enroll Certificate on IIS Server ( SCCM Management Point Site System Server)](#enroll-certificate-on-iis-server-sccm-management-point-site-system-server) 4. [Configure IIS Default Website for SSL](#configure-iis-default-website-for-ssl) 5. [Configure Management Point for HTTPS](#configure-management-point-for-https) 6. [Related Posts:](#related-posts) 7. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Create AD Group for ConfigMgr IIS Servers** Create an AD Group with **SCCM IIS Servers** name and add SCCM site system server (e.g, SCCM Management Point) member of this AD group. When we will issue a Web server authentication certificate later, the certificate enrollment permission will be granted to this AD group. ## **Issue Server Authentication Certificate for SCCM IIS Site System Servers** On the server running the certification authority, open the Certification Authority Console, right click **Certificates Templates** and select **Manage** ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-31.jpeg)In the **Certificate Template Management** console, Right click on **Web Server template** and then select **Duplicate Template** ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-32.jpeg)In the **Duplicate Template** dialog box, ensure that **Windows 2003 Server Enterprise Edition** is selected in **Certification Authority** ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-33.jpeg)In the **General** tab, enter a template name **ConfigMgr Web Server Certificate**, Change the validity period if needed. ![Certificate template ConfigMgr Web Server Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-34.jpeg)In the **Subject Name** tab, select **Supply in the request** ![Certificate template Subject Name](https://techuisitive.com/wp-content/uploads/2023/04/image-35.jpeg)In the **Security** tab, remove the **Enroll** permission from the **Enterprise Admins** security group Choose **Add**, enter **SCCM IIS servers** in the text box and then Choose **Ok** Select the **Enroll** and **Read** permission for this group Choose Ok, Close the **Certificate Templates Console** ![Certificate template Security](https://techuisitive.com/wp-content/uploads/2023/04/image-36.jpeg)Back in the **Certification Authority** console, right click **Certificates Templates,** select **New / Certificate Template to Issue** ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-37.jpeg)In the Enable Certificate Template dialog box, select the new template you just created, **ConfigMgr Web Server Certificate ,** Click Ok ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-38.jpeg) ## **Enroll Certificate on IIS Server ( SCCM Management Point Site System Server)** Go to Run, type **certml.msc** to open Local Machine Certificate Store Right click **Certificates**, select **All Tasks / Request New Certificate** ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-39.jpeg)On the page, click **Next** If you see the **Select Certificate Enrolment Policy** page, chose **Next** On the **Request Certificates** page, identify the certificate which you have issued (**ConfigMgr Web Server Certificate** ) from the list, and then select **More information is required to enroll for this certificate. Choose here to configure settings.** ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-40.jpeg)In the Certificate Properties dialog box, in the **Subject** tab **Alternative name:** o Type: DNS o Value: Management Point Server FQDN Click on Add Click Ok to close the Certificate Properties dialog box ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-41.jpeg)Back to **Request Certificates** page, select the certificate (ConfigMgr Web Server Certificate) from the list of available certificates, click **Enroll.** ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-42.jpeg)On the **Certificates Installation Results** page, wait until the certificate is installed, click **Finish**. ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-43.jpeg) ## **Configure IIS Default Website for SSL** The next step is to configure web servers to use SSL certificate. On the Management Point site system server, Open **Internet Information (IIS) Manager** , right click on **Default Web Site** and select **Edit Bindings.** ![IIS Server Bindings](https://techuisitive.com/wp-content/uploads/2023/04/image-44.jpeg)On the **Site Bindings** window, click on **Add** ![IIS Server Bindings](https://techuisitive.com/wp-content/uploads/2023/04/image-45.jpeg)On the **Add Site Bindings** window, select **https**, leave **IP address** to **All Unassgined**. Click on **Select** and choose the SSL certificate which you enrolled for Management Point. You can now see **SSL certificate** under **SSL Certificate.** Click on **Ok** to return to **Site Bindings** windows. ![IIS Server Bindings](https://techuisitive.com/wp-content/uploads/2023/04/image-46.jpeg)On the **Site Bindings** window, click on **Close** ![IIS Server Bindings](https://techuisitive.com/wp-content/uploads/2023/04/image-47.jpeg)## **Configure Management Point for HTTPS** We have now completed all certificates requirements. The Management Point can now be configured for HTTPS. Go to **Site Configuration / Servers and Site System Roles**, select the server with Management Point role. Select **Management Point / Properties** Select **HTTPS** and click on **Apply**. Click **Ok** to close the window. Configuration Manager will now reinstall the MP role with HTTPS. You can monitor **mpsetup.log, mpMSI.log and mpcontrol.log** file to ensure that configuration was successful and management point is working fine in HTTPS mode. ![SCCM Management Point https](https://techuisitive.com/wp-content/uploads/2023/04/image-48.jpeg)## **Related Posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Infrastructure & Site Administration](https://techuisitive.com/tag/sccm-infrastructure-site-administration/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Infrastructure & Site Administration --- ### [Configure SCCM Software Update Point for SSL](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) **Published:** November 21, 2022 **Author:** Equebal Ahmad **Excerpt:** Microsoft deprecated HTTP-only communication in Configuration Manager to increase security. The HTTP-only communication will not be supported with first release after Oct 31, 2022. Hence, existing infrastructure should be configured for HTTPS based communication in ConfigMgr. The HTTPS communication can be enabled using PKI certificates. **Content:** Microsoft deprecated HTTP-only communication in Configuration Manager to increase security. The HTTP-only communication will not be supported with first release after Oct 31, 2022. Hence, existing infrastructure should be configured for HTTPS based communication in ConfigMgr. The HTTPS communication can be enabled using PKI certificates. The HTTPS communication is also required for the Software Update Point if you want to use Cloud Management Gateway (CMG) to support internet-based clients. If you are not ready for HTTPS based communication for all clients and need SSL Software Update point for CMG only then dedicate a site systems for CMG and have both the management point and software update point role on that. In this blog post, we will walk through the SSL requirements and configuration for SCCM Software Update Point. We will use SSL certificates from Microsoft Public Key Infrastructure (PKI). **Related Post:** [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) Table Of Contents 1. [Issue & Enroll server authentication certificates for ConfigMgr IIS servers](#issue-enroll-server-authentication-certificates-for-configmgr-iis-servers) 2. [Bind the certificate to the WSUS Administration site](#bind-the-certificate-to-the-wsus-administration-site) 3. [Configure the WSUS web services to require SSL](#configure-the-wsus-web-services-to-require-ssl) 4. [Configure the WSUS application to use SSL](#configure-the-wsus-application-to-use-ssl) 5. [Configure Software Update Point for SSL](#configure-software-update-point-for-ssl) 6. [Verify the WSUS console can connect using SSL](#verify-the-wsus-console-can-connect-using-ssl) 7. [Verify the site server can sync updates](#verify-the-site-server-can-sync-updates) 8. [Verify a client can scan for updates](#verify-a-client-can-scan-for-updates) 9. [Related Posts:](#related-posts) 10. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Issue & Enroll server authentication certificates for ConfigMgr IIS servers** If you have already configured the Management Point for HTTPS and SUP role is installed on same site system server then this step can be skipped. We can use the same PKI certificate for IIS WSUS administration site SSL configuration. If you need the PKI certificate for Software Update Point site system server then follow the below steps. - [Issue server authentication certificate for ConfigMgr IIS servers](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Enroll Web server certificate on ConfigMgr](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/)[ IIS servers](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm#viewer-bjgc2) ## **Bind the certificate to the WSUS Administration site** Binding a certificate to a website in IIS means that you are **activating the installed digital certificate and associating it with a particular website, port, and/or IP Address**. Follow the below process to bind a certificate to default IIS website. On the WSUS server, open Internet Information Services (IIS) Manager. Go to **Sites** > **WSUS Administration,** select Edit Bindings ![WSUS IIS bindings](https://techuisitive.co.in/wp-content/uploads/2023/04/image-216.jpeg)In the **Site Bindings** window, select the line for **https**, then select **Edit…**. Don’t remove the HTTP site binding. WSUS uses HTTP for the update content files. ![IIS site bindings](https://techuisitive.co.in/wp-content/uploads/2023/04/image-217.jpeg)Under the **SSL certificate** option, click on drop down list and select the certificate. ![IIS site bindings](https://techuisitive.co.in/wp-content/uploads/2023/04/image-218.jpeg)Click on **Ok** to close **Edit Site Binding** window. ![IIS site bindings](https://techuisitive.co.in/wp-content/uploads/2023/04/image-219.jpeg)## **Configure the WSUS web services to require SSL** In IIS Manager on the WSUS server, go to **Sites** > **WSUS Administration ,** expand the WSUS Administration site so you see the list of web services and virtual directories for WSUS. ![IIS site bindings | API Remoting](https://techuisitive.co.in/wp-content/uploads/2023/04/image-220.jpeg)Select **ApiRemovint30** and make following changes. - Enable the **Require SSL** option. - Verify the **Client certificates** option is set to **Ignore**. - Select **Apply**. Repeat the above steps for below WSUS services as well. - ClientWebService - DSSAuthWebService - ServerSyncWebService - SimpleAuthWebService ![IIS site bindings](https://techuisitive.co.in/wp-content/uploads/2023/04/image-221.jpeg)## **Configure the WSUS application to use SSL** Once you configured the web services for SSL, the WSUS application needs to be notified to perform additional configuration to support the change. The configuration need to be done using WsusUtil.exe To make the changes perform below steps: Open an admin command prompt on the WSUS server. The user account running this command must be a member of either the WSUS Administrators group or the local Administrators group. Change directory to the tools folder for WSUS: cd “c:\\Program Files\\Update Services\\Tools” Configure WSUS to use SSL with the following command: **WsusUtil.exe configuressl ** WsusUtil returns the URL of the WSUS server with the port number specified at the end. The port will be either 8531 (default) or 443. Verify the URL returned is what you expected. If something was mistyped, you can run the command again. ![SCCM IIS Server SSL Configuration](https://static.wixstatic.com/media/64e6b8_31e21e45e8ff48809ef6017e2a10b20b~mv2.jpg/v1/fill/w_592,h_95,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_31e21e45e8ff48809ef6017e2a10b20b~mv2.jpg)## **Configure Software Update Point for SSL** Perform the below steps to configure software update point to require SSL communication to WSUS server. - Open the Configuration Manager console and connect to either your central administration site or the primary site server for the software update point you need to edit. - Go to **Administration** > **Overview** > **Site Configuration** > **Servers and Site System Roles**. - Select the site system server where WSUS is installed, then select the software update point site system role. - From the ribbon, choose **Properties**. - Enable the **Require SSL communication to the WSUS server** option. ![SCCM Software Update Point } Enable SSL](https://static.wixstatic.com/media/64e6b8_8ff4d38efd2e4082a53b8a213e9cb7c9~mv2.jpg/v1/fill/w_506,h_452,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_8ff4d38efd2e4082a53b8a213e9cb7c9~mv2.jpg) ## **Verify the WSUS console can connect using SSL** Open the WSUS console and select **Action** > **Connect to Server**. - Enter the FQDN of the WSUS server for the **Server name** option. - Select **Use Secure Sockets Layer (SSL) to connect to this server** - Click on Connect ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-222.jpeg)If the configurations are good then console will connect to WSUS server without any issue. ![WSUS console](https://techuisitive.co.in/wp-content/uploads/2023/04/image-223.jpeg)## **Verify the site server can sync updates** You can follow below steps to confirm that ConfigMgr site server able to sync software updates from Microsoft updates. To validate the same, go to **Software Library > Software Updates > All Software Updates** and select **Synchronize Software Updates** ![SCCM sync updates](https://techuisitive.co.in/wp-content/uploads/2023/04/image-224.jpeg)Monitor the wsyncmgr.log on ConfigMgr site server. You should see the synchronization progress in the log file. ![wsyncmgr.log](https://techuisitive.co.in/wp-content/uploads/2023/04/image-225.jpeg)## **Verify a client can scan for updates** Check the **LocationServices.log** to confirm that the client sees the correct WSUS SSL URL ![wsynmgr.log](https://techuisitive.co.in/wp-content/uploads/2023/04/image-226.jpeg)Review the **WUAHandler.log** to verify that the client can successfully scan. ## **Related Posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Infrastructure & Site Administration](https://techuisitive.com/tag/sccm-infrastructure-site-administration/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Infrastructure & Site Administration --- ### [How to Issue & Auto enroll Client Authentication Certificate for SCCM Clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) **Published:** November 22, 2022 **Author:** Equebal Ahmad **Content:** Issuing and enrolling Client Authentication Certificates for SCCM clients is a critical step in enabling secure communication and compliance within Configuration Manager. This guide provides a clear, step‑by‑step walkthrough on how to configure certificate templates, enable auto‑enrollment via Group Policy, and ensure SCCM clients receive the required certificates seamlessly. By following these instructions, administrators can establish a reliable PKI foundation for SCCM operations. A client certificate is also required on any computer that will be managed via the Cloud Management Gateway ( CMG ), and devices are not Azure AD / Hybrid AD-joined. It is also required on the server that will host the Cloud Management Gateway connection point. Let’s understand how we can issue a client authentication certificate using Microsoft Active Directory Certificate Services (Public Key Infrastructure / PKI) and configure auto-enrollment via Group Policy. Table Of Contents 1. [How to Issue a Client Authentication Certificate from Microsoft PKI](#how-to-issue-a-client-authentication-certificate-from-microsoft-pki) 2. [Configure Client Authentication Certificate Auto Enrollment](#configure-client-authentication-certificate-auto-enrollment) 3. [How to Export Trusted Root Certificate](#how-to-export-trusted-root-certificate) 4. [Conclusion](#conclusion) 5. [Related Posts:](#related-posts) 6. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## How to Issue a Client Authentication Certificate from Microsoft PKI RDP to Certificate Authority Server On the **Certificate Authority** console, right-click **Certificate Template** and click **Manage**. ![Certificate template to Issue a Client Authentication Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-49.jpeg)Right-click **Workstation Authentication** and click **Duplicate Template.** ![Certificate template | Client Authentication Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-51.jpeg)Under the Compatibility tab, make sure to use to Windows Server 2003 under the **Certificate Authority** option. ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-50.jpeg)In the **General** tab, enter **SCCM Client Certificate** under **the Template display name.** Set the validity period as per your requirement. ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-52.jpeg)Click on the Security tab, select the Domain Computers group, and add the permission of Read and Autoenroll, do not clear **Enroll**. Then click on **Ok** ![Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-53.jpeg)Refresh the console and check if the new template is there In the **Certificate Authority** console, right-click **Certificate Templates**, choose **New**, and then choose **Certificate Template to Issue**. ![Certificate template - New template to issue](https://techuisitive.com/wp-content/uploads/2023/04/image-54.jpeg)In the **Enable Certificate Templates** dialog box, choose the new template that you just created, **ConfigMgr Client Certificate**, and then choose **OK**. ![Enable Certificate template](https://techuisitive.com/wp-content/uploads/2023/04/image-55.jpeg)## **Configure Client Authentication Certificate Auto Enrollment** The fastest way to deploy the client certificate to all your machines is through an auto-enrollment GPO. Follow the process below to configure the auto-enrollment group policy. Launch **Group Policy Management** on your Domain (Start / Administrative Tools / **Group Policy Management**) Right-click the desired OU and select **Create a GPO in this domain, and Link it here…** ![Configure Client Authentication Certificate Auto Enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-56.jpeg)Name your GPO **SCCM Client Cert – Auto Enroll**, then click OK. ![GPO Certificate auto enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-57.jpeg)A blank GPO will now be created. Right-click and edit your newly created GPO. ![GPO Certificate auto enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-58.jpeg)Navigate to: **Computer Configuration / Policies / Windows Settings / Security Settings / Public Key Policies** Right-click on **Certificate Services Client – Auto-Enrollment** and then click **Properties** ![GPO Certificate auto enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-59.jpeg)Change the **Configuration Model:** to **Enabled** Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** checkbox Click **Apply** and **OK** ![GPO Certificate auto enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-60.jpeg)The group policy is now configured for auto-enrollment. When Group Policy is reapplied, any machine on the domain that communicates with the Domain Controller will automatically request and receive a client authentication certificate. On the client machine, the certificate will be placed in the **Local Computer Personal Certificate Store** To expedite testing, you can reboot the workstation and run **the gpupdate /force** command to force an update of the Group Policy. Below is the result from the GPRESULT command. You can see that GPO has been applied, and **SCCM Client Cert- Auto enroll** is winning GPO. ![GPO Certificate auto enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-94.png)## How to **Export Trusted Root Certificate** When configuring SCCM for SSL, the trusted root certificate must be provided to the site server. This certificate is also required during the setup of the Cloud Management Gateway (CMG) to establish secure communication. Follow the steps below to export the trusted root certificate from a workstation that has enrolled the Client Authentication Certificate via Group Policy (GPO). Go to Run and type **certlm.msc** and press Enter to open the local computer certificate store. Right-click on the client authentication certificate and select **Open** ![Export Trusted Root Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-61.jpeg)In the **Certificate** page, select the highest certification path and click on **View certificate.** ![Export Trusted Root Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-62.jpeg)The **Certificate Information** page will open in a new window ![Export Trusted Root Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-65.jpeg)Click on the **Details** tab and then click on **Copy to file…** ![Export Trusted Root Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-64.jpeg)On the **Welcome to the Certificate Export Wizard** page, click on **Next** On the **Certificate Export Wizard** page, ensure that **DER conded binary X.509 (.CER)** format is selected. Click on **Next** ![Export Trusted Root Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-63.jpeg)Provide the name for the file and click on **Next** ![Export Trusted Root Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-66.jpeg)On the **Completing the Certificate Export Wizard** page, click on **Finish**. ![Export Trusted Root Certificate](https://techuisitive.com/wp-content/uploads/2023/04/image-67.jpeg)## Conclusion Issuing and enrolling Client Authentication Certificates in SCCM is a vital step for enabling secure communication, compliance, and seamless management of clients. By configuring certificate templates, enabling auto‑enrollment through Group Policy (GPO), and exporting the trusted root certificate for SSL and Cloud Management Gateway (CMG), administrators can build a reliable PKI foundation for Configuration Manager. Following this step‑by‑step process ensures that SCCM clients consistently receive the required certificates, strengthening both security and operational efficiency in your environment. ## **Related Posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Infrastructure & Site Administration](https://techuisitive.com/tag/sccm-infrastructure-site-administration/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Infrastructure & Site Administration --- ### [Cloud Management Gateway - CMG Setup Guide - Part 1 | SCCM | ConfigMgr](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) **Published:** November 26, 2022 **Author:** Equebal Ahmad **Content:** The SCCM cloud management gateway (CMG) provides a simple way to manage Configuration Manager clients over the internet. CMG does not require any additional on-premises infrastructure. The CMG services are hosted in Microsoft Azure cloud and act as a gateway for internet clients to communicate with the on-premises Configuration Manager infrastructure. In this blog post series, you will find the step-by-step guide to plan and implement a Cloud Management Gateway virtual machine scale set deployment. Please note that the option to deploy CMG as a cloud service (Classic) is deprecated. All new CMG deployments should be a Virtual machine scale set. **Post in this series:** - **Part 1 | Cloud Management Gateway (CMG) Setup Guide** - [Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate) - [Part 3 | Configure SCCM Site for SSL](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl) - [Part 4 | Integrate Azure Active Directory with ConfigMgr](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr) - [Part 5 | Setup Cloud Management Gateway](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway) - [Part 6 | Validate CMG Health & Client Communication](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication) Table Of Contents 1. [Prepare for Cloud Management Gateway (CMG) deployment with Virtual Machine Scale Set (VMSS).](#prepare-for-cloud-management-gateway-cmg-deployment-with-virtual-machine-scale-set-vmss) 2. [Identify Servers for Site System Roles](#identify-servers-for-site-system-roles) 3. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) 4. [Related posts:](#related-posts) 5. [Explore More SCCM Guides](#explore-more-sccm-guides) ## Prepare for Cloud Management Gateway (CMG) deployment with Virtual Machine Scale Set (VMSS). In this first part of the series, we’ll cover the SCCM CMG prerequisites, SCCM CMG VMSS prerequisites, and the requirements for implementing a CMG VM Scale Set in a production environment. ### **Azure Subscription** An Azure subscription is required to host the Cloud Management Gateway. This subscription can be in one of the following environments: - Global Azure cloud - Azure US Government cloud An Azure administrator needs to participate in the initial creation of certain components. When you create the CMG, you need an account that is an Azure Subscription Owner and an Azure AD Global Administrator. ### **Identify Globally Unique CMG Service URL** ConfigMgr VM Scale Set ( VMSS )Deployment do not use \*.cloudapp.net address. The service name uses the **cloudapp.azure.com** domain along with the region. For example, **GraniteFalls.EastUS.CloudApp.Azure.Com** Deployment Name should be globally unique. The ConfigMgr client policy includes the Service Name. The client resolves the Service Name via CNAME alias to the **Deployment name**. The following options are available to decide a service name. **With DNS CNAME :** You can have your own domain in the service name **Service Name**: cmgprefix. **Deployment Name**: cmgprefix.region.cloudapp.azure.com **Without DNS CNAME** Both the Service Name and the Deployment name should be the same. **Service Name**: cmgprefix.region.cloudapp.azure.com **Deployment Name**: cmgprefix.region.cloudapp.azure.com For this deployment, we will use the CMG service and the deployment name. **Service Name**: techuisitivecmg.techuisitive.com **Deployment Name**: techuisitvecmg.eastus.cloudapp.azure.com #### **Check Unique CMG Service URL Availability** The CMG Server Authentication Certificate requires a globally unique name to identify the service in Azure. The Service Name we identified in the previous steps will be used for requesting the certificate. Hence, follow the next steps to confirm that the service name is available for Virtual Machine Scale Set, Key Vault, and Storage. #### **Check name availability for Virtual Machine Scale Set** - Sign in to the Azure Portal - From the Azure portal home page, select **Create a resource** under **Azure Services** - Search for **Virtual machine scale set**, select **Create** - Select the **Subscription** and **Resource group** that you will use for the CMG. - In the **Virtual machine scale set name** field, type the prefix **techuisitivecmg** - Select the Region that you will use for CMG: **East US** The interface reflected that the Domain is available. ![Cloud Management Gateway Prerequisites Azure VM Scale Set](https://techuisitive.com/wp-content/uploads/2023/04/image-80.jpeg)#### **Check name availability for Key Vault** Follow the steps below to check the name availability for the key vault required for VMSS CMG deployment. - Sign in to the Azure Portal - From the Azure portal home page, select **Create a resource** under **Azure Services** - Search for **Key Vault**, select **Create** - Select the **Subscription** and **Resource group** that you will use for the CMG. - In the **Key vault** field, type the prefix **techuisitivecmg** - Select the Region that you will use for CMG: **East US** The interface reflected that the Domain is available. ![CMG | Azure Key valut](https://techuisitive.com/wp-content/uploads/2023/04/image-81.jpeg)#### **Check name availability for Storage Account** Follow the steps below to check the name availability for a storage account in Azure. - Sign in to the Azure Portal - From the Azure portal home page, select **Create a resource** under **Azure Services** - Search for **Storage Account**, select **Create** - Select the **Subscription** and **Resource group** that you will use for the CMG. - In the **Storage Account Name** field, type the prefix **techuisitivecmg** - Select the Region that you will use for CMG: **East US** - The interface reflected that the Domain is available. ![Check Azure storage account for Cloud Management Gateway VMSS](https://techuisitive.com/wp-content/uploads/2023/04/image-82.jpeg)### **Create DNS CNAME** A DNS CNAME is required if you want to use your own corporate domain name for the Service Name. e.g, Service Name: techuisitivecmg.techusitive.com Deployment Name: techuisitvecmg.eastus.cloudapp.azure.com The following CNAMEs need to be created at your domain registrar. Host: techuisitivecmg.techusitive.com **Destination: techuisitvecmg.eastus.cloudapp.azure.com** ![nslookup CMG](https://techuisitive.com/wp-content/uploads/2023/04/image-83.jpeg)### **Register Azure Resource Providers** The CMG service requires that you register specific resource providers in your Azure subscription. When you deploy the CMG to a virtual machine scale set, register the following resource providers: - Microsoft.KeyVault - Microsoft.Storage - Microsoft.Network - Microsoft. Compute Follow the steps below to register Azure Resource Providers in the Microsoft Azure Portal. If your Azure subscription is used for other services, most likely these resource providers are already registered. However, validate the same before proceeding to the next steps. - Log in to the Azure Portal - In the Azure Portal, select Cost management and billing - Click on Cost Management and select Go to subscription - Under the section Settings, select Resource Provider and click on Register if it’s not already registered. ![Check Azure Resource Provider for SCCM CMG VMSS](https://techuisitive.com/wp-content/uploads/2023/04/image-84.jpeg)### **Internet Access / Firewall Ports Requirements** ConfigMgr/SCCM servers must allow required internet traffic to Microsoft portals and Azure services for a secure, fully functional production environment. Review [Microsoft’s official documentation](https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/hierarchy/ports "Microsoft’s official documentation") to understand detailed internet access requirements and firewall configurations for SCCM CMG. ### **Identify Certificate Requirements for Server and Clients** The Cloud Management Gateway uses a certificate-based HTTPS web service to help secure network communication with clients. You need a web server authentication certificate for CMG. The certificate can be obtained from an internal PKI or a Public certificate authority. If you want to go for a public certificate authority, then the CMG service name must use your own domain, and a DNS CNAME will be required. We already discussed this in previous steps. **Internet-based clients** connect to the CMG to access on-premises Configuration Manager components. There are multiple options for client identity and authentication: - Azure AD - PKI certificates - Configuration Manager site-issued tokens We will use a PKI certificate from Microsoft PKI / Active Directory Certificate Service for this deployment. ### **Active Directory Groups** The following Active Directory group is required for issuing a PKI certificate for the SCCM site server and the SCCM Management Point / Software Update Point. **Group name: SCCM Site Server** Member: SCCM Site servers **Group Name: SCCM IIS Servers** Member: Management Point and Software Update Point Site System servers ### **Service Connection Point** Requirement for CMG Setup The **Configuration Manager Service Connection Point (SCP)** must be configured in **online mode** to successfully deploy and manage a Cloud Management Gateway (CMG). When the SCP is in online mode, it can: - Communicate directly with Microsoft cloud services. - Download the latest updates, feature packs, and hotfixes. - Enable CMG provisioning by exchanging required metadata with Azure. - Ensure compliance with Microsoft’s licensing and service validation requirements. If the SCP is set to **offline mode**, CMG setup will fail because the site cannot establish the necessary trust and connectivity with Azure services. ## **Identify Servers for Site System Roles** The following on-premises roles are required for Cloud Management Gateway. - Cloud Management Gateway Connection Point - Management Point (HTTPS) - Software Update Point (SSL) Configure at least one Management Point and Software Update Point for Secure Communication to be used with CMG. You’ve now completed the prerequisites and initial configuration for CMG. The next step is to issue, enroll, and export the server authentication certificate — a critical requirement for secure communication between SCCM and Azure. Continue with [**\[Part 2 Issue, Enroll & Export Server Authentication Certificate\]** ](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate "[Part 2 Issue, Enroll & Export Server Authentication Certificate] ")to move forward in your CMG setup journey.” **Next post:** [Part 2 | Issue, Enroll & Export Server Authentication ](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate)[Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) ## Frequently Asked Questions (FAQs) ### **Which certificates are required for CMG?** A server authentication certificate is mandatory. You can use either an internal PKI or a public CA. ### **What Azure roles are needed to deploy CMG?** You need Azure subscription owner rights and Azure AD Global Admin permissions to provision resources. ### **Which firewall ports must be open for CMG communication?** Outbound HTTPS (TCP 443) is required from SCCM servers to Microsoft portals and Azure services. ### **Can CMG be deployed in offline mode?** No, the Service Connection Point must be in online mode for CMG provisioning. ## **Related posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM, Step by Step Guides **Tags:** SCCM Infrastructure & Site Administration --- ### [SCCM CMG Setup Guide (Part 2): Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) **Published:** November 26, 2022 **Author:** Equebal Ahmad **Excerpt:** The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over internet. In the first part of this blog post series, we discussed about CMG prerequisites and requirements. In this post, we will discuss about web server authenication certificate requirements for CMG. We will issue PKI certificate from Microsoft PKI, enroll that to SCCM primary site server and export the same to .PFX format to use during CMG setup. **Content:** The cloud management gateway (CMG) provides a simple way to manage the Configuration Manager client over the internet. In the first part of this blog post series, we discussed CMG prerequisites and requirements. In this post, we will discuss web server authentication certificate requirements for CMG. We will issue a PKI certificate from Microsoft PKI, enroll in the SCCM primary site server, and export the same to.PFX format to use during CMG setup. ## **Post in this series:** - [Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - **Part 2 | Issue, Enroll & Export Server Authentication Certificate** - [Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) Table Of Contents 1. [Post in this series:](#post-in-this-series) 2. [Issue Web Server Authentication Certificate](#issue-web-server-authentication-certificate) 3. [Enroll Certificate on SCCM Primary Site](#enroll-certificate-on-sccm-primary-site) 4. [Export Certificate with Private Key](#export-certificate-with-private-key) 5. [Related posts:](#related-posts) 6. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Issue Web Server Authentication Certificate** A web server authentication certificate is required to establish secure communication between Configuration Manager and the Cloud Management Gateway service hosted in Azure. Follow the steps below to issue a web server (IIS Server) authentication certificate from Microsoft PKI. On the server running the **certification authority**, open the Certification Authority Console, right-click Certificates Templates, and select **Manage.** ![Certmgmt console | Server Authentication Certificate](https://techuisitive.co.in/wp-content/uploads/2023/04/image-108.jpeg)In the Certificate Template Management console, right-click on the **Web Server** template and then select **Duplicate Template** ![Certmgmt console](https://techuisitive.co.in/wp-content/uploads/2023/04/image-109.jpeg)In the **Duplicate Template** dialog box, ensure that **Windows Server 2003** is selected in the **Certification Authority** option**.** ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-110.jpeg)In the General tab, enter a template name . Change the validity period as required. ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-111.jpeg)In the **Request Handling** tab, select **Allow private key to be exported** ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-112.jpeg)In the **Security tab**, remove the **Enroll** permission from the **Enterprise Admins** security group ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-113.jpeg)Choose **Add**, enter **SCCM IIS servers** in the text box, and then choose **Ok** ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-114.jpeg)Select the **Enroll** and **Read** permission for this group. Choose **Ok**, and Close the Certificate Templates Console. ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-115.jpeg)Back in the Certification Authority console, right-click **Certificates Templates**, select **New / Certificate Template to Issue** ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-116.jpeg)In the **Enable Certificate Template** window, select the new template you just created, , and click **Ok** ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-117.jpeg) ## **Enroll Certificate on SCCM Primary Site** We have issued a web server authentication certificate in previous steps. Now we need to enroll the certificate on the SCCM primary site server. RDP to the SCCM Primary site server and follow the steps below to enroll the certificate. Go to run, type **certlm.msc,** and press Enter to launch **the Local Certificate Store** In the console, expand **Certificates (Local computer) / Personal / Certificates** Right-click **Certificates**, select **All Tasks / Request New Certificate** ![Request New Certificate](https://techuisitive.co.in/wp-content/uploads/2023/04/image-118.jpeg)On the **Before you Begin** page, click **Next** If you see the **Select Certificate Enrolment** Policy page, choose **Next** On the **Request Certificates** page, identify from the list, and then select **More information is required to enroll for this certificate. Choose here to configure settings**. ![Certificate enrollment](https://techuisitive.co.in/wp-content/uploads/2023/04/image-119.jpeg)In the **Certificate Properties** dialog box, in the **Subject** tab, provide the following details. **Subject Name:** o **Type**: Common Name o **Value**: techuisitivecmg.techusitive.com Click on Add **Alternative name:** o **Type**: DNS o **Value**: techuisitivecmg.techusitive.com Click on Add **Note**: The value (techuisitivecmg.techusitive.com) is the CMG Service Name, which we identified in pre-requisites. ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-120.jpeg)In the **General** tab, enter a friendly name for the certificate. Click Ok to close the Certificate Properties dialog box ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-121.jpeg)On the **Request Certificates** page, select from the list of available certificates, and click **Enroll**. ![Certificate enrollment](https://techuisitive.co.in/wp-content/uploads/2023/04/image-122.jpeg)On the C**ertificates Installation Results** page, wait until the certificate is installed. click **Finish** ![Certificate template](https://techuisitive.co.in/wp-content/uploads/2023/04/image-123.jpeg)The certificate should now be available in Personal > Certificates folder. ![Certlm](https://techuisitive.co.in/wp-content/uploads/2023/04/image-124.jpeg) ## **Export Certificate with Private Key** On the SCCM server, in Certificates (Local computer) console, right-click <**Web Server Certificate**> that you just created, select **All Tasks / Export** ![Export Certificate](https://techuisitive.co.in/wp-content/uploads/2023/04/image-125.jpeg)In the **Certificates Export Wizard**, choose **Next** On the **Export Private Key** page, select Yes, export the private key, and click **Next** ![Export Certificate](https://techuisitive.co.in/wp-content/uploads/2023/04/image-126.jpeg)On the **Export file format** page, ensure that the **Personal Information Exchange – PKCS #12 (.PFX)** option is selected. Select **Include all certificates in the certification path if possible**, click **Next** ![Export Certificate](https://techuisitive.co.in/wp-content/uploads/2023/04/image-127.jpeg)On the **Security** page, specify a strong password to protect the exported certificate with its private key, and click **Next** ![Export Certificate](https://techuisitive.co.in/wp-content/uploads/2023/04/image-128.jpeg)On the **File to Export** page, specify the name of the file that you want to export and click Next to finish the export. ![Export Certificate](https://techuisitive.co.in/wp-content/uploads/2023/04/image-129.jpeg)With the server authentication certificate issued, enrolled, and exported, the Part 2 configuration is now complete. You can proceed to the next step in this series. **Next Post:** [Part 3 | Configure SCCM Site for ](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl)[SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) ## **Related posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Infrastructure & Site Administration](https://techuisitive.com/tag/sccm-infrastructure-site-administration/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM, Step by Step Guides **Tags:** SCCM Infrastructure & Site Administration --- ### [SCCM CMG Setup Guide - Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) **Published:** November 26, 2022 **Author:** Equebal Ahmad **Content:** The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over internet. In the previous post, we discussed about server authentication certificate requirements for CMG. In the part 3 of SCCM CMG setup guide series, we will discuss about SSL configurations for SCCM site and client authentication certificate requirements. ## **Post in this series:** - [Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [Part 2 | Issue, Enroll & Export Server ](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate)[Authentication ](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/)[Certificate](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate) - **Part 3 | Configure SCCM Site for SSL** - [Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [Part 5 | Setup Cloud Management ](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway)[Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) Table Of Contents 1. [Post in this series:](#post-in-this-series) 2. [Deploy Client Authentication Certificate for ConfigMgr Clients](#deploy-client-authentication-certificate-for-configmgr-clients) 3. [Configure Management Point for HTTPS](#configure-management-point-for-https) 4. [Configure Software Update Point for SSL](#configure-software-update-point-for-ssl) 5. [Configure SCCM Site for HTTPS](#configure-sccm-site-for-https) 6. [Related posts:](#related-posts) 7. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Deploy Client Authentication Certificate for ConfigMgr Clients** A client certificate is required on any computer that needs SSL communication with the Configuration Manager HTTPS Management Point or SSL Software Update Point. A client certificate is also required on any computer that will be managed via the Cloud Management Gateway ( CMG ), and devices are not Azure AD / Hybrid AD joined. It is also required on the server that will host the Cloud Management Gateway connection point. Follow the steps below to issue and auto-enroll a client authentication certificate for Configuration Manager clients. We will issue the certificate from Microsoft Active Directory Certificate Service (PKI) and use Group Policy ( GPO) to auto-enroll the certificate on all domain computers. [Issue and auto-enroll client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - Issue Client Authentication Certificate - Configure Client Authentication Certificate Auto Enrollment - Export Trusted Root Certificate **Note:** The certificate exported in the last step will be required during CMG setup. ## **Configure Management Point for HTTPS** The Cloud management gateway (CMG) requires an HTTPS management point for secure communication. You need at least one management point in HTTPS mode in your hierarchy to support internet-based client through CMG. If you don’t have an HTTPS management point in your ConfigMgr hierarch,y then follow the below article to configure the same prior to going ahead with CMG setup. [Configure Management Point for HTTPS | SCCM | ConfigMgr](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) ## **Configure Software Update Point for SSL** The Cloud management gateway (CMG) requires an SSL-enabled software update point to support an internet-based client. You need at least one SSL-enabled software update point in the hierarchy to deploy software updates on internet-based clients. If you don’t have an SSL-enabled software update point in your ConfigMgr hierarchy, then follow the below article to configure the same. The software update point role is not a mandatory requirement for CMG setup, and you can perform this step later as well. [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) ## **Configure SCCM Site for HTTPS** The SCCM site needs to be configured for SSL communication with clients. Please ensure that the following settings are configured. In the SCCM console, go to **Administration/Site configuration/Sites**, select **Properties,** and click on the **Communication Security** tab. - Ensure that the **HTTPS or HTTP** option is selected under **Site System Settings**. - Under **Client Settings**, select **Use PKI client certificate when available** - Under **Trusted Root Certificate Authority**, click on **Set** and upload the trusted root certificate you exported during client authentication certificate deployment (refer: [Export Trusted Root Certificate](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/#viewer-fdkpg) ). ![SCCm Site Properties PKI Certificate](https://techuisitive.co.in/wp-content/uploads/2023/04/image-130.jpeg)**Next Post:** [Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) ## **Related posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Infrastructure & Site Administration](https://techuisitive.com/tag/sccm-infrastructure-site-administration/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Infrastructure & Site Administration --- ### [SCCM CMG Setup Guide - Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) **Published:** November 26, 2022 **Author:** Equebal Ahmad **Content:** The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over internet. In the previous posts we discussed about CMG prerequisites, server authentication certificate requirement for CMG, client authentication certificate reqiurment and SSL configuration for ConfigMgr site. In this post, we will discuss about Configuration Manager site integration with Azure Active Directory. ## **Post in this series:** - [Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [Part 3 | Configure SCCM Site ](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl)[for ](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/)[SSL](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl) - Part 4 | Integrate Azure Active Directory with ConfigMgr - [Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) Table Of Contents 1. [Post in this series:](#post-in-this-series) 2. [Configure Azure Services](#configure-azure-services) 3. [Run Azure Full Discovery](#run-azure-full-discovery) 4. [Verify App registration in Azure](#verify-app-registration-in-azure) 5. [Related posts:](#related-posts) 6. [Explore More SCCM Guides](#explore-more-sccm-guides) ## **Configure Azure Services** The Configuration Manager site need to be integrated with Azure AD before we go ahead with Cloud Management Gateway setup. The integration process creates and register two apps (Server and Client) in Azure active directory. These apps are used for SCCM site and client commincation with CMG service hosted in Azure. Follow the below process to complete the integration. On the SCCM console, go to **Administration > Cloud Services > Azure Services**, right click and select **Configure Azure Services** Provide a Name **Techuisitive CMG**, Select **Cloud Management** and click on **Next**. ![SCCM CMG Azure Services | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.co.in/wp-content/uploads/2023/04/image-131.jpeg)Browse and Create Web App (Cloud management web app) and then Native app (Cloud management native client app. In the **App Properties** page, To create a **Web App**, click on **Browse** ![SCCM CMG App Properties](https://techuisitive.co.in/wp-content/uploads/2023/04/image-132.jpeg)Click **Create** on Server App window ![SCCM CMG App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-133.jpeg)Provide the below details in **Create Server Application** window. • **Application Name:** ConfigMgr CMG server App • **Secret Key expires:** 1 years • **Azure AD admin account:** Sign in with Azure AD admin account • **Azure AD Tenant Name:** Select Azure AD Tenant name from the list Click on **Ok** ![SCCM CMG App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-134.jpeg)Review the details and click on **Ok** to create Web App and retrun to Server App Window. ![SCCM CMG App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-135.jpeg)Back in **App properties** click on **Browse** under **Native Client app** to create Client app. ![SCCM CMG App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-136.jpeg)In the **Client App** window, Click on **Create**. ![SCCM CMG App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-137.jpeg)Provide the following details in **Create Client Application**. • **Application Name:** ConfigMgr CMG Client App • **Azure AD admin account:** Sign in with Azure AD admin account • **Azure AD Tenant Name:** Select Azure AD Tenant name from the list Click on **Ok** to return to previous window. ![SCCM CMG Client App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-138.jpeg)In the **Client App** window, click on **Ok**. ![SCCM CMG Client App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-139.jpeg)Back to **App Properties** window, click on **Next**. ![SCCM CMG Client App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-140.jpeg)On the **Discovery** page, select **Enable Azure Active Directory User Discovery,** click **Next** ![SCCM CMG Client App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-141.jpeg) In the **Summary** page, review the details and click on **Next** to finish the task. ![SCCM CMG Client App](https://techuisitive.co.in/wp-content/uploads/2023/04/image-142.jpeg)You can now see the Azure Service details in ConfigMgr console. ![SCCM CMG Status](https://techuisitive.co.in/wp-content/uploads/2023/04/image-143.jpeg)## **Run Azure Full Discovery** - In the SCCM console, select **Administration/Azure Services/ ** - At the bottom view, right click on the **Azure Active Directory User Disocvery** and select **Run Full Discovery Now** ![SCCM CMG - Full Discovery](https://techuisitive.co.in/wp-content/uploads/2023/04/image-144.jpeg)## **Verify App registration in Azure** Once ConfigMgr site integration with Azure Ad completed, you can see the Client and Server apps registered in Azure Active Directory. - Login to Azure portal. - Search for **App registration** and click on **All applcations** tab. - You should see Server and Client app listed there. ![Azure App Registration](https://techuisitive.co.in/wp-content/uploads/2023/04/image-145.jpeg)**Nex post :** [Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) ## **Related posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Infrastructure & Site Administration](https://techuisitive.com/tag/sccm-infrastructure-site-administration/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Infrastructure & Site Administration --- ### [SCCM CMG Setup Guide - Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) **Published:** November 26, 2022 **Author:** Equebal Ahmad **Content:** The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over internet. In the previous posts we discussed about CMG prerequisites, server authentication certificate requirement for CMG, client authentication certificate reqiurment, SSL configuration for ConfigMgr site and ConfigMgr site integration with Azure Active Directory. In this post, we will discuss about creating Cloud Management Gateway, adding CMG connection point site system role, configuring other CMG and client related settings. ## **Post in this series:** - [Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://www.techuisitive.com/post/cloud-management-gateway-cmg-setup-guide-part1) - [Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate) - [Part 3 | Configure SCCM Site for SSL](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl) - [Part 4 | Integrate Azure Active Directory with ConfigMgr](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr) - **Part 5 | Setup Cloud Management Gateway** - [Part 6 | Validate CMG Health & Client Communication](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication) Table Of Contents 1. [Post in this series:](#post-in-this-series) 2. [Create Cloud Management Gateway](#create-cloud-management-gateway) 3. [Add CMG connection Point Site System Role](#add-cmg-connection-point-site-system-role) 4. [Configure Management Point to Allow CMG Traffic](#configure-management-point-to-allow-cmg-traffic) 5. [Configure Software Update Point to Allow CMG Traffic](#configure-software-update-point-to-allow-cmg-traffic) 6. [Configure Client Settings](#configure-client-settings) 7. [Related posts:](#related-posts) 8. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Create Cloud Management Gateway** Go to Configuration Manager console **Administration/Features** and ensure **Cloud management gateway with Azure VM scale set** is turned on. ![Enable Cloud Management Gateway with Azure VM Scale Set](https://techuisitive.co.in/wp-content/uploads/2023/04/image-146.jpeg)Go to the **Administration > Cloud Services > Cloud Management Gateway**, right click on Cloud Management Gateway and select **Create Cloud Management Gateway** ![Create Cloud Management Gateway](https://techuisitive.co.in/wp-content/uploads/2023/04/image-147.jpeg)Sign-in with Azure Administrator rights. The Azure AD App name should be auto-populated, click **Next** ![Setup Cloud Management Gateway](https://techuisitive.co.in/wp-content/uploads/2023/04/image-148.jpeg)On the **Specify additional details for this cloud services** page **Specify a server PKI certificate for the cloud service:** - **Certificate file :** Click on **Browse** and select the server authentication certificate you exported for CMG. - **Service name** will populate automatically based on CNAME/Alternative DNS name provided in certificate. - Select correct **region** - Validate deployment name (serviceprefix.region.cloudapp.azure.com) - Resource Group: Create new one - VM Instances: 1 **Specify security settings for authenticating client connections through Cloud Management Gateway:** - Click on the **certificate** and Upload PKI trusted root certificate you have exported earlier. Refer [Export Trusted Root Certificate](https://www.techuisitive.com/post/deploy-client-authentication-certificate-for-sccm-clients-configmgr#viewer-fdkpg) - Select **Verify client certificate revocation** Select “**Allow CMG to function as a cloud distribution point and serve content from Azure storage**” Click on **Next** ![Specify additional details for this cloud service](https://techuisitive.com/wp-content/uploads/2023/09/image.jpeg)In the **Alert** page, leave the default settings and click on **Next**. Review the details in **Summary** page and click on Next to complete the tasks. ![Cloud Management Gateway Wizard Summary](https://techuisitive.co.in/wp-content/uploads/2023/04/image-150.jpeg)In **Completion** page, click on **Close**. ![Cloud Management Gateway Wizard Completion](https://techuisitive.co.in/wp-content/uploads/2023/04/image-151.jpeg)You can now see the Cloud Management Gateway service name in console. The Status will change to **Ready** once **provisioning** completed. ![Cloud Management Gateway](https://techuisitive.co.in/wp-content/uploads/2023/04/image-152.jpeg) ## **Add CMG connection Point Site System Role** Cloud Management Gateway connection point manage all communication between ConfigMgr on premises infrastructure and Cloud Management Gateway service hosted in Microsoft Azure. Follow the below steps to add a Cloud Management Gateway Connection Point site system role. In the SCCM console, go to **Administration > Site Configuration > Servers and Site system roles** > select and right click on **Site system server > Add site system roles** ![Add CMG Connection Point](https://techuisitive.co.in/wp-content/uploads/2023/04/image-153.jpeg)Click on **Next** twice to got to **System Role Section** page. Select **Cloud Management Gateway Connection Point** and click on **Next** ![Add CMG Connection Point](https://techuisitive.co.in/wp-content/uploads/2023/04/image-154.jpeg)Select Cloud **Management Gateway name** and Region and click on **Next** ![Add CMG Connection Point](https://techuisitive.co.in/wp-content/uploads/2023/04/image-155.jpeg)Confirm the settings and click on Next to finish. ![Add CMG Connection Point](https://techuisitive.co.in/wp-content/uploads/2023/04/image-156.jpeg)In the **Completion** page, click on **Close**. ![Add CMG Connection Point](https://techuisitive.co.in/wp-content/uploads/2023/04/image-157.jpeg)Go to **Cloud Management Gateway** and select **CMG service** Name. Check if Cloud connection point role status is **Connected** ![Add CMG Connection Point](https://techuisitive.co.in/wp-content/uploads/2023/04/image-158.jpeg)## **Configure Management Point to Allow CMG Traffic** The Management Point need to be configured to allow Cloud Management Gateway traffic. - Go to **Configuration Manager console / Administration / Site configuration / Servers and site system role** - Select Site system with the Management Point role which you want to use for CMG - Right click on **Management Point** and select **Properties** - Ensure following settings are configured to allow internet traffics through CMG - Select **Allow Configuration Manager cloud management gatway traffic** - Select **Allow intranet and internet connections** if you want to use this management point for both internet and intranet clients - Select **Allow internet only communication** if you want to use this management point for internet clients only. You must have another management point to support intranet clients if selecting this option. ![Allow Configuration Manager Cloud management gateway traffic | Management Point](https://techuisitive.co.in/wp-content/uploads/2023/04/image-159.jpeg)## **Configure Software Update Point to Allow CMG Traffic** The Software Update Point need to be configured to allow Cloud Management Gateway traffic. - Go to **Configuration Manager console / Administration / Site configuration / Servers and site system role** - Select Site system with the Software Update Point role which you want to use for CMG - Right click on **Software Update Point** and select **Properties** - Ensure following settings are configured to allow internet traffics through CMG - Select **Allow Configuration Manager cloud management gatway traffic** - Select **Allow Internet and intranet client connections** if you want to use this management point for both internet and intranet clients - Select **Allow internet only client connections** if you want to use this software update point for internet clients only. You must have another software update point to support intranet clients if selecting this option. ![Software Update Point | Allow Configuration Manager Cloud Management Gateway traffic](https://techuisitive.co.in/wp-content/uploads/2023/04/image-160.jpeg) ## **Configure Client Settings** In the SCCM console, go to **Administration > Client Settings**, select client settings name and go to Properties Configure Following settings **Cloud Services** **Enable client to use a cloud management gateway** – Yes **Allow access to cloud distribution point** – Yes ![CMG Client Settings](https://techuisitive.co.in/wp-content/uploads/2023/04/image-161.jpeg)**Client Policy** **Enable user policy requests from Internet client** – Yes ![CMG Client Settings](https://techuisitive.co.in/wp-content/uploads/2023/04/image-162.jpeg)**Nex post :**[ Part 6 | Validate CMG Health & Client Communication](https://www.techuisitive.com/post/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication) ## **Related posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Infrastructure & Site Administration](https://techuisitive.com/tag/sccm-infrastructure-site-administration/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Infrastructure & Site Administration --- ### [SCCM CMG Setup Guide - Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) **Published:** November 26, 2022 **Author:** Equebal Ahmad **Content:** The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over internet. In the previous posts we discussed about CMG prerequisites, server authentication certificate requirement for CMG, client authentication certificate reqiurment, SSL configuration for ConfigMgr site , ConfigMgr site integration with Azure Active Directory and CMG setup and client settings. In this post, we will discuss about validating Cloud Management Gateway services and client communication. ## **Post in this series:** - [Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - **Part 6 | Validate CMG Health & Client Communication** Table Of Contents 1. [Post in this series:](#post-in-this-series) 2. [Check CMG Status](#check-cmg-status) 3. [Check Client Policy](#check-client-policy) 4. [Check if Clients are Communicating from the Internet](#check-if-clients-are-communicating-from-the-internet) 5. [Check CMG Role Endpoint Status](#check-cmg-role-endpoint-status) 6. [Monitor CMG Health from Monitoring > Cloud Management](#monitor-cmg-health-from-monitoring-cloud-management) 7. [Related posts:](#related-posts) 8. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Check CMG Status** Go to **Administration > Cloud Services > Cloud Management Gateway** and check the following - CMG service status is **Ready** - Select the Connection Points tab at the bottom of the console and check if the Connection Point status is **Connected** ![SCCM CMG Connection Analyzer | Validate CMG Health](https://techuisitive.com/wp-content/uploads/2023/04/image-163.jpeg)While the CMG service name is selected, click on **Connection Analyzer** **Simulate the testing for the Azure AD user** - Sign in with an Azure AD user - Click on **Start** to test the connections **Simulate the testing for the SCCM client** - Select **Client certificate** - Click on **Browse** and select **Client Authentication Certificate** - Click on Start to test the connections ![SCCM CMG connection analyser](https://techuisitive.com/wp-content/uploads/2023/04/image-164.jpeg)## **Check Client Policy** Verify that the client has received the internet-based management URL. The client should receive the policy while on the intranet. - On the client connected to the Intranet, go to Configuration Manager client properties > network tab - Verify that the CMG service name is visible in Internet Internet-based **management point** option ![SCCM Client properties CMG url](https://techuisitive.com/wp-content/uploads/2023/04/image-165.jpeg) ## **Check if Clients are Communicating from the Internet** Perform below checks for the machines that are connected to the Internet. The client must have received Internet based management URL to be able to communicate with CMG. - Go to **SCCM console > Devices** - Add the **Device online from the** Internet and the **Device online Management Point** column - If the client is able to communicate through CMG, you can see the CMG management point URL ![SCCM CMG device online from internet](https://techuisitive.com/wp-content/uploads/2023/04/image-166.jpeg)If you want to see the list of all machines that are online from the Internet, you can quickly apply below criteria. ![CMG Status](https://techuisitive.com/wp-content/uploads/2023/04/image-113.png)## **Check CMG Role Endpoint Status** Go to **Administration > Cloud Services > Cloud Management Gateway,** select **CMG Service Name,** and select the Role Endpoint tab at the bottom of the screen. You will see the communication status for the Management Point and Software Update Point for CMG. You can see the total number of requests in the last 30 days. When a new CMG is created, the number of requests can confirm that clients are able to communicate with SCCM via Cloud Management Gateway. ## **Monitor CMG Health from Monitoring > Cloud Management** You can also monitor Cloud Management Gateway health from the ConfigMgr console > Monitoring > Cloud Management pane. This dashboard shows the details such as client online from Cloud Management Gateway / Intranet Management Point, CMG traffic in the last 30 days, Client online trends in the last 30 days. ![SCCM Cloud Management Traffic monitoring](https://techuisitive.com/wp-content/uploads/2023/04/image-114.png)## **Related posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Infrastructure & Site Administration](https://techuisitive.com/tag/sccm-infrastructure-site-administration/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Infrastructure & Site Administration --- ### [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) **Published:** November 26, 2017 **Author:** Equebal Ahmad **Content:** Software distribution failures in SCCM can stem from issues with content delivery, client health, or policy application. Effective troubleshooting requires knowing which reports to check and which client‑side logs provide actionable insights. This guide consolidates the most important steps, log references, and error codes to help administrators quickly diagnose and resolve deployment problems. Note: This article lists the steps for troubleshooting SCCM software distribution (legacy package & program model). Table Of Contents 1. [Content Monitoring and Validation from Console](#content-monitoring-and-validation-from-console) 2. [Reports](#reports) 3. [Log Files](#log-files) - [Policyagent.log](#policyagentlog) - - [PolicyEvaluator.log](#policyevaluatorlog) - - [Execmgr.log](#execmgrlog) - - [CAS.log](#caslog) - - [Location services.log](#location-serviceslog) - - [ContentTransferManager.log](#contenttransfermanagerlog) - - [Datatransferservices.log](#datatransferserviceslog) 4. [Deployment Errors](#deployment-errors) - [Exit Code](#exit-code) - - [Program Failed with Runtime Exceeded Error:](#program-failed-with-runtime-exceeded-error) - - [The program is waiting for the service window availability](#the-program-is-waiting-for-the-service-window-availability) - - [Program waiting for content for a long time](#program-waiting-for-content-for-a-long-time) - - [Program failed with Exit Code 1603 – A fatal error occurred during installation](#program-failed-with-exit-code-1603-a-fatal-error-occurred-during-installation) - - [Error: Software Distribution Site Settings for the client are missing from WMI](#error-software-distribution-site-settings-for-the-client-are-missing-from-wmi) 5. [References](#references) 6. [Related Posts:](#related-posts) 7. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## Content Monitoring and Validation from Console The article below provides details on content monitoring and validation from the console. [https://blogs.technet.microsoft.com/inside\_osd/2011/04/06/configuration-manager-2012-content-monitoring-and-validation/](https://blogs.technet.microsoft.com/inside_osd/2011/04/06/configuration-manager-2012-content-monitoring-and-validation/) ## Reports SCCM reports should be the first thing to check for the software deployment status. By looking into the report, you can determine the scope of failure, such as large-scale failure, location-specific failure or client-specific issues. A large-scale failure may be caused by an issue with a package or a program, while an issue can be related to a specific client if the deployment failure rate is low and limited to a few clients. There are multiple reports available for each category. All Software Distribution reports can be found in below folders under Monitoring > Reporting > reports. · Software Distribution – Collections · Software Distribution – Content · Software Distribution – Package and Program Deployment · Software Distribution – Package and program Deployment Status As a Deployment Administrator, it’s advisable that you browse through all these reports and make yourself familiar with them so you can quickly refer to them whenever required. For Example, you can refer to “Package and program deployment status messages for a specified client and deployment” to check the deployment status of a specific deployment for a specific machine. While another report, “Status of a specified package and program deployment,” can be referred to know the overall status of a specific deployment. ## Log Files Reviewing client-side logs is one of the most important steps to quickly identify any possible issue with deployment. There are a few log files that you should review when troubleshooting software distribution issues. A complete list of SCCM 2012 log files is available here. While log files can be viewed in Notepad, there is a tool, [CMTrace](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/#cmtrace "CMTrace"), in Configuration Manager that will simplify the log review experience. This tool can be found under \\tools folder. This tool can be used for real-time monitoring of the log file. You can find here more details about CMTrace and other tools that every Configuration Manager administrator should know. ### **Policyagent.log** When you make a change in the Configuration Manager console, the site server creates a policy to communicate the change to the client. The site server sends the policy to the management point, and the client polls for policy at the interval configured in the Computer Client Agent properties. The SCCM client takes appropriate actions as soon as a policy arrives. The Policyagent.log records policy download requests using the Data Transfer services. This log file helps to troubleshoot policy request problems. The entries similar to the one below should be recorded in the log file policy download. ***Download of policy CCM\_Policy1, PolicyID=”ScopeID\_D791533\_4C64JH/Authlist\_43b454f-aa453d”*** If you do not see any activity in PolicyAgent.log for long time (may be couple of days), then check SCCM client health as it may not be healthy. ### **PolicyEvaluator.log** The PolicyEvaluator.log records the details of new policy settings. This log can help to troubleshoot policy override issues. ### **Execmgr.log** Execmgr.log provides the execution details of the advertised programs or updates their status. This log file provides brief details such as the command line for the executed program and the exit code. By looking into the error carefully, you can identify the issue quickly. The Excemgr.log should include the following entry when a new policy for a package arrives on the client. The presence of such an entry helps you to determine whether you have the latest policy for the new package populating the client. ***Policy arrived for parent package PKG00001 Program Test Program1*** When a policy is updated for a program that the client received earlier, the following entries will be shown. ***Policy is updated for parent package PKG00001 Program Test Program1*** If the package is not available on the client machine, then you will see the entry for the package download request. ***Requesting content from CAS for package PKG00001 version 1*** The Execmgr.log shows download progress and completed status. The following entries should be included in the log when the package download starts until completion. ***Program Test Program1 change to state STATE\_ADVANCED\_DOWNLOAD content in progress*** ***Execution Request for Package PKG00001 program Test Program1 state change from NotExist to AdanceDownload*** ***Mandatory Execution requested for program Test Program1 and advertisement ADV00001*** ***Successfully raised SoftDistWaitingContentEvent event for program Test Program1*** ***Execution Request for package PKG00001 program Test Program1 state change from WaitingDependency to waitingcontent*** ***Execution Request for Package PKG00001 program Test Program1 state change from WaitingContent to NotifyExecutinon*** The further entries should include the program path, the command line, and execution status. ***Successfully selected content location C:\\Windows\\System32\\CCM\\Cache\\PKG00001.1.System*** ***Command line = “C:\\Windows\\system32\\CCM\\Cache\\PKG00001.1.system\\TestProgram1.bat*** ***Raised Program Started Event for Advertisement: ADV00001, Package: PKG00001, Program: Test Program 1*** ***Program Exit Code 0*** ***Execution is completed for program test program1. The exit code is 0, The execution status is success.*** ### **CAS.log** The CAS (Content Access Service) maintains the local package cache and checks if it already has the content. If content is not present in the cache, then CAS instructs ContentTransferManager to initiate the download. CAS will be notified again once the download is completed. The details below should be found in CAS.log for each request. ***Successfully created download request for content*** ***Matching DP location found 0*** ***Download completed for content*** ### **Location services.log** The LocationServices.log records attempt to find management points and distribution points. This log file can help to troubleshoot scenarios where the client cannot find a management point or distribution point. ### **ContentTransferManager.log** ContentTransferManager is the one who determines how the content should be downloaded. When a package is to be downloaded from a distribution point using BITS, the download request is handed over to DataTransferService.log: ### **Datatransferservices.log** The DataTransferServices.log records all Background Intelligent Transfer (BITS) communication for policy or package download. The entries related to package download can be found here. ## Deployment Errors The Execmgr.log records the success or failure information for all advertisements. The information below can help troubleshoot the issue. ### **Exit Code** The Excecmgr.log records the exit code for all deployments. By understanding the exit code, you can move forward with troubleshooting in the right direction. For all success deployment, the exit code will be 0. ***Execution is completed for program test program1. The exit code is 0, the execution status is success.*** To know the description of common exit codes, you can use the ‘net Helpmsg’ command from the command prompt. For Example, the deployment failed with Exit Code 1. As you see in the screenshot below, the error code 1 error description is ‘Incorrect Function’. Most probably, the issue is with the command line you have provided in the program. So, you need to re-validate the command line. ![Exit code net helpmsg](https://techuisitive.com/wp-content/uploads/2023/04/image-28.jpeg)Another example: ![net helpmsg 1619](https://techuisitive.com/wp-content/uploads/2023/04/image-29.jpeg)In fact, by understanding the error code and its description, you can quickly move towards the next troubleshooting steps for SCCM deployments. You may not get the details of all exit codes using the above command. However, you can refer to Microsoft Documentation System Error Codes for a complete list of error codes. There are custom error codes for Software Distribution, which can be found [here](https://www.blogger.com/blog/post/edit/342669710247136852/1236727204634257138#). ### Program Failed with Runtime Exceeded Error: The most common issues that lead to the above failure reasons are as follows. 1\. The “Maximum allowed run time” set in program properties is too short for the installation to complete. The default time is 120 minutes, and it should be fine with most of the deployment. ![SCCM program maximum allowed run time](https://techuisitive.com/wp-content/uploads/2023/04/image-30.jpeg)2\. The program is not a silent install, and it’s waiting for user input. This may happen due to error messages popping up if install is not completely silent. If it’s a silent install, then try to install manually with the same command line that is used in the package program. 3\. There may be an issue with the installation package, which might get stuck in the middle. Try to install the package manually to identify any possible issues with the package. 4\. Select the “Allow users to interact with this program” checkbox in program properties and deploy to the test machine, check if you are getting any prompts during installation. ### **The program** is waiting for the service window **availability** [Maintenance Windows](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) provide administrators with a way to define a period of time that limits when changes can be made on the system that are members of a collection. You will see similar details in Execemgr.log when a Service window is not available. You can also refer to ‘ServiceWindowsManager.log’ for more specific information about Maintenance Windows. ***Successfully raised SoftDistWaitingForServiceWindowEvent event for program Test Program1*** ***Execution Request for advert ADV00001 package PKG00001 program Test Program1 state change from Ready to WaitingServiceWindow execmgr*** To check all Maintenance Windows available for a client, you can refer to the **“Maintenance Windows Available to a Particular Client”** SCCM report. ### **Program waiting for content for a long time** If you are seeing the message below for a long time, then there may be an issue with package download. However, review DataTransferServices.log to check if the download is in progress. ***Execution Request for package program state change from WaitingDependency to waitingcontent*** Refer to the article below to know the details about **Content Monitoring and validation** The article below provides good details about basic content deployment troubleshooting ### **Program failed with Exit Code 1603 – A fatal error occurred during installation** The error code 1603 is a generic Windows Installer error code. This error indicates that a problem occurred during installation, and there can be various reasons behind the failure. The error code 1603 is the most difficult to troubleshoot. The best option to troubleshoot error 1603 is to use MSI verbose logging. You need to re-run the setup with verbose logging enabled. You can follow the similar steps listed below. Generate a verbose log using the command. This command will create a verbose log file, which offers a lot of information about the installation. ***Msiexec /i \\setup.msi /l\*v c:\\temp\\msi.log*** Open the log file in a text editor such as Notepad and review carefully. The article below describes a few tricks that you can use to quickly identify the failure reason from the verbose log. [https://blogs.msdn.microsoft.com/astebner/2005/08/01/how-to-locate-the-cause-of-error-code-1603-in-a-verbose-msi-log-file/](https://www.blogger.com/blog/post/edit/342669710247136852/1236727204634257138#) · ### **Error: Software Distribution Site Settings for the client are missing from WMI** The above error indicates that the client has not yet received the software distribution site setting. This may happen due to the following reasons - Check if the client is healthy. You can review ccmexec.log to know client health status. - An issue with WMI, try to stop the WMI service, rename **%windir%\\system32\\wbem\\repository** folder and start WMI again. - The client has not received the policy from Management Point. Check PolicyAgent.log to know if new policies are coming. - Check locationservices.log to know if the client is able to locate a Management Point. ## References **Troubleshooting SCCM Software Distribution** **Troubleshooting Configuration Manager** [Microsoft Press eBook](https://www.blogger.com/blog/post/edit/342669710247136852/1236727204634257138#) ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting, Troubleshooting --- ### [Configuration Manager OSD task sequence fails with error code 0x80004005](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/) **Published:** June 1, 2018 **Author:** Equebal Ahmad **Excerpt:** The MECM / SCCM task sequence may fail with following error: An error occurred while retrieving policy for this computer (0x80004005). For more information, please contact your system administrator or helpdesk operator. The error code 0x80004005 is a generic error code which means Access Denied. There may be number of reason behind this and you should analyze smsts.log to understand exact reason behind this error code. **Content:** When deploying operating systems with Configuration Manager (SCCM/ConfigMgr), administrators may encounter the dreaded error code **0x80004005**. This generic failure can be particularly frustrating because it doesn’t point to a single root cause—it often arises from issues such as missing drivers, boundary misconfigurations, or network connectivity problems during the task sequence. Understanding how to interpret log files like *smsts.log* and systematically narrowing down potential causes is key to resolving this error and ensuring smooth OS deployment across your environment. You may encounter the following error during OSD. ***An error occurred while retrieving policy for this computer (0x80004005). For more information, please contact your system administrator or helpdesk operator.*** As mentioned above, the error code 0x80004005 is a generic error code, which means Access Denied. There may be a number of reasons behind this, and you should analyze [**smsts.log**](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/)to understand the exact reason behind this error code. ## **Time Sync Issue** **Error in smsts.log** ``` SyncTimeWithMP() failed. 80072ee7.TSMBootstrap 25-4-2018 18:02:191501 (0x0580) Failed to get time information from MP: MPServerName ``` If you see the above errors in smsts.log then it can be related to a time sync issue Check the date and time on the client machine BIOS. You can press F8 in the Windows PE screen to open a command prompt and validate the date and time from the command line. In case of a time issue, correct the time and retry the Task sequence. ## **DNS Issue** **Error in smsts.log** ``` unknown host (gethostbyname failed) sending with winhttp failed; 80072ee7 Failed to get client identity (80072ee7) ``` The above error indicates DNS-related issues. You can launch the command prompt by pressing F8 and validate the following things. - Check if an IP address has been assigned to the machine by the DHCP server. - Check if you can ping the Management Point using the Management Point server FQDN. If you have used Dynamic media while creating the USB boot disk, then try Site-based media and select the management point client reporting to. ## **The self-signed certificate has expired** The above issue also happens due to expired self-signed certificates. Follow the steps below to check the self-signed certificate expiry date. - Open the Configuration Manager console - Navigate to \\Administration\\Overview\\Site Configuration\\Servers and Site System Roles - Select the Site System in the top right pane - Right-click on Distribution Point in the bottom right pane and select Properties - In the Distribution Point Properties windows, go to the Communication tab and validate the Self-signed certificate date. ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM OSD, SCCM Troubleshooting, Troubleshooting --- ### [Failed to connect with DP - Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) **Published:** April 30, 2021 **Author:** Equebal Ahmad **Content:** ## **Issue:** The SCCM package distribution was failing on one of the newly commissioned Distribution Point. The Distmgr.log on primary site server was showing below error. **ERROR DPConnection::ConnectRemoteIISManagementWMI() – Failed to connect to . error = 0x8004100e** Error code 0x8004100e translates to WBEM\_E\_INVALID\_NAMESPACE. The error **ConnectRemoteIISManagementWMI()** was also indicating that the issue is with WMI. ![distmgr.log error code 0x8004100e ](https://techuisitive.com/wp-content/uploads/2023/04/image.png)## **Cause:** IIS 6 WMI Compatibility was not installed on Distribution Point. This is required component for accessing WMI namespace on Remote IIS server. ![Add server roles](https://techuisitive.com/wp-content/uploads/2023/04/image.jpeg) ## **Solution:** Installed IIS 6 WMI Compatibility on Distribution Point. Refreshed the package on DP after installation and package distributed on distribution point without any issue. ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting --- ### [How to Initiate SCCM Client Agent Actions Using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) **Published:** March 2, 2022 **Author:** Equebal Ahmad **Excerpt:** The SCCM client agent actions can be manually triggered to force SCCM client agent to download the policy or re-evaluate specific tasks such as hardware inventory immediately. When you are logged on a local machine, this can be quickly performed by going to Configuration Manager client properties > Action tab. However in real word, SCCM administrators mostly perform the troubleshooting remotely without taking the remote control of end user devices. **Content:** The SCCM client agent actions can be manually triggered to force the SCCM client agent to download the policy or re-evaluate specific tasks, such as hardware inventory, immediately. When you are logged on to a local machine, this can be quickly performed by going to the Configuration Manager client properties > Action tab. However, in the real world, SCCM administrators mostly perform troubleshooting remotely without taking control of end-user devices. Table Of Contents 1. [SCCM Client Agent Actions Trigger Schedule ID](#sccm-client-agent-actions-trigger-schedule-id) 2. [PowerShell Command to Initiate SCCM Client Agent Actions](#powershell-command-to-initiate-sccm-client-agent-actions) - [Local Machine](#local-machine) - - [Remote Machine](#remote-machine) - - [Remote Machine – PowerShell Remote](#remote-machine-powershell-remote) - - [Full command lines to use with PowerShell Remote / Local Computer](#full-command-lines-to-use-with-powershell-remote-local-computer) 3. [Related Posts](#related-posts) 4. [Explore More SCCM Guides](#explore-more-sccm-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## SCCM Client Agent Actions Trigger Schedule ID Every action listed under the Action tab has a specific Trigger Schedule ID, and these IDs can be used to trigger the action manually using PowerShell commands. ![SCCM Client Agent Actions](https://techuisitive.com/wp-content/uploads/2023/05/image.png)**Client Action Trigger Schedule ID****Client Action Name**{00000000-0000-0000-0000-000000000021}Machine policy retrieval & Evaluation Cycle{00000000-0000-0000-0000-000000000022}Machine policy evaluation cycle{00000000-0000-0000-0000-000000000001}Hardware inventory cycle{00000000-0000-0000-0000-000000000002}Software inventory cycle{00000000-0000-0000-0000-000000000003}Discovery Data Collection Cycle{00000000-0000-0000-0000-000000000113}Software updates scan cycle{00000000-0000-0000-0000-000000000114}Software updates deployment evaluation cycle{00000000-0000-0000-0000-000000000031}Software metering usage report cycle{00000000-0000-0000-0000-000000000121}Application deployment evaluation cycle{00000000-0000-0000-0000-000000000026}User policy retrieval{00000000-0000-0000-0000-000000000027}User policy evaluation cycle{00000000-0000-0000-0000-000000000032}Windows installer source list update cycle{00000000-0000-0000-0000-000000000010}File collection## PowerShell Command to Initiate SCCM Client Agent Actions ### Local Machine **Machine policy retrieval & Evaluation Cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000021}" ``` ### Remote Machine **Machine policy retrieval & Evaluation Cycle:** ``` Invoke-WmiMethod -ComputerName "Host Name" -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000021}" ``` ### Remote Machine – PowerShell Remote Another best option during troubleshooting is to use PowerShell remoting. The PowerShell **Enter-PSSession** cmdlet will allow you to connect with the remote computer. Once you connect with remote PowerShell, you can execute all commands similar to a local machine. Please note that the Windows remote management (WinRm) service must be running on the remote computer for PowerShell remoting to work. ``` Enter-Pssession "Host Name" Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000021}" ``` ### Full command lines to use with PowerShell Remote / Local Computer **Machine policy retrieval & Evaluation Cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000021}" ``` **Machine Policy Evaluation Cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000022}" ``` **Discovery data collection Cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000003}" ``` **Software Inventory Cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000002}" ``` **Hardware Inventor Cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000001}" ``` **Software Update Scan Cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000113}" ``` **Software Update Deployment Evaluation Cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000114}" ``` **Software Metering Usage Report Cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000031}" ``` **Application Deployment Evaluation:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000121}" ``` **User policy retrieval:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000026}" ``` **User policy evaluation cycle:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000027}" ``` **Windows installer source list update cycle**: ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000032}" ``` **File Collection:** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000010}" ``` ## Related Posts - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [SCCM Troubleshooting](https://techuisitive.com/tag/sccm-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting --- ### [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) **Published:** March 21, 2022 **Author:** Equebal Ahmad **Excerpt:** ConfigMgtr | SCCM client installation may fail with below error when management point is configured for HTTPS. [CCMHTTP] ERROR: URL=http://CMSRV01.techuisitive.local/ccm_system/request, Port=80, Options=1248, Code=0, Text=CCM_E_BAD_HTTP_STATUS_CODE Failed (0x87d0027e) to send location request to 'CMSRV01.techuisitive.local'. StatusCode 403, StatusText 'Forbidden' GetDPLocations failed with error 0x87d0027e Failed to get DP locations as the expected version from MP 'CMSRV01.techuisitive.local'. Error 0x87d0027e **Content:** When deploying the **SCCM client**, administrators may encounter the dreaded installation failure with error code **0x87d0027e**. This error typically occurs when the client setup cannot communicate properly with the **Management Point (MP)**, often due to HTTPS misconfiguration, certificate trust issues, or incorrect command-line parameters. In this guide, we’ll break down the **causes of error 0x87d0027e**, walk through **step-by-step troubleshooting**, and share best practices to ensure a smooth SCCM client installation across your environment. ## Issue 1: Download fails when the Management Point is configured to use HTTPS The SCCM client installation failed with the following error when the management point was configured for HTTPS. ``` [CCMHTTP] ERROR: URL=http://CMSRV01.techuisitive.local/ccm_system/request, Port=80, Options=1248, Code=0, Text=CCM_E_BAD_HTTP_STATUS_CODE Failed (0x87d0027e) to send location request to 'CMSRV01.techuisitive.local'. StatusCode 403, StatusText 'Forbidden' GetDPLocations failed with error 0x87d0027e Failed to get DP locations as the expected version from MP 'CMSRV01.techuisitive.local'. Error 0x87d0027e ``` ![ccmsetup logs | error 0x87d0027e](https://techuisitive.com/wp-content/uploads/2023/04/image-27.jpeg) ## **Solution** for Error 0x87d0027e When installing the **Configuration Manager (SCCM) client** from a **Management Point (MP) configured for HTTPS**, you must explicitly define the HTTPS properties using the `/mp` switch in the `ccmsetup.exe` command. ``` ccmsetup.exe SMSSITECODE=P01 /mp:https://mpserver.domain.com ``` - `SMSSITECODE=P01` → Site code where client should register - `/mp:` → Explicitly defines HTTPS Management Point ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** SCCM Troubleshooting --- ### [OSD Task Sequence Failed with Error 0x80072EE7 | SCCM | ConfigMgr](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) **Published:** March 25, 2022 **Author:** Equebal Ahmad **Excerpt:** Configuration Manager Windows 10 / Windows 11 Operating System Deployment failed with Error code 0x80072ee7 once machine reboot into full OS mode during OS Deployment. The following errors are logged in smsts.log file. unknown host (gethostbyname failed) Sending with winhttp failed; 0x80072ee7 Failed to send status message (80072ee7) **Content:** During SCCM Operating System Deployment (OSD), you may encounter the error **0x80072EE7** when the machine reboots into full OS mode. This error indicates that the client cannot resolve the SCCM server name or address, often due to missing or incorrect network drivers. In this guide, we’ll walk through the root cause analysis using *smsts.log*, explain why the Ethernet adapter fails to initialize, and provide step‑by‑step remediation strategies to ensure a successful deployment. ## **Issue** *In Configuration Manager (SCCM), Windows 10 and Windows 11 Operating System Deployment may fail with error code **0x80072EE7** after the machine reboots into full OS mode. The issue is captured in the **smsts.log** file, where the following errors are recorded.* *unknown host (gethostbyname failed)* *Sending with winhttp failed; 0x80072ee7* *failed to send the request* *Failed to send status message (80072ee7)* *Note: This article focuses* on the error 0x80072ee7 when it occurs in full OS mode. If you get the same error code during the Windows PE phase, then the issue may be related to DHCP, DNS, or drivers in the *Windows PE boot image.* ## **Cause:** The error code **0x80072EE7** translates to *“The server name or address could not be resolved.”* In SCCM/ConfigMgr, this error often occurs due to incorrect TCP/IPv4 settings and typically points to a **network driver issue** during the Task Sequence. When the machine reboots into full OS mode, it cannot communicate with the SCCM server, causing the OSD to fail with error 0x80072EE7. Log analysis confirms that the **Windows PE phase completed successfully**, but the failure occurred after the system transitioned into **Windows full OS mode**, where the network adapter was unable to initialize properly. ![SCCM OSD - Error 0x80072EE7 - smsts.log](https://techuisitive.com/wp-content/uploads/2023/03/image-41.png)Further analysis of the **smsts.log** file shows that the Ethernet adapter was not detected during the Task Sequence. Instead, only the wireless adapter was identified, but no IP address was assigned to the Wi‑Fi adapter. As a result, the machine failed to establish network connectivity, preventing communication with the SCCM/ConfigMgr server and causing the OSD to fail with error **0x80072EE7**. ![SCCM OSD - Error 0x80072EE7 - smsts.log](https://techuisitive.com/wp-content/uploads/2023/03/image-42.png)The Task Sequence failed because the **Ethernet adapter was not detected**, leaving the client unable to communicate with the **SCCM/ConfigMgr Management Point**. Without a valid network connection, the Operating System Deployment (OSD) process could not continue, resulting in error **0x80072EE7**. ![SCCM OSD - Error 0x80072EE7 - smsts.log](https://techuisitive.com/wp-content/uploads/2023/03/image-43.png)## **Solution:** Since the Ethernet adapter was not detected, the issue is most likely related to **network drivers**. To fix error **0x80072EE7** during SCCM OSD on Windows 10 or Windows 11 machines, follow these steps: Confirm that the **Apply Drivers / Apply Driver Package** step was executed during Task Sequence execution. **Check network connectivity** Verify that there was no network outage at the time of deployment. If the OSD succeeds on a retry, the failure may have been caused by a temporary network interruption. **Validate network drivers** Add the latest drivers for the specific hardware model in **ConfigMgr**. Include an **Apply Drivers** or **Apply Driver Package** step in the Task Sequence. **Re‑validate product name** - Even if drivers are already added, confirm the product name matches the hardware. Hardware models may have different product names due to specification changes. Use the following PowerShell command to get the product name: `Get-WmiObject -Class win32_computersystemproduct `Example output:Code`IdentifyingNumber : PFXXXXXX Name : 20XXXXXX Vendor : LENOVO Version : ThinkPad X390 Caption : Computer System Product` **Check Task Sequence execution** Review the **smsts.log** or Task Sequence status messages in Configuration Manager. ## **Related Posts:** - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [PXE-E99: Unexpected network error – SCCM OSD]() - [Location of smsts.log file during SCCM OSD](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [Configuration Manager OSD task sequence fails with error code 0x80004005](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM OSD, SCCM Troubleshooting, Troubleshooting --- ### [PXE-E99 : Unexpected network error - SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) **Published:** April 20, 2022 **Author:** Equebal Ahmad **Content:** Encountering PXE-E99: Unexpected Network Error during SCCM OSD can be frustrating, especially when it happens randomly across machines. This guide walks you through the root cause of the issue, explains why SCCM fails to recognize certain devices, and provides step-by-step troubleshooting methods using SMSPXE logs and database cleanup. By the end, you’ll know exactly how to resolve PXE boot failures and ensure smoother OS deployments. ## Issue During Operating System Deployment (OSD) with Configuration Manager (SCCM), the PXE boot process may intermittently fail on certain machines, displaying the PXE‑E99: Unexpected Network Error. ``` >>Start PXE Over IPv4 Station IP address is : xx.xxx.xxx.xxx Server IP address is : xx.xxx.xxx.xxx NBP filename is smsboot\x64\Wdsmgfw.efi NBP filesize is 0 bytes PXE-E99: Unexpected network error. ``` ![PXE-E99 Error](https://techuisitive.com/wp-content/uploads/2023/04/image-60.png)## **Cause:** This issue can occur when the SCCM OSD Task Sequence is deployed only to the Unknown Computers collection. If the machine was previously built, a record already exists in the SCCM database. As a result, the device is no longer treated as an unknown computer, and SCCM does not find any active deployment for it. Consequently, the PXE‑enabled Distribution Point rejects the boot image request. ## **Solution** The quickest way to locate a machine record in SCCM is by searching with its MAC address. This can be done directly from the Configuration Manager console or through a ConfigMgr report. However, in many cases, no record may be found in SCCM using the MAC address alone.” ![SCCM Console Search Device using Mac address for PXE E99 error](https://techuisitive.com/wp-content/uploads/2023/04/image-61.png)We need to dig deeper in that case. The SMSPXE.log on the PXE-enabled Distribution Point comes to our rescue. Open **smspxe.log** in CMTrace and try PXE boot on the problematic machine. You can find the real-time logs for the machine communicating with the PXE-enabled DP. See what’s happened in our case. We tried to find the machine in SCCM using the device MAC address, but we could not find any records. However, the smspxe.log shows that the device is in the database, and it could not find any deployment available for the device. ![smspxe.log showing real time boot request and boot image offering by configuration manager.](https://techuisitive.com/wp-content/uploads/2023/04/image-62.png)*D3:15:C2:5C:6A:C7, X023984C-15DB-99Z2-A25D-F43DB2F4X123: **Device is in the database.*** *D3:15:C2:5C:6A:C7, X023984C-15DB-99Z2-A25D-F43DB2F4X123: **no advertisements found*** Next, we searched for the device record in the SCCM console using the SMBIOS ID and successfully located it. After deleting the existing record from the Configuration Manager database, the machine was treated as an Unknown Computer. On the subsequent PXE boot attempt, the OSD Task Sequence was detected, and the PXE‑E99 error was resolved. ![Configuration Manager console showing device search using SMBIOS GUID](https://techuisitive.com/wp-content/uploads/2023/04/image-63.png)## **Related Posts:** - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [PXE-E99: Unexpected network error – SCCM OSD]() - [Location of smsts.log file during SCCM OSD](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [Configuration Manager OSD task sequence fails with error code 0x80004005](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM OSD, SCCM Troubleshooting, Troubleshooting --- ### [SCCM PXE Boot Troubleshooting Guide: Fix OSD Deployment Failures in ConfigMgr](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) **Published:** June 2, 2022 **Author:** Equebal Ahmad **Excerpt:** Preboot Execution Environment (PXE) boot in SCCM enables administrators to easily access the Windows Preinstallation Environment (WinPE) across the network via PXE. PXE is an industry standard created by Intel that provides pre-boot services within the devices firmware that enables devices to download network boot programs to client computers. In this article, we will brief how to troubleshoot SCCM OSD PXE issues. **Content:** PXE boot is one of the most common methods used in **SCCM/Configuration Manager (ConfigMgr)** for **Operating System Deployment (OSD)**. However, administrators often encounter PXE boot failures that prevent task sequences from starting. These issues can stem from DHCP misconfigurations, missing boot images, or distribution point problems. In this guide, we’ll walk through the most frequent PXE errors, explain how to analyze log files such as **smspxe.log**, and provide step‑by‑step troubleshooting techniques to quickly restore OSD functionality. If you want to know more about the PXE boot process in the Configuration Manager, then you should start with [this](https://docs.microsoft.com/en-us/troubleshoot/mem/configmgr/understand-pxe-boot) Microsoft article. The article explains the PXE boot process in Configuration Manager. ## **Troubleshooting SCCM OSD PXE Issues** To effectively troubleshoot **PXE boot issues in SCCM/Configuration Manager (ConfigMgr/MECM)**, it’s important to understand the components involved in the PXE process. PXE relies on several elements—such as **DHCP configuration, Distribution Points, boot images, and network connectivity**—and a failure in any of these can prevent the client from starting the task sequence. By breaking down each component, administrators can quickly pinpoint the root cause and apply the right fix. ### **1. Verify IP Helper Configuration for PXE Boot** **IP helpers** are used to forward DHCP broadcast requests to DHCP servers located in different network subnets. By default, a DHCP request generated by a client computer is a broadcast that cannot travel outside its local subnet or VLAN. To enable PXE boot across multiple subnets, IP helpers must be configured on the routers so that DHCP broadcasts are forwarded to the **DHCP server** and the **PXE‑enabled Distribution Point (DP)**. If you suspect an issue with IP helper configuration, work with your organization’s **network team** to validate that IP helpers are correctly forwarding DHCP requests to both the DHCP server and the PXE‑enabled DP. To configure IP helpers on routers, you will need the following details: - **Source VLAN/Subnet** used for PXE‑based OS deployment - **IP address of the PXE‑enabled Distribution Point** - **DHCP server IP address** ### **2. DHCP Discovery Troubleshooting for PXE Boot in SCCM** If the **PXE boot process** fails before **Windows PE (WinPE)** loads, the client will display a **PXE error code** on the screen. Below are some of the common error messages you may encounter during SCCM/ConfigMgr OSD deployments. #### **PXE-E51: No DHCP or proxyDHCP offers were received** ![PXE-E51: No DHCP or proxyDHCP offers were received](https://techuisitive.com/wp-content/uploads/2023/03/image-44.png)The **PXE‑E51 error** indicates that the PXE client did not receive a response to its **DHCPDISCOVER message**. This failure usually points to a problem with DHCP availability or network forwarding. **Possible causes include:** - **No DHCP server available** in the network, or the DHCP service is down. - The **DHCP server is not configured** to respond to PXE client requests. - **IP helpers are not configured** on routers to forward DHCPDISCOVER broadcasts to the DHCP server or PXE‑enabled Distribution Point in a different subnet. #### **PXE-E52: proxyDHCP offers were received. No DHCP offers were received** ![PXE-E52: proxyDHCP offers were received. No DHCP offers were received](https://techuisitive.com/wp-content/uploads/2023/03/image-54.jpeg)The **PXE‑E52 error** indicates that the PXE client has received one or more **proxyDHCP offers** but did not receive a valid **DHCP offer**. This situation typically points to DHCP availability or configuration issues in the environment. **Possible causes include:** - **No DHCP server available** in the network, or the DHCP service is down. - The **DHCP server is not configured** to respond to PXE client requests. - **IP helpers are not configured** on routers to forward DHCPDISCOVER broadcasts to the DHCP server or PXE‑enabled Distribution Point in a different subnet. #### **PXE-E53: No boot filename received** ![PXE-E53: No boot filename received](https://techuisitive.com/wp-content/uploads/2023/03/image-45.png)The **PXE‑E53 error** occurs when the PXE client receives a reply to its **DHCPDISCOVER message** but the **boot file information is missing**. Without the boot file details, the PXE boot process cannot continue into **Windows PE (WinPE)**. **Possible causes include:** - **DHCP Options 66 and 67** are not properly configured to provide the PXE server and boot file name details. This applies if you are using a DHCP server to supply PXE boot information to clients. - **IP helpers are not configured** on routers to forward DHCPDISCOVER broadcasts to the PXE server in a different subnet. ### **3. PXE Boot Stuck at “Start PXE over IPv4/IPv6** This is another common issue encountered during **SCCM/ConfigMgr Operating System Deployment (OSD)** using PXE boot. When initiating a PXE‑based image deployment, the client may display the **“Start PXE over IPv4”** or **“Start PXE over IPv6”** message and then remain stuck on that screen without progressing further. Understanding why PXE boot hangs at this stage is critical for effective **SCCM PXE troubleshooting**, as it often points to problems with **network configuration, DHCP/IP helpers, or boot image availability**. ![Start PXE over IPv4](https://techuisitive.com/wp-content/uploads/2023/03/image-46.png)### **Cause:** The **PXE boot request** may be rejected by SCCM/ConfigMgr due to one of the following reasons: - The **Task Sequence is deployed only to Unknown Computers**. As a result, any PXE boot request from a known device (already present in SCCM) will be rejected. - The **device was previously imaged** using SCCM, and its record already exists in the SCCM database. - A **USB‑to‑Ethernet adapter** is being reused across multiple devices, and the adapter’s MAC address is already present in the SCCM database, causing conflicts. You can see the following entries in the SMSPXE.LOG file on the PXE-enabled distribution Point for the device you are trying to PXE boot. The location of the smspxe.log file on the PXE-enabled distribution point is **\\\\DP server\\SMS\_DP$\\SMS\\Logs** *D3:15:C2:5C:6A:C7, X023984C-15DB-99Z2-A25D-F43DB2F4X123: **Device is in the database.*** *D3:15:C2:5C:6A:C7, X023984C-15DB-99Z2-A25D-F43DB2F4X123: **no advertisements found*** ![SCCM PXE no advertisements found](https://techuisitive.com/wp-content/uploads/2023/03/image-47.png)### **Solution:** The device record already exists in **SCCM/ConfigMgr**. To resolve this, delete the machine entry from the SCCM database. You can locate the record using the **Device Serial Number, MAC address, or SMBIOS GUID**. Note that the serial number will only be available if the client was previously active and had submitted hardware inventory to SCCM. Find the device in SCCM with the MAC address: ![SCCM Device Search from SCCM console for using Mac Address](https://techuisitive.com/wp-content/uploads/2023/03/image-48.png)Find the Device in SCCM with the SMBIOS GUID / Device ID: ![SCCM Device Search from SCCM console for using SMBIOS GUID](https://techuisitive.com/wp-content/uploads/2023/03/image-49.png)#### Using a USB‑to‑Ethernet Adapter for PXE Boot – Whitelist USB to Ethernet Adapter If you are using a single **USB‑to‑Ethernet adapter** to build multiple devices via PXE boot, the **MAC address of the adapter must be whitelisted** in SCCM/ConfigMgr. Without whitelisting, SCCM may reject PXE requests because the same MAC address is detected across different machines. To whitelist the adapter’s MAC address in SCCM: 1. Navigate to **Hierarchy Settings Properties**. 2. Go to the **Client Approval and Conflicting Records** tab. 3. Add the MAC address under **Duplicate Hardware Identifiers**. This will allow SCCM to ignore the hardware ID of the devices for the purpose of PXE boot and client registration. ![SCCM : Client Approval and Conflicting Records](https://techuisitive.com/wp-content/uploads/2023/03/image-50.png)### ✅ Best Practices Checklist for PXE Boot in SCCM - **DHCP & IP Helpers** - Ensure DHCP services are running and properly configured. - Configure IP helpers on routers to forward DHCPDISCOVER requests to PXE servers across subnets. - **Task Sequence Deployment** - Deploy Task Sequences to the correct device collections (not just Unknown Computers). - Remove stale or duplicate device records from the SCCM database. - **Device Identifiers** - Use **MAC address** or **SMBIOS GUID** for reliable device identification. - Whitelist MAC addresses of **USB‑to‑Ethernet adapters** if reused across multiple PXE deployments. - **Boot Image & Drivers** - Verify NIC drivers are included in the boot image. - Confirm boot images are distributed to PXE‑enabled Distribution Points. - **Logs & Monitoring** - Review **SMSPXE.LOG** on the PXE‑enabled DP for request/response details. - Check **smspxe.log** for rejection messages, duplicate identifiers, or missing boot file info. - **General Hygiene** - Document whitelisted adapters and device records for future reference. - Regularly audit SCCM collections and PXE configurations to prevent conflicts. ## Conclusion PXE boot issues in **SCCM/ConfigMgr OSD deployments** often stem from misconfigured DHCP options, missing IP helper settings, or duplicate device records in the database. By systematically verifying DHCP services, IP helper configurations, and device identifiers, administrators can quickly isolate and resolve most PXE errors. Leveraging tools like **SMSPXE.LOG** for detailed diagnostics and applying best practices such as whitelisting USB‑to‑Ethernet adapter MAC addresses ensures smoother, more reliable PXE‑based imaging. With these troubleshooting steps in place, you can minimize deployment failures and maintain a consistent, scalable OSD workflow across your environment. ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM OSD, SCCM Troubleshooting, Troubleshooting --- ### [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) **Published:** October 13, 2022 **Author:** Equebal Ahmad **Excerpt:** SCCM client installation fails with error 0x87d00215 - Failed to get DP locations as the expected version from MP error. This error is mostly related with missing or misconfigured site boundaries. The above error indicates that a new version of client installation source was required. However a distribution point could not be located. **Content:** When **SCCM client installation fails with error 0x87d00215 – “Failed to get DP locations as the expected version from MP”**, it usually points to a boundary-related issue. In most cases, this error occurs due to **missing or misconfigured SCCM site boundaries**, preventing the client from locating a valid Distribution Point (DP) for content. Understanding how boundaries and boundary groups are configured is key to resolving this problem quickly and ensuring smooth client deployments. ## **Issue** Details: During **SCCM client installation**, the following error was recorded in the `ccmsetup.log` file ***`Failed to get DP locations as the expected version from MP 'http://server1.techuisitive.com'. Error 0x87d00215`*** The client was installed using the command line: *ccmsetup.exe /SMSSITECODE = P01* ## **Cause:** The error indicates that the SCCM client required a new version of the installation source. However, the client was unable to locate a valid **Distribution Point (DP)** to download the updated source files. This typically occurs when **site boundaries are missing or misconfigured**, preventing the client from resolving DP locations through the Management Point (MP). ## Step‑by‑Step Troubleshooting for Error 0x87d00215 - ### **1. Verify SCCM Boundary Configuration** - Open the **SCCM Console** → *Administration* → *Hierarchy Configuration* → *Boundaries*. - Confirm that the **client’s IP subnet** or **Active Directory (AD) site** is listed as a boundary. - If missing, create a new boundary: - Right‑click *Boundaries* → *Create Boundary*. - Select the appropriate type (IP Subnet, AD Site, IP Range). - Enter the client’s subnet or AD site details. - Save and apply the configuration. ### **2. Check Boundary Group Association** - Navigate to *Administration* → *Hierarchy Configuration* → *Boundary Groups*. - Ensure the boundary you verified/created in Step 1 is **added to a boundary group**. - If not: - Edit the boundary group. - Click *Add* → select the boundary. - Save changes. - This step ensures SCCM knows which group the client belongs to. ### **3. Validate Distribution Point (DP) Assignment** - Within the same boundary group, go to the **References tab**. - Confirm that the boundary group is associated with at least one **Distribution Point (DP)**. - If missing: - Click *Add* → select the appropriate DP. - Save changes. - Without a DP association, clients cannot download the installation source. ### **4. Trigger Client Installation Again** - On the client machine, rerun the installation command: - Monitor `C:\Windows\CCMSetup\Logs\ccmsetup.log` for progress. - If boundaries and DP associations are correct, the error should no longer appear. ### **5. Additional Verification (Optional)** - Use the **LocationServices.log** on the client to confirm DP discovery. - Check if the client can resolve the Management Point (MP) and DP without errors. - If issues persist, review recent **Group Policy changes** or **network restrictions** that may block communication. ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting, Troubleshooting --- ### [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) **Published:** October 28, 2022 **Author:** Equebal Ahmad **Content:** In Configuration Manager (SCCM/ConfigMgr), you may encounter a situation where the **Cloud Management Gateway (CMG) Connection Point** status shows as *Disconnected*. This issue typically indicates a communication or configuration problem between the CMG and the on‑premises site system. In this guide, we’ll walk through the common causes, log file analysis, and step‑by‑step troubleshooting methods to restore connectivity and ensure smooth client communication through CMG. ## **Issue:** After configuring a new **Cloud Management Gateway (CMG)** in **SCCM/Configuration Manager**, you may notice that the **CMG Connection Point status** shows as *Disconnected*. This typically indicates a communication or configuration issue between the CMG and the site system. The following error is logged in the **SMS\_CLOUD\_PROXYCONNECTOR.log** file, which provides critical details for troubleshooting. ``` ERROR: Failed to build HttpV2 connection 711c3af4-a0a8-44bd-a8dd-01572a7b276c with server xxxCMG.CLOUDAPP.NET:443. Exception: System.Net.WebException: The remote name could not be resolved: 'xxxcmg.cloudapp.net'~~ at Microsoft.ConfigurationManager.CloudConnection.ProxyConnector.HttpConnectionV2.SendInternal(HttpMethod method, String path, String payload, Int32& statusCode, Byte[]& responsePayload)~~ at Microsoft.ConfigurationManager.CloudConnection.ProxyConnector.HttpConnectionV2.SendInternal(HttpMethod method, String path, Byte[] payload)~~ at Microsoft.ConfigurationManager.CloudConnection.ProxyConnector.HttpConnectionV2.Online()~~ at Microsoft.ConfigurationManager.CloudConnection.ProxyConnector.ConnectionBase.Start()~~ at Microsoft.ConfigurationManager.CloudConnection.ProxyConnector.ConnectionManager.MaintainConnections() ``` ### **Cause:** The logs indicate that the **remote name could not be resolved**, which occurred because Microsoft changed the way **Cloud Management Gateway (CMG) service names** are registered with Azure. Starting with **ConfigMgr version 2010**, when you deploy CMG to a **Virtual Machine Scale Set (VMSS)**, the deployment name format is different. With VMSS, the service name uses the **cloudapp.azure.com** domain along with the Azure region. For example: `GraniteFalls.EastUS.CloudApp.Azure.Com` for a deployment in the East US region. In the above setup, the service name was configured with the **Prefix.Cloudapp.net** domain, which is no longer valid for VMSS‑based CMG deployments. This mismatch caused the connection point to show as *Disconnected*. ### **Solution:** Option 1: Keep the Service name the same as the Deployment name. **Examples:** **Service Name:** Prefix.Region.CloudApp.Azure.Com e;g*:* techuisitivecmg.EastUS.CloudApp.Azure.com **Deployment Name:** Prefix.Region.CloudApp.Azure.Com e:g: techuisitivecmg.EastUS.CloudApp.Azure.com Option 2: Another option is to use your own domain address for the CMG service name and create a DNS CNAME to route the traffic to the CMG deployment name. Microsoft recommends this method. **Example:** **Service Name:** techuisitivecmg.techuisitive.com **Deployment name:** techuisitivecmg.EastUS.CloudApp.Azure.com **DNS CNAME:** Create a DNS CNAME in public DNS (Your DNS registrar) to route the request coming for the Service name address to the **CMG Deployment address.** The Configuration Manager client policy includes the CMG service name. The client resolves the service name via the CNAME alias to the deployment name. The CNAME for the above example will be: **HostName**: techuisitivecmg **Value:** techuisitivecmg.EastUS.CloudApp.Azure.com ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting --- ### [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) **Published:** November 6, 2022 **Author:** Equebal Ahmad **Content:** When deploying the **Configuration Manager (ConfigMgr/SCCM) client** using the push installation method, you may encounter the error *0x800706ba – The RPC server is unavailable*. This error typically appears in **ccm.log** on the site server and indicates that the server was unable to establish a connection with the client over **RPC ports**. Common causes include blocked ports, firewall restrictions, or misconfigured security policies. In this guide, we’ll walk through the error details, root causes, and the required network/firewall configurations to successfully complete client push installation. ## **Issue:** The Configuration Manager client push installation failed with the following error. ***Unable to connect to remote machine “Computer1.domain.com” using Kerberos with alternate account, error – 0x800706ba.*** The ccm.log file on the ConfigMgr site server shows the following error details: `---> Connected to administrative share on machine Computer1.domain.com using account 'Domain\Account'---> Attempting to make IPC connection to share with Kerberos authentication---> SspiEncodeStringsAsAuthIdentity succeeded for IPC$ authentication!---> SspiExcludePackage succeeded for IPC$ authentication!---> SspiMarshalAuthIdentity succeeded for IPC$ authentication!---> NetUseAdd succeeded for IPC$ authentication!---> Searching for SMSClientInstall.* under '\Computer1.domain.com\admin$\'Submitted request successfully---> Unable to connect to remote machine "Computer1.domain.com" using Kerberos with alternate account, error - 0x800706ba.--> NTLM fallback is enabled, remote machine "Computer1.domain.com" is continuing with client push.---> Unable to connect to remote machine "Computer1.domain.com" using Kerberos with alternate account, error - 0x800706ba.---> Unable to connect to remote machine "Computer1" using Kerberos with machine account, error - 0x80070005.---> Unable to connect to WMI on remote machine "Computer1.domain.com", error = 0x800706ba.---> Unable to connect to WMI on remote machine "Computer1", error = 0x80070005.--> NTLM fallback is enabled, remote machine "Computer1" is continuing with client push.---> Unable to connect to WMI on remote machine "Computer1", error = 0x80070005.---> Deleting SMS Client Install Lock File '\Computer1.domain.com\admin$\SMSClientInstall.P01'` ## Cause – RPC Connectivity The above error indicates that the **SCCM site server** was unable to establish a connection with the client over **RPC ports**. This issue may occur due to the following reasons: - **RPC port 135 / Dynamic RPC ports** are not open between the SCCM site server and the client. - A **firewall application** installed on the client machine is blocking inbound traffic over RPC ports. ![Infographic showing SCCM site server communicating with client computer over required ports for client push installation: TCP 445 for SMB admin$ share TCP/UDP 135 for RPC/WMI Dynamic RPC ports (TCP 1024–5000 or 49152–65535) Includes firewall illustration and reminder to allow these ports in network and local firewalls.](https://techuisitive.com/wp-content/uploads/2022/11/image-1024x683.png)Infographic: **SCCM Site Server ↔ Client Communication Over Required Ports**. Visual summary of TCP 445 (SMB), TCP/UDP 135 (RPC), and dynamic RPC ports used during ConfigMgr client push installation. ## **Solution:** Ensure that all **ports required for ConfigMgr client push installation** are open and allowed through the **network firewalls**. Without proper RPC and SMB connectivity, the site server cannot establish communication with the client, resulting in error *0x800706ba (RPC server unavailable)*. ### **Ports Required for ConfigMgr Client Push Installation** The following ports must be open between the **SCCM site server** and **client machines** for client push installation to succeed: - **Server Message Block (SMB) – TCP 445** Used by the site server to connect to the **admin$ share** and copy the installation batch file to the client. - **Remote Procedure Call (RPC) – TCP/UDP 135** Used by the site server to connect with **Windows Management Instrumentation (WMI)** on the client. Once connected, the batch file is executed to initiate client installation. - **Remote Procedure Call (RPC) – Dynamic Ports** - **TCP 1024–5000** (legacy range) - **TCP 49152–65535** (modern OS range). After the initial connection over port 135, subsequent communication occurs over dynamic ports randomly selected from these ranges. #### Firewall Considerations If all the above ports are allowed in the **network firewall** and you still encounter error *0x800706ba (RPC server unavailable)*, the issue may be caused by a **local firewall application** blocking inbound RPC traffic. - **Quick Test:** Temporarily disable the firewall application on the client and retry client push. - **If successful:** Work with your **security team** to configure permanent exceptions for SCCM communication. #### Required Windows Defender Firewall Rules The following applications/services must be allowed in **Windows Defender Firewall**: - **File and Print Sharing** - **Windows Management Instrumentation (WMI)** - **Remote Procedure Call (RPC)** ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Client, SCCM Troubleshooting, Troubleshooting --- ### [How to Fix SCCM Application Deployment Error 0x87d01106](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) **Published:** December 28, 2022 **Author:** Equebal Ahmad **Excerpt:** When monitoring the application deployment through SCCM report, the following deployment error was logged for multiple devices. Error description: Failed to verify the executable file is valid or to construct the associated command line. The application was trying to execute a PowerShell script. However PowerShell.exe could not be located on client computers. The full path for Powershell.exe file was not provided in command line. **Content:** During application deployment in **Configuration Manager (ConfigMgr/SCCM)**, you may encounter the error *0x87d01106 – Failed to verify the executable file is valid or to construct the associated command line*. This issue is commonly logged in **AppEnforce.log** and occurs when the deployment tries to run a PowerShell script but cannot locate **PowerShell.exe**. The root cause is typically a missing or misconfigured **PATH environment variable**, which prevents the client from resolving the PowerShell executable. In this guide, we’ll explain the error details, its cause, and the recommended fix — using the full path to PowerShell.exe in the deployment command line. ## **Deployment Error** While monitoring the **application deployment** through SCCM reports, the following error was logged across multiple devices: **Error description:** *Failed to verify the executable file is valid or to construct the associated command line* ![ Application Deployment Error 0x87d01106](https://techuisitive.com/wp-content/uploads/2023/04/image-66.png)Further investigation on the client machine revealed the following error entries in the **AppEnforce.log** file. **Error in C:\\Windows\\ccm\\logs\\AppEnforce.log File :** Context: Machine Command line: Powershell.exe -ExecutionPolicy ByPass -File MyScript.ps1 Allow user interaction: No UI mode: 0 User token: null Session Id: 4294967295 Content path: C:\\WINDOWS\\ccmcache\\3 Working directory: Invalid executable file Powershell.exe AppProvider::EnforceApp – Failed to invoke EnforceApp on Application handler ( 0x87d01106 ). ![SCCM error 0x87d01106 ](https://techuisitive.com/wp-content/uploads/2023/04/image-67.png)## **Cause** for Error 0x87d01106 The application attempted to execute a **PowerShell script**, but **PowerShell.exe** could not be located on the client computers. This occurred because the **full path to PowerShell.exe** was not specified in the deployment command line, leaving the process dependent on the PATH environment variable, which was either missing or misconfigured. powershell.exe -ExecutionPolicy ByPass -File MyScript.ps1 The **PowerShell.exe path** must be defined in the **PATH environment variable**. By default, Windows includes this path automatically. However, it may be **overwritten or removed** by other applications due to misconfiguration. As a result, SCCM deployments that rely on PowerShell will fail on computers where the **PowerShell.exe path is missing from the PATH variable**. ![SCCM Program](https://techuisitive.com/wp-content/uploads/2023/04/image-68.png)## **Solution** for Error 0x87d01106 It is best practice to provide the **complete path to the PowerShell executable** in the program command line. This eliminates dependency on the **PATH environment variable**, ensuring that PowerShell.exe can always be located using the explicit path provided. The full command line to execute a PowerShell script should look like this: %SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy ByPass -File MyScript.ps1 ![Command line for SCCM Application](https://techuisitive.com/wp-content/uploads/2023/04/image-69.png)## **Quick Fix Checklist:** - ✅ Verify AppEnforce.log for error 0x87d01106 - ✅ Check PATH environment variable for PowerShell.exe - ✅ Update deployment command line with full path - ✅ Redeploy application ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting, Troubleshooting --- ### [Fix SCCM Client Installation Error 0x87d00227 (ccmsetup Failed) – ConfigMgr Troubleshooting Guide](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) **Published:** January 18, 2023 **Author:** Equebal Ahmad **Excerpt:** When deploying the SCCM client, you may encounter the error ccmsetup failed with error code 0x87d00227 in the ccmsetup.log file. This issue typically occurs when the client installation is blocked due to a metered network connection. In this guide, we’ll explain the cause of the error, walk through the solution using the /AllowMetered parameter, and show how to clean up previous installations with ccmclean to ensure a smooth client deployment. **Content:** When deploying the SCCM client, you may encounter the error **ccmsetup failed with error code 0x87d00227** in the `ccmsetup.log` file. This issue typically occurs when the client installation is blocked due to a metered network connection. In this guide, we’ll explain the cause of the error, walk through the solution using the `/AllowMetered` parameter, and show how to clean up previous installations with `ccmclean` to ensure a smooth client deployment. ## **Issue** *SCCM client push installation failed, with the following error recorded in the* `ccmsetup.log` *file.* *MapNLMCostDataToCCMCost() returning Cost 0x2* *Client deployment cannot be fulfilled since use of a metered network is not allowed.* *CcmSetup failed with error code 0x87d00227* ![Error 0x87d00227 ](https://techuisitive.com/wp-content/uploads/2023/04/image-112.png)## **Cause** The error code **0x87d00227** translates to *Functionality disabled*. This typically occurs when a device is connected to a **metered network**, preventing the SCCM client from installing. Starting with **ConfigMgr version 2006**, a new `ccmsetup` parameter **/AllowMetered** was introduced. This parameter enables client installation by allowing content downloads over metered connections. ## **Solution** for Error **0x87d00227** - Add the parameter **/AllowMetered** in the **Client Push Installation Properties**. This allows SCCM client installation even if the device is connected to a metered network. The bypass applies only to SCCM client installation traffic. - If you are reinstalling the Configuration Manager client, the setup may reuse previous configurations and still display the error—even if the device is no longer on a metered connection. To avoid this, it’s recommended to **clean up the previous SCCM client installation** using **ccmclean**. #### Steps to remove ConfigMgr client and all references: 1. Copy **ccmclean.exe** from the SCCM site server installation directory → **Tools** folder → to the client machine. 2. Run **ccmclean.exe** from the command line on the remote machine. 3. Monitor **ccmsetup.log** to verify cleanup progress. Once the cleanup is complete, rerun **ccmsetup** with the **/AllowMetered** parameter to enable installation over metered networks. If the issue needs to be fixed across multiple machines using **Client Push**, you can also add the **/AllowMetered** parameter directly in the **Client Push Installation Properties**. This ensures the setting is applied consistently during client deployments. ### Run `ccmclean` and `ccmsetup` via PowerShell Remoting ### **1. Connect to the Remote Computer** - Launch PowerShell. - Enter the remote session:powershell `Enter-PSSession -ComputerName ` - Navigate to the SCCM setup folder:powershell `cd \ cd C:\Windows\ccmsetup` ### **2. Uninstall SCCM Client** - Copy **ccmclean.exe** from the SCCM site server installation directory → **Tools** folder → to the remote computer’s `C:\Windows\ccmsetup` folder. - Run the cleanup command:powershell`.\ccmclean` - Monitor **ccmsetup.log** to verify cleanup progress. ### **3. Install SCCM Client** - Copy **ccmsetup.exe** from the SCCM site server installation directory → **Client** folder → to the remote computer’s `C:\Windows\ccmsetup` folder. - Run the installation command with required parameters:powershell`ccmsetup.exe /force /AllowMetered SMSMP=MPSERVERNAME SMSSITECODE=XYZ` ### **4. Alternative Option** If you’ve already added the **/AllowMetered** switch in **Client Push Installation Properties**, you can simply use **Client Push installation** to reinstall the client across multiple machines without manual copying. ## **Related Posts** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Client, SCCM Troubleshooting, Troubleshooting --- ### [SCCM OSD - Domain Join Failed with Error Code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) **Published:** March 1, 2023 **Author:** Equebal Ahmad **Content:** When deploying Windows 10 using SCCM OSD on HP EliteBook 840 G8 devices, you may encounter a puzzling error: **domain join failed with error code 0x54b**. Although the operating system deployment completes successfully, the machine refuses to join Active Directory, leaving administrators scratching their heads. In this guide, we’ll walk through the symptoms, root cause, and practical steps to resolve this issue so your deployments run smoothly. We noticed the following behaviors. - Setup Windows and ConfigMgr, reboot the machine, the configuration takes 15-20 minutes, and then continue with the rest of the Task sequence steps. - The Task Sequence continues to send status messages to SCCM, and the build completes successfully. - Machines do not join the Active Directory Domain. - The OS deployment on other hardware models works fine from the same network without any issues. The following issues are reported in log files: **C:\\Windows\\panther\\UnattendGC\\Setuperr.log** *\[DJOIN.EXE\] Unattended Join: NetJoinDomain failed error code is \[1355\]* *\[DJOIN.EXE\] Unattended Join: Unable to join; gdwError = 0x54b* **C:\\Windows\\panther\\UnattendGC\\Setupact.log** *Unattended Join: Calling DsGetDcName for* xyz.com *\[DJOIN.EXE\] Unattended Join: DsGetDcName failed: 0x54b, last error is 0x0, will retry in 10 seconds…* *\[DJOIN.EXE\] Unattended Join: DsGetDcName failed: 0x54b, last error is 0x0, will retry in 10 seconds…* *\[DJOIN.EXE\] Unattended Join: NetJoinDomain failed error code is \[1355\]* *\[DJOIN.EXE\] Unattended Join: Unable to join; gdwError = 0x54b* ## **Cause:** The error indicates a potential network-related issue. However, since the build completes successfully and continues to send status messages to ConfigMgr, the problem appears to be intermittent rather than a complete network failure. Further investigation and information available on other blogs helped us to conclude the following points. - HP Elitebook 840 G8 do not have an in-built NIC card and a USB Type C to Ethernet adapter was used to connect the machine to the LAN. - There was a delay in network initialization when the machine rebooted during Setup Windows and ConfigMgr. The setup continued to try Domain join for 15-20 minutes and then timed out. - The network initialization worked fine at the next reboot, and the Task Sequence execution was completed successfully. The client sends all status messages to SCCM. ## **Solution:** Based on the information available on different blogs & forums, we tried the following options. However, none of them worked for us. We were able to build the laptop successfully (with Domain join) using the docking station. The following options did not resolve the issue for us. If any of these steps worked in your environment, please share your experience in the comments. - Disabled fast boot in BIOS - Updated the BIOS to the latest version - Included the latest drivers in the SCCM drivers package - Added a step after “Setup Windows and Configuration Manager” to delay the execution of the next step. - Added an additional step to retry the domain join if the machine is not yet joined to the Domain. The step executes if the following WMI condition is met *`SELECT * FROM Win32_ComputerSystem WHERE NOT Domain LIKE "%FQDN%"`* ## **Related Posts** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM OSD, SCCM Troubleshooting, Troubleshooting --- ### [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) **Published:** March 15, 2023 **Author:** Equebal Ahmad **Content:** ## What is Error 0x87d00213? ConfigMgr error 0x87d00213 indicates that an application deployment has timed out. This usually happens when the installation takes longer than the maximum run time defined in the deployment settings, or when user interaction is required but not allowed. This guide will help you in application deployment troubleshooting related to ConfigMgr error 0x87d00213. When the application deployment fails with error 0x87d00213 (timeout occurred), you will see the following details on AppEnforce.log file. ``` Exceeded timeout of 120 minutes while waiting for process 8584 to finish. WaitForRunningProcess failed. Error 0x87d00213. CMsiHandler::CompleteEnforcement failed with 0x87d00213 CAppProvider::CompleteEnforcement failed with error 0x87d00213 ++++++ Failed to enforce app. Error 0x87d00213. ++++++ ``` ## **Common Cause** The timeout error generally happens due to the following reasons. - **Maximum Run Time Exceeded:** The application installer runs longer than the configured limit. - **User Interaction Required:** Prompts or dialogs appear but cannot be displayed to the user. - **Group Policy Changes:** GPOs affecting PowerShell execution or script signing can block installations. - **Environment Changes:** Updates or configuration changes that alter how scripts run. ## **Step-by-Step Troubleshooting Guide** You need to understand both the issue itself and the number of impacted machines. This will help you determine whether the problem is isolated to individual devices or if broader environmental changes are causing a larger impact. If application deployment was functioning properly and suddenly stopped, the root cause may be related to recent changes in the environment, such as modifications to group policies ### 1. Verify Maximum Run Time - Check if the **Maximum Allowed Run Time** is sufficient for application installation. - Enable the “**Allow users to view and interact with the program installation**” option. If the application displays any dialog box, it will be visible to the user. ![Application - User experience](https://techuisitive.com/wp-content/uploads/2023/04/image-165.png)### 2. Test Manual Installation - Run the installer manually on the affected machine. - Confirm whether prompts or errors appear. ### 3. Check Group Policy Settings - Review GPOs related to PowerShell execution policies. - Ensure scripts are signed if required. ### 4. Review Logs - Inspect `AppEnforce.log` for detailed error messages. - Look for timeout entries or blocked script execution. As you see in the screenshot below, the application installation was started at 16:34:29. The Configuration Manager client waited for 2 hours for execution to complete, and then it is considered the deployment as failed with a timeout occurred message. ![appenforce.log | error 0x87d00213 ](https://techuisitive.com/wp-content/uploads/2023/04/image-164.png)## Real-World Example I recently encountered a similar issue where all PowerShell script–initiated application deployments suddenly stopped working. The deployments consistently failed with error **0x87d00213**, and even previously successful deployments were impacted. In my case, the root cause was a Group Policy Object (GPO) change. The policy was updated to allow execution only of digitally signed PowerShell scripts. As a result, any unsigned script triggered a hidden prompt asking whether the untrusted script should be executed. Because this prompt was not visible to end users, the script stalled at that stage and eventually timed out, causing the deployment to fail. Since this mandate came from the corporate security team, the resolution was to digitally sign all existing PowerShell scripts. Once signed, deployments through SCCM resumed successfully. ## Best Practices to Prevent Future Errors - Set realistic maximum run times for applications. - Use silent installation parameters whenever possible. - Proactively sign PowerShell scripts. - Regularly review GPO changes that may affect deployments. ## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting, Troubleshooting --- ### [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005 | ConfigMgr](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) **Published:** June 6, 2023 **Author:** Equebal Ahmad **Content:** When working with **Configuration Manager (ConfigMgr/SCCM)**, software update scans may fail with the error *“Failed to Add Update Source for WUAgent of type (2) and id … Error = 0x80004005”*. This issue typically appears in **WUAHandler.log** and **ScanAgent.log** and is linked to corrupt or misconfigured Group Policy settings. In this guide, we’ll walk through the symptoms, root cause, and step‑by‑step resolution — including how to rename the **Registry.pol** file, force a Group Policy update, and restart the SMS Agent Host service. By the end, you’ll have a reliable fix for this common SCCM client error and a cleaner update scan process. ## Issue The SCCM software update scan failed on the Configuration Manager client. When you look into the Software Update Troubleshooting report ( Troubleshooting 1 – Scan errors ), it shows that the scan failed with Unknown Error -2147467259 (Hex Erro coThe **SCCM software update scan** failed on the Configuration Manager client. In the **Software Update Troubleshooting report** (*Troubleshooting 1 – Scan errors*), the scan result shows **Unknown Error –2147467259** (Hex error code **0x80004005**).de – 80004005). ![SCCM Report | Troubleshooting 1 - Scan errors | 0x80004005](https://techuisitive.com/wp-content/uploads/2023/05/image-9-1024x226.png)### **Error in SCCM client log WUAHandler.log** The following errors are recorded in the **WUAHandler.log** file, located in the client log directory at: `C:\Windows\CCM\Logs` `Its a WSUS Update Source type ({D7249651-3163-5AE0-8FCD-C1A8302838A8}), adding it. WUAHandler 5/15/2023 7:35:54 PM 5576 (0x15C8)Failed to check enrollment url, 0x00000001: WUAHandler 5/15/2023 7:35:54 PM 5572 (0x15C4)SourceManager::GetIsWUfBEnabled - There is no Windows Update for Business settings assignment. Windows Update for Business is not enabled through ConfigMgr WUAHandler 5/15/2023 7:35:54 PM 5572 (0x15C4)Unable to read existing WUA Group Policy object. Error = 0x80004005. WUAHandler 5/15/2023 7:35:54 PM 5576 (0x15C8)Enabling WUA Managed server policy to use server: http://SRV1.Techuisitive.local:8530 WUAHandler 5/15/2023 7:35:54 PM 5576 (0x15C8)Failed to check enrollment url, 0x00000001: WUAHandler 5/15/2023 7:35:54 PM 7336 (0x1CA8)SourceManager::GetIsWUfBEnabled - There is no Windows Update for Business settings assignment. Windows Update for Business is not enabled through ConfigMgr WUAHandler 5/15/2023 7:35:54 PM 7336 (0x1CA8)Failed to Add Update Source for WUAgent of type (2) and id ({D7249651-3163-5AE0-8FCD-C1A8302838A8}). Error = 0x80004005. WUAHandler 5/15/2023 7:35:54 PM 5576 (0x15C8)CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for bundles WUAHandler 5/16/2023 4:49:22 AM 1548 (0x060C)` ![WUAHandler.log](https://techuisitive.com/wp-content/uploads/2023/05/image-8-1024x354.png)### Error in **ScanAgent.log** The same error is also recorded in the **ScanAgent.log** file on the client computer. `CScanJob::Execute- Failed at AddUpdateSource, Error = 0x80004005 ScanAgent 5/15/2023 7:35:54 PM 5576 (0x15C8)ScanJob({E01213CF-7FCD-49AF-A546-40C246C569AC}): CScanJob::OnScanComplete -Scan Failed with Error=0x80004005 ScanAgent 5/15/2023 7:35:54 PM 5576 (0x15C8)ScanJob({E01213CF-7FCD-49AF-A546-40C246C569AC}): CScanJobManager::OnScanComplete- failed at CScanJob::OnScanComplete with error=0x80004005 ScanAgent 5/15/2023 7:35:54 PM 5576 (0x15C8)` ## Cause This issue may occur due to a **corrupt Group Policy**. The exact reason can be difficult to determine, but in many cases the **Group Policy update fails repeatedly** on affected machines. In the environment where this error was observed, the computers had been **migrated from a different domain** and carried over several inherited configuration issues, which contributed to the problem. ## Solution The recommended fix is to **rename the Registry.pol file** and then force a **Group Policy update**. This action resolves the corrupt Group Policy issue and ensures a new Registry.pol file is automatically created. Renaming the file (instead of deleting it) is preferred, as it preserves a backup for reference. You can perform these steps remotely using a **PowerShell remote session**: **Step 1: Connect to the remote machine** ``` Enter-PSSession -ComputerName ``` **Step 2: Rename the Registry.pol file** ``` cd C:\Windows\System32\GroupPolicy\Machine REN Registry.pol Registry.pol.old ``` **Step 3: Force Group Policy update** ``` GPUPDATE /FORCE ``` **Step 4: Restart SMS Agent Host service** ``` Restart-Service ccmexec -Verbose ``` **Step 5: Trigger Software Update Scan Cycle** ``` Invoke-WmiMethod -Namespace root\ccm -Class sms_client -Name TriggerSchedule "{00000000-0000-0000-0000-000000000113}" ``` ## **Related Posts** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting, Troubleshooting --- ### [Fix SCCM Management Point Installation Issue after SCCM 2303 Upgrade](https://techuisitive.com/management-point-installation-failed-after-sccm-2303-upgrade/) **Published:** July 11, 2023 **Author:** Equebal Ahmad **Content:** ## Issue After SCCM 2303 Upgrade from 2111, the Management Point installation failed on all MPs with below error. **Status Message:** Site Component Manager could not copy file “D:\\Program Files\\Microsoft Configuration Manager\\Client\\x64\\md4ws.msi” to “\\MPServer\\D$\\SMS\\Client\\x64\\md4ws.msi”. Site Component Manager reports this error when it fails to: 1. Create the destination directory, if it does not already exist. 2. Assign the proper directory permissions to the destination directory. 3. Copy the source file to the destination directory. Possible cause: The site system is turned off, not connected to the network, or not functioning properly. Solution: Verify that the site system is turned on, connected to the network, and functioning properly. Possible cause: Site Component Manager does not have sufficient access rights to administer the site system. Solution: Verify that the Site System Connection accounts are properly configured to allow the site to administer the site system. Possible cause: Network problems are preventing Site Component Manager from connecting to the site system. Solution: Investigate and correct any problems on your network. ![ConfigMgr Status Message | SCCM 2303 Upgrade](https://techuisitive.com/wp-content/uploads/2023/05/image-21.png)**The following errors are logged in sitecomp.log** ERROR: Failed to get file (\\?\\D:\\Program Files\\Microsoft Configuration Manager\\Client\\x64\\md4ws.msi) attribute SMS\_SITE\_COMPONENT\_MANAGER 19/04/2023 09:33:34 14924 (0x3A4C) Failed to validate version for file D:\\Program Files\\Microsoft Configuration Manager\\Client\\x64\\md4ws.msi (\\MPServer\\D$\\SMS\\Client\\x64\\md4ws.msi). Will replace the file. SMS\_SITE\_COMPONENT\_MANAGER 19/04/2023 09:33:34 14924 (0x3A4C) Could not copy file D:\\Program Files\\Microsoft Configuration Manager\\Client\\x64\\md4ws.msi to \\MPServer\\D$\\SMS\\Client\\x64\\md4ws.msi. The operating system reported error 0: The operation completed successfully. SMS\_SITE\_COMPONENT\_MANAGER 19/04/2023 09:33:34 14924 (0x3A4C) ## Cause The file md4ws.msi was missing on the site server in the D:\\Program Files\\Microsoft Configuration Manager\\Client\\x64 folder. This file is for Microsoft Defender. ## Solution The reason behind the missing file was unknown. However same file was present in another folder, “D:\\Program Files\\Microsoft Configuration Manager\\CMUClient\\x64”. I simply copied the file to the D:\\Program Files\\Microsoft Configuration Manager\\Client\\x64 folder from where ConfigMgr setup was trying to copy the file to the destination folder.. The Management Point installation was succeeded on all MP at the next retry. ## Related Posts - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [Management Point Installation Failed after SCCM 2303 Upgrade](https://techuisitive.com/management-point-installation-failed-after-sccm-2303-upgrade/ "Management Point Installation Failed after SCCM 2303 Upgrade") ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting, Troubleshooting --- ### [Windows 10 /11: Create a virtual drive with the SUBST command](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/) **Published:** December 25, 2017 **Author:** Equebal Ahmad **Content:** SUBST is a command in the Microsoft Windows operating system. This command can be used to create a virtual drive (Associate a path with a drive letter) in Windows by mapping any desired folder to a specific drive letter. This can be useful in many scenarios, such as testing an application that requires a specific drive letter. You can watch the video to understand its usage. ## Related Posts - [Windows 10 – Remote administration through PowerShell – Part 1](https://techuisitive.com/windows-10-remote-administration-through-powershell-part-1/) - [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) - [Windows Administrator Basics: Windows Services](https://techuisitive.com/windows-administrator-basics-windows-services/) - [Windows Administrator Basics: Managing Windows Services from Powershell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) - [Windows Administrator Basics: Windows Registry](https://techuisitive.com/windows-administrator-basics-windows-registry/) - [Basic Knowledge for Windows Desktop Support Engineer](https://techuisitive.com/basic-knowledge-for-windows-desktop-support-engineer/) - [Windows 10 /11 : Create a virtual drive with SUBST command](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/) ## Explore More Windows Guides Continue building your Windows administration skills with practical, step-by-step guides covering Windows configuration, troubleshooting, device management, PowerShell, and automation. - **[Windows 10/11 Guides](https://techuisitive.com/microsoft-windows/)** – Explore practical guides for Windows configuration, administration, troubleshooting, updates, PowerShell, and everyday Windows management. - **[Microsoft Intune Learning](https://techuisitive.com/microsoft-intune/)** – Learn how to manage Windows devices with Intune, including device enrollment, configuration, compliance, application deployment, and updates. - **[Automation](https://techuisitive.com/automation/)** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive administration tasks and manage Windows devices more efficiently. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Windows 10 / 11 **Tags:** Windows Administration --- ### [Windows Administrator Basics: Windows Services](https://techuisitive.com/windows-administrator-basics-windows-services/) **Published:** April 18, 2018 **Author:** Equebal Ahmad **Content:** **What is Windows Services** A Windows Service is a computer program that operates in the background. A service don’t have a user interface. They are intended to provide core operating system features such as Event logging, printing or error reporting. Some applications install their own services. Antivirus applications are one of such example. They install different services to enable real time monitoring of your system. **Services Console** Services console provide an interface to view and manage services. The Services console can be launched in different way. However the easiest way to launch services console is to type “Services” in Windows 10 Search Box. You can now see ‘Services – Desktop App’ in the list. Just click on Services icon to open Services console. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-174.png)The Services Console will be opened. You can view, start, stop and configure Windows services from Services Console. To see the description of a service, click on the service and description will appear in left pane. The description is often sufficient to make you understand the purpose of specific service. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-175.png)**Properties:** To view the details of a service, right click on service and select Properties. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-176.png)**Properties: General Tab** There are four tabs in services properties. We will first understand the details available in **General** tab of Properties window. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-177.png)**Service Name**: Most of the time you need this when dealing with services from command line or scripts. **Display Name:** This is the full name of service. You will find this name in Services console. **Path to Executable:** This is the path of services. For BITS and many other Windows services, you will see executable path is set to svchost.exe. Service Host (svchost.exe) is a process that hosts other Windows services that perform various system functions. There can be multiple instances of svchost.exe running on your computer, with each instance containing a different service. **Startup Type:** There are four startup type available for a service. They are: - Automatic : The service is started automatically during windows boot process. - Automatic (Delayed) : Delayed service wait to start until all Automatic services are started. - Manual : The service is in stop state by default. However it can be started by another application when required. - Disabled : The service will not start until condition is set to any other startup type. **Service Status:** Shows current status of the service. **Properties: Log On Tab** The **Log On** tab allow you to configure whether the service is logged on as local system account or other account. This is mostly useful in server environment when resource access on other servers are required. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-178.png)**Properties: Recovery Tab** The **Recovery** tab allows you to define actions that can be performed on service failure. You can define an action for first, second and subsequent failure. You can also enable custom action such as executing a script which will send an email to administrator to notify about service failure. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-179.png)**Properties: Dependencies Tab** The **Dependencies** tab have two sections. The first section lists the system components required for the service to work. The second section lists the service that depends on the selected service. In this example, The BITS service has a dependency over Remote Procedure Call (RPC) service. The BITS service will not work until RPC service is started. The second section is blank as other services are not depended on BITS. Please see our next article [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) to know more about managing Windows services from command line. ## **Related Posts** - [Windows 10 – Remote administration through PowerShell – Part 1](https://techuisitive.com/windows-10-remote-administration-through-powershell-part-1/) - [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) - [Windows Administrator Basics: Windows Services](https://techuisitive.com/windows-administrator-basics-windows-services/) - [Windows Administrator Basics: Managing Windows Services from Powershell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) - [Windows Administrator Basics: Windows Registry](https://techuisitive.com/windows-administrator-basics-windows-registry/) - [Basic Knowledge for Windows Desktop Support Engineer](https://techuisitive.com/basic-knowledge-for-windows-desktop-support-engineer/) - [Windows 10 /11 : Create a virtual drive with SUBST command](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Windows 10 / 11 **Tags:** Windows Administration --- ### [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) **Published:** April 21, 2018 **Author:** Equebal Ahmad **Content:** This is the second article for Windows Services. You can access previous article Windows Services Basics [here](https://www.techuisitive.com/post/windows-administrator-basics-windows-services). ## **Managing Windows services from command line** ### **Net Command** You can use NET START and NET STOP command to start and stop Windows service. Using Net command to start a Windows Service ***`NET START   < ServiceName >`*** ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-167.png)Using Net command to stop a Windows Service ***`NET STOP < Service Name >`*** ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-168.png) ### **SC (Service Control) Command** SC.exe is a powerful command line tool to manage Windows Services. This can be used to Query, Start,Stop,Create or Delete a Windows service. This tool can manage the services on remote computer as well. In this article, we are going to explore Query , start and stop options only. **Query Service status of specific service on Local machine** *`SC QUERY < Service Name >`* ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-169.png)**Query Service status of specific service on Remote machine** *`SC < \\Computer Name > QUERY < Service Name >`* ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-170.png)**Query Service status of all services on local machine** *`SC QUERY `* ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-171.png)**Stop a Service on local machine** *`SC STOP < Service Name >`* ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-172.png) **Start a Service on local machine** *`SC START < Service Name >`* ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-173.png)**Start a service on Remote machine** *`SC < \\Computer Name > START < Service Name >`* **Stop a service on Remote machine** *`SC < \\Computer Name > STOP < Service Name >`* Please see our next article [Managing Windows Services from PowerShell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) to know more about managing Windows services from Powershell. ## **Related Posts:** - [Windows 10 – Remote administration through PowerShell – Part 1](https://techuisitive.com/windows-10-remote-administration-through-powershell-part-1/) - [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) - [Windows Administrator Basics: Windows Services](https://techuisitive.com/windows-administrator-basics-windows-services/) - [Windows Administrator Basics: Managing Windows Services from Powershell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) - [Windows Administrator Basics: Windows Registry](https://techuisitive.com/windows-administrator-basics-windows-registry/) - [Basic Knowledge for Windows Desktop Support Engineer](https://techuisitive.com/basic-knowledge-for-windows-desktop-support-engineer/) - [Windows 10 /11 : Create a virtual drive with SUBST command](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Windows 10 / 11 **Tags:** Windows Administration --- ### [Windows Administrator Basics: Managing Windows Services from PowerShell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) **Published:** April 3, 2018 **Author:** Equebal Ahmad **Content:** This is the third post for Windows services. You can access previous posts using below link. [Windows Services ](https://www.techuisitive.com/post/windows-administrator-basics-windows-services)[Basics](https://techuisitive.com/windows-administrator-basics-windows-services/) [Managing Windows services ](https://www.techuisitive.com/post/windows-administrator-basics-managing-services-from-command-line)[from ](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/)[command line](https://www.techuisitive.com/post/windows-administrator-basics-managing-services-from-command-line) ## **Get status of a service using Get-Service cmdlets** The Get-Service cmdlets allow you to list services on local computer. **Examples**: **List all services on the computer** ``` PS C:\> Get-Service Status   Name               DisplayName                            ------   ----               -----------                            Running  AdobeARMservice    Adobe Acrobat Update Service           Stopped  AJRouter           AllJoyn Router Service                 Stopped  ALG                Application Layer Gateway Service      Stopped  AppReadiness       App Readiness                          Stopped  BDESVC             BitLocker Drive Encryption Service     ``` **Examples**: **List all services which match a search string** ``` PS C:\> Get-Service -DisplayName "*Application*" Status     Name                 DisplayName                            ------       ----                     -----------                            Stopped  ALG                  Application Layer Gateway Service      Stopped  AppIDSvc         Application Identity                   Running  Appinfo            Application Information                Stopped  AppMgmt          Application Management Stopped  COMSysApp     COM+ System Application  ``` **Examples**: **List all Running Services** ``` PS C:\> Get-Service | Where-Object {$_.Status -eq "Running"} Status   Name               DisplayName                            ------   ----               -----------                            Running  AdobeARMservice    Adobe Acrobat Update Service           Running  Appinfo            Application Information                Running  AppXSvc            AppX Deployment Service (AppXSVC)      Running  aswbIDSAgent       aswbIDSAgent                           Running  AudioEndpointBu... Windows Audio Endpoint Builder         ``` **Examples**: **Get status of specific service** ``` PS C:\> Get-Service -Name BITS ``` ![](https://techuisitive.com/wp-content/uploads/2023/04/image-147.png)**Examples**: **Get status of specific service on Remote Computer** To get the status of a service on remote computer you just need to add -ComputerName parameter ``` PS C:\> Get-Service -ComputerName Desktop-9OP8RCA -Name BITS Status   Name               DisplayName                            ------   ----               -----------                            Running  BITS               Background Intelligent Transfer Ser...    ``` ![](https://techuisitive.com/wp-content/uploads/2023/04/image-148.png)**Start and Stop service using Start-Service and Stop-Service cmdlets** As name suggest, the Stop-Service cmdlets allow you to stop a service while Start-Service cmdlets allow you to start a service. The below examples show usage of both cmdlets to start / stop service on local or remote computer. **Examples**: **Stop a service** ``` PS C:\> Stop-Service -Name BITS ``` Another way is to get a service using Get-Service cmdlets and then pass the output to Stop-Service cmdlets using Piping. ``` PS C:\> Get-Service -Name BITS | Stop-Service ``` ![](https://techuisitive.com/wp-content/uploads/2023/11/image-1.png)![](https://techuisitive.com/wp-content/uploads/2023/04/image-149.png)The benefits of using second methods is that it support remote services as well. While Get-Service cmdlet support remote services, Start-Service and Stop-Service cmdlets do not. However, the result can be achieved by usage of Piping. See the below example to understand how Piping was used to start and stop a service on remote computer ![](https://techuisitive.com/wp-content/uploads/2023/04/image-150.png)![](https://techuisitive.com/wp-content/uploads/2023/04/image-151.png)Do you need an offline copy (PDF , ebook) of all Windows services articles? Download a free copy from [Techuisitive Store](https://www.techuisitive.com/shop?Collection=ebooks) or below link. ## **Related Posts:** - [Windows 10 – Remote administration through PowerShell – Part 1](https://techuisitive.com/windows-10-remote-administration-through-powershell-part-1/) - [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) - [Windows Administrator Basics: Windows Services](https://techuisitive.com/windows-administrator-basics-windows-services/) - [Windows Administrator Basics: Managing Windows Services from Powershell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) - [Windows Administrator Basics: Windows Registry](https://techuisitive.com/windows-administrator-basics-windows-registry/) - [Basic Knowledge for Windows Desktop Support Engineer](https://techuisitive.com/basic-knowledge-for-windows-desktop-support-engineer/) - [Windows 10 /11 : Create a virtual drive with SUBST command](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell, Windows 10 / 11 **Tags:** Windows Administration --- ### [Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/) **Published:** July 4, 2023 **Author:** Asif Khan **Excerpt:** Using provisioning package device failed to complete AAD Join with error 0xCAA2000C. The issue can also be tracked under Audit Logs in Azure. You will get entry of the device that you are trying to onboard , looking at the Azure audit logs it shows that the device gets added and then gets removed immediately. **Content:** # **Issue** Using the [provisioning package](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C"), the device failed to complete AAD Join. The issue can also be tracked under Audit Logs in Azure. You will get an entry of the device that you are trying to onboard. Looking at the Azure audit logs, it shows that the device gets added and then gets removed immediately. ![intune Provisioning Palcage error 0xCAA2000C](https://techuisitive.com/wp-content/uploads/2023/07/image-29.png)DeviceAADJoin failed with ‘0xCAA2000C’ at CSP node ‘AADJ/BPRT’. Provisioning failure can also be seen in the Event Viewer. ## Workaround for Error 0xCAA2000C While there could be multiple issues related to 0xCAA2000C, the one that worked for me was to exclude MFA for Intune Enrollment. After I created a Conditional Access Policy to exclude Intune Enrollment for MFA, I could see the device successfully getting joined to Azure AD using Provision Package. ## Related Posts - [Fix Device Enrollment Error: DeviceAADJoin Failed with Error 0x8018000A](https://techuisitive.com/fix-device-enrollment-error-deviceaadjoin-failed-with-error-0x8018000a/ "Fix Device Enrollment Error: DeviceAADJoin Failed with Error 0x8018000A") - [Fix Windows 11 Intune Enrollment Error 0x800700b7 \[Step-by-Step Guide](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/ "Fix Windows 11 Intune Enrollment Error 0x800700b7 [Step-by-Step Guide") - [Troubleshooting Intune Issues on Windows 10 / Windows 11](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/ "Troubleshooting Intune Issues on Windows 10 / Windows 11") ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Troubleshooting, Troubleshooting --- ### [Fix Windows 11 Intune Enrollment Error 0x800700b7 [Step-by-Step Guide]](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) **Published:** September 21, 2022 **Author:** Equebal Ahmad **Excerpt:** You may encounter below error when trying to enroll Windows 11 device to Intune with provisioning package. Provisioning failure , Installation of a provisioning package failed. Please work with the package author to diagnose the problem. Reported error code: 0x800700b7 **Content:** ## Issue **Summary** A **Windows provisioning package** allows [bulk enrollment](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/ "Bulk enrollment of Windows 10 / 11 Devices to Intune Using Provisioning Package") of Windows 10 or later devices into[ **Microsoft Intune**](https://techuisitive.com/microsoft-intune/ "Microsoft Intune"). However, you might encounter the following error when attempting to enroll a **Windows 11 device** using a provisioning package: *****Provisioning failure**: Installation of a provisioning package failed. Please work with the package author to diagnose the problem. **Reported error code**: `0x800700b7`*** The error code `0x800700b7` Typically indicates that a provisioning package has already been applied to the device. As a result, the system is unable to create a new provisioning instance. This issue commonly occurs if the same provisioning package was previously executed on the device. ## **TL;DR:** Error **0x800700b7** during Windows 11 Intune enrollment via provisioning package means the package already exists on the device. Go to **Settings → Accounts → Access work or school → Add or Remove a provisioning package**, remove the existing one, and then re‑run the .ppkg. ![Fix Windows 11 enrollment error 0x800700b7 using provisioning package.](https://techuisitive.com/wp-content/uploads/2023/03/image-39.png)## What Causes Error 0x800700b7? The error typically occurs when: - A **duplicate provisioning package** has been applied to the device. - Remnants of a previously applied package remain in the system registry. - The provisioning package itself is **corrupted or incomplete**. In short, Windows detects a conflict when trying to apply the same package more than once, or when leftover configuration data interferes with enrollment ## How to Fix Enrollment Error 0x800700b7 To fix the 0x800700b7 error, you need to remove the provisioning package by following the steps below. Once the existing package is removed, you can run the package again. - **Open Settings** Go to **Settings → Accounts → Access work or school**. - **Check for Provisioning Packages** Click on **Add or Remove a Provisioning package** at the bottom of the screen. ![0x800700b7 provisioning](https://techuisitive.com/wp-content/uploads/2023/10/image-59.png)- **Remove Duplicate Package** On the **Add or Remove** a provisioning package screen, select the provisioning package that you want to remove and click on **Remove**. ![provisioning failure 0x800700b7](https://techuisitive.com/wp-content/uploads/2023/10/image-60.png)**Retry Enrollment** Re-run the provisioning package or initiate Intune enrollment again. It should work as expected now. Still encountering the error? Feel free to leave a comment below or reach out with your log snippet for further assistance. ## Advanced Troubleshooting If the issue persists, try these additional steps: - **Check Event Viewer Logs** Navigate to **Event Viewer → Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider**. Look for detailed error messages. - **Review Registry Keys** Inspect `HKLM\Software\Microsoft\Provisioning` for leftover entries from old packages. Remove only if you’re confident—always back up the registry first. - **Validate Package Integrity** Ensure the provisioning package (`.ppkg` file) is not corrupted. Recreate or re-export it if necessary. ## **Related Posts** - [Fix Device Enrollment Error: DeviceAADJoin Failed with Error 0x8018000A](https://techuisitive.com/fix-device-enrollment-error-deviceaadjoin-failed-with-error-0x8018000a/ "Fix Device Enrollment Error: DeviceAADJoin Failed with Error 0x8018000A") - [Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [Troubleshooting Intune Issues on Windows 10 / Windows 11](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/ "Troubleshooting Intune Issues on Windows 10 / Windows 11") - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Troubleshooting --- ### [Compare Hardware and Software Details Between Two Computers Using PowerShell](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) **Published:** February 27, 2021 **Author:** Equebal Ahmad **Content:** This tool allows you to quickly compare the hardware configuration, installed software, and software updates on two remote computers. The comparison results are exported to an Excel file, making it easy to review the differences side by side in separate columns. ## **Key Features** - Collect the data for two computers. You need to provide at least one computer name. - The result will be saved in an Excel file in the script directory. - You can quickly compare the data for two computers, which will be helpful in troubleshooting client issues. ## How to Run the Script - Right-click on the script and select “Run with PowerShell,” and follow on-screen instructions. ![Get Computer info script](https://techuisitive.com/wp-content/uploads/2023/04/image-93.jpeg)![](https://techuisitive.com/wp-content/uploads/2023/04/image-94.jpeg)## **Download** Scripts [Compare hardware and software between two computers](https://techuisitive.com/wp-content/uploads/2026/08/Compare-hardware-and-software-between-two-computers.zip)[Download](https://techuisitive.com/wp-content/uploads/2026/08/Compare-hardware-and-software-between-two-computers.zip) ## **Related Posts:** - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [String Functions : UPPER, LOWER & PROPER | Microsoft Excel](https://techuisitive.com/string-functions-upper-lower-proper-microsoft-excel/) - [How To Join Texts Using TEXTJOIN & IF Functions | Microsoft Excel](https://techuisitive.com/how-to-join-texts-using-textjoin-if-functions-microsoft-excel/) - [Basic Excel Functions you should know to make your work life easier](https://techuisitive.com/basic-excel-functions-you-should-know-to-make-your-work-life-easier/) ## Explore More Windows Guides Continue building your Windows administration skills with practical, step-by-step guides covering Windows configuration, troubleshooting, device management, PowerShell, and automation. - **[Windows 10/11 Guides](https://techuisitive.com/microsoft-windows/)** – Explore practical guides for Windows configuration, administration, troubleshooting, updates, PowerShell, and everyday Windows management. - **[Microsoft Intune Learning](https://techuisitive.com/microsoft-intune/)** – Learn how to manage Windows devices with Intune, including device enrollment, configuration, compliance, application deployment, and updates. - **[Automation](https://techuisitive.com/automation/)** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive administration tasks and manage Windows devices more efficiently. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell, Windows 10 / 11 **Tags:** PowerShell, Windows Guides --- ### [Troubleshooting Intune Issues on Windows 10 / Windows 11](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) **Published:** June 1, 2021 **Author:** Equebal Ahmad **Content:** **Troubleshooting Intune MDM on Windows 10 and Windows 11 devices is a critical skill for IT administrators and endpoint managers.** Common issues such as policy sync failures, missing apps, or configuration drift can disrupt productivity and security. In this guide, we’ll walk through **basic Intune MDM troubleshooting steps,** including policy validation, diagnostics report generation, log collection, and Intune Management Extension (IME) analysis. Whether you’re managing a small business or an enterprise environment, these **step-by-step Intune troubleshooting techniques** will help you quickly identify and resolve device management problems. ## How to **Validate Intune Policies Status** The **Access work or school** page in Windows 10 settings is a quick starting point for Intune MDM troubleshooting. It provides a snapshot of the device’s management status, including applied policies and deployed applications. Under the **Policies** section, you can view all configuration policies currently enforced by your organization. Likewise, the **Applications** section lists the apps that are being managed through Intune. Reviewing this page is often the fastest way to confirm whether required policies and applications have successfully synced to the device before moving on to deeper diagnostics. ![MDM - work or school - Intune policy status](https://techuisitive.com/wp-content/uploads/2023/04/image-85.jpeg)### Check Device Sync Status If you do not see the expected policies/applications applied, then you can check the Sync status on the same page. You can force sync as well from here. ![Collect simple diagnostics report](https://techuisitive.com/wp-content/uploads/2023/04/image-86.jpeg)## Generate a Diagnostic Report You can also generate a diagnostics report in HTML format using the “Create report” button (see the above screenshot). Here are the complete steps. - Go to Settings > Access Work and School - Select Tenant ’s Azure AD > and click on Info - Scroll down to the bottom and click on **Create report** The report will be saved to: C:\\Users\\Public\\Public Documents\\MDMDiagnostics\\MDMDiagReport.html ![Managed applications section of MDMDiagReport.html](https://techuisitive.com/wp-content/uploads/2023/04/image-87.jpeg) ## **Generate detailed diagnostics report** A **detailed MDM diagnostics report** can be generated directly from the **Access work or school** page in Windows 10/11. Under the **Related settings** section, you’ll find the **Export your management log files** option, which allows you to collect Intune diagnostics logs for troubleshooting policy sync and device management issues. If the settings window is maximized, this option appears at the **top-right corner of the screen**. Exporting these log files provides administrators with a comprehensive view of applied Intune policies, configuration profiles, and potential errors, making it an essential step in **Intune MDM troubleshooting**. ![Windows 10 MDM - Export your management log files](https://techuisitive.com/wp-content/uploads/2023/04/image-88.jpeg)The diagnostics report is saved as a **CAB file (MDMDiagReport.cab)** in the following location: `C:\Users\Public\Documents\MDMDiagnostics` This file contains detailed **Intune MDM diagnostics logs**, including applied policies and configuration data, and can be used by administrators for **troubleshooting Windows 10/11 device management issues**. ![MDMDiagReport](https://techuisitive.com/wp-content/uploads/2023/04/image-89.jpeg)## **Collect diagnostics log from Intune Admin Center** You can collect **diagnostics logs** directly from the **Intune Admin Center** by following the steps below. These logs provide comprehensive data for **Intune MDM troubleshooting**, including details from the **MDM agent**, **MECM client**, **Windows Autopilot**, **registry keys**, **event viewer logs**, **networking information**, and other critical components. Reviewing these logs helps administrators quickly identify configuration issues, policy sync failures, and connectivity problems across managed Windows 10/11 devices. ### 📋 Collecting Diagnostics Logs from Endpoint Manager Admin Center - **Step 1: Navigate to the Intune admin center** - In the left‑hand navigation pane, select **Devices**. - From the list of enrolled devices, choose the specific **Windows 10/11 device** you want to troubleshoot. - **Step 2: Access the Collect Diagnostics option** - Once inside the device blade, go to the **Overview** section. - In the top menu, click on **Collect diagnostics**. - This option triggers the collection of **Intune MDM logs, Autopilot logs, registry keys, event viewer logs, networking data, and MECM client logs**. - The collected package is automatically uploaded to the Intune admin portal for review. ![Intune admin center | collect diagnostics logs](https://techuisitive.com/wp-content/uploads/2023/11/image-1.jpeg)- **Step 3: Confirm the action** - A confirmation prompt will appear asking if you want to proceed. - Click **Yes** to start the diagnostics collection process. - The process may take several minutes depending on the device’s configuration and log size. - Once complete, the logs will be available under the **Device → Collect diagnostics history** tab for download and analysis. ![Intune admin center | collect diagnostics logs](https://techuisitive.com/wp-content/uploads/2023/04/image-90.jpeg)The log files will be organized in different folders named as numbers (1,2,3….) which contain the details mentioned above. The “result.xml” file in the root folder will have details of the information collected by the diagnostics tool. Please check Microsoft documentation to know more about the data collected by the diagnostics tool. ![MDM Diagnostics log - result.xml](https://techuisitive.com/wp-content/uploads/2023/04/image-91.jpeg)### **Intune Management Extension** The Intune management extension supplements the in-box Windows 10 MDM features. It allows Microsoft Intune to run the PowerShell scripts on Windows 10 devices. The IME runs as a service called “Microsoft Intune Management Extension”. The service name is IntuneManagementExtension. IME logs are located in C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs folder. You can use CMTrace.exe, provided with Configuration manager,to view these logs. - AgentExecutor - ClientHealth - IntuneManagementExtension The full content of the script is logged in the IntuneManagementExtension log which can be useful in troubleshooting. ![IntuneManagementExtension log](https://techuisitive.com/wp-content/uploads/2023/04/image-92.jpeg)## **Related Posts** - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Troubleshooting, Troubleshooting --- ### [Fix Invalid_Client Error When Joining Windows 10 to Azure AD (Microsoft Entra ID)](https://techuisitive.com/invalid_client-error-when-joining-windows-10-device-to-azure-ad-tenant/) **Published:** September 8, 2021 **Author:** Equebal Ahmad **Excerpt:** When trying to join a Windows 10 or Windows 11 device to the Azure AD tenant using Settings > Access Work or School > Connect > Join this Device to Azure AD , you may get invalid_client error. Looks like we can't connect to the URL for your organization's MDM terms of use. Try again, or contact your system administrator with the problem information from this page. **Content:** *When enrolling Windows 10 devices into Azure AD, admins may encounter the **Invalid\_client error**. This typically indicates a misconfiguration in the device registration or authentication flow. In this guide, we’ll explain why it happens and how to fix it step by step.* ## What is Invalid\_Client Error: You may encounter the following **Invalid\_Client error** when attempting to join a **Windows 10 device** to your **Azure AD (Microsoft Entra ID) tenant**. The following errors are displayed. *Something went wrong.* *Looks like we can’t connect to the URL for your organization’s MDM terms of use. Try again, or contact your system administrator with the problem information from this page.* *Error: Invalid\_Client* *Description: Failed to authenticate user* ![Failed to authenticate user | invalid_client error](https://techuisitive.com/wp-content/uploads/2023/10/image-52.png)## Invalid\_Client Error – Root Cause and Resolution The **Invalid\_Client error** can occur for several reasons during a **Windows 10 Azure AD (Microsoft Entra ID) join**. If you encounter this issue, review the following checks to quickly identify and resolve the problem. ### **1. Validate automatic MDM enrollment** settings When a user is configured for **automatic enrollment into Microsoft Intune** during a **Microsoft Entra ID (formerly Azure Active Directory) join**, Intune enrollment becomes a mandatory step in the **Azure AD Join process**. If **MDM enrollment** fails, the device will not successfully join Azure AD. To resolve this, verify that **MDM enrollment scopes** are correctly configured by following the steps outlined below. Go to **Microsoft Intune admin center > Devices > Windows > Automatic Enrollment** to check the settings. The **MDM user scope** must be configured to either **Some** or **All**. If it is set to **Some**, verify that the user is a member of the **Entra ID group** specified in the scope configuration. ![Microsoft Intune Automatic Enrollment](https://techuisitive.com/wp-content/uploads/2023/10/image-53.png)### **2.** Ensure Microsoft Intune License Is Assigned to the User The user must be assigned both a Microsoft Intune license and an Azure Active Directory Premium P2 license. You can verify this by navigating to **Microsoft Intune > Users > \[User Name\] > Licenses**. If the same error persists after assigning the license, allow 10–15 minutes for the changes to propagate before retrying. ![Invalid_Client error verify license](https://techuisitive.com/wp-content/uploads/2021/09/image-1024x441.png)## **Related Posts** - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM SQL Query for Windows 10 / 11 Version Summary](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) - [Configure Windows 10 / 11 Device as Kiosk | Microsoft Intune](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [Windows 11 enrollment failed with error 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [Enroll Windows 11 Device to Intune through Azure AD Join method | Corporate Devices](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Invalid\_Client error when joining Windows 10 device to Azure AD tenant](https://techuisitive.com/invalid_client-error-when-joining-windows-10-device-to-azure-ad-tenant/) - [Join Windows 10 Device to Azure Active Directory](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Bulk enrollment of Windows 10/ 11 Devices to Intune](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Microsoft Intune – Windows 10 MDM- Basic troubleshooting](https://www.techuisitive.com/post/intune-windows-10-mdm-basic-troubleshooting) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://www.techuisitive.com/post/that-account-info-didn-t-work-error-when-disconnecting-windows-10---11-work-or-school-account) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://www.techuisitive.com/post/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Windows 10 / 11 **Tags:** Intune Troubleshooting --- ### [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code: 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) **Published:** March 7, 2022 **Author:** Asif Khan **Content:** In a **hybrid Azure AD setup**, you may encounter situations where a workstation fails to enroll in Intune after completing the Hybrid Join process. When you check the **Event Viewer** under *Applications and Services → Microsoft → Windows → DeviceManagement → Enterprise-Diagnostics-Provider → Operational*, you might see the error: **Unknown Win32 Error code: 0xcaa9001f** Microsoft’s [official documentation ](https://docs.microsoft.com/en-us/troubleshoot/mem/intune/mdm-enrollment-error-0xcaa9001f#:~:text=This%20issue%20occurs%20when%20integrated,t%20configured%20in%20Configuration%20Manager "official documentation ")provides a potential fix, but the solution only applies if your environment and issue match the scenarios described there. In many cases, this error can also stem from unique factors within your own infrastructure setup, requiring deeper troubleshooting. ![MDM Enroll : Error 0xcaa9001f](https://techuisitive.com/wp-content/uploads/2023/04/image-8.png)![MDM Enroll: Error 0xcaa9001f](https://techuisitive.com/wp-content/uploads/2023/04/image-9.png)## **Symptoms:** When attempting to enroll devices in a **hybrid Azure AD environment**, you may observe the following conditions: - **Enrollment failure after Hybrid Join** Devices successfully complete the Hybrid Azure AD Join process but fail to enroll in Intune MDM. The enrollment attempt does not progress, leaving the workstation unmanaged. - **AAD Connect synchronization in place** Your environment uses **Azure AD Connect** to synchronize on-premises Active Directory objects with Azure AD. The affected devices belong to organizational units (OUs) that are included in the synchronization scope. - **Group Policy configured for MDM enrollment** A **GPO (Group Policy Object)** has been deployed to automatically trigger MDM enrollment using user credentials. Despite this configuration, devices fail to register with Intune. - **OU targeting in AAD Connect** Synchronization is scoped to specific **OUs** in Active Directory. The devices experiencing issues are part of these targeted OUs, yet they still fail to enroll. - **Event Viewer error** In the Event Viewer under *Applications and Services → Microsoft → Windows → DeviceManagement → Enterprise-Diagnostics-Provider → Operational*, you may see the error: **Unknown Win32 Error code: 0xcaa9001f** ## **Cause** : The issue occurs in the following situation. - The device was originally part of the Organizational Unit (OU) configured for synchronization with Azure AD Connect. However, it was moved out of this OU multiple times, which disrupted the synchronization process and left the device registration in a **pending state** within Azure AD. When a device remains stuck in this pending status, enrollment attempts typically fail and result in the **Unknown Win32 Error code: 0xcaa9001f**. ## **Solution:** Move the device back into the Organizational Unit (OU) that is included in Azure AD Connect synchronization. On the affected machine, disconnect it from Azure AD by removing its registration. Next, run the following command with administrative privileges: dsregcmd /leave After executing the command, restart the device. Once it reboots, Azure AD Connect will resynchronize the object and re-establish the device’s join with Azure AD. ## **Related Posts** - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Troubleshooting --- ### [That account info didn't work - error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) **Published:** September 2, 2022 **Author:** Equebal Ahmad **Content:** You may encounter the following error when trying to disconnect a [Work or School account](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/ "Work or School account") on Windows 10 / 11. The issue keeps happening with different local administrator accounts as well. ***Error: That account info didn’t work. Ensure*** you’re entering information ***for*** ***a local administrator account and try again.*** ![That account info didn't work](https://techuisitive.com/wp-content/uploads/2023/04/image-108.png)## **Cause:** This issue may occur if the computer’s NetBIOS name is more than 15 characters long (e.g., PC-12340000000000000016). In our case, the machine was enrolled in Microsoft Entra ID (Formerly Azure AD) using the Windows [provisioning package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/ "Bulk enrollment of Windows 10 / 11 Devices to Intune Using Provisioning Package"), and a long NetBIOS name was automatically assigned to the computer. The machine name was auto-generated based on the serial number. It was a virtual machine, and the serial number was longer. ## **Solution:** Rename the computer and keep the NetBIOS name within 15 characters. Reboot the machine, then try disconnecting it from Azure AD again. In our case, the machine was successfully disconnected from Azure AD after reducing the NetBIOS name length to 15 characters. ## **Related Posts** - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Windows 10 / 11 **Tags:** Intune Troubleshooting, Troubleshooting --- ### [How to Fix Intune Enrollment Error 0x800705b4](https://techuisitive.com/how-to-fix-intune-enrollment-error-0x800705b4/) **Published:** May 7, 2024 **Author:** Equebal Ahmad **Content:** When enrolling Windows devices into[ Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune"), administrators may encounter the error code **0x800705b4**, often during the *Device Preparation* stage. This error typically occurs when **Bring Your Own Device (BYOD)** enrollment is blocked by Intune’s platform restriction policies. While the message itself can be frustrating, the underlying cause is straightforward: Intune is preventing personal devices from joining due to policy settings. In this guide, we’ll walk through the root cause of error 0x800705b4 and provide clear steps to resolve it, ensuring a smoother enrollment experience for both IT admins and end users. Table Of Contents 1. [Issue: Intune BYOD enrollment error 0x800705b4](#issue-intune-byod-enrollment-error-0x800705b4) 2. [Causes of Intune Enrollment Error 0x800705b4](#causes-of-intune-enrollment-error-0x800705b4) 3. [Step-by-Step to Validate BYOD Enrollment Restrictions](#step-by-step-to-validate-byod-enrollment-restrictions) 4. [Solution](#solution) 5. [Troubleshooting Table: Intune Enrollment Error 0x800705b4](#troubleshooting-table-intune-enrollment-error-0x800705b4) 6. [Related Posts](#related-posts) 7. [Explore More Intune Guides](#explore-more-intune-guides) ## Issue: Intune BYOD enrollment error **0x800705b4** **Stage:** Device Preparation **Step:** Preparing your device for mobile management (0x800705b4). **Error:** Setup could not be completed. Please try again or contact your support person for help. ![Intune Enrollment Error 0x800705b4 | Intune BYOD enrollment error](https://techuisitive.com/wp-content/uploads/2024/04/Screenshot-2024-04-13-175658.png)## Causes of Intune Enrollment Error 0x800705b4 The device platform enrollment restriction policy can be used to block the enrollment of personally owned (BYOD) Windows devices. When you encounter this error, you should check the policy to confirm if BYOD devices are blocked. ## Step-by-Step to Validate BYOD Enrollment Restrictions Follow the steps below to check the device enrollment restriction policy. - On the **Intune admin center,** navigate to **Devices / Device onboarding / Enrollment** - Select **Device platform restriction** - Click on **Windows restrictions** - Under Device type restriction, click **All users** under the default restriction policy. If you have custom policies, then click on Policy name. - Select **Properties** and validate the restriction settings configured for the policy. As highlighted in the screenshot below, you can see that Windows MDM is blocked for personally owned (BYOD) devices. ![Intune Device platform restriction policy](https://techuisitive.com/wp-content/uploads/2024/04/image-1024x354.png)## Solution The solution depends on the organization’s policy. If your organization permits the enrollment of Windows BYOD (Bring Your Own Device) devices, you can resolve this error by editing the **platform restriction policy** and setting it to **Allow**. Once updated, personally owned Windows devices can be successfully enrolled in Intune. If your organization does **not** allow enrollment of personally owned Windows 10 or later devices, there’s no direct fix available. In that case, the best approach is to engage with your IT decision-makers to discuss whether enabling BYOD enrollment aligns with your organization’s policies and security requirements. ## Troubleshooting Table: Intune Enrollment Error 0x800705b4 Error StagePossible CauseResolution**Device Preparation**BYOD enrollment blocked by Intune platform restriction policyEdit the **platform restriction policy** → set Windows (BYOD) to **Allow****Enrollment Attempt**Organization policy disallows personally owned Windows 10/11 devicesNo direct fix. Contact IT decision-makers to discuss enabling BYOD enrollment**General Enrollment**Network/connectivity issuesVerify internet connection and retry enrollment**Policy Sync**Device not compliant with assigned policiesReview compliance policies and ensure the device meets requirements## Related Posts - [Create ADE Enrollment Profile in Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/) - [Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/) - [Windows 11 enrollment failed with error 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [Bulk enrollment of Windows 10 / 11 Devices to Intune Using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [How to Configure Enrollment Status Page (ESP) in Microsoft Intune](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) - [How to Fix Intune Enrollment Error 0x800705b4](https://techuisitive.com/how-to-fix-intune-enrollment-error-0x800705b4/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Troubleshooting --- ### [Fix Windows Hello for Business Error 0x80090010 During Autopilot](https://techuisitive.com/fixing-windows-autopilot-error-0x80090010-during-windows-hello-setup/) **Published:** April 14, 2026 **Author:** Equebal Ahmad **Content:** The Windows Autopilot Device Preparation streamlines the device provisioning. However, sometimes things don’t go as planned, and you may encounter different issues. One common issue you may encounter is Error code: 0x80090010. This error often points to issues with the device’s TPM or cryptographic services. In this post, we will discuss the issues and possible solutions. ## When Error 0x80090010 Appears During Windows Hello Setup This error usually appears at the point where **Windows Hello tries to create a PIN** during Autopilot device preparation. Instead of completing the setup, the process fails and throws **Error code: 0x80090010**. - Device enrollment or device preparation completes successfully. - User is prompted to configure **Windows Hello PIN** (after MFA/2FA authentication). - Authentication succeeds. - During PIN provisioning, the process fails with the Something went wrong error **0x80090010**. ![Windows autopilot device preparation Something went wrong error 0x80090010. ](https://techuisitive.com/wp-content/uploads/2026/03/image-5-1024x643.png)Windows Hello for Business error 0x80090010## Cause for Windows Hello for Business Error 0x80090010 The error **0x80090010 (NTE\_PERM)** is related to a permission or cryptographic key issue. In this case, it indicates a **failure in Windows Hello for Business (WHfB) key provisioning**, often due to TPM or Credential Manager access. ### Common Causes for PIN Setup Failure - **TPM is not ready or inaccessible** during WHfB provisioning. - **Corrupted existing PIN/credentials** stored locally. - **Policy conflicts** (e.g., Intune/Group Policy enforcing WHfB incorrectly). - **AAD/Hybrid join state mismatch** – device is joined, but WHfB cannot finalize key binding. - **Residual enrollment artifacts** from previous attempts. - **No TPM present** – Standard Virtual Machines (VMs) don’t expose a hardware TPM to the guest OS. - **No vTPM configured** – Even Hyper‑V, VMware, or Azure VMs need vTPM enabled to support WHfB. ## Step-by-Step Fix for Error 0x80090010 ### Virtual Machines (VMs) The standard virtual machines don’t expose a hardware TPM to the guest OS. Even Hyperv-V, vMware, or Azure VMs need a vTPM to support WHfB. If you’re testing Intune/Autopilot enrollment flows in a VM, **disable the WHfB policy** for that test group. Otherwise, you’ll consistently hit 0x80090010 during PIN setup because the VM cannot provision the required keys. If you have VMs in production, then enable the vTPM if supported. Otherwise, the VMs should be excluded from the policy to avoid inconvenience to the users. - Hyper‑V: Configure **Shielded VM** with vTPM. - VMware: Add a **Virtual Trusted Platform Module** device. - Azure: Use **Generation 2 VMs** with vTPM enabled. The screenshot below shows how you can enable vTPM in HyperV. ![Enable TPM in HyperV](https://techuisitive.com/wp-content/uploads/2026/04/image-1.png)Enable Trusted Platform Module (TPM) in HyperV### **Policy Validation** - Review Intune/Group Policy settings for WHfB. - Temporarily disable the WHfB policy or exclude the device to confirm if PIN setup succeeds without enforcement. ### **Check TPM Health** The issue may happen due to TPM corruption. Follow the steps below to check TPM health on a physical device (Laptop/Desktop). - Run `tpm.msc` and confirm TPM is enabled, ready, and owned. - If misconfigured, clear TPM and retry PIN setup. ![How to check TPM health on Windows 11](https://techuisitive.com/wp-content/uploads/2026/04/image-1024x543.png)### **Reset Windows Hello Credentials** #### Reset Windows Hello Credential from Settings Apps Follow the steps below to reset the Windows Hello credentials from the Settings app. - Navigate to **Settings > Accounts > Sign-in options**. - Remove existing PIN/Hello credentials. - Reboot and reattempt PIN setup. ![Remove Windows Hello PIN from settings app](https://techuisitive.com/wp-content/uploads/2026/04/image-2-1024x459.png)#### The Hard Reset If removing the Windows Hello PIN from the Settings app does not work, this method clears the physical database where the credentials are stored. Deleting the NGC (Next Generation Credentials) folder in Windows can fix issues with Windows Hello PIN login, such as errors saying “Something went wrong”, “your PIN isn’t available”. If you are unable to set, remove, or use a PIN. It essentially resets stored PIN and biometric credentials, forcing Windows to recreate them. Steps to remove the NGC folder. - Open **File Explorer** and go to: `C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft`. - Right-click the **Ngc** folder and select **Properties** > **Security** > **Advanced**. - Click **Change** next to the Owner, type `Everyone`, and click **OK**. - Check the box **“Replace owner on subcontainers and objects”** and click **Apply**. - Now, **Delete** everything inside the Ngc folder. - Restart your PC and go to **Settings > Accounts > Sign-in options** to set up a new PIN. ### **Force Entra ID Rejoin** for Device When a device shows inconsistent Azure AD/Entra ID join states, a forced rejoin often resolves authentication and token issues. By using the `dsregcmd` tool, administrators can quickly verify the join status, remove stale registrations, and re-establish a clean connection to Entra ID. - Run `dsregcmd /status` to check the join state. - If inconsistent, run `dsregcmd /leave`, and reboot the device. - Run **dsregcmd /join** to rejoin the device to Entra ID. ![dsrecmd /status Azure AD join status](https://techuisitive.com/wp-content/uploads/2026/04/image-3.png)### **Check Event Logs** #### **User Device Registration Logs (Entra ID Join Events)** For **Windows Hello for Business (WHfB)**, the **Microsoft > Windows > User Device Registration** log in Event Viewer captures events tied to the device’s registration and trust establishment with Entra ID. These logs track the provisioning of WHfB keys, certificate issuance, and registration status, helping administrators diagnose why PIN or biometric setup may fail, or why a device isn’t properly recognized for WHfB authentication. - Path: **Event Viewer > Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin** - Logs device registration events with Azure AD/Entra ID. - Useful for troubleshooting WHfB provisioning and join issues. The event logs show the error below in this case: *The NGC key registration initialization operation failed. Exit code: Access denied.. User email: xyz@domain.com. Auth token: .*. ![User device registration log in event viewer](https://techuisitive.com/wp-content/uploads/2026/04/image-6-1024x570.png)**User Device Registration Event Logs**Another event log shows that WHfB provisioning was not launched. *Windows Hello for Business provisioning will not be launched. Device is AAD joined ( AADJ or DJ++ ): Yes User has logged on with AAD credentials: Yes Windows Hello for Business policy is enabled: Yes Windows Hello for Business post-logon provisioning is enabled: Yes **Local computer meets Windows hello for business hardware requirements: No** User is not connected to the machine via Remote Desktop: No User certificate for on premise auth policy is enabled: No Machine is governed by none policy. Cloud trust for on premise auth policy is enabled: No User account has Cloud TGT: Not Tested* ![WHfB logs user device registration](https://techuisitive.com/wp-content/uploads/2026/04/image-8.png)**User Device Registration Event Logs**### Windows Hello for Business Logs (PIN & Key Provisioning) - Path: **Event Viewer > Applications and Services Logs > Microsoft > Windows > Hello-For-Business > Operational** - Dedicated WHfB log. - Shows PIN setup, key generation, and authentication events. - Best place to check if WHfB provisioning succeeded or failed. The logs show that Windows Hello provisioning failed. *Windows Hello processing failed with 0x80090010.* ![Windows Hello processing failed with 0x80090010.](https://techuisitive.com/wp-content/uploads/2026/04/image-5.png)**Windows Hello for Business (WHfB) Logs**### **Azure AD Authentication Logs (PRT & Token Events)** - Path: **Event Viewer > Applications and Services Logs > Microsoft > Windows > AAD > Operational** - Logs Azure AD authentication and token events. - Helpful when WHfB sign-in fails due to Entra ID issues. ### **Authentication Logs (Sign‑in Attempts & Credential Use)** - Path: **Event Viewer > Security > Authentication** - General authentication logs. - Can show WHfB sign-in attempts alongside password or smart card logins. ## Frequently Asked Questions (FAQs) ### Why does Windows Hello fail with error 0x80090010 during Autopilot? Windows Hello error **0x80090010 (NTE\_PERM)** usually occurs due to permission issues with the NGC folder, TPM-related problems, or misconfigured policies in Intune. During Windows Autopilot deployment, these issues can prevent successful PIN provisioning and cause Windows Hello setup to fail. ### Can Intune policies cause Windows Hello error 0x80090010? Yes, incorrect or conflicting **Microsoft Intune policies** are a common cause. Misconfigured Windows Hello for Business settings—especially when assigned at both user and device levels—can lead to provisioning failures and trigger the 0x80090010 error during Autopilot. ## Related Posts - [Autopilot Device Preparation Error 80180003](https://techuisitive.com/autopilot-device-preparation-error-80180003/) - [BitLocker : The encryption method of the OS volume doesn’t match the BitLocker policy](https://techuisitive.com/bitlocker-the-encryption-method-of-the-os-volume-doesnt-match-the-bitlocker-policy/) - [Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/) - [Fixing Windows Autopilot Error 0x80090010 During Windows Hello Setup](https://techuisitive.com/fixing-windows-autopilot-error-0x80090010-during-windows-hello-setup/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Windows Autopilot **Tags:** Autopilot Troubleshooting, Troubleshooting --- ### [Fix Incorrect Driver Update Status in Intune](https://techuisitive.com/intune-driver-update-device-not-reporting-correct-status/) **Published:** May 7, 2025 **Author:** Equebal Ahmad **Content:** Microsoft [Intune Driver Update Management](https://techuisitive.com/manage-windows-drivers-update-with-intune/ "Manage Windows Drivers Update with Intune") streamlines how IT admins deploy and monitor Windows driver updates. However, some devices may report incorrect compliance status even after successfully installing the driver. In this guide, we explain why devices get stuck in the “offering” state, how to confirm installation, and the steps to force a full telemetry sync to ensure accurate reporting in Intune. ## Issue: Intune Driver Updates Reporting Incorrect Status We deployed **driver updates** to devices managed by **Microsoft Intune**, but many endpoints remain stuck in the **“Offering” state** for an extended period. The compliance status does not change even after **2–3 weeks**, creating confusion for IT admins monitoring update progress. Interestingly, this issue occurs only with **driver updates scheduled for a future date**, while immediate deployments report status correctly. ![Intune Driver Update Offering State ](https://techuisitive.com/wp-content/uploads/2025/04/image-4.png)## Observation: Driver Installed but Incorrect Status Reported The **driver update was successfully installed** on the affected devices, as confirmed through **Device Management**. Despite this, the **Intune compliance report** continued to show an **incorrect status**, leaving the devices marked as non‑compliant. This mismatch highlights a reporting issue where the **installation state on the endpoint** does not synchronize properly with **Microsoft Intune**, resulting in inaccurate compliance visibility for admins. ![Device Management driver status](https://techuisitive.com/wp-content/uploads/2025/04/image-3.png)## Solution: Force Full Telemetry Sync in Intune As advised by **Microsoft**, we resolved the reporting mismatch by running a command to **force a full telemetry sync** on the impacted devices. This ensures that the device’s actual driver installation status is correctly reported back to **Microsoft Intune**. - The full telemetry sync may take up to **48 hours** to complete. - The command does not generate any output when executed. **Command to run on affected devices:** ``` compattelrunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun ent ``` ## Summary and Best Practices This issue highlights a common challenge in **Intune Driver Update Management**: devices may successfully install drivers but fail to report the correct compliance status due to delayed telemetry synchronization. Running a **full telemetry sync** ensures that Intune reflects the actual installation state, though admins should allow up to **48 hours** for reporting to update. To minimize similar issues in the future, consider these best practices: - **Monitor telemetry syncs** regularly to ensure accurate compliance reporting. - **Schedule driver updates carefully**, avoiding unnecessary delays that may cause devices to remain in the “Offering” state. - **Leverage Intune reporting tools** to cross‑check installation status against Device Management. - **Communicate with end users** proactively, providing clear instructions for remediation if compliance status appears incorrect. - **Submit feedback to Microsoft** when recurring reporting mismatches occur, as these may indicate service‑level improvements needed. ## Related Posts - [Autopilot Device Preparation Error 80180003](https://techuisitive.com/autopilot-device-preparation-error-80180003/) - [BitLocker : The encryption method of the OS volume doesn’t match the BitLocker policy](https://techuisitive.com/bitlocker-the-encryption-method-of-the-os-volume-doesnt-match-the-bitlocker-policy/) - [Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/) - [Fixing Windows Autopilot Error 0x80090010 During Windows Hello Setup](https://techuisitive.com/fixing-windows-autopilot-error-0x80090010-during-windows-hello-setup/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Device Configuration Troubleshooting, Troubleshooting --- ### [How to Monitor and Troubleshoot Windows Autopatch Issues](https://techuisitive.com/how-to-monitor-and-troubleshoot-windows-autopatch-issues/) **Published:** July 21, 2025 **Author:** Equebal Ahmad **Content:** Windows Autopatch is a cloud-based service built into Microsoft Intune that automates the deployment of updates for Windows, Microsoft 365 Apps, Edge, and Teams. It streamlines patch management through phased deployment rings and centralized monitoring. Even with automation, proactive monitoring and troubleshooting remain essential. Intune equips admins with dashboards, alerts, diagnostic tools, and Graph API/Copilot capabilities to detect issues early and resolve them swiftly. In this post, you’ll find detailed, actionable guidance to monitor your Autopatch environment effectively and fix common pitfalls. Please check out [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) if you want to make yourself familiar with Windows Autopatch. Table Of Contents 1. [Step-by-Step Guides to Troubleshoot Windows Autopatch Issues](#step-by-step-guides-to-troubleshoot-windows-autopatch-issues) 2. [Windows Autopatch Issues – Cause vs Resolution – Quick Comparison Table](#windows-autopatch-issues-cause-vs-resolution-quick-comparison-table) 3. [Conclusion](#conclusion) 4. [Frequently Asked Questions on Windows Autopatch Troubleshooting](#frequently-asked-questions-on-windows-autopatch-troubleshooting) 5. [Related Posts](#related-posts) 6. [Explore More Intune Guides](#explore-more-intune-guides) ## Step-by-Step Guides to Troubleshoot Windows Autopatch Issues ### 1. Check Windows Autopatch Device Readiness Status **Windows Autopatch device readiness** refers to ensuring that your organization’s devices meet all the requirements necessary for successful management and updates by the Windows Autopatch service. The device must be in the **Ready** state for receiving the updates. The **Windows Autopatch Devices** **Readiness** report is accessible from the **Device / Monitoring / Autopatch Groups Membership**. This report provides the status of Windows autopatch device readiness. You can determine whether a device is Ready, Not Ready, ot Not registered to Autopatch service. ![Autopatch Group Membership](https://techuisitive.com/wp-content/uploads/2025/07/image-1024x434.png)#### Device with Registered > Ready status In a Windows Autopatch readiness report, the **“Ready” status** indicates that a device meets all requirements to be fully managed by the Autopatch service. This means the device has passed both **prerequisite checks** (before registration) and **post-registration readiness checks**, ensuring it can receive and report software updates without issues. The report also includes the name of the Deployment ring that you can refer to understand which ring the device is a member of. #### Device with Registered > Not ready status Devices that are **Not ready** may have configuration mismatches, missing updates, or other issues that prevent them from being fully managed by Autopatch. IT admins can use the readiness report to detect and fix these problems The possible issues are listed below. I have added the screenshot for the issues that I encountered during the autopatch testing. - **The device has not synchronized with Intune for the past 28 days:** Quick Checklist: Device not synced with Intune (28+ days) - Power on the device and connect to the internet - Trigger manual sync: *Settings > Accounts > Access work or school > Sync* - Run `dsregcmd /status` to confirm the join state - Check the Intune portal for stale records and clean up if needed - Verify firewall/VPN allows Intune service endpoints - Re‑enroll the device if sync still fails - **Conflicting Windows Update for Business settings:** Conflicting Windows updates for business settings may prevent devices from being registered with the Autopatch service. You need to ensure these settings are configured through GPO or Microsoft Intune. Alternatively, you can also use [Windows Autopatch – Auto remediation script ](https://kengoossens.com/windows-autopatch-auto-remediation-script/ "Windows Autopatch - Auto remediation script ")to fix the conflicts. The script can be deployed as an Intune remediation script. You may see the following errors in case of a conflict when selecting the ‘Not Ready” link in the Autopatch readiness report. **Error description:** Windows Autopatch has identified a configuration that will prevent the device from receiving Windows updates, drivers, and firmware. **Registry keys:** Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NotAutoUpdate **Error description:** Windows Autopatch has identified a configuration that will prevent the device from receiving Windows updates, drivers, and firmware. **Registry keys:** Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations #### Device with Not registered status The **Not Registered** tab displays details of devices that haven’t met the prerequisites for Windows Autopatch registration. ![Autpatch - Device not registered](https://techuisitive.com/wp-content/uploads/2025/07/image-1-1024x415.png)The prerequisites include the following checks: - Intune or Cloud-Attached - Microsoft Entra stale device - Windows OS version - ConfigMgr Co-management workloads - Microsoft Entra ID join type - Disabled Microsoft Entra device - Empty Device Serial Number - Empty Device Manufacturer - Empty Device Model - Duplicated Serial Number - Last Intune device Check-in Now, take a look at the following prerequisite issues that I encountered during Windows autopatch implementation. I have added screenshots for your reference. **Check:** ConfigMgr Co-management workloads **More info:** Workloads must be swung over to pilot Intune or Intune. The screenshot below shows that the device is a Co-managed device. However, the Windows update workload has not been swung over to Intune. Ensure you have added the device to the appropriate collection in Configuration Manager to switch the workload to Intune. The device must be connected to the corporate network (office, VPN, or CMG) to allow the latest Configuration Manager policy downloads. ![Workloads must be swung over to pilot Intune or Intune.](https://techuisitive.com/wp-content/uploads/2025/05/image-33.png)**Check:** Windows OS version **More Info:** Either Windows OS version or Edition is not supported The screenshot below shows that the device doesn’t meet Windows OS version prerequisites. Please check [Windows Autopatch Prerequisites ](https://techuisitive.com/understanding-windows-autopatch-with-intune/#Prerequisites "Windows Autopatch Prerequisites ")to know about supported OS versions. ![Autopatch: Either Windows OS version or Edition is not supported](https://techuisitive.com/wp-content/uploads/2025/05/image-34.png)**Check:** Microsoft Entra stale device **More Info:** A stale device is a device that has been registered with Microsoft Entra ID but hasn’t been used to access any cloud apps in the last 28 days. Stale devices don’t have an Intune object associated with it anymore. Another example where the device failed multiple prerequisite checks. The workload has not been swung to Intune. However, the device has also not reported to Intune or Entra ID for more than 28 days. Hence, it may be a stale record, or the user may be on a long vacation. If you’re seeing a large number of stale devices in Entra ID, it may indicate that a proper device decommissioning process is missing in the environment. ![Microsoft Entra stale device](https://techuisitive.com/wp-content/uploads/2025/05/image-35-1024x372.png)You can check [Detailed prerequisite check workflow diagram](https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices#detailed-prerequisite-check-workflow-diagram "Detailed prerequisite check workflow diagram") at Microsoft Learn for more details about autopatch device registration prerequisites. ### 2. Check Policy Conflicts and Errors The **Deployment status** report, accessible via **Devices > Windows Update > Monitor**, lets you monitor policy conflicts and errors across every Windows Autopatch update ring (e.g., Test, First, Fast, Broad, Last). It presents a device‑by‑device breakdown showing the assigned deployment ring, update state (such as Succeeded, Error, In Progress, Conflict), and whether the update has been paused. Clicking on a specific ring or policy name drills down into detailed logs, highlighting the root causes of conflicts or failures, such as WSUS/GPO interference, missing prerequisites, or diagnostic errors. Optional columns like hex error codes, client/service state, and last Intune check-in time provide added context for in-depth troubleshooting. This centralized view simplifies identifying problem devices, analyzing failure reasons, and prioritizing remediation ![](https://techuisitive.com/wp-content/uploads/2025/07/image-2-1024x377.png)### 3. Check **Software Updates Reports** The **Microsoft Intune admin center** features a robust suite of **Windows update reports**, accessible under **Devices → Windows updates**. These reports provide both high-level overviews and granular device-level insights into update deployment: ![Intune Windows Update Reports](https://techuisitive.com/wp-content/uploads/2025/07/image-3-1024x393.png)**Compatibility & Readiness Insights** – The Feature Update Device Readiness report provides risk assessments for each device, highlighting possible compatibility barriers from apps, drivers, or system configurations. **Update Rings Report** – Displays deployment results (Succeeded, Error, Conflict, Not Applicable, In Progress) for each update ring policy, showing device counts and status percentages in intuitive charts. **Device-Level Reporting** – Drilling into a specific ring reveals detailed data per device, including check-in timestamps, user, individual setting statuses, and full policy assignment results. **Feature Updates Reporting** – Enables compliance tracking and failure troubleshooting for feature updates, with dedicated “Organizational” and “Operational” views and alert-level detail. **Driver & Expedited Update Reports** – Specialized reports surface driver update failures and expedited quality update issues, allowing targeted triage. ## Windows Autopatch Issues – Cause vs Resolution – Quick Comparison Table IssueCauseResolution**Device not synchronized with Intune for past 28 days**Device inactive, powered off, or stale record in Entra ID/Intune. VPN/firewall blocking sync.Update OS edition, clean stale records, re‑enroll the device, and confirm prerequisites before retry.**The device shows “Not Registered”**Missing prerequisites (unsupported OS, stale hybrid join, conflicting GPOs).Power on and connect the device, trigger manual sync, run `dsregcmd /status`, clean stale records, verify firewall/proxy, and re‑enroll if needed.**Device sho**ws “Not Registered.**”**Enrollment prerequisites failed (unsupported edition, stale Entra ID record, hybrid join issues).Run `gpresult /h `[`report.html`](https://report.html), identify conflicts, migrate policies to Intune, and remove redundant GPOs.**Policy conflicts detected**Overlapping GPOs vs Intune policies, duplicate settings applied.Power on and connect the device, trigger manual sync, run `dsregcmd /status`, clean stale records, verify firewall/proxy, re‑enroll if needed.**Software updates not applying**WSUS/GPO conflicts, Windows Update service disabled, VPN blocking update endpoints.Assign correct licenses, verify RBAC roles, and confirm Autopatch service account permissions.**Stale or orphaned devices in Intune/Entra ID**Devices no longer active but still listed, hybrid join cleanup not performed.Power on and connect the device, trigger manual sync, run `dsregcmd /status`, clean stale records, verify firewall/proxy, and re‑enroll if needed.**Licensing or role assignment issues**Missing required licenses (E3/E5), RBAC misconfiguration.Power on and connect the device, trigger manual sync, run `dsregcmd /status`, clean stale records, verify firewall/proxy, and re‑enroll if needed.## Conclusion By embracing Windows Autopatch, organizations can achieve a more secure, efficient, and hands-off approach to managing their Windows and Microsoft 365 updates. It’s a powerful step towards modernizing your IT operations and ensuring your workforce always has access to the latest, most secure tools. ## Frequently Asked Questions on Windows Autopatch Troubleshooting ### **What does “Not Ready” mean in Windows Autopatch?** It indicates that the device does not meet one or more prerequisites (e.g., unsupported OS version, stale Entra ID record, or conflicting GPO settings). ### **How do I fix policy conflicts in Intune Autopatch?** Run `gpresult /h report.html` to identify conflicting GPOs, then migrate those settings into Intune configuration profiles. ### **Why is my device showing “Not Registered”?** This usually happens when prerequisites fail during enrollment. Common causes include hybrid-joined devices with stale records or unsupported editions of Windows. ### **Can I monitor Autopatch readiness via Microsoft Graph?** Yes. You can query Autopatch readiness reports using Graph API endpoints, which allows automation and integration with dashboards. ### **How often should I check Autopatch readiness reports?** Best practice is weekly, especially before Patch Tuesday, to ensure devices are compliant and update rings are healthy. ## Related Posts - [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) - [Manage Edge Chromium favorites with Endpoint Manager | Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Configure Edge Chromium Homepage & Startup Page](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) - [Configure Microsoft Edge Sleeping Tabs using Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Configure Google Chrome settings using Administrative templates | Intune | Endpoint Manager](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Block USB Device with Exception](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows 10 /11 Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Local Admin Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) Tags: [Device Configuration Troubleshooting](https://techuisitive.com/tag/device-configuration-troubleshooting/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Device Configuration Troubleshooting --- ### [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) **Published:** May 31, 2023 **Author:** Asif Khan **Content:** Microsoft 365 Apps can be deployed using Intune and deployed as Microsoft 365 Apps Type. Making it available for self-service install in the Intune company portal, you may experience that Microsoft 365 Apps is stuck in a downloading status. We recommend that you use Microsoft documentation for troubleshooting, installation, or download failure. However, if it gets stuck in downloading status and doesn’t provide a success or failure status, then you must restart the device to reflect the status change. ![Intune | Microsoft 365 Apps stucks](https://techuisitive.com/wp-content/uploads/2023/05/image-18.png)Before you restart the device, monitor the installation status in **Programs and Features** and monitor it from Start Menu – All Apps. Once the software is available in Start Menu and it shows as installed in Program and Features, proceed to restart the device. After the device restarts, status will show as success in company portal if M365 appears in Start Menu and Program and Features ![Windows 10 / 11 | Programs and Features](https://techuisitive.com/wp-content/uploads/2023/05/image-19.png)![Windows 10 | Microsoft 365 Apps | Start Menu](https://techuisitive.com/wp-content/uploads/2023/05/image-20.png)## **Related Posts** - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune App Troubleshooting, Troubleshooting --- ### [How to Fix Autopilot Error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/) **Published:** July 6, 2024 **Author:** Equebal Ahmad **Content:** **[Windows Autopilot](https://techuisitive.com/category/windowsautopilot/ "Windows Autopilot") Error 80070002** typically occurs during Hybrid Azure AD Join deployments when the Offline Domain Join (ODJ) process fails. This error indicates that the Intune Connector was unable to apply the domain join blob correctly, often due to misconfigured OU permissions, trailing spaces in computer name prefixes, or connector communication issues. For IT administrators, this can halt device provisioning and frustrate end users, making it essential to quickly identify the root cause and apply the right fix ## Windows Autopilot Hybrid Azure AD Join error 80070002 While provisioning a device using **Microsoft Intune Windows Autopilot Hybrid Azure AD Join**, you enter your corporate credentials on the **company branding screen** after completing the **Out‑of‑Box Experience (OOBE)**. The enrollment process then stalls at the *“Please wait while we set up your device”* screen for approximately 20–30 minutes before eventually failing with **Autopilot error 80070002**. ***Something went wrong: Confirm you are using the correct sign-in information and that your organization uses this feature. You can try to do this again or contact your system administrator with the error code 80070002.*** ![Autopilot error 80070002](https://techuisitive.com/wp-content/uploads/2024/07/image-1024x714.png)## Cause 1: Incorrect OU Permission ### Background The environment was initially configured correctly, and **Windows Autopilot Hybrid Azure AD Join provisioning** worked without issues. However, the process suddenly stopped functioning. Since this error is often linked to **incorrect Active Directory OU permissions**, our investigation focuses on that area. This problem typically occurs when the device fails to receive an **Offline Domain Join (ODJ) blob** from the **Intune Connector**. During provisioning, the device expects the ODJ blob after receiving Intune’s **offline domain join profile**. Once the Intune Connector processes the ODJ request, it creates a computer account in the **on‑premises Active Directory domain**. The device then receives these details at the next sync. If the Autopilot device does not receive the blob, it continues waiting indefinitely, causing the **Hybrid Join provisioning** to stall and eventually time out with **Autopilot error 80070002**. ### Step 1: Check Event Logs To identify the root cause, you need to review the **Intune Connector server logs**. If your environment has multiple **Intune Connector servers**, you must check each one individually to determine which server processed the **Offline Domain Join (ODJ) request**. This step is essential because the **Autopilot Hybrid Azure AD Join provisioning** process depends on the connector that handled the ODJ blob creation, and only by reviewing all servers can you pinpoint where the failure occurred. **Step 1.1** Log in to the Intune ODJ connector server **Step 1.2:** Open Event Viewer and navigate to `Event Viewer → Applications and Services Logs → Microsoft → Windows → ODJConnectorService → Admin` **Step 1.3:** Review the recent logs to see if any errors were reported for the device. We found the following error in the ODJConnectorService event log on the Intune connector server. The ODJConnectorService event was showing a “*Failed to call NetProvisionComputerAccount machineName*=xxxx” error message. ![OdJConnectorService Intune connector server log | Failed to call NetProvisionComputerAccount machineName](https://techuisitive.com/wp-content/uploads/2024/06/image-8-1024x720.png)**Event viewer logs:** ``` `RequestOfflineDomainJoinBlob_Failure: Failed to generate ODJ blobRequestId: xxxxDeviceId: xxxxDomainName: xxxxRetryCount: 0ErrorDescription: Failed to call NetProvisionComputerAccount machineName=xxxxInstanceId: xxxxDiagnosticCode: 268435455WinErrorCode: 8557DiagnosticText: We are unable to complete your request because a server-side error occurred. Please try again. [Exception Message: "DiagnosticException: 0x0FFFFFFF. We are unable to complete your request because a server-side error occurred. Please try again."] [Exception Message: "Failed to call NetProvisionComputerAccount machineName=xxxx"]` ``` ### Steps 2: Check Netsetup Log The **NetSetup.log** file provides detailed records of all **domain join operations** performed by Windows. By reviewing this log, administrators can quickly identify **domain join‑related issues**, such as failures in the **Offline Domain Join (ODJ) process**, misconfigured **Active Directory OU permissions**, or errors linked to **Windows Autopilot Hybrid Azure AD Join provisioning**. **Step 2.1:** Open File Explorer **Step 2.2:** Navigate to **c:\\windows\\debug** folder and open **Netsetup.log** The **NetSetup.log** file is located at C:\\Windows\\Debug\\NetSetup.log On the **Intune Connector server, the following error was displayed**. According to the log entry, the connector was unable to create a **computer object in Active Directory**, which strongly indicates that the **OU permissions** assigned were not configured correctly. This failure in the **Offline Domain Join (ODJ) process** is a common cause of **Windows Autopilot Hybrid Azure AD Join error 80070002**. ``` `NetpMapGetLdapExtendedError: Parsed [0x216d] from server extended error string: 0000216D: SvcErr: DSID-031A126C, problem 5003 (WILL_NOT_PERFORM), data 0NetpModifyComputerObjectInDs: ldap_add_s failed: 0x35 0x216dNetpCreateComputerObjectInDs: NetpModifyComputerObjectInDs failed: 0x216dNetpProvisionComputerAccount: LDAP creation failed: 0x216dldap_unbind status: 0x0NetpJoinCreatePackagePart: status:0x216d.NetProvisionComputerAccount: status: 0x216d` ``` ### Step 3: Check OU Permission **Step 3.1:** Open the “Active Directory Users and Computers” console **Steps 3.2:** Expand the Domain tree and locate the OU **Step 3.3:** Right-click on the OU and select properties. Validate the object permission for the OU. We reviewed the permissions assigned to the **Intune Connector server computer account** on the **Active Directory OUs** designated for **Hybrid Azure AD Join devices**. For successful provisioning, the Intune Connector must have **Full Control (for Computer objects)** on the OU and all child containers where new computer accounts are created. Although the correct permissions were originally configured, they were later changed to *“This object only”* for unknown reasons. This misconfiguration prevented the connector from creating computer objects during the **Offline Domain Join (ODJ) process**, resulting in **Windows Autopilot error 80070002**. ![](https://techuisitive.com/wp-content/uploads/2024/06/image-9.png)### Solution Assign the correct **Active Directory OU permissions** to the **Intune Connector server computer account** to ensure successful **Offline Domain Join (ODJ) provisioning**. You can follow the official [Microsoft documentation](https://learn.microsoft.com/en-us/autopilot/tutorial/user-driven/hybrid-azure-ad-join-computer-account-limit "Microsoft documentation") for step‑by‑step guidance on delegating OU permissions to the Intune Connector server. Once the permission was updated to *“This object and all child objects”*, the issue was resolved, and the **Windows Autopilot Hybrid Azure AD Join build** completed successfully without triggering **error 80070002**. ### Cause 2 The **NetSetup.log** file located at *`C:\Windows\Debug\NetSetup.log`* on the **Intune Connector server** reported the error code **0x2558**. This entry indicated that the connector was unable to create a **computer object on the Domain Controller**, pointing to a likely **Active Directory OU permission misconfiguration** during the **Offline Domain Join (ODJ) process**. Such failures are a common root cause of **Windows Autopilot Hybrid Azure AD Join error 80070002**. OS Version: 6.2 Build number: 9200 (20348.fe\_release.210507-1500) SKU: Windows Server 2022 Standard Architecture: 64-bit (AMD64) NetProvisionComputerAccount: lpDomain: techuisitive.local lpMachineName: Desktop- 9i65i lpMachineAccountOU: OU=Mumbai, OU=India,dc=techuisitive, dc=local lpDcName: (NULL) dwOptions: 0x0 NetProvisionComputerAccount: requesting text encoded blob NetProvisionComputerAccount: status: 0x2558 Upon further investigation, we discovered that the issue was isolated to a specific **physical site**, while **Windows Autopilot Hybrid Azure AD Join provisioning** continued to work correctly at other locations. The error code **0x2558** translates to **DNS\_ERROR\_INVALID\_NAME\_CHAR**. A closer review of the **[Offline Domain Join (ODJ) profile](.https://techuisitive.com/create-an-offline-domain-join-configuration-profile-in-intune/ "Offline Domain Join (ODJ) profile")** revealed a trailing blank space at the end of the **computer name prefix**. This extra whitespace caused the generated computer name to end with an invalid character, resulting in a **device provisioning failure** and triggering **Autopilot error 80070002**. ### Solution We resolved the issue by removing the trailing whitespace from the **computer name prefix** in the **Offline Domain Join (ODJ) profile**. Once the prefix was corrected, the **Windows Autopilot Hybrid Azure AD Join provisioning** process completed successfully, and the devices were enrolled without triggering **error 80070002**. ## Related Posts - [How to Fix Autopilot error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/ "How to Fix Autopilot error 80070002") - [Windows Autopilot Device Preparation – Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/ "Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide") - [Windows 10 Autopilot Deployment Guide | Intune](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) - [Intune – Configure Enrollment Status Page (ESP)](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Bulk enrollment of Windows 10/ 11 Device to Intune using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Enroll Windows 11 Device to Intune through Azure AD Join method](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Windows 11 enrollment with Provisioning package failed with error code 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/). ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Autopilot Troubleshooting, Troubleshooting --- ### [How to Fix Autopilot Device Preparation Error 80180003](https://techuisitive.com/autopilot-device-preparation-error-80180003/) **Published:** January 13, 2025 **Author:** Equebal Ahmad **Content:** Windows Autopilot simplifies device deployment, but errors like **Device Preparation Error 80180003** can disrupt enrollment. This guide explains the root causes—such as MDM authority misconfiguration, device type restrictions, and licensing issues—and provides step-by-step troubleshooting to help IT admins resolve the error quickly and ensure seamless Intune onboarding. ## Issue – **The user is not authorized to enroll** In newly configured Intune environments, Windows Autopilot Device Preparation (Autopilot v2) may fail with error code 80180003. ***The user is not authorized to enroll. You can try to do this again or contact your system administrator with the error code 80180003.*** ![Autopilot Device Preparation Error 80180003](https://techuisitive.com/wp-content/uploads/2024/09/image-26.png)## Causes of Autopilot Error 80180003 The **“Something went wrong” – Error 80180003** in Windows Autopilot Device Preparation may occur due to several configuration or policy issues in Intune and Microsoft Entra ID: - **Device type restriction:** The device is blocked by Intune’s enrollment restrictions. - **Maximum device limit reached:** The user has already enrolled the maximum number of devices allowed in Intune. - **Unsupported Windows edition:** The computer is running **Windows 10 Home**, which does not support Intune enrollment or Microsoft Entra ID join. Enrollment requires **Windows 10 Pro or higher**. - **Microsoft Entra join setting disabled:** The setting *Users may join devices to Microsoft Entra ID* is configured as **None**, preventing new users from joining their devices. - **Missing licenses:** The user does not have the required **Microsoft Intune** or **Entra ID Premium** licenses assigned. - **MDM authority not configured:** The **MDM authority** is not set to Microsoft Intune, blocking device enrollment. We have noticed the following error in DeviceManagement-Enterprise-Diagnostics-Provider logs in the event viewer. ***MDM Enroll: Server Returned Fault/Code/SubCode/Values(Authorization) Fault/Reson/Text=(MDM Authority Not Defined).*** ![MDM Enroll: Server Returned Fault/Code/SubCode/Values(Authorization) Fault/Reson/Text=(MDM Authority Not Defined).](https://techuisitive.com/wp-content/uploads/2024/09/image-29-1024x661.png)***MDM Enroll Failed:(The user is not authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator.*** ![MDM Enroll Failed:(the user is not authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator.](https://techuisitive.com/wp-content/uploads/2024/09/image-30-1024x654.png)When reviewing the **Intune enrollment logs**, you may encounter the following entry related to **Windows Autopilot Device Preparation Error 80180003**: ***Intune mobile device management (MDM) authority is not configured yet.*** ![Intune mobile device management (MDM) authority is not configured yet.](https://techuisitive.com/wp-content/uploads/2024/09/image-31.png)Finally, on the Tenant details, we can see that the MDM authority status was Unknown. ![Intune Tenant details MDM authority](https://techuisitive.com/wp-content/uploads/2024/09/image-32-1024x342.png) ## Solution: Configure MDM Authority to Microsoft To resolve **Windows Autopilot Device Preparation Error 80180003**, configure the **MDM authority** to Microsoft Intune by following these steps: 1. **Open the Intune Admin Center** Navigate to **Microsoft Intune Admin Center** > **Troubleshooting + Support** > **Guided Scenarios (Preview)**. 2. **Select Guided Scenario** Choose **“Set up a test device to try out cloud management”** and click **Start**. 3. **Complete the Setup** Follow the on‑screen instructions. This process will trigger the **MDM Authority prompt**, allowing you to set the authority to **Microsoft Intune**. ![Set up a test device to try out cloud management | Intune Guided scenario](https://techuisitive.com/wp-content/uploads/2024/10/image-1024x549.png)## Related Posts - [How to Fix Autopilot error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/ "How to Fix Autopilot error 80070002") - [Windows Autopilot Device Preparation – Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/ "Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide") - [Windows 10 Autopilot Deployment Guide | Intune](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) - [Intune – Configure Enrollment Status Page (ESP)](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Bulk enrollment of Windows 10/ 11 Device to Intune using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Enroll Windows 11 Device to Intune through Azure AD Join method](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Windows 11 enrollment with Provisioning package failed with error code 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/). ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Windows Autopilot **Tags:** Autopilot Troubleshooting, Troubleshooting --- ### [How to Fix Intune Win32 App Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) **Published:** May 29, 2024 **Author:** Equebal Ahmad **Content:** Deploying Win32 applications through Microsoft Intune can sometimes throw unexpected errors that block installations. One common issue administrators face is **Intune Win32 App Error 0x87D30006**, which occurs when detection rules are misconfigured or cannot be parsed. In this guide, we’ll explain the root cause of this error, walk through a real-world example, and show you how to fix it step by step—so your apps install smoothly on Windows 10 and 11 devices. ## Error Details Error code: **0x87D30006** Error description: **Invalid detection rule or unable to parse detection rule**. ![0x87D30006 Error description: Invalid detection rule or unable to parse detection rule.](https://techuisitive.com/wp-content/uploads/2024/05/image-1-300x258.png)## Cause – Win32 App Detection Rule Misconfiguration The error **0x87D30006** in **Microsoft Intune** typically occurs due to a misconfiguration in the **[Win32 app detection rule](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive")**. In this case, a **registry-based detection method** was used, but the **registry key** was mistakenly enclosed in **square brackets**. Because of this formatting issue, the detection rule could not be parsed correctly on the **client device**, preventing **Intune app installation** from proceeding. ![](https://techuisitive.com/wp-content/uploads/2024/05/image-3-1024x216.png)***Registry key used:** \[HKEY\_LOCAL\_Machine\\SOFTWARE\]MICROSOFT\\Windows\\CurrentVersion\\Uninstall\\GPL Ghostscript 9.21\]* ***Correct registry key:** HKEY\_LOCAL\_Machine\\SOFTWARE\]MICROSOFT\\Windows\\CurrentVersion\\Uninstall\\GPL Ghostscript 9.21* ## Resolution To resolve this issue, ensure that the **Intune Win32 detection rules** are configured correctly and that registry paths are entered without unnecessary characters. Proper configuration of detection methods is critical for successful **application deployment in Intune**. The application installed successfully as soon as I removed the **square bracket** from the **Intune Win32 app registry path** and updated the **Intune policy** on the device. Correcting the **registry-based detection rule** allowed the **Microsoft Intune client** to parse the detection method properly, enabling smooth **Win32 app deployment**. ## **Intune Win32 App Installation Errors – 0x87D1041C vs 0x87D30006** Another common issue in Microsoft Intune Win32 app deployment is the error 0x87D1041C, which occurs when the Win32 app detection rule is incorrect. In this scenario, the application installs successfully, but Intune cannot detect it post‑installation. As a result, the app status remains undetected even though the installation completed. By contrast, error **0x87D30006** represents a parsing issue with the detection rule itself. For example, if the **registry path** in the detection method is misconfigured (such as being enclosed in **square brackets**), Intune cannot parse the rule on the **client device**. In this case, the application installation does not even begin because the detection rule fails validation. Understanding the difference between these two errors is critical for effective **Intune troubleshooting**: - **0x87D1041C** → App installs, but detection fails due to incorrect rule configuration. - **0x87D30006** → Detection rule cannot be parsed, preventing installation altogether. Correctly configuring **Intune Win32 detection rules** ensures smooth **application deployment** and avoids these common errors. ## 🛠 Troubleshooting Checklist: Intune Win32 App Error 0x87D30006 ✅ **Check detection rule type** – Confirm if you’re using a registry-based detection rule. ✅ **Verify registry key format** – Ensure the registry key is entered correctly. ❌ **Avoid square brackets** – Do not enclose the registry key path in `[]`. 🔍 **Test parsing on client side** – Make sure the detection rule is recognised and parsed properly. 🚀 **Re-deploy the app** – Once corrected, redeploy the Win32 app via Intune ## Related Posts - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune App Troubleshooting --- ### [Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) **Published:** April 28, 2026 **Author:** Equebal Ahmad **Content:** The remediation scripts in Microsoft Intune are a powerful way to remediate issues. We can use a remediation script to automatically fix common Windows issues across managed devices. We can also leverage the Microsoft Graph API to automate remediation script creation and assignment. In this post, we’ll walk through: - A common Windows issue to remediate (clearing temp files to free disk space). - The PowerShell script to fix the issue. - How to automate the creation of the remediation script in Intune using Microsoft Graph API. ## Pre‑requisites & Required permissions Before running the deployment framework, ensure your environment meets the following requirements: - **Licensing:** An active Microsoft Intune license within the tenant. - **Authentication:** An Entra ID (Azure AD) App Registration configured for the **Client Credentials Flow** using the `[https://graph.microsoft.com/.default](https://graph.microsoft.com/.default)` scope. - **Graph API Permissions***(Requires Admin Consent)*: - `DeviceManagementScripts.ReadWrite.All` — To create and manage the remediation scripts. - `Directory.ReadWrite.All` — To read, verify, and assign the script to Entra ID groups. - **Local Environment:** PowerShell installed along with the required **Microsoft.Graph** modules. - **Workspace Assets:** The target `config.json` parameter map file stored alongside the detection and remediation `.ps1` source files. ## Automation Script Workflow for Intune Remediation To automate Intune remediation script deployment with Microsoft Graph, follow these structured steps: ![](https://techuisitive.com/wp-content/uploads/2026/04/1000347731-1024x683.png "1000347731") ## Set up Environment ### Create Azure App Registration Register an Entra ID app with the required Graph API permissions, then record the Tenant ID, Application (Client ID), and Client Secret. These credentials will be used later in the Intune automation script. ![Entra ID App registration for Intune Automation](https://techuisitive.com/wp-content/uploads/2026/04/image-19-1024x337.png)#### Core Permissions - **DeviceManagementScripts.ReadWrite.All** Grants full read/write access to Intune scripts, including creating, updating, deleting, and assigning remediation scripts. This is the **mandatory permission** for automation scenarios using the Microsoft Graph API and Intune. - **Directory.ReadWrite.All** Provides read/write access to directory data in Entra ID (Azure AD). Required when your automation needs to create, update, or manage Entra ID groups for script assignment. This ensures seamless integration between Intune remediation scripts and Entra ID group management. ![Microsoft Graph API permission for Intune remediation script automation](https://techuisitive.com/wp-content/uploads/2026/04/image-16-1024x394.png)## Defining the Core Components (Detection, Remediation, and JSON) To build this automation, we will use two PowerShell scripts and a configuration JSON file. Together, they provide the logic and input required by the master script (`create_intune_remediation_script.ps1`) to deploy the Intune remediation. - **Detection Script:** Evaluates the target system to check if the available disk space on the system drive (C:) is below 5 GB. - **Remediation Script:** Executes only if the detection script finds low disk space, clearing files from the Windows temporary folder to free up storage. - **JSON Configuration File:** Centralizes all input arguments—such as script names, target Entra ID groups, and description fields—passing them seamlessly to the master script. > 💡 **Note:** Ensure that all three files are saved in the same directory as your master script (`create_intune_remediation_script.ps1`) before executing the automation. ``` Intune-Remediation-Automation/ ├── create_intune_remediation_script.ps1 # Master Execution Script ├── config.json # Deployment Configuration ├── detection_script.ps1 # Target Detection Script └── remediatiation_script.ps1 # Target Remediation Script ``` ### Detection Script Intune remediation logic relies on strict exit codes. This script evaluates whether the primary system drive has dropped below the **5 GB threshold**. - **Exit Code 0:** System compliant (No action needed). - **Exit Code 1:** System non-compliant (Triggers the remediation script). ``` PowerShell # Check if free disk space on C: drive is less than 5 GB $freeSpaceGB = (Get-PSDrive -Name C).Free / 1GB if ($freeSpaceGB -lt 5) { Write-Output "Disk space is low: $freeSpaceGB GB free." exit 1 # Indicate detection of issue } else { Write-Output "Disk space is sufficient: $freeSpaceGB GB free." exit 0 # No issue detected } ``` ### Remediation Script Executed automatically by the Intune Management Extension only if the detection script above exits with code `1`. It target-clears local Windows temporary directories to recover storage. ``` PowerShell # Clear Temp Folder Script $TempPath = $env:TEMP Write-Output "Clearing temp files from $TempPath..." Get-ChildItem -Path $TempPath -Recurse -Force -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse -ErrorAction SilentlyContinue Write-Output "Temp files cleared successfully." ``` These scripts can be uploaded to Intune as detection and remediation scripts, respectively, ensuring remediation runs only when disk space is low. ### Automation Configuration Payload (Config.JSON) This file externalizes all environment-specific variables. Instead of hardcoding target groups or script configurations into the master script, define them within this structured JSON profile: ``` JSON { "ScriptName": "Clear Temp Folder", "Description": "Detects low disk space and clears temp files.", "DetectionScriptPath": "C:\\Intune\\Automate Remediation Script Creation\\Detection_script.ps1", "RemediationScriptPath": "C:\\Intune\\Automate Remediation Script Creation\\Remediation_script.ps1", "EntraIDGroupName": "Intune Remediation Script Disk Cleanup UAT", "CreateGroup": "Yes" } ``` ## The Automation Script **Ensure you configure Microsoft Graph API credentials to enable Intune remediation automation. Update *Tenant ID, Client ID, and Client Secret* before running the script.** ### Gather Parameter from JSON and Prepare Payload The snippet below shows how to read parameters from JSON and prepare the payload. ``` # Set path to config.json in the current script directory $JsonFilePath = Join-Path -Path $PSScriptRoot -ChildPath "config.json" Show-Message "Json File: $JsonfilePath" -Type Info # Read JSON input file $jsonContent = Get-Content -Path $JsonFilePath -Raw | ConvertFrom-Json Show-Message "JSON Parameters:" -Type Info foreach ($property in $jsonContent.PSObject.Properties) { Show-Message "$($property.Name): $($property.Value)" -Type Info } # Read and encode the detection script content $detectionScriptContent = Get-Content -Path $jsonContent.DetectionScriptPath -Raw $encodedDetectionScript = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($detectionScriptContent)) # Read and encode the remediation script content $remediationScriptContent = Get-Content -Path $jsonContent.RemediationScriptPath -Raw $encodedRemediationScript = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($remediationScriptContent)) # Prepare payload $payload = @{ displayName = $jsonContent.ScriptName description = $jsonContent.Description publisher = "IT Admin" runSchedule = @{ interval = "PT24H" } # Run every 24 hours detectionScriptContent = $encodedDetectionScript remediationScriptContent = $encodedRemediationScript } ``` ### Steps to Use the Automation Script - Update Tenant ID, Client ID, and Client Secret before running the script (Required once for a tenant) - Update the content of the detection script. - Update the content of the remediation script. - Update the JSON file with parameters. - Run the automation script. ## Result The automation script will create the remediation script and assign the script to the Entra ID group provided in the JSON file. You can see in the screenshot below that the script was created and assigned based on the details provided in the JSON config file. ![Intune remediation script automation](https://techuisitive.com/wp-content/uploads/2026/04/image-14-1024x546.png)You can find the log files for the script execution under the “Logs” subfolder within the script directory. ## Conclusion With this approach, you can automate the creation and deployment of Intune remediation scripts using the Microsoft Graph API. The example here addresses a simple but common issue – clearing temp files. The same workflow can be applied to more complex scenarios like fixing registry settings, resetting services, or enforcing configuration baselines. ## Script Download Download the complete script from [Techuisitive GitHub repository](https://github.com/techuisitive/Intune-Remediation "Techuisitive GitHub repository"). ## FAQs About Intune Remediation Script Automation ### **Why should I use automation instead of creating scripts directly in the Intune admin center?** While the Intune web UI is fine for one-off tasks, it creates massive technical debt in enterprise environments. Moving to a Microsoft Graph API automation framework shifts your endpoint management to an **Infrastructure as Code (IaC)** model, delivering four primary advantages: **Disaster Recovery:** If a critical script is accidentally deleted from the console, you don’t have to search through old local files. Running your master script instantly re-creates, configures, and re-assigns the entire remediation layout down to the target Entra ID groups. **Version Control & CI/CD:** Instead of losing your script history with every portal overwrite, you can store your code in a Git repository (like GitHub) to track every modification, run peer code reviews, and automate deployments. **Zero Configuration Drift:** By tying the script files directly to a `config.json` payload metadata profile, you guarantee that script settings, execution contexts, descriptions, and assignments remain perfectly standardized every single time. **Multi-Tenant Scalability:** Instead of wasting time clicking through the portal across different Development, QA, or production tenants, you update your configuration array once and deploy universally in seconds. ### **What happens if token acquisition fails?** The master script proactively evaluates the response payload from the identity provider to verify the token’s operational status. In the event that token acquisition fails—whether due to an expired client secret, incorrect GUID parameters, or unauthorized scopes—the framework executes a controlled, fail-fast sequence; it suppresses subsequent API logic to prevent a cascade of unauthorized request errors, terminates the execution pipeline gracefully with an explicit exit code, and logs the comprehensive error diagnostics directly to the system console for rapid troubleshooting. ## Related Posts - [Bulk Win32 App Deployment to Intune Using PowerShell and Microsoft Graph API](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) - [Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) - [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) - [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/) - [Bulk Add Devices to Entra ID Group from CSV File](https://techuisitive.com/powershell-script-add-device-to-entra-id-group-from-csv-file/) - [How to Bulk Rename Windows Devices from Intune](https://techuisitive.com/how-to-bulk-rename-windows-devices-from-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Automation Featured, Automation Graph API, Intune Automation, Intune Remediation, PowerShell --- ### [Export Device Configuration Profiles List in Intune](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/) **Published:** October 26, 2023 **Author:** Equebal Ahmad **Content:** While managing an Intune environment, the number of policies grows over time. At some point in time, you may need to review all existing policies to understand if they are still required, need to be consolidated, or need to be retired. A review may also be required if multiple tenants need to be consolidated or policies need to be migrated to another tenant as part of corporate restructuring, mergers, or acquisitions. Let’s understand how to export the device configuration profile list to CSV. A similar approach can be followed for other policy types such as Compliance policy or Firewall policy. Please find the list of a few blog posts related to Device Configuration Profiles. This will help you understand Device Configuration Profiles if you are not aware. - [Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [How to Configure Windows Kiosk Using Microsoft Intune | Windows 10 / 11](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) - [Configure Edge Chromium Homepage & Startup Page](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) ## Export Device Configuration Profiles List from Intune Admin Center Follow the below steps to export the configuration profiles from Microsoft Intune Admin Center. - Open Intune Admin Center[ https://endpoint.microsoft.com/](< https://endpoint.microsoft.com/>) or the new link - Navigate to **Devices / Configuration Profiles** - Click on the **Columns** if you would like to add or remove the columns which you want to export. ![Export Device Configuration Profiles](https://techuisitive.com/wp-content/uploads/2023/10/image-1024x491.png)- Add or Remove the columns which you want to export as per your requirements. ![Export Device Configuration Profiles | Add or Remove Column](https://techuisitive.com/wp-content/uploads/2023/10/image-2.png) - Click on **Export** to start exporting the profiles list. The profile name and other selected columns details will be exported to CSV file. ![Export Device Configuration Profiles](https://techuisitive.com/wp-content/uploads/2023/10/image-1-1024x491.png)- You can see the progress and completion notification in the **Notifications area**. You can access the Notifications area by clicking on the bell icon at the top right corner of Intune admin center. The file is usually downloaded to the **Downloads** folder. ![Intune Notification area](https://techuisitive.com/wp-content/uploads/2023/10/image-37.png)- The Device configuration profiles list now exported in CSV file. You can open this in Microsoft Excel and analyze the data further based on your requirements. ![Intune Device Configuration Profiles CSV](https://techuisitive.com/wp-content/uploads/2023/10/image-3.png) ## Export Other Intune Policies from Intune Admin Center The similar process can be followed to export other policies from Microsoft Intune Admin Center. You just need to navigates to different Intune blades , customize the columns and export the data. You can find few examples below which includes policy type and Intune blade you need to navigates. Profile TypeNavigates ToCompliance PoliciesDevices / Windows / Compliance PoliciesAccount ProtectionEndpoint Security / Account ProtectionDevice ComplianceEndpoint Security / Device ComplianceAntivirusEndpoint Security / AntivirusDisk EncryptionEndpoint Security / Disk EncryptionFirewallEndpoint Security / FirewallAttack Surface ReductionEndpoint Security / Attach Surface Reduction## Related Posts - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) - [Export Device Configuration Profiles List in Intune](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/) - [How to Export Settings Catalog Policy in Intune](https://techuisitive.com/export-settings-catalog-policy-in-intune/ "How to Export Settings Catalog Policy in Intune") - [Export and Import Device Compliance Policies in Intune](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/ "Export and Import Device Compliance Policies in Intune") - [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/ "How to Export Device Configuration Profiles in Intune") - [How to Export Endpoint Security Policies in Intune](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune "How to Export Endpoint Security Policies in Intune") - [How to Provision Windows 10 / Windows 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) **Tags:** [Intune Policy Management](https://techuisitive.com/tag/intune-policy-management/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Policy Management](https://techuisitive.com/microsoft-intune/#Policy-Management "Policy Management")** –Explore more guides on policy management, including creating, configuring, deploying, and troubleshooting policies in Microsoft Intune. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Policy Management --- ### [How to Export Settings Catalog Policy in Intune](https://techuisitive.com/export-settings-catalog-policy-in-intune/) **Published:** November 2, 2023 **Author:** Equebal Ahmad **Content:** Intune Settings catalog are new way of managing settings through Intune. Settings catalog lists all the settings you can configure, and all in one place. This feature simplifies how you create a policy, and how you see all the available settings. We can export Microsoft Intune policies using **PowerShell scripts** in JSON file. The exported configuration can be imported to different tenants. Intune policies are mostly fall under two categories – Configuration and Compliance. Theses policies are further organized in sub categories such as Device Configuration Profiles, Setting Catalog etc. Each of these required different PowerShell Script to export / import data from Intune. The[ PowerShell Intune Samples script ](https://github.com/microsoftgraph/powershell-intune-samples " PowerShell Intune Samples script ")includes these scripts and it can be downloaded from [here](https://github.com/microsoftgraph/powershell-intune-samples "here"). Let’s understand how to export **settings catalog** policies from Intune tenants. The settings for each profile will be exported in separate JSON file. The settings can be then imported to different tenants one by one. We will use [SettingCatalog\_Export.ps1](https://github.com/microsoftgraph/powershell-intune-samples/tree/master/SettingsCatalog "SettingCatalog_Export.ps1") script from above repository to export the settings. ## Export Settings Catalog Policies in JSON File Using PowerShell Script Since we are going to export Settings Catalog, let’s understand which policies can be exported. We have selected the Configuration Profiles tab and can see different profile types listed there. These includes Settings Catalog, Kiosk , Device Restriction , Administrative Templates etc. Only Settings Catalog profile type will be exported by the script. ![Intune Settings catalog](https://techuisitive.com/wp-content/uploads/2023/10/image-10.png)Another configuration profiles which we have created for Windows LAPS and located under **Endpoint Security / Account Protection** , are also following under Settings catalog. While the Policy type columns doesn’t show that information, that can be verified when editing the policy. ![](blob:https://techuisitive.com/24943423-3301-4954-8ae5-d3af1fee5220)![Intune Device Configuration Profiles](https://techuisitive.com/wp-content/uploads/2023/10/image-9-1024x355.png)While editing the policy, you can notice Settings catalog label at top left. It doesn’t matter at which blade the Settings catalog policies are created, all of them will be exported by this script. ![Intune Settings catalog](https://techuisitive.com/wp-content/uploads/2023/10/image-38.png) Follow the below steps to export Settings catalog in JSON file. The script will export **All Setting Catalog Files** in the target folder. - Download the Intune PowerShell scripts from [PowerShell Intune Samples](https://github.com/microsoftgraph/powershell-intune-samples) and extract all files to local drive. - Run PowerShell as an Administrator - Set PowerShell execution Policy to ByPass ( Set-ExecutionPolicy bypass ) - Install PowerShell AzureAD and Microsoft Graph Module if not already installed - Change the location to the “SettingsCatalog” under “powershell-intune-samples-master” - Run the script **.\\SettingsCatalog\_Export.ps1** ![SettingsCatalog_Export.ps1 | Export Settings catalog](https://techuisitive.com/wp-content/uploads/2023/10/image-4.png)**Note:** If you encounter below error at this stage then follow [this reddit post](https://www.reddit.com/r/Intune/comments/15i4kli/scripts_to_connect_to_intune_azure_ad/?rdt=42623&onetap_auto=true "this reddit post") to fix the issue. Exception calling “LoadFrom” with “1” argument(s): “Could not load file or assembly ‘file:///C:\\Program Files\\WindowsPowerShell\\Modules\\AzureAD\\[2.0.2.182](https://2.0.2.182/)\\Microsoft.IdentityModel.Clients.ActiveDirectory.dll’ or one of its dependencies. The system cannot find the file specified.” - Sign-in using your Intune administrator account. Select the checkbox to consent on behalf of your organization and click Accept. - Provide the folder path to export the data. The folder will be created if it’s not exists. All of Settings catalog will be exported here in separate JSON files. ![SettingsCatalog_Export.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-5.png)You can see progress on PowerShell window while data export is in progress. ![SettingsCatalog_Export.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-6.png)All Settings catalog profiles are now exported. You can check the same from File Explorer. As you see, each Settings catalog profiles are exported in separate JSON file. ![SettingsCatalog_Export.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-7.png)Here is the snapshot of one of JSON file. ![SettingsCatalog_Export.ps1 JSON](https://techuisitive.com/wp-content/uploads/2023/10/image-8-1024x519.png)## Import Settings Catalog Policy from JSON File Now the Settings catalog profiles have been exported in separate JSON files. We can import them in another tenant one by one using **SettingsCatalog\_Import\_FromJSON.ps1** script. Follow the below steps to import the settings using script. If you trying this from different machines where you exported the files then you may need to repeat the initial steps we followed for export. Please note that importing the policy will not place them in production. The policy will remain unassing and you need to assign them manually or through a script. - Change the directory to **“SettingsCatalog”** folder and run the script **.\\SettingsCatalog\_import\_FromJSON.ps1** - Specify the JSON file name with full path which you want to import. ![SettingsCatalog_Import_fromJSON.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-13.png)The settings will be imported. You can see the status on PowerShell window. ![SettingsCatalog_Import_fromJSON.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-14.png)You can now see the new policy created in the portal. Since, we have imported the settings in same tenant for testing, the previous policy was renamed. ![Intune Settings Catalog](https://techuisitive.com/wp-content/uploads/2023/10/image-15.png)## Related Posts - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) - [Export Device Configuration Profiles List in Intune](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/) - [How to Export Settings Catalog Policy in Intune](https://techuisitive.com/export-settings-catalog-policy-in-intune/ "How to Export Settings Catalog Policy in Intune") - [Export and Import Device Compliance Policies in Intune](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/ "Export and Import Device Compliance Policies in Intune") - [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/ "How to Export Device Configuration Profiles in Intune") - [How to Export Endpoint Security Policies in Intune](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune "How to Export Endpoint Security Policies in Intune") - [How to Provision Windows 10 / Windows 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Policy Management](https://techuisitive.com/microsoft-intune/#Policy-Management "Policy Management")** –Explore more guides on policy management, including creating, configuring, deploying, and troubleshooting policies in Microsoft Intune. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Policy Management --- ### [Export and Import Device Compliance Policies in Intune](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/) **Published:** November 9, 2023 **Author:** Equebal Ahmad **Content:** You may have a requirement to export or import Microsoft Intune policies while working on tenant migration or setting up a new environment. The export and import can save a lots of time when working on tenant migration or consolidation. You can also have standard set of policies in JSON to quickly import while working on a new tenant setup. The imported policy can be further customized as per organization requirements. However, there are no such options available in Intune admin center to export or import policy settings. You need to work with Microsoft Graph / Microsoft Graph PowerShell API for this. Fortunately, prebuilt PowerShell scripts are available in [Github ](https://github.com/microsoftgraph/powershell-intune-samples "Github ")repository and the process of using these scripts are straighforward. Let’s understand how to export and import **Device Compliance Policies** using PowerShell Sample Scripts available in Github. ![](https://techuisitive.com/wp-content/uploads/2023/10/image-27-1024x330.png) ## How to Export Device Compliance Policies in JSON File Follow the below steps to export Device Compliance Policies in JSON file. - Download the Intune PowerShell scripts from [PowerShell Intune Samples](https://github.com/microsoftgraph/powershell-intune-samples) and extract all files to local drive. - Run PowerShell as an Administrator - Set PowerShell execution Policy to ByPass ( Set-ExecutionPolicy bypass ) - Install PowerShell AzureAD and Microsoft Graph Module if not already installed - Change the location to the “CompliancePolicy” under “Powershell-intune-samples-master” - Run the script **.\\CompliancePolicy\_Export.ps1** - If prompted, login with your Azure AD / Entra ID credential. - Specify a path to export the policy data. ![CompliancePolicy_Export.ps1 | Import Device Compliance Policies](https://techuisitive.com/wp-content/uploads/2023/10/image-24.png)You can see the export progress in PowerShell window. The script export each compliance policy in a separate JSON and CSV file. ![CompliancePolicy_Export.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-25.png)You can view the exported files in File Explorer. ![CompliancePolicy_Export.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-26.png) ## How to Import Device Compliance Policies from JSON File Now the Device compliance policies have been exported in separate JSON files. We can import them in another tenant one by one using **CompliancePolicy\_FromJSON.ps1** script. If you are trying the import from different machines than where you exported the files then you may need to repeat the initial steps we followed for export. Please note that imported policies remain unassigned. You need to assign them to device , users or groups to move them to production. Follow the below steps to import the policies to Intune tenant. - Change the directory to **“CompliancePolicy”** folder and run the script **.\\CompliancePolicy\_import\_FromJSON.ps1** - Specify the JSON file name with full path which you want to import. ![CompliancePolicy_import_FromJSON.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-28.png)The script will show the message that policy was found and it shows the details on screen. ![CompliancePolicy_import_FromJSON.ps1 | Import Intune compliance policy](https://techuisitive.com/wp-content/uploads/2023/10/image-29.png)The script will then import the settings from JSON file to Intune tenant. ![CompliancePolicy_import_FromJSON.ps1 | Import Intune Compliance Policy from JSON](https://techuisitive.com/wp-content/uploads/2023/10/image-30.png)You can validate the same form Intune tenant where you have imported the settings. Since, the testing was done on same tenant, you can see a new file created with same name. The older one was renamed as Old. ![Intune | Compliance Policies](https://techuisitive.com/wp-content/uploads/2023/10/image-31-1024x342.png)## Related Posts - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) - [Export Device Configuration Profiles List in Intune](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/) - [How to Export Settings Catalog Policy in Intune](https://techuisitive.com/export-settings-catalog-policy-in-intune/ "How to Export Settings Catalog Policy in Intune") - [Export and Import Device Compliance Policies in Intune](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/ "Export and Import Device Compliance Policies in Intune") - [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/ "How to Export Device Configuration Profiles in Intune") - [How to Export Endpoint Security Policies in Intune](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune "How to Export Endpoint Security Policies in Intune") - [How to Provision Windows 10 / Windows 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Policy Management](https://techuisitive.com/microsoft-intune/#Policy-Management "Policy Management")** –Explore more guides on policy management, including creating, configuring, deploying, and troubleshooting policies in Microsoft Intune. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Policy Management --- ### [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/) **Published:** December 11, 2023 **Author:** Equebal Ahmad **Content:** You may have a requirement to export or import [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") policies while working on Intune tenant to tenant migration as part of divestiture, merger or acquisition. It’s also required when you tested the policy in a test environment and later need to migrate the same to production environment. You can also have standard set of policies in JSON to quickly import them while working on a new tenant setup. The imported policy can be further customized as per organization requirements. As of now there are no options available in Intune admin center to duplicate or export Intune device configuration profile. This make the things difficult when you need to export Intune policies to different tenants or want to duplicate a profile to quickly create another one. The options to duplicate or export settings are available for Settings catalog. However for other profile types, we can use the PowerShell samples scripts available in [GitHub](https://github.com/microsoftgraph/powershell-intune-samples "GitHub"). In this blog post, we will discuss how to export and import **Device Configuration Profiles** using PowerShell Sample Scripts. You can export / import configuration profiles (Device features, Device restrictions, Kiosk etc.) using this script. ![Export Device configuration profiles | Intune](https://techuisitive.com/wp-content/uploads/2023/10/image-19.png)## Export Device Configuration Profiles in JSON File Follow the below steps to export Device configuration profiles in JSON file. - Download the Intune PowerShell scripts from [PowerShell Intune Samples](https://github.com/microsoftgraph/powershell-intune-samples) and extract all files to local drive. - Run PowerShell as an Administrator. - Set PowerShell execution Policy to ByPass ( Set-ExecutionPolicy bypass ) - Install PowerShell AzureAD and Microsoft Graph Module if not already installed. - Change the location to the “DeviceConfiguration” under “Powershell-intune-samples-master” - Run the script **.\\DeviceConfiguration\_Export.ps1** - If prompted, login with your Azure AD / Entra ID credential. - Specify a path to export the policy data. ![export intune device configuration profile | DeviceConfiguration_Export.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-16.png)The PowerShell script exports each device configuration policies in separate JSON file in the path you provided. ![export intune configuration profiles | DeviceConfiguration_Export.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-17.png)You can open the File Explorer and browse to the folder to see each JSON file. ![Export intune policies](https://techuisitive.com/wp-content/uploads/2023/10/image-18.png) ## How to Import Device Configuration Policy from JSON File We can now import the device configuration policy from JSON file to a new tenant or same tenant to create another policy. If you need to import the policy in same tenant then simply open the JSON file in notepad and update the policy name. Else policy will be created with same name which may leads to confusion. Please note that imported policies remain unassigned. You need to assign them to device , users or groups to move them to production. Follow the below steps to import the policies to Intune tenant. - Follow the initial steps you have used to export the policies to JSON file. - Change the directory to **“DeviceConfiguration”** folder and run the script **.\\DeviceConfiguration\_import\_FromJSON.ps1** **-FileName ** ![DeviceConfiguration_import_FromJSON.ps1 | Import Intune device configuration profile](https://techuisitive.com/wp-content/uploads/2023/10/image-20.png)You can see the import progress on screen. The script will return to prompt once import process completed. ![DeviceConfiguration_import_FromJSON.ps1 ](https://techuisitive.com/wp-content/uploads/2023/10/image-21.png)You can now see the imported policy in Microsoft Intune admin center. Since we have used same tenant for testing, you can see that two policies exists with same name. ![Device configuration profiles | Intune](https://techuisitive.com/wp-content/uploads/2023/10/image-22.png)## Related Posts policy - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) - [Export Device Configuration Profiles List in Intune](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/) - [How to Export Settings Catalog Policy in Intune](https://techuisitive.com/export-settings-catalog-policy-in-intune/ "How to Export Settings Catalog Policy in Intune") - [Export and Import Device Compliance Policies in Intune](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/ "Export and Import Device Compliance Policies in Intune") - [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/ "How to Export Device Configuration Profiles in Intune") - [How to Export Endpoint Security Policies in Intune](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune "How to Export Endpoint Security Policies in Intune") - [How to Provision Windows 10 / Windows 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Policy Management](https://techuisitive.com/microsoft-intune/#Policy-Management "Policy Management")** –Explore more guides on policy management, including creating, configuring, deploying, and troubleshooting policies in Microsoft Intune. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Policy Management --- ### [How to Export Endpoint Security Policies in Intune](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune/) **Published:** December 18, 2023 **Author:** Equebal Ahmad **Content:** Exporting and importing endpoint security policies in Microsoft Intune can save administrators significant time when migrating, testing, or replicating configurations across tenants. While the Intune admin center doesn’t yet provide a direct export option for endpoint security policies, PowerShell Intune Samples scripts offer a reliable workaround. In this guide, we’ll walk through the step-by-step process of exporting policies to JSON files and importing them back into Intune, helping you streamline policy management and reduce repetitive configuration tasks Let’s understand how to export the Endpoint security policies using a PowerShell sample script and then import the policy to another tenant. ## Export Endpoint Security Policies in JSON File Follow the steps below to export Endpoint security policies in a JSON file using a PowerShell script. Please note that the steps below will export all Endpoint security policies in the folder path you provide. - Download the [ Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/#) PowerShell scripts from [PowerShell Intune Samples](https://github.com/microsoftgraph/powershell-intune-samples) and extract all files to the local drive. - Run PowerShell as an Administrator. - Set PowerShell execution Policy to ByPass ( Set-ExecutionPolicy bypass ) - Install PowerShell AzureAD and Microsoft Graph Module if not already installed. - Change the location to the “DeviceConfiguration” under “Powershell-intune-samples-master” - Run the script **.\\EndpointSecurityPolicy\_Export.ps1** - If prompted, log in with your Azure AD / Entra ID credentials. - Specify a path to export the policy data. ``` .\EndpointSecurityPolicy_Export.ps1 ``` ![EndpointSecurityPolicy_Export.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-44.png)The script will export all Endpoint security policies in the folder path you provided. The script exports each policy in a separate JSON file. The current date and time are appended to each file name. ![EndpointSecurityPolicy_Export.ps1](https://techuisitive.com/wp-content/uploads/2023/10/image-45.png)You can open File Explorer and browse to the folder to see all exported policies in a JSON file. ![File explorer Windows 11 / Windows 11](https://techuisitive.com/wp-content/uploads/2023/10/image-46.png)## Import Endpoint Security Policies in Intune You can import the exported policy into either a different tenant or the same tenant to create a new policy and customize it as needed. If you are importing into the same tenant, it’s best practice to update the policy name to avoid confusion. This can be done quickly by opening the JSON file in Notepad and editing the **displayName** field before re-importing. When you import the policy, it remains unassigned. You must assign the policy to a device or user group as per your requirements. Follow the process below to import the policy into Microsoft Intune. - Follow the initial steps provided to export the policies. - Run the script **.\\EndpointSecurityPolicy\_Import\_FromJSON.ps1** - If prompted, log in with your Azure AD / Entra ID credentials. - Specify a path to export the policy data. ``` .\EndpointSecurityPolicy_Import_FromJSON.ps1 ``` ![Import Endpoint security policy | Intune | PowerhShell script](https://techuisitive.com/wp-content/uploads/2023/10/image-47.png)The script will read the policy and show information on the screen. ![Import Endpoint security policy | Intune | PowerhShell script](https://techuisitive.com/wp-content/uploads/2023/10/image-48.png)Later, you will see the message that the policy is being imported to Intune. The script returns to the prompt once imports are complete. ![Import Endpoint security policy | Intune | PowerhShell script](https://techuisitive.com/wp-content/uploads/2023/10/image-49.png)You can verify the imported policy directly in the Intune admin center. In this example, two policies with the same name are visible—the original policy and the one imported from the JSON file. Notice that the imported policy remains unassigned by default, allowing you to configure assignments as needed. ![Export Endpoint Security Policies | Intune](https://techuisitive.com/wp-content/uploads/2023/10/image-51-1024x432.png)## Related Posts - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) - [Export Device Configuration Profiles List in Intune](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/) - [How to Export Settings Catalog Policy in Intune](https://techuisitive.com/export-settings-catalog-policy-in-intune/ "How to Export Settings Catalog Policy in Intune") - [Export and Import Device Compliance Policies in Intune](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/ "Export and Import Device Compliance Policies in Intune") - [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/ "How to Export Device Configuration Profiles in Intune") - [How to Export Endpoint Security Policies in Intune](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune "How to Export Endpoint Security Policies in Intune") - [How to Provision Windows 10 / Windows 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Policy Management](https://techuisitive.com/microsoft-intune/#Policy-Management "Policy Management")** –Explore more guides on policy management, including creating, configuring, deploying, and troubleshooting policies in Microsoft Intune. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Policy Management --- ### [Deny M365 Apps access from Untrusted Locations | Intune](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/) **Published:** January 6, 2024 **Author:** Equebal Ahmad **Content:** Conditional Access is a feature of Microsoft Entra ID that helps organizations improve security and compliance. Conditional access policy includes sets of conditions which user or device must satisfy to access company resources. A conditional access policy can be used to allow or block access to company resources. In this blog post, we will demonstrate how to deny M365 apps access for the devices from untrusted locations. We will consider two users group, one from India and another from outside India. We will allow o365 app access from India and block the access for the users outside India. ## Create Named Locations We will start by creating Name locations. A Named Location in Conditional Access policies allow enforcement of access control based on device location. The Named Locations can be created based on Country (Determined by IP address / GPS location) and IP address range. We will create named location based on country. Follow the below steps to create a named location. - In the **Intune admin center**, navigates to **Devices / Conditional Access / Named locations** - Click on **+Countries location** - In the new flyer window, provide the following details - Name: India - Select Determine location by IP address (IPv4 and IPv6) - Select India from country list - Click on **Create**. ![Deny M365 Apps access | Conditional access policies](https://techuisitive.com/wp-content/uploads/2023/12/image-31-1024x463.png)You can now see the location you created in Name location list. We will use this named location when creating a conditional access policy. ![Intune Named locations](https://techuisitive.com/wp-content/uploads/2023/12/image-32-1024x370.png) ## Create Conditional Access Policy in Microsoft Intune Now we will create a conditional access policy to block access for all users. The named location – India will be excluded from the policy. That will block M365 apps access to all users expect the users in India. Follow the below steps to create a conditional access policy from Microsoft Intune admin center. - Log in to **Microsoft Intune Admin Center**. - In the Microsoft Intune admin center page, go to **Home > Devices > Conditional Access**. - In the **Overview** page, click on **+Create new policy**. ![Intune conditional access overview](https://techuisitive.com/wp-content/uploads/2023/12/image-33-1024x197.png)In the New – Conditional Access policy page, provide the following details. - Name: Deny o365 Apps access from Untrusted locations - Under **Assignments**, select **Users** - Select **Include** / “**Select** **Users and groups**” **/ Users and groups** and select the user or group on which you want to apply conditional access policy. ![Intune conditional access policies | New](https://techuisitive.com/wp-content/uploads/2023/12/image-36.png)- Under the **Assignments**, select **Target resources** - **Select what this policy applies to** : Cloud apps - **Include**: Select apps - Click on select and choose office 365 ![Intune conditional access policies](https://techuisitive.com/wp-content/uploads/2023/12/image-35.png) - Click on **Conditions** under **Assignments**, select **Locations** - Set **Configure** toggle button to **Yes** - Click on **Include** and select **Any Location** **Note:** This will block the application access from all locations. We will allow the application access from specific location in next steps. ![Intune conditional access policies](https://techuisitive.com/wp-content/uploads/2023/12/image-38-1024x574.png)- Under the **Configure** option, click on **Exclude** tab. - Click on **Selected Locations** radio button and select the location **India**. **Note:** We have excluded India location from conditional access policy. So, application access will blocked for all users except the users in India. ![Intune conditional access policies](https://techuisitive.com/wp-content/uploads/2023/12/image-39-1024x612.png)Under **Access Control**, select **Grant / Block access** ![Intune conditional access policies](https://techuisitive.com/wp-content/uploads/2023/12/image-40.png)Under the **Enable policy**, set the toggle button to **On** and click on **Create**. See the notification area to confirm successful policy creation. ![Intune conditional access policies | enable policy](https://techuisitive.com/wp-content/uploads/2023/12/image-41-1024x172.png) ## End User Experience We tried to access the office.com portal from India. It was accessible without any issue as India location (determined by IP address) was excluded from conditional access policy. ![Intune conditional access policies | End user experience](https://techuisitive.com/wp-content/uploads/2023/12/image-42-1024x470.png)Now same user tried to access the office.com portal from other country. The user was unable to access office.com portal. User received the following message: *You cannot access this right now. Your sign-in was successful but does not meet the criteria to access this resource. For example, you might be signing from a browser, app or location that is restricted by your admin.* ![Intune conditional access policies | You cannot access this right now.](https://techuisitive.com/wp-content/uploads/2023/12/image-43.png)## Related Posts - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [FeedSpot Top 25 SCCM Blogs to Follow in 2023](https://techuisitive.com/feedspot-top-25-sccm-blogs-to-follow-in-2023/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Compliance & Conditional Access](https://techuisitive.com/microsoft-intune/#Device-Compliance-and-Conditional-Access "Device Compliance & Conditional Access")** – Explore more guides on device compliance and Conditional Access, including compliance policies, device health, access controls, and securing access to organizational resources. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Conditional Access, Device Compliance and CA, Intune Guides --- ### [How to Bulk Rename Windows Devices from Intune](https://techuisitive.com/how-to-bulk-rename-windows-devices-from-intune/) **Published:** February 4, 2025 **Author:** Equebal Ahmad **Content:** The **Bulk device actions** in [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") allow you to perform remote actions on the managed devices. You can run the remote actions on up to 100 devices for most of the actions. The following remote actions can be performed on the managed Windows devices. Not all remote actions are available for all platforms. You will see the supported actions once you select the device platform in Bulk Device Actions. - Autopilot reset - Collect diagnostics - Custom notifications - Delete - Rename - Restart - Retire - Sync - Wipe - Update cellular data plan ## Rename a Windows device using Bulk device action Let’s understand how to rename a Windows 10/11 device using the **Bulk device actions**. - Open the Microsoft Intune portal - On the Microsoft Intune portal, navigate to Devices > Windows and select **Bulk device actions**. You can also select Devices > All Devices > Bulk device actions. ![Bulk Rename Devices](https://techuisitive.com/wp-content/uploads/2025/02/image-6.png)- Select the following details on the **Bulk device action** page. - OS: Windows - Device type: Physical devices - Device action: Rename ![Bulk Rename Devices from Intune](https://techuisitive.com/wp-content/uploads/2025/02/image-7.png)You can use the following tokens in the computer name. **{{serialnumber}}** – This token adds the device serial number to the computer name. Examples: DT-{{%Serialnumber%}} If the device serial number is xyz123 then the computer name would be DT-XYZ123 **{{rand:x}}** – add x number of random digits to computer name Examples: DT-{{rand:6}} Rename the device as DT suffix by 6 random digits such as DT-561543 Click on **Next** once you update the new name field. ![Bulk Rename Devices](https://techuisitive.com/wp-content/uploads/2025/02/image-8.png)On the **Devices** page, click **+Select devices to include** and select all devices you want to rename. You can add up to 100 devices. Click on **Next** to go to **Review + Create**. ![How to bulk rename devices from Intune](https://techuisitive.com/wp-content/uploads/2025/02/image-9.png)Review the details on the **Review + create** page and click **Create** to finish the policy creation. ![Intune bulk device action](https://techuisitive.com/wp-content/uploads/2025/02/image-10.png)See the notification in the Notifications area to confirm policy creation. ![Intune notification](https://techuisitive.com/wp-content/uploads/2025/02/image-11.png)The device is renamed as per the applied token after a reboot. The user does not receive any notification to reboot their device and reboot will not be forced. ![Intune Windows devices](https://techuisitive.com/wp-content/uploads/2025/02/image-12-1024x367.png)## Related Posts - [Collect Device Inventory Using Intune Properties Catalog](https://techuisitive.com/collect-device-inventory-using-intune-properties-catalog/) - [Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) - [How to Reset Windows 11 PC to Factory Settings](https://techuisitive.com/how-to-reset-windows-11-pc-to-factory-settings/) - [How to Block Built-in Apps on iOS Using Intune](https://techuisitive.com/how-to-block-built-in-apps-on-ios-using-intune/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/) - [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/) - [How to Rename Device from Intune](https://techuisitive.com/how-to-rename-device-from-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Management, Intune Guides --- ### [How to Join a Windows 10 Device to Entra ID](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) **Published:** November 29, 2021 **Author:** Equebal Ahmad **Content:** Microsoft Entra ID (Formerly Azure Active Directory) is a cloud version of on-premises Active Directory. You have to join the machine to Azure Active Directory to manage it through **[Microsoft Intune](https://techuisitive.com/category/intune/)**. Here are the steps to join Windows 10 devices to Microsoft Entra ID. Go to Windows 10 **Settings | Accounts | Access Work or School** and click on **Connect** ![Join windows 10 device to Azure AD } Access work or school](https://techuisitive.com/wp-content/uploads/2023/04/image-170.jpeg)In the **Set up a work or school account** page, click on **Join this device to Azure Active Directory** ![Azure AD Join | Access work or school](https://techuisitive.com/wp-content/uploads/2023/04/image-171.jpeg)In the **Sign in** page, enter your company email ID and click on **Next** ![Azure AD Join | Sign in page](https://techuisitive.com/wp-content/uploads/2023/04/image-172.jpeg)Approve the sign in request in case of Multi-factor authentication (MFA) is enabled for your account. ![Azure AD Join | MFA](https://techuisitive.com/wp-content/uploads/2023/04/image-173.jpeg) Review the message in next screen and click on **Join** ![Make sure this is your organization message](https://techuisitive.com/wp-content/uploads/2023/11/image-2.jpeg)The progress window will be shown which may take some time. ![Azure AD Join | Progress](https://techuisitive.com/wp-content/uploads/2023/04/image-174.jpeg)You will see the final message once AD join process is completed. ![Azure AD Join | Completed](https://techuisitive.com/wp-content/uploads/2023/04/image-175.jpeg)You can also validate this from **Access work or school** tab in settings. You can now see that device is joined to Azure Active Directory (AAD) tenant. ![Azure AD Join | Access work or school validation](https://techuisitive.com/wp-content/uploads/2023/04/image-177.jpeg)## Related Posts - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM SQL Query for Windows 10 / 11 Version Summary](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) - [Configure Windows 10 / 11 Device as Kiosk | Microsoft Intune](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [Windows 11 enrollment failed with error 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [Enroll Windows 11 Device to Intune through Azure AD Join method | Corporate Devices](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Invalid\_Client error when joining Windows 10 device to Azure AD tenant](https://techuisitive.com/invalid_client-error-when-joining-windows-10-device-to-azure-ad-tenant/) - [Join Windows 10 Device to Azure Active Directory](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Bulk enrollment of Windows 10/ 11 Devices to Intune](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Microsoft Intune – Windows 10 MDM- Basic troubleshooting](https://www.techuisitive.com/post/intune-windows-10-mdm-basic-troubleshooting) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://www.techuisitive.com/post/that-account-info-didn-t-work-error-when-disconnecting-windows-10---11-work-or-school-account) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://www.techuisitive.com/post/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Windows 10 / 11 **Tags:** Device Management --- ### [How to Enroll a Windows 11 Device in Intune Using Microsoft Entra Join](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) **Published:** August 23, 2022 **Author:** Equebal Ahmad **Content:** Enrolling Windows 11 corporate devices into Microsoft Intune is a critical step for IT administrators to ensure secure management, compliance, and streamlined access. One of the most reliable methods is using Azure AD Join, now known as Microsoft Entra ID Join, which directly connects devices to the organization’s cloud directory. This guide provides a step‑by‑step walkthrough of enrolling Windows 11 devices through the Azure AD / Entra ID Join method, complete with screenshots, prerequisites, and troubleshooting tips. Whether you’re setting up new endpoints, migrating from on‑premises Active Directory, or managing devices in hybrid environments, this tutorial will help you quickly configure and verify Intune enrollment for corporate‑owned Windows 11 systems. Note: The Azure Active Directory is now Microsoft Entra ID. ## Prerequisites ### Configure Automatic Enrollment Automatic enrollment allows users to seamlessly enroll their Windows devices into Microsoft Intune. To enable this, **Auto Enrollment must be configured** so that devices are automatically enrolled in Intune as soon as they are joined to **Microsoft Entra ID** (formerly Azure Active Directory). For step-by-step guidance, see **[Configure Azure Active Directory Automatic Enrollment](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/#Configure-Azure-Active-Directory-Automatic-Enrollment "Configure Azure Active Directory Automatic Enrollment")**, which explains how to set up and manage automatic enrollment in Entra ID. ## How to Join a Windows 11 Device to Azure Active Directory Follow the steps to enroll a Windows 11 device in Intune using the Azure AD Join enrollment method. - On a Windows 11 device, go to Windows 11 **Settings > Accounts.** The account you are using should have local administrator rights. ![Enroll Windows 11 Device to Intune | Accounts](https://techuisitive.com/wp-content/uploads/2023/04/image-1.jpeg)Scroll down and click on the **Access work or School** option. ![Windows 11 device intune enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-2.jpeg)On the **Access work or school** page, click on **Connect** ![Intune device enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-3.jpeg)On the **Set up a work or school account** page, click on **Join this device to Azure ActiveDirectory** ![Enroll device in Intune](https://techuisitive.com/wp-content/uploads/2023/04/image-4.jpeg)On the Sign-in page, enter your Azure AD account and click on Next. The AAD account should have permission to enroll the device in Intune. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-5.jpeg)Enter the password in the next screen and click on Sign in ![](https://techuisitive.com/wp-content/uploads/2023/04/image-6.jpeg)If Multi-Factor Authentication (MFA) is enabled, then you will get a prompt for authentication. ![intune auto enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-7.jpeg)On the “**Make sure this is your organization**” page, review the organization and click on **Join**. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-8.jpeg)The device is now joined to Azure Active Directory. Since we have already configured Automatic Enrollment for Microsoft Intune in Azure AD, the device is automatically enrolled in Microsoft Intune. Click on **Done**. ![enroll a device in Intune](https://techuisitive.com/wp-content/uploads/2023/04/image-9.jpeg)You now need to log on with your Azure AD account. You can either reboot the device or just sign out and log on with your Azure AD account. Click on the **Start Menu** and select **Sign out** ![](https://techuisitive.com/wp-content/uploads/2023/04/image-10.jpeg)Log on with your Azure AD account. You will see the Setting up for work or school account ( Enrollment Status Page). This will take some time, depending on the number of policies and applications assigned to the device/user in Microsoft Intune. ![Intune enrollment | Enrollment status Page (ESP)](https://techuisitive.com/wp-content/uploads/2023/04/image-11.jpeg)You can now see the device record in Azure AD and the device enrolled in Microsoft Intune. You can validate the same from the Azure Active Directory console or Microsoft Intune Admin Center. ![Azure AD Joined](https://techuisitive.com/wp-content/uploads/2023/04/image-12.jpeg)## **Related Posts** - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM SQL Query for Windows 10 / 11 Version Summary](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) - [Configure Windows 10 / 11 Device as Kiosk | Microsoft Intune](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [Windows 11 enrollment failed with error 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [Enroll Windows 11 Device to Intune through Azure AD Join method | Corporate Devices](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Invalid\_Client error when joining Windows 10 device to Azure AD tenant](https://techuisitive.com/invalid_client-error-when-joining-windows-10-device-to-azure-ad-tenant/) - [Join Windows 10 Device to Azure Active Directory](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Bulk enrollment of Windows 10/ 11 Devices to Intune](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Microsoft Intune – Windows 10 MDM- Basic troubleshooting](https://www.techuisitive.com/post/intune-windows-10-mdm-basic-troubleshooting) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://www.techuisitive.com/post/that-account-info-didn-t-work-error-when-disconnecting-windows-10---11-work-or-school-account) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://www.techuisitive.com/post/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Device Management --- ### [Organizing Laptops and Desktops in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) **Published:** May 15, 2023 **Author:** Asif Khan **Content:** Organizing laptops and desktops in device management has always been a challenge. In SCCM, we had to use Chassis type, and in Intune, we can’t use that anymore. ## Problem Organizations may require deploying apps or policies only to desktops or laptops. We have often found in various forum Dynamic Group should be used to create groups for laptops and desktops based on the device model. The challenge with this method is when we use the “in” Operator we have to give the full Model name, it may be a problem when the new model of the device enrolls and no one adds that name in the dynamic group, it won’t get added to the group thereby it will miss the apps and policies. To solve that problem, we can use the “contains” operator and give a model name that contains words like “Elitebook” which belongs to the laptop. The same can be done for desktop dynamic groups based on the word containing “Desk” which belongs to devices like the HP Prodesk 400 G5 series. This will ensure devices with those keywords get added to the dynamic group without manual effort. We have a challenge with the above solution also, Dynamic group only supports up to 5 criteria. If you have more than 5 unique models, then it won’t work for you. ## Solution Use **Intune Filter** when deploying apps. **[Intune Filter](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/)** works like a Dynamic group without the limitation of 5 criteria. Filter has rules. Use Model as property and Contains as Operator and give a keyword unique for laptop or desktop. When deploying an application use these filters to include or exclude laptops or desktops as a filter. You can follow [this article](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/) to learn the steps required to create Intune Filters. ![Intune Filters](https://techuisitive.com/wp-content/uploads/2023/05/image-6.png)You can also refer to Microsoft documentation to know about all properties available for Filters. **How to create a filter: Refer –** [**https://learn.microsoft.com/en-us/mem/intune/fundamentals/filters**](https://learn.microsoft.com/en-us/mem/intune/fundamentals/filters) ## **Related Posts** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Win32 Apps vs LOB Apps](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Tags: [Device Management](https://techuisitive.com/tag/device-management/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Device Management --- ### [How to Create and Manage Microsoft Intune Device Categories](https://techuisitive.com/how-to-create-and-manage-microsoft-intune-device-categories/) **Published:** October 5, 2023 **Author:** Equebal Ahmad **Content:** [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") device categories allow you to manage easily and group devices. Intune device category can be used to create Azure AD group and Assignment Filters to manage policy deployments. The devices can be automatically added into Azure AD (Entra ID) groups or Assignment Filters based on the device category assigned to a device. Device categories are supported on Windows, Mac, iOS and Android. Table Of Contents 1. [Allow User to Select Device Category from Intune Company Portal](#allow-user-to-select-device-category-from-intune-company-portal) 2. [How to Create Intune Device Category](#how-to-create-intune-device-category) 3. [How to Check all Intune Device Categories](#how-to-check-all-intune-device-categories) 4. [Check or Update the Device category for a Device](#check-or-update-the-device-category-for-a-device) 5. [Create Intune Assignment Filters using Device Category](#create-intune-assignment-filters-using-device-category) 6. [Create Azure AD Group Based on Intune Device Category](#create-azure-ad-group-based-on-intune-device-category) 7. [Explore More Intune Guides](#explore-more-intune-guides) ## Allow User to Select Device Category from Intune Company Portal A user can select the appropriate device category for a device from the Microsoft Intune Company Portal. To allow users to select a device category, you need to enable **Let users select device categories in the Company portal** setting in Microsoft Intune. This setting can be enabled from **Microsoft Intune Admin Center / Tenant administration / Customization**. ![Intune Device Categories | Let uses select device categories in the Company Portal](https://techuisitive.com/wp-content/uploads/2023/09/image.png)The users will get a prompt as in the below screenshot to choose the best category for their device once logged on to the Intune Company Portal. ![Intune device categories | Intune Company portal](https://techuisitive.com/wp-content/uploads/2023/07/Intune-Device-Category.jpg) ## How to Create Intune Device Category Let’s understand, how to create device category in Microsoft Intune. Follow the below steps to create a device category from the Microsoft Intune admin center. Navigate to Devices / Device Categories and click on the Create **Device category** ![Create intune device category](https://techuisitive.com/wp-content/uploads/2023/09/image-1-1024x484.png)In the **Create device category** page, provide the appropriate **Name** and **Description** for the category and click on **Next**. ![Intune device category](https://techuisitive.com/wp-content/uploads/2023/09/image-2.png)In the **Review + create** page, review the details and click on **Create** to create the category. ![Create device category in Intune](https://techuisitive.com/wp-content/uploads/2023/09/image-3.png) ## How to Check all Intune Device Categories You can check existing device categories in Intune from the Intune admin center or the Intune Graph API PowerShell module. ### Check Intune Device Categories from the Intune Admin Center Follow the below steps to check the Intune device category from the Intune admin center. Log on to Intune admin center and navigate to **Devices / Device categories**. You will see all device categories listed at the right side of the screen. ![how to check Intune device category](https://techuisitive.com/wp-content/uploads/2023/09/image-4-1024x407.png)### Check Intune Device Categories from PowerShell To check the device categories from PowerShell, you need to connect with MS-Graph. Follow [How to Install PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/ "How to Install PowerShell SDK for Microsoft Intune Graph API") to know how to install and connect with MS-Graph. `Get-DeviceManagement_DeviceCategories` ![how to check Intune device category with PowerShell](https://techuisitive.com/wp-content/uploads/2023/09/image-6-1024x238.png) ## Check or Update the Device category for a Device You can check or update a device category from Intune admin center. Navigate to the **Devices** blade, select a device, and go to **Properties**. You can see the currently assigned category to the device. You can also update the device category from here. ![Intune Update Device category](https://techuisitive.com/wp-content/uploads/2023/09/image-5-1024x631.png)You can also check the device category for a device from PowerShell using Get-IntuneManagedDevice cmdlet. `Get-IntuneManagedDevice | Select-Object id,deviceName,deviceCategoryDisplayName` ![Intune device category powershell](https://techuisitive.com/wp-content/uploads/2023/09/image-7-1024x176.png)`Get-IntuneManagedDevice | Where-Object {$_.deviceName -eq 'TESTVM01'} | Select-Object deviceName,deviceCategoryDisplayName` ## Create Intune Assignment Filters using Device Category [Intune Assignment Filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/ "Intune Filters – Assign Microsoft Store App policy using Filters") allow granular targeting of policies. You can create an assignment filter based on device categories. In the Intune Admin Center, navigate to **Devices > Filters** and click on **Create Filter** **> Managed Devices** In the Create filter page, select the following: Adjust the values as per your requirements. Click on Next once you updated the query. - **Property** : deviceCategory - **Operator** : Equals - **Value** : Intune Test Devices ![Create Assignment Filters using Device Category](https://techuisitive.com/wp-content/uploads/2023/09/image-11.png)You can use Filter Preview to quickly test the query result. Click on Preview at the bottom left screen to see the filter result preview. Click on **Next** to move to Review + create screen and complete the Filter creation process. ![Create Assignment Filters using Device Category](https://techuisitive.com/wp-content/uploads/2023/09/image-14-1024x530.png) ## Create Azure AD Group Based on Intune Device Category In the Intune admin center, navigate to **Groups** blade and click on **New Group**. Provide the following details. - Group Type : Security - Group Name: Intune Test Devices - Azure AD roles can be assigned to the group: No - Membership type : Dynamic device Click on **Add Dynamic Query** ![](https://techuisitive.com/wp-content/uploads/2023/09/image-18-1024x668.png)In the **Configure Rules** tab , Add query expression for device category and click on **Validate Rules** tab to validate the expression result. ![](https://techuisitive.com/wp-content/uploads/2023/09/image-19-1024x602.png)Click on **Add Devices** and select the desired device from the list. You can see the result in th**e Status** column. A green tick mark shows that the device met the query criteria and will be a member of the dynamic collection. ![](https://techuisitive.com/wp-content/uploads/2023/09/image-20-1024x617.png)Click on **Save** to return to the previous Window. Click on **Create** to complete AAD Group creation process. ### Related Posts - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [FeedSpot Top 25 SCCM Blogs to Follow in 2023](https://techuisitive.com/feedspot-top-25-sccm-blogs-to-follow-in-2023/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Device Management, Intune Guides --- ### [How to Rename Device from Intune](https://techuisitive.com/how-to-rename-device-from-intune/) **Published:** January 30, 2025 **Author:** Equebal Ahmad **Content:** You may need to rename a device that is not named per organization standard. The device can be renamed from the Intune console and no hand and feet support is required. Follow the below steps to rename a device from the Microsoft Intune admin center. - On the Intune admin console, navigate to Devices/Windows Devices and select the device that you want to rename. - Click on the dots at the right side of the screen and select “Rename device” ![Intune rename device](https://techuisitive.com/wp-content/uploads/2025/01/image-1-1024x453.png)On the Rename device flyer window, you can enter the new computer name or use the following tokens. {{serialnumber}} – Add the device serial number to the computer name. Examples: LTUS{{%Serialnumber%}} DTIN{{%Serialnumber%}} {{rand:x}} – add x number of random digits to computer name Examples: LTIN-{{rand:6}} – Rename the device to LTIN- followed by 6 random characters such as LTIN-XYZABC ![Intune Rename device](https://techuisitive.com/wp-content/uploads/2025/01/image-2.png)Enter the new computer name and click on **Rename**. A reboot is required to complete the device rename. If you want to reboot the device immediately then toggle the “**Restart after rename**” button to **Yes**. This will trigger an immediate reboot of the device. If you leave the option to No, the device rename process will be completed once the user reboots the device. The user does not see any notification if the option is set to No. ![Intune rename device](https://techuisitive.com/wp-content/uploads/2025/01/image-3.png)You can see the below notifications in the Intune notification area for the successful action. ![Intune rename a device end user experience,](https://techuisitive.com/wp-content/uploads/2025/01/image-4.png)The process was very quick for my test device. As soon as I clicked on **Rename**, the “*You’re about to be signed out*” notification appeared on the device. ![You're about to be signed out](https://techuisitive.com/wp-content/uploads/2025/01/image-5.png)The second and final notification appeared after 2-3 minutes stating that the device would be rebooted in 2 minutes. ![](https://techuisitive.com/wp-content/uploads/2025/01/image-6-1024x498.png)The device was renamed successfully after a reboot. The same can be validated from the device properties on Windows 10 / 11 devices. ![Windows 11 device specification](https://techuisitive.com/wp-content/uploads/2025/01/image-7-1024x438.png)The information was quickly updated on the Intune admin console as well. ![Intune rename device from Intune admin console](https://techuisitive.com/wp-content/uploads/2025/01/image-8.png)## Related Posts - [Collect Device Inventory Using Intune Properties Catalog](https://techuisitive.com/collect-device-inventory-using-intune-properties-catalog/) - [Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) - [How to Reset Windows 11 PC to Factory Settings](https://techuisitive.com/how-to-reset-windows-11-pc-to-factory-settings/) - [How to Block Built-in Apps on iOS Using Intune](https://techuisitive.com/how-to-block-built-in-apps-on-ios-using-intune/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/) - [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/) - [How to Rename Device from Intune](https://techuisitive.com/how-to-rename-device-from-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Management](https://techuisitive.com/microsoft-intune/#device-management "Device Management")** – Explore more device management guides covering Microsoft Intune, device configuration, enrollment, compliance, security, and Windows device management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Management, Intune Guides --- ### [Get Hardware Hash for Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) **Published:** January 25, 2023 **Author:** Equebal Ahmad **Excerpt:** To identify a device with Windows Autopilot, the device's unique hardware identify (hardware hash) must be captured and uploaded to the service. This is usually first step when you want to provision a machine using Windows Autopilot. The hardware hash can be uploaded by manufacturer / raeseller for new devices. However, hardware hash need to be collected manually for the devices which are already in corporate environment and not already enrolled into Microsoft Intune. **Content:** Windows Autopilot traditionally requires a hardware hash to manually register devices. This guide walks you through collecting the hash quickly with PowerShell and exporting it for upload into Microsoft Intune. **Related Post: [Windows 10 Autopilot Deployment Guide | Intune](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/)** **Notes:** The latest version of Windows Autopilot, known as ***Windows Autopilot Device Preparation* (Autopilot v2)**, no longer requires a device hash. Instead, adding the serial number as a corporate identifier is sufficient. Please check out [Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) to know more about Autopilot Device Preparation. Table Of Contents 1. [1. Install the Script Directly from the PowerShell Gallery](#1-install-the-script-directly-from-the-powershell-gallery) 2. [2. Download and run the Script on each computer](#2-download-and-run-the-script-on-each-computer) - [2.1 Get Device Information (Hardware Hash) for Local Device](#21-get-device-information-hardware-hash-for-local-device) - - [2.2. Get Hardware Hash for Remote Device](#22-get-hardware-hash-for-remote-device) - - [2.3 Get Hardware Hash for Multiple Remote Computers (Input from text file)](#23-get-hardware-hash-for-multiple-remote-computers-input-from-text-file) - - [2.4 Get hardware hash for Multiple Remote Devices ( Input from csv file)](#24-get-hardware-hash-for-multiple-remote-devices-input-from-csv-file) - - [2.5 Get Device Information (Hardware hash) for Multiple Remote Devices ( Input from SCCM Collection)](#25-get-device-information-hardware-hash-for-multiple-remote-devices-input-from-sccm-collection) 3. [3. Get Device Hardware Hash Details From SCCM](#3-get-device-hardware-hash-details-from-sccm) - [SCCM Report: Windows AutoPilot Device Information](#sccm-report-windows-autopilot-device-information) - - [4. ConfigMgr CMPivot Utility](#4-configmgr-cmpivot-utility) 4. [Related Posts:](#related-posts) 5. [Explore More Intune Guides](#explore-more-intune-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## 1. Install the Script Directly from the PowerShell Gallery You need to run the following command in elevated PowerShell to install the script directly from the PowerShell Gallery. The command will install the Get-WindowsAutopilot script, execute the script, and save the Hardware hash in the C:\\HWID folder. ``` [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory -Path "C:\HWID" Set-Location -Path "C:\HWID" $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts" Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned Install-Script -Name Get-WindowsAutopilotInfo Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv ``` ## 2. Download and run the Script on each computer The [Get-WindowsAutoPilotInfo](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo "Get-WindowsAutoPilotInfo") script uses WMI to retrieve properties needed for a device to register with Windows AutoPilot. This script can obtain hardware hash from local or remote devices. You can download the PowerShell script (Get-WindowsAutoPilotInfo.ps1) from the PowerShell gallery. ### 2.1 **Get Device Information (Hardware Hash) for Local Device** To collect hardware hash for a local computer, copy the script to the local computer and use the command line below. The script exports the hardware hash in a CSV file in the current directory. *Get-WindowsAutoPilotInfo.ps1 -outputfile HWIDVM003.CSV* ![get autopilot hardware hash](https://techuisitive.com/wp-content/uploads/2023/04/image-38.png)### 2.2. **Get Hardware Hash for Remote Device** You can use the above script to get the hardware hash for autopilot for a remote computer. You need to run the script with -ComputerName parameter. *Get-WindowsAutoPilotInfo.ps1 -ComputerName TESTDEVICE01 -OutputFile deviceinfo.csv* ![Dell autopilot hardware hash](https://techuisitive.com/wp-content/uploads/2023/04/image-39.png) ### 2.3 **Get Hardware Hash for Multiple Remote Computers (Input from text file)** We have shown how to get the hardware hash for autopilot for a remote computer in the last example. However, the example was for a single remote computer. To get hardware hash for multiple remote computers, the input can be provided from a text file. The computer’s name should be provided in a text file in the format below. ![Intune hardware hash input text file mulitple computer](https://techuisitive.com/wp-content/uploads/2023/04/image-40.png)Use the command line below to get the autopilot hardware hash for all computers in a text file. The script will export the hardware hash in CSV file in the current directory. Please note that all devices should be online, and the necessary ports should be open in the firewall to establish a connection with remote WMI. *Get-content .\\Computers.txt | .\\Get-WindowsAutoPilotInfo.ps1 -OutputFile deviceinfo.csv* ![collect autopilot hardware hash remotely](https://techuisitive.com/wp-content/uploads/2023/04/image-41.png) ### 2.4 **Get hardware hash for Multiple Remote Devices ( Input from csv file)** To get a hardware hash for multiple remote computers, the input can be provided from a CSV file. The computer’s name should be provided in CSV file in the format below. Please note that **ComputerName** column header is mandatory when you provide input from a CSV (Comma Separated File). ![Hardware hash CSV](https://techuisitive.com/wp-content/uploads/2023/04/image-42.png)CSV file format for Get-WindowsAutoPilotInfo.ps1 Use the command line to collect the hardware hash. The script will export the hardware hash in a CSV file in the current directory. *Import-Csv -path .\\computers.csv | .\\Get-WindowsAutoPilotInfo.ps1 -OutputFile deviceinfo.csv* ![intune hardware hash](https://techuisitive.com/wp-content/uploads/2023/04/image-43.png)### 2.5 **Get Device Information (Hardware hash) for Multiple Remote Devices ( Input from SCCM Collection)** The Get-WindowsAutopilotInfo script also accepts the input directly from the SCCM collection. To get the hardware hash for members of the SCCM collection, you need to get the list of collection members using the Get-CMCollectionMember cmdlet and pass the input to the Get-WindowsAutopilotInfo script. Follow the steps below to get the hardware hash for a member of the SCCM collection. Similar to the input provided from CSV / Text file, this method also requires that the machine is online, as the script will gather the information by connecting to a remote computer’s WMI. - Open Windows Powershell with Local Administrator permission - Set execution policy to unrestricted ***(Set-ExecutionPolicy Unrestricted -Scope currentuser)*** - Import Configuration Manager Powershell Module **(*Import-Module ‘C:\\Program Files\\Microsoft Configuration Manager\\AdminConsole\\bin\\ConfigurationManager.psd1’)*** - Change drive letter to SCCM site code ( e.g, CD P01) - Use the below command to obtain the hardware hash. *Get-CMCollectionMember -CollectionName “Test VMs” | D:\\temp\\Get-WindowsAutopilotInfo.ps1 -OutputFile D:\\temp\\deviceinfo.csv* ![Get hardware hash for autopilot](https://techuisitive.com/wp-content/uploads/2023/04/image-44.png)## 3. **Get Device Hardware Hash Details From SCCM** ### **SCCM Report: Windows AutoPilot Device Information** The built-in SCCM report “**Windows AutoPilot Device Information**” pulls out the hardware hash for SCCM clients. SCCM collects this information as part of the default hardware inventory and information already present in the SCCM database. Follow the steps below to get the details. - In the Configuration Manager admin console, navigate to Monitoring / Reports and search for “AutoPilot”. - From the result, select “Windows AutoPilot Device Information” report and run the report. - Export the result to CSV file. ![SCCM Report | Windows AutoPilot Device Information](https://techuisitive.com/wp-content/uploads/2023/04/image-45.png)### 4. ConfigMgr **CMPivot Utility** CMPivot is an in-console utility introduced in Configuration Manager version 1806. CMPivot allows SCCM admins to initiate a live query on select computers. The device must be online and accessible to collect the information using the CMPivot tool. Follow the steps below to collect the hardware hash using the CMPivot utility. - Launch Configuration Manager Admin Console - Navigate to the **device collection** and select **any** **device collection** that you want to collect the Hardware hash. - **Right-Click** on **Device** collection and select **Start** **CMPivot**. You will now see the CMPivot application opened. Follow the steps mentioned below to open Get Autopilot CSV info script from the Community hub and get the hardware hash using that script. ![Collect hardware hash autopilot | CMPivot](https://techuisitive.com/wp-content/uploads/2023/04/image-46.png)1. Click on the **Query** tab. 2. Click on **Community hub** icon on the top right corner. Wait for the list. It may take some time. 3. Click on Get Autopilot CSV info script 4. You will see the script in the query editor 5. Click on **Run Query** 6. You can see the result in the Result pane ## **Related Posts:** - [How to Fix Autopilot error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/ "How to Fix Autopilot error 80070002") - [Windows Autopilot Device Preparation – Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/ "Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide") - [Windows 10 Autopilot Deployment Guide | Intune](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) - [Intune – Configure Enrollment Status Page (ESP)](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Bulk enrollment of Windows 10/ 11 Device to Intune using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Enroll Windows 11 Device to Intune through Azure AD Join method](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Windows 11 enrollment with Provisioning package failed with error code 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/). ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM, Microsoft Intune, Step by Step Guides, Windows Autopilot **Tags:** Autopilot Guides --- ### [Create Group Based on Windows Autopilot Group Tag](https://techuisitive.com/create-group-based-on-windows-autopilot-group-tag/) **Published:** August 17, 2024 **Author:** Equebal Ahmad **Content:** Windows Autopilot group tags make dynamic device management simple. By mapping group tags to Microsoft Entra ID attributes, IT admins can automatically organize devices into security groups during provisioning. This guide walks you step-by-step through creating dynamic groups in Intune using Autopilot group tags, ensuring streamlined enrollment and policy assignment. If you’re new to Windows Autopilot, you may want to start with the basics of device provisioning. In our guide [How to Provision Devices with Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/ "How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot"), we walk through the enrollment process step by step. Once devices are provisioned, you can use group tags—as explained in this post—to automatically organize them into dynamic Microsoft Entra ID groups for streamlined management. ## Dynamic Membership Rule Expressions for Autopilot Groups When creating expressions: - **To include all Autopilot devices**, use the following syntax: (device.devicePhysicalIds -any (\_ -startsWith “\[ZTDid\]”)) - **To include Autopilot devices with a specific group tag** (mapped to the **OrderID** attribute in Microsoft Entra ID), use: (device.devicePhysicalIds -any (\_ -eq “\[OrderID\]:179887111881”)) Replace `179887111881` with the actual **Group Tag (OrderID)** value assigned to your devices. ## Step-by-Step: Creating Dynamic Groups in Intune Follow these steps to create a Microsoft Entra ID group using a Windows Autopilot group tag. - Open the Microsoft Intune admin portal at [https://intune.microsoft.com](https://intune.microsoft.com/), - Navigate to the *Groups* blade, and select *New Group* to begin creating your dynamic group. ![Entra ID New Group Based on Windows Autopilot Group Tag](https://techuisitive.com/wp-content/uploads/2024/07/image-50-1024x547.png)On the **New Group** page, provide the following details: - **Group Type**: **Security** - **Group Name**: Enter a clear, descriptive name for your group (e.g., *Site-XYZ-Devices*). - **Group Description**: Add a meaningful description that explains the purpose of the group. - **Membership Type**: Select **Dynamic**. Next, click **Add dynamic query** to define a dynamic membership rule. The group membership will be automatically populated based on this rule. ![Intune group based on Windows Autopilot Group Tag](https://techuisitive.com/wp-content/uploads/2024/07/image-51.png)On the **Dynamic membership rules > Configure Rules** page: - Click the **Edit** link under **Rule syntax**. - Enter the following expression, replacing *GroupTag* with the actual tag you assigned during Autopilot registration: **(device.devicePhysicalids -any \_ -eq “\[OrderID\]:GroupTag”)** For example: **(device.devicePhysicalids -any \_ -eq “\[OrderID\]:WA-Test-PP”)** All the Windows Autopilot devices with the group tag “WA-Test-PP” will become members of the group. ![Entra ID Group - Dynamic rule - OrderID](https://techuisitive.com/wp-content/uploads/2024/07/image-52.png)On the **Members** tab: - Click the **Refresh** link. - The device should now appear in the group, automatically added based on the dynamic membership rule you configured in the previous step ![Entra ID Group - Group Tag](https://techuisitive.com/wp-content/uploads/2024/07/image-53-1024x454.png)## Related Posts - [How to Get AAD Group Members’ Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) - [Powershell Script to Add Bulk Users / Computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/ "Dynamic Group Based on Enrollment Profile in Intune") - [Deny M365 Apps access from Untrusted Locations | Intune](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides, Windows Autopilot **Tags:** Autopilot Guides --- ### [Create an offline domain join configuration profile in Intune](https://techuisitive.com/create-an-offline-domain-join-configuration-profile-in-intune/) **Published:** August 28, 2024 **Author:** Equebal Ahmad **Content:** The offline Domain join feature was introduced in Windows Server 2008 R2. A command line utility named Djoin.exe allow you to join a computer to a domain without physically contacting a domain controller while completing the domain join process. The [Windows Autopilot ](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/ "How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot")hybrid join use this feature to join the device to on-premises domain during device provisioning. You can create an offline Domain join profile (ODJ profile) and assign the same to Autopilot devices. The ODJ profile includes Domain and Active Directory OU details. You have to create a separate ODJ profile for each OU where you want to create computer object. Follow the below steps to create an offline Domain join profile. - On the Intune admin center, navigate to Devices > Windows > Configuration - Click on Create and select the following - Platform: Windows 10 an Later - Profile Type: Template - Template Name: Domain Join - Click on Create ![Intune offline domain join profile](https://techuisitive.com/wp-content/uploads/2024/07/image-46-1024x540.png)On the **Domain Join** page, enter a suitable **Name** and **Description** for the profile and click on **Next**. ![Intune ODJ profile ](https://techuisitive.com/wp-content/uploads/2024/07/image-47-1024x612.png) - Enter the following details on **Configuration settings** page. - **Computer name prefix:** Enter the prefix you want for the computer name. The computer name will be formed with prefix and random characters. For example: if the prefix is “TEST-” then the computer name can be “TEST-XYZABC” - **Domain name:** Enter the Domain name where you want the device to join - **Organizational unit:** Enter the Organizational unit (OU) name in Distinguished Name (DN) format. The distinguished name (DN) format for an organizational unit (OU) in Active Directory is similar to “OU=OU\_Name, DC=domain, DC=com”. In this format, OU\_Name represents the name of the OU, and the DC components represent the domain components of the Active Directory domain ![Intune Offline domain join profile Configuration settings](https://techuisitive.com/wp-content/uploads/2024/07/image-48.png)On the **Assignment** page, assign the profile to an Entra ID group and click on **Next**. If you need to create a separate profile for a different location, you can create an Entra ID group based on the Autopilot device group tag. You can have a separate group tag for each location and assign that group tag to the Autopilot device. ![Intune ODJ profile assignment](https://techuisitive.com/wp-content/uploads/2024/07/image-49-1024x641.png)On the Review+create page, review the settings and click on Create the profile. Ensure you assign the Offline domain join configuration profile to the Autopilot devices. The respective ODJ profile will be picked based on the assignment during Autopilot hybrid join. ## Related Posts - [How to Fix Autopilot error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/ "How to Fix Autopilot error 80070002") - [Windows Autopilot Device Preparation – Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/ "Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide") - [Windows 10 Autopilot Deployment Guide | Intune](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) - [Intune – Configure Enrollment Status Page (ESP)](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Bulk enrollment of Windows 10/ 11 Device to Intune using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Enroll Windows 11 Device to Intune through Azure AD Join method](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Windows 11 enrollment with Provisioning package failed with error code 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/). ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Autopilot Guides --- ### [Bulk Update Autopilot Group Tag Using PowerShell](https://techuisitive.com/bulk-update-autopilot-group-tag-using-powershell/) **Published:** September 27, 2024 **Author:** Equebal Ahmad **Content:** Windows Autopilot group tags are used to categorize devices based on specific attributes. You can assign a group tag to a device during autopilot registration or hash import. When you create rules using Autopilot device attributes, Autopilot devices that meet the criteria are automatically added to the group. This simplifies the device grouping during Autopilot device provisioning. The group tag for individual devices can be updated from the Intune admin center. However, there are no such options available for bulk updates of group tags from the Intune admin center. We can use PowerShell and the Microsoft Graph API to bulk update group tags. ## Microsoft Graph Command Line Tools The users with the Intune Administrator role can update the group tag from the Intune admin console. However, you need access to Microsoft Entra ID Enterprise Application and Microsoft Graph Command Line Tools to update the Group tag through the Microsoft Graph API. **Application Name**: Microsoft Graph Command Line Tools **API Name:** Microsoft Graph **Claim Value:** - Group.ReadWrite.All - Device.ReadWrite.All - DeviceManagementManagedDevices.ReadWrite.All - DeviceManagementServiceConfig.ReadWrite.All - GroupMember.ReadWrite.All ![Autopilot group tag bulk update](https://techuisitive.com/wp-content/uploads/2024/09/image-4-1024x229.png)An Entra ID administrator must provide organization consent for the above API claim value. If admin consent has not been provided, you will see prompts below. The organization’s consent needs to be provided only once. ![Microsoft Graph command line tool admin consent](https://techuisitive.com/wp-content/uploads/2024/09/image-8-1024x549.png) ## CSV File – Device & Group Tag Details The PowerShell script takes input from the CSV file. You must organize the Device Name and Group tag in the format below in a CSV file. The column header must be the same as provided in the screenshot below. ![Intune autopilot group tag update script](https://techuisitive.com/wp-content/uploads/2024/09/image-6.png)## The PowerShell Script The below PowerShell script updates the group tag for all devices in the provided CSV file. You can also download the script & CSV file from the link provided at the end of this post. The **Microsoft.Graph.Intune** and **WindowsAutopilotIntune** PowerShell modules are required for this script. If the required modules are not installed, then the script will install them. ``` Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned $deviceList = "$PSScriptRoot\devices.csv" #Install Microsoft.Graph.Intune module if(-not (Get-Module Microsoft.Graph.Intune -ListAvailable)) { Write-Host "Installing Microsoft.Graph Module" -ForegroundColor Cyan Install-Module Microsoft.Graph.Intune -Scope CurrentUser -Force } #Install WindowsAutopilotIntune module if(-not (Get-Module WindowsAutopilotIntune -ListAvailable)) { Write-Host "Installing WindowsAutopilotIntune Module" -ForegroundColor Cyan Install-Module WindowsAutopilotIntune -Scope CurrentUser -Force } Connect-MgGraph -scopes Group.ReadWrite.All, Device.ReadWrite.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementServiceConfig.ReadWrite.All, GroupMember.ReadWrite.All $devices = import-csv -Path $deviceList $totalDevices = ($devices).Count $sn=1 Write-Host "Total Devices: $totalDevices" -ForegroundColor Yellow foreach ($device in $devices){ try { $serialNumber = $device.SerialNumber $groupTag = $device.GroupTag Write-Host -NoNewline "Device:$sn of $totalDevices, Serial Number:$serialNumber, Group Tag:$groupTag ....." -ForegroundColor Cyan $id = (get-AutopilotDevice -serial $serialNumber).id Set-AutopilotDevice -id $id -groupTag $groupTag Write-host "Group tag udpated." -ForegroundColor Green } catch { $message = $_.Exception.Message Write-Host "Error: $message" -ForegroundColor Red } $sn+=1 } ``` ![Autopilot group tag bulk update script](https://techuisitive.com/wp-content/uploads/2024/09/image-3-1024x98.png)## Script Download You can download the PowerShell script and sample CSV file from the link below. [AutoPilotGroupTagUpdate](https://techuisitive.com/wp-content/uploads/2024/09/AutoPilotGroupTagUpdate.zip)[Download](https://techuisitive.com/wp-content/uploads/2024/09/AutoPilotGroupTagUpdate.zip) ## Related Posts - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides, Windows Autopilot **Tags:** Autopilot Guides, Autopilot PowerShell, Intune Automation, Intune Guides, PowerShell --- ### [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) **Published:** April 7, 2022 **Author:** Equebal Ahmad **Excerpt:** Windows Autopilot is a modern deployment solution from Microsoft that simplifies how IT teams provision, configure, and manage Windows 10/11 devices. By integrating with Microsoft Intune and Azure Active Directory (Entra ID), Autopilot enables zero‑touch setup, repurposing, and recovery of devices with minimal infrastructure. **Content:** Windows Autopilot is a modern deployment solution from Microsoft that simplifies how IT teams provision, configure, and manage Windows 10/11 devices. By integrating with **Microsoft Intune** and **Azure Active Directory (Entra ID)**, Autopilot enables zero‑touch setup, repurposing, and recovery of devices with minimal infrastructure. In this step‑by‑step guide, you’ll learn how to configure Autopilot profiles, enrollment settings, and device registration to streamline your **OS deployment workflow** and deliver a seamless out‑of‑box experience (OOBE) for end users. **Notes:** Microsoft has introduced a new version of Windows Autopilot called *Windows Autopilot Device Preparation* (also known as Autopilot v2). For more details, check out this article on Windows Autopilot Device Preparation: [Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) Table Of Contents 1. [Configure Azure Active Directory Automatic Enrollment](#configure-azure-active-directory-automatic-enrollment) 2. [Configure Azure Active Directory custom branding (Optional)](#configure-azure-active-directory-custom-branding-optional) 3. [Create a device group for Windows Autopilot](#create-a-device-group-for-windows-autopilot) 4. [Create Windows Autopilot Deployment Profile](#create-windows-autopilot-deployment-profile) - [Deployment Profile Settings (Windows Autopilot)](#deployment-profile-settings-windows-autopilot) 5. [Configure Enrollment Status Page (ESP)](#configure-enrollment-status-page-esp) 6. [Manually Register the Device with Windows Autopilot](#manually-register-the-device-with-windows-autopilot) 7. [Reset the VM to factory settings](#reset-the-vm-to-factory-settings) 8. [Out of Box Experience (OOBE)](#out-of-box-experience-oobe) - [Enrollment Status Page (ESP) Stages](#enrollment-status-page-esp-stages) 9. [🎉 Enrollment Complete](#enrollment-complete) - [Conclusion](#conclusion) 10. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) - [What is Windows Autopilot?](#what-is-windows-autopilot) - - [Do I need to manually register devices for Autopilot?](#do-i-need-to-manually-register-devices-for-autopilot) - - [What is the Enrollment Status Page (ESP) and why is it important?](#what-is-the-enrollment-status-page-esp-and-why-is-it-important) - - [Can I customize the Out‑of‑Box Experience (OOBE) for users?](#can-i-customize-the-outofbox-experience-oobe-for-users) - - [What happens if ESP installation takes longer than expected?](#what-happens-if-esp-installation-takes-longer-than-expected) - - [Can users bypass ESP if an installation fails?](#can-users-bypass-esp-if-an-installation-fails) - - [How do dynamic groups help in Autopilot deployments?](#how-do-dynamic-groups-help-in-autopilot-deployments) - - [What are the stages of ESP during enrollment?](#what-are-the-stages-of-esp-during-enrollment) - - [What happens if a device is reset to factory settings?](#what-happens-if-a-device-is-reset-to-factory-settings) - - [How does Autopilot improve IT efficiency compared to traditional imaging?](#how-does-autopilot-improve-it-efficiency-compared-to-traditional-imaging) 11. [Related Posts:](#related-posts) 12. [Explore More Intune Guides](#explore-more-intune-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Configure Azure Active Directory Automatic Enrollment** Automatic enrollment enables users to seamlessly enroll their Windows devices into **Microsoft Intune**. As soon as a device joins **Azure Active Directory (Azure AD)**, it is automatically registered and enrolled in Intune for management. Follow these steps to configure **Automatic MDM enrollment** from the **Azure portal**. - Sign in to the [Azure portal](https://portal.azure.com/), and select **Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune**. - Configure MDM user scope. If you **select** Some, then you need to select an Azure AD Group. ![Intune - MDM Scope](https://techuisitive.com/wp-content/uploads/2023/04/image-70.png)Note: MDM user scope must be set to an Azure AD group that contains user objects. ## **Configure Azure Active Directory custom branding (Optional)** The **Azure Active Directory (Azure AD) custom branding** feature allows organizations to create a personalized login experience by adding company‑specific branding to the sign‑in page. You can configure elements such as logos, background images, and custom text directly from the **Azure portal → Azure AD → Company Branding** settings. This ensures a consistent, professional identity across all user sign‑ins. ![Azure Active Directory - Custom Branding](https://techuisitive.com/wp-content/uploads/2023/04/image-71.png)## **Create a device group for Windows Autopilot** To assign an **Intune Autopilot Deployment Profile**, you must first create a device group in **Azure Active Directory (Azure AD)**. The recommended approach is to use **dynamic membership rules** based on Autopilot device attributes (such as `ZTDId`). This eliminates the need to manually add devices, since each device automatically becomes a member of the group once its hardware hash is imported into Windows Autopilot. **Dynamic Membership Rule Expression:** ``` (device.devicePhysicalIDs -any (_ -contains "[ZTDId]")) ``` ![Intune - Dynamic Device Group](https://techuisitive.com/wp-content/uploads/2023/04/image-72.png)## **Create Windows Autopilot Deployment Profile** **Windows Autopilot deployment profiles** are used to configure and manage Autopilot devices during provisioning. To enable Autopilot for a device, you must assign a **Windows Autopilot Deployment Profile** that defines settings such as enrollment options, user experience, and device configuration. Follow these steps to create and assign an Autopilot deployment profile in **Microsoft Intune**. In the **Microsoft Intune admin center**, choose **Devices** > **Windows** > **Windows enrollment** > **Deployment Profiles** ![Windows Autopilot | Deployment Profile | Intune autopilot | Auto pilot intune](https://techuisitive.com/wp-content/uploads/2023/06/image-2.png)Click on **Create Profile** and select **Windows PC** to begin configuring a new **Windows Autopilot Deployment Profile** in **Microsoft Intune**. This profile defines how devices are provisioned, including enrollment settings, user experience, and configuration policies, ensuring a seamless Autopilot deployment process. ![Intune Autopilot Deployment Profile](https://techuisitive.com/wp-content/uploads/2023/04/image-73.png)On the **Basics** page, enter a **Name** for the deployment profile and, optionally, provide a **Description** to identify its purpose. Once complete, click **Next** to proceed with the configuration. ![Microsoft Autopilot Deployment Profile](https://techuisitive.com/wp-content/uploads/2023/04/image-74.png)On the **Out‑of‑Box Experience (OOBE)** page, proceed with the **default settings** to simplify configuration. These defaults are optimized for most deployment scenarios and ensure a consistent Windows Autopilot setup without requiring additional customization. ![Intune - Windows Auto pilot Deployment Profile - OOBE](https://techuisitive.com/wp-content/uploads/2023/04/image-75.png)### Deployment Profile Settings (Windows Autopilot) - **Deployment Mode:** *User Driven* Devices with this profile require users to enroll using their **Microsoft Entra ID (formerly Azure Active Directory)** credentials. - **Join to Azure AD:** *Azure AD joined* Ensures devices are automatically joined to your organization’s Azure AD tenant. - **Microsoft Software License Terms:** *Hide* Skips the license terms screen during OOBE for a smoother setup. - **Privacy Settings:** *Hide* Removes privacy prompts to streamline the enrollment process. - **Hide Change Account Options:** *Hide* Prevents users from switching accounts during setup. - **User Account Type:** *Standard* Configures enrolled devices with standard user privileges by default. - **Allow White Glove OOBE:** *No* Disables pre‑provisioning (White Glove) mode for this profile. - **Language (Region):** *Operating System default* Uses the OS default language and region settings. - **Automatically Configure Keyboard:** *Yes* Keyboard layout is automatically configured during setup. - **Apply Device Name Template:** *Yes* Applies a predefined naming convention to enrolled devices for consistency. On the **Assignment** page, select and add the **Azure Active Directory (AAD) group** you created for **Windows Autopilot devices**. This ensures that the deployment profile is automatically applied to all devices in the group. Once the group is added, click **Next** to continue with the configuration. ![Intune - Windows Autopilot Deployment Profile - Assignment](https://techuisitive.com/wp-content/uploads/2023/04/image-76.png)On the **Review + Create** page, carefully review all configuration details for your **Windows Autopilot Deployment Profile**. Once you’ve verified the settings, click the **Create** button to finalize and publish the profile in **Microsoft Intune**. ![Intune - Windows Auto pilot Deployment Profile - Create + review](https://techuisitive.com/wp-content/uploads/2023/04/image-77.png)The **Windows Autopilot Deployment Profile** has now been successfully created. You can view and manage it by navigating to **Devices → Windows Enrollment → Windows Autopilot Deployment Profiles** in the **Microsoft Intune portal**. ![Intune Autopilot Profile list](https://techuisitive.com/wp-content/uploads/2023/04/image-78.png)## **Configure Enrollment Status Page** (ESP) The **Enrollment Status Page (ESP)** provides real‑time visibility into the progress of **device provisioning** during enrollment. It appears when a new device is enrolled in **Microsoft Intune** or when a new user signs in for the first time. You can enable ESP during the **default Out‑of‑Box Experience (OOBE)** for: - **Azure AD Join** - **Windows Autopilot deployments** - First‑time sign‑in for new users By showing ESP, IT admins can ensure that critical apps, policies, and configurations are applied before users access the desktop, delivering a consistent and secure onboarding experience. For a detailed walkthrough, check out this post for the **[step‑by‑step guide to configuring the Enrollment Status Page (ESP)](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/ "step‑by‑step guide to configuring the Enrollment Status Page (ESP)")** in **Microsoft Intune**. It covers how to enable ESP during **Windows Autopilot deployments**, **Azure AD join**, and first‑time user sign‑ins to ensure a smooth and secure provisioning experience. ## **Manually Register the Device with Windows Autopilot** After configuring all required settings in **Microsoft Intune** to support **Windows Autopilot scenarios**, the next step is to manually register a test device. This process is primarily intended for **testing and validation**. In production environments, organizations should rely on **OEMs (Original Equipment Manufacturers)** or **Cloud Solution Provider (CSP) partners** for Autopilot registration. OEMs such as **Dell, HP, and Lenovo** support the **Windows Autopilot OEM partner program** and can handle device registration on your behalf using the **[registration authorization process](https://docs.microsoft.com/en-us/mem/autopilot/registration-auth "registration authorization process")**. Check out this article to know different ways to collect hardware hash for a device: [Get Hardware Hash for Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) For testing purposes, follow these steps to manually register a device: 1. **Install Windows 10** on a test device or virtual machine (VM). This device will be used for Autopilot deployment testing. 2. **Download the PowerShell script** `Get-WindowsAutoPilotInfo.ps1` from the PowerShell Gallery. This script retrieves the device’s **hardware hash** and **serial number**. The serial number helps quickly identify which device the hardware hash belongs to. 3. **Run the PowerShell script** on the test device you prepared. The script will generate the hardware hash file required for manual registration in Windows Autopilot. ![Windows Autopilot - Capture hardware hash](https://techuisitive.com/wp-content/uploads/2023/04/image-79.png)Once the hardware hash has been captured in a **CSV file**, the next step is to upload it to **Windows Autopilot**. Using **Microsoft Intune**, you can import the device and register it for Autopilot deployment. In the **Microsoft Endpoint Manager admin center**, navigate to: **Devices → Windows → Windows Enrollment → Windows Autopilot Deployment Program → Devices** From here, you can upload the CSV file to add the device to Autopilot for testing or production scenarios. ![Intune - Windows Autopilot devices](https://techuisitive.com/wp-content/uploads/2023/04/image-80.png)On the next screen, click on **Import** ![Intune - Windows Autopilot devices](https://techuisitive.com/wp-content/uploads/2023/04/image-81.png)On the **Add Autopilot Devices** screen, click the **Browse** button and select the **hardware hash CSV file** you previously generated. Once the file is selected, click **Import** to upload the device information. This step registers the device into the **Windows Autopilot Deployment Program** through **Microsoft Intune**, enabling automated enrollment and configuration during provisioning. ![Intune - Windows Autopilot devices - Import](https://techuisitive.com/wp-content/uploads/2023/04/image-82.png)You can monitor the **status of device imports** in the **Notifications area** of the **Microsoft Endpoint Manager admin center**. This allows you to verify whether the hardware hash CSV file was successfully uploaded and if the devices have been registered into the **Windows Autopilot Deployment Program**. ![Intune - Console Notification](https://techuisitive.com/wp-content/uploads/2023/04/image-83.png)If the **import is successful**, the device details will appear on the **Windows Autopilot Devices** page in the **Microsoft Endpoint Manager admin center**. From here, you can confirm that the hardware hash has been registered, validate the device information, and ensure the correct **deployment profile** is assigned. ![Intune - Windows Autopilot Devices - List](https://techuisitive.com/wp-content/uploads/2023/04/image-84.png)## **Reset the VM to factory settings** Now that the device has been registered, the next step is to **reset the Windows 10 VM to factory settings**. This action forces the device to enter the **Windows setup Out‑of‑Box Experience (OOBE)** stage. At this point, the **Windows Autopilot profile** is automatically downloaded from the **Windows Autopilot service**, ensuring the device provisions according to the assigned deployment profile. ⚠️ **Important:** Before resetting the device, make sure it is connected to a network and that **Internet access is available**. Without connectivity, the Autopilot profile cannot be retrieved, and the OOBE process will not complete successfully. Perform the steps below to reset your Windows OS to factory settings. - From the Start Menu, select **Settings** - In the Windows Settings window, select **Update & Security** - In the **Windows Update** window, select **Recovery** from the left pane You will now see the Recovery page. Click on **Get Started under Reset this PC to begin the** reset process. ![Windows 10 Reset PC](https://techuisitive.com/wp-content/uploads/2023/04/image-85.png)On the **Choose an option** page, select **Remove everything**. This ensures the **Windows 10 VM** is reset to **factory settings**, wiping all files, apps, and configurations. By doing so, the device will re‑enter the **Windows setup Out‑of‑Box Experience (OOBE)** stage, where the **Windows Autopilot profile** is automatically downloaded and applied. ![Windows 10 reset - Choose Options](https://techuisitive.com/wp-content/uploads/2023/04/image-86.png)After initiating the reset, you will see the **“Getting things ready”** page. Once the reset process completes, the machine automatically reboots. Following the reboot, the device enters the **Windows setup Out‑of‑Box Experience (OOBE)** stage, where the **Windows Autopilot profile** is downloaded and applied to the device. ![Windows 10 reset](https://techuisitive.com/wp-content/uploads/2023/04/image-87.png)## **Out of Box Experience (OOBE)** After resetting the test VM, the device automatically enters the **Windows setup OOBE stage**. The end user will go through the same experience during enrollment. The first few screens include: - **Network connection:** When you reset a Windows 10 OS, saved network details such as Wi‑Fi SSID and password are automatically restored. In most cases, this screen may not appear. - **Region settings:** Select the appropriate region for the device. - **Keyboard layout:** Choose the default keyboard layout. - **Additional keyboard layout:** Optionally add extra keyboard layouts if required. - **License agreement:** Acknowledge the Microsoft Software License Terms to proceed. ![OOBE - Region](https://techuisitive.com/wp-content/uploads/2023/04/image-88.png)The next screen in the **Windows setup Out‑of‑Box Experience (OOBE)** is the **user login page**. - **Company branding & tenant details:** If you don’t see your organization’s branding or tenant information here, it means the device has **not been identified as a Windows Autopilot device**. In that case, the Autopilot profile has not been applied. - **Login credentials:** The user should sign in with their **corporate ID and password**. Enter the company corporate ID, click **Next**, and proceed with authentication. This step ensures the device is enrolled into **Microsoft Intune** under the correct tenant and that the assigned **Windows Autopilot deployment profile** is applied. ![Windows Autopilot - Login page](https://techuisitive.com/wp-content/uploads/2023/04/image-89.png)You will be prompted for the password on the next screen. Enter the password and click on **Next**. ![Windows Autopilot - Login page](https://techuisitive.com/wp-content/uploads/2023/04/image-90.png)After the user login, the **Enrollment Status Page (ESP)** will be displayed on the next screen. The ESP provides real‑time visibility into the **device provisioning process**, showing the progress of app installations, policy configurations, and profile assignments. This ensures that all required settings are applied before the user reaches the Windows desktop, delivering a secure and consistent onboarding experience. ![](https://techuisitive.com/wp-content/uploads/2024/08/image.png)### Enrollment Status Page (ESP) Stages The **Enrollment Status Page (ESP)** guides users through several stages during device provisioning. These stages ensure that all required configurations, apps, and policies are applied before the user reaches the desktop. #### **Device Preparation** This stage validates the device setup and prepares it for enrollment. Typical tasks include: - **Securing the device** (e.g., TPM validation, BitLocker checks) - Joining your organization’s network - Registering your Device for Mobile Device Management - Preparing your device for mobile management Once device preparation is complete, the ESP moves to the next stage. ![Windows Autopilot - Enrollment Status Page (ESP)](https://techuisitive.com/wp-content/uploads/2023/04/image-91.png)#### **Device Setup:** During the **Device Setup** phase of the **Enrollment Status Page (ESP)**, **Windows Autopilot** ensures that all essential configurations are applied before the user can access the system. At this stage, the device receives **security policies** and installs required apps via **Microsoft Intune**. The **Device Setup stage** includes the following steps: - **Security Policies:** Critical compliance and configuration policies are applied to secure the device. - **Certificates:** Required certificates are installed to enable secure communication with corporate resources. - **Network Connections:** Network profiles are configured to ensure seamless connectivity. - **Apps:** Line‑of‑business (LOB) apps, Microsoft 365 apps, and other required software are installed before the user reaches the desktop. This structured process guarantees that devices are compliant, secure, and ready for productivity from the very first login. ![Windows 10 Autopilot Device Setup](https://techuisitive.com/wp-content/uploads/2024/08/image-2.png)#### **Account Setup:** The **Account Setup** phase is the final stage of the **Enrollment Status Page (ESP)**. During this stage, the device is joined to **Microsoft Entra ID (formerly Azure AD)**, compliance policies are enforced, and required apps are installed via **Microsoft Intune**. This ensures the device is fully secured and ready for use before the user reaches the desktop. The **Account Setup stage** includes the following actions: - **Joining your organization’s network:** The device is connected to the corporate directory via Entra ID/Azure AD. - **Security Policies:** Compliance and configuration policies are applied to enforce organizational standards. - **Certificates:** Necessary certificates are installed to enable secure access to corporate resources. - **Network Connections:** Network profiles are configured to ensure seamless connectivity. - **Apps:** Required applications are installed, ensuring the device is ready for productivity from the first login. ![Windows 10 Autopilot Account Setup](https://techuisitive.com/wp-content/uploads/2024/08/image-1.png)The next screen in the **Windows setup OOBE** is the **Privacy Settings** page. Here, you can configure privacy options such as location services, diagnostic data, tailored experiences, and advertising ID. - **Toggle the settings** on or off according to your organization’s requirements or personal preferences. - Once the selections are made, click **Accept** to continue with the setup process. This step ensures that privacy configurations are aligned with compliance requirements before the device completes enrollment. ![Windows Autopilot - Privacy Settings](https://techuisitive.com/wp-content/uploads/2023/04/image-92.png)Once enrollment configurations are finished, the user will get a prompt for additional authentication if Multi-Factor Authentication (MFA) is enabled. ![Multifactor Authentication Page](https://techuisitive.com/wp-content/uploads/2023/04/image-93.png)## 🎉 Enrollment Complete Your device has completed the **Windows Autopilot enrollment process**. - All **security policies**, **certificates**, and **network configurations** have been applied. - Required **apps** have been installed via **Microsoft Intune**. - The device is now fully joined to your organization’s **Microsoft Entra ID (Azure AD)** tenant. - If **Multi‑Factor Authentication (MFA)** was enabled, the user has already passed the additional verification step. ✅ **Your device is now ready to use** — secure, compliant, and provisioned with the assigned deployment profile. ### Conclusion By following the complete **Windows Autopilot enrollment workflow** — from importing devices and resetting them to factory settings, through the **Out‑of‑Box Experience (OOBE)**, the **Enrollment Status Page (ESP)** stages, privacy configuration, and optional **Multi‑Factor Authentication (MFA)** — you ensure that every device is provisioned securely, consistently, and in compliance with organizational standards. This process guarantees that: - Devices are correctly identified as **Autopilot‑managed**. - **Security policies, certificates, and network profiles** are applied before user access. - Required **apps** are installed via **Intune**. - Users experience a seamless, branded, and secure onboarding flow. ✅ **The end result:** A device that is fully ready for productivity from the very first login — secure, compliant, and aligned with your organization’s deployment profile. ## Frequently Asked Questions (FAQs) ### **What is Windows Autopilot?** Windows Autopilot is Microsoft’s modern deployment solution that simplifies provisioning, configuration, and management of Windows 10/11 devices. It integrates with **Intune** and **Microsoft Entra ID (Azure AD)** to deliver a zero‑touch setup experience. ### **Do I need to manually register devices for Autopilot?** Not in production. OEMs (Dell, HP, Lenovo, etc.) or CSP partners can register devices on your behalf. Manual registration using hardware hash is mainly for **testing or validation**. ### **What is the Enrollment Status Page (ESP) and why is it important?** ESP provides **real‑time visibility** during device provisioning. It ensures that required apps, policies, and profiles are installed before users access the desktop, delivering a secure and consistent onboarding experience. ### **Can I customize the Out‑of‑Box Experience (OOBE) for users?** Yes. Through Autopilot deployment profiles, you can configure options such as **Azure AD join**, **user account type**, **privacy settings**, and **company branding** to deliver a tailored setup experience. ### **What happens if ESP installation takes longer than expected?** By default, ESP shows an error after **60 minutes**. You can increase this timeout if apps or policies require more time to install during enrollment. ### **Can users bypass ESP if an installation fails?** Yes, depending on your configuration. You can allow users to: - **Reset the device** if installation fails, or - **Bypass ESP and use the device** even if errors occur. ### **How do dynamic groups help in Autopilot deployments?** Dynamic groups in Azure AD automatically include devices based on attributes (like **ZTDId**). This eliminates manual group management and ensures deployment profiles are applied consistently. ### **What are the stages of ESP during enrollment?** ESP runs through three stages: - **Device Preparation** (TPM validation, BitLocker, MDM registration) - **Device Setup** (security policies, certificates, apps) - **Account Setup** (Azure AD join, compliance policies, required apps) ### **What happens if a device is reset to factory settings?** After reset, the device re‑enters OOBE. The Autopilot profile is automatically downloaded, ensuring the device provisions according to the assigned deployment profile. ### **How does Autopilot improve IT efficiency compared to traditional imaging?** Autopilot eliminates the need for custom images and manual setup. Devices can be shipped directly to users, who simply sign in with corporate credentials to receive all required apps and policies. ## **Related Posts:** - [How to Fix Autopilot error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/ "How to Fix Autopilot error 80070002") - [Windows Autopilot Device Preparation – Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/ "Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide") - [Windows 10 Autopilot Deployment Guide | Intune](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) - [Intune – Configure Enrollment Status Page (ESP)](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Bulk enrollment of Windows 10/ 11 Device to Intune using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Enroll Windows 11 Device to Intune through Azure AD Join method](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Windows 11 enrollment with Provisioning package failed with error code 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/). ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Windows Autopilot **Tags:** Autopilot Featured, Autopilot Guides, intune featured, Intune Guides --- ### [The Remediation Playbook: How Intune Admins Can Automate Fixes in 2026](https://techuisitive.com/the-remediation-playbook-how-intune-admins-can-automate-fixes-in-2026/) **Published:** August 4, 2026 **Author:** Equebal Ahmad **Content:** Modern endpoint management goes way beyond just pushing out policies – it’s about getting devices to fix themselves. With Microsoft Intune’s detection and remediation scripts, you can catch and fix issues automatically before users even realize anything is wrong. Now that we are dealing with hybrid work setups and managing Windows 10 and 11, having that kind of automation isn’t just a nice bonus—it’s pretty much essential. This playbook highlights the **strategy behind Intune remediation scripts**—helping admins design smarter fixes, automate compliance, and build self‑healing endpoints. We will cover detection logic, remediation triggers, logging, and reporting so you can move beyond quick fixes to a sustainable automation framework. 👉 For step‑by‑step deployment tutorials, check out: - [Automate Intune Remediation Script Creation with PowerShell and Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/ "Automate Intune Remediation Script Creation with PowerShell and Graph API") - [Step‑by‑Step Guide to Creating Intune Detection and Remediation Scripts](https://techuisitive.com/how-to-create-intune-detection-and-remediation-scripts-step-by-step-guide/ "Step‑by‑Step Guide to Creating Intune Detection and Remediation Scripts") ## What Are Detection and Remediation Scripts? **Detection Script:** A PowerShell script that checks whether a specific condition is met on the device. For example, it can verify whether BitLocker is enabled, OneDrive is syncing properly, or a required registry key exists. The script returns a status indicating whether the device is compliant. **Remediation Script:** A companion PowerShell script that runs only when the detection script reports a non-compliant state. It automatically applies the required fix, such as enabling BitLocker, restarting a service, resetting OneDrive, or updating a registry setting to restore compliance. Think of the **detection script** as the **diagnostic test** that identifies the issue, and the **remediation script** as the **treatment plan** that automatically resolves it. ## Intune Remediation Workflow ![Intune remediation workflow](https://techuisitive.com/wp-content/uploads/2026/07/image-13-1024x683.png)## How Detection Works When a remediation package is assigned, Microsoft Intune deploys the **PowerShell detection script** to all targeted devices. The script runs locally on each device and checks whether the required condition is satisfied, such as verifying that BitLocker is enabled, a registry value exists, or a specific service is running. The detection script then returns an exit code to Intune:. - **Exit code 0** → The required condition is met, so the device is considered **compliant**. No further action is taken. - **Exit code 1** → The required condition is not met, so the device is considered **non-compliant**. Intune proceeds to run the remediation script (if one is available). Based on the detection result, Intune determines whether remediation is necessary, ensuring that fixes are applied only to devices that actually require them. ## How Remediation Is Triggered If the detection script returns an **exit code of 1**, indicating that the device is **non-compliant**, Microsoft Intune automatically runs the associated **PowerShell remediation script**. The remediation script attempts to correct the issue and bring the device back into the desired state. Administrators can configure how often the detection and remediation scripts run, such as **once**, **hourly**, or **daily**, depending on the scenario and organizational requirements. The scripts run silently in the background using the configured execution context (user or system), allowing issues to be resolved with minimal disruption to end users. At the next scheduled run, the detection script executes again to verify that the remediation was successful and that the device remains compliant. ## Why Enable Logs for Troubleshooting Intune remediation logs provide detailed information about each script execution, including when the detection script ran, what condition it evaluated, the exit code that was returned, and whether the remediation script was executed successfully. These logs help administrators quickly identify the root cause of failures, such as incorrect registry paths, missing files, insufficient permissions, or errors in the PowerShell script itself. In addition to troubleshooting, the logs provide valuable evidence for compliance reporting and security audits by showing when remediation was performed and whether the device was successfully returned to the desired state. 👉 Best practice: Always enable transcript logging in your scripts (`Start-Transcript` / `Stop-Transcript`). ## Exported Reports: What They Contain & Why They Matter Microsoft Intune allows administrators to export remediation reports that provide a detailed overview of script execution across managed devices. These reports include key information such as: - **Detection results** – Shows which devices passed or failed the detection script. - **Remediation status** – Indicates whether the remediation script ran successfully or encountered an error. - **Execution details** – Includes timestamps, device names, user information, and error messages to help diagnose failures. These reports help administrators: - **Identify recurring issues** by spotting devices or configurations that repeatedly fail detection. - **Measure remediation effectiveness** by verifying that scripts are successfully resolving issues across the environment. - **Prioritize troubleshooting efforts** by focusing on devices with persistent failures or specific error messages. - **Track compliance trends** and generate documentation for operational reviews or security audits. Intune reports give visibility into: - **Device compliance status** (how many devices passed detection). - **Remediation success/failure counts**. - **Error messages** from failed runs. ## Benefits of Using Detection and Remediation - **Proactive issue resolution** – Detect and fix common issues automatically before users notice them or submit help desk tickets. - **Consistent device configuration** – Apply the same remediation across all managed devices, ensuring a standardized and compliant environment. **Scalability** – Automate repetitive administrative tasks and manage thousands of devices without manual intervention. - **Improved security and compliance** – Continuously enforce security baselines by correcting issues such as disabled BitLocker, missing antivirus settings, or non-compliant configurations. - **Better user experience** – Resolve problems in the background, reducing downtime, minimizing disruptions, and improving device reliability. ## Example Use Cases for 2026 Microsoft Intune remediation can automate the detection and repair of many common Windows issues. Some popular use cases include: - **Reset Windows Update components** – Detect Windows Update failures and automatically reset update components to resolve installation issues. - **Repair Intune enrollment issues** – Identify devices with broken or incomplete Intune enrollment and perform automated corrective actions where applicable. - **Reapply network configurations** – Restore Wi-Fi, VPN, or proxy settings that have been modified or are preventing users from accessing corporate resources. - **Clear Microsoft Teams or Outlook cache** – Remove corrupted cache files to resolve sign-in problems, synchronization issues, and application performance problems. - **Update Microsoft Defender signatures** – Detect outdated security intelligence and trigger a signature update to keep devices protected against the latest threats. - **Enforce security and configuration baselines** – Automatically correct issues such as disabled BitLocker, stopped services, missing registry values, or incorrect system settings to maintain compliance. ## Conclusion Detection and remediation scripts are a core component of modern Microsoft Intune administration, enabling organizations to identify and resolve device issues automatically. By combining proactive detection, automated remediation, and detailed reporting, IT administrators can shift from reactive troubleshooting to a scalable, self-healing device management approach. Whether you’re enforcing security baselines, correcting configuration drift, or resolving common Windows issues, Intune remediation helps improve compliance, reduce support tickets, and deliver a more reliable experience for end users. As organizations continue to adopt cloud-based endpoint management, detection and remediation scripts will remain an essential tool for maintaining healthy, secure, and productive Windows devices. ## Related Posts - [How to Create Intune Detection and Remediation Scripts (Step‑by‑Step Guide)](https://techuisitive.com/how-to-create-intune-detection-and-remediation-scripts-step-by-step-guide/) - [Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) - [Automating Intune Reports Using PowerShell and Microsoft Graph API](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/ "Automating Intune Reports Using PowerShell and Microsoft Graph API") ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Automation, Intune Remediation --- ### [Windows Autopilot Device Preparation aka Autopilot v2 Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) **Published:** November 22, 2024 **Author:** Equebal Ahmad **Content:** Windows Autopilot Device Preparation, also known as **Autopilot v2**, is Microsoft’s latest evolution in device provisioning. Unlike the traditional Autopilot process, this streamlined approach eliminates the need to import hardware hashes, relying instead on the **device serial number** to identify corporate devices. This guide walks you step‑by‑step through configuring Autopilot Device Preparation, helping IT admins simplify deployment, accelerate setup, and ensure a clean, secure onboarding experience for end users. When using **Windows Autopilot Device Preparation (Autopilot v2)**, the device must **not be registered** with the traditional **Windows Autopilot service**. If the device is already registered, you must **deregister it first**. Otherwise, the existing **Autopilot policy** will take precedence, preventing the Device Preparation profile from applying correctly. Table Of Contents 1. [Requirements](#requirements) 2. [Set up Windows automatic Intune enrollment](#set-up-windows-automatic-intune-enrollment) 3. [Allow users to join devices to Microsoft Entra ID](#allow-users-to-join-devices-to-microsoft-entra-id) 4. [Create a Device Group for Windows Autopilot Device Preparation](#create-a-device-group-for-windows-autopilot-device-preparation) 5. [Create a User Group to Assign Device Preparation Policy](#create-a-user-group-to-assign-device-preparation-policy) 6. [Assign applications and PowerShell scripts to the device group](#assign-applications-and-powershell-scripts-to-the-device-group) 7. [Create a Windows Autopilot device preparation policy](#create-a-windows-autopilot-device-preparation-policy) 8. [Add a Windows device to the corporate device identifier](#add-a-windows-device-to-the-corporate-device-identifier) 9. [Reset Device to Factory Settings](#reset-device-to-factory-settings) 10. [End User Experience](#end-user-experience) 11. [Monitoring & Troubleshooting Autopilot Device Preparation](#monitoring-troubleshooting-autopilot-device-preparation) 12. [Classic Autopilot vs. Autopilot Device Preparation (v2)](#classic-autopilot-vs-autopilot-device-preparation-v2) 13. [Conclusion](#conclusion) 14. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) 15. [Related Posts](#related-posts) 16. [Explore More Intune Guides](#explore-more-intune-guides) ## Requirements **Operating System** - Windows 11, version **23H2** with update **KB5035942** or later - Windows 11, version **22H2** with update **KB5035942** or later **Identity** - Only **Microsoft Entra ID join** is supported (Azure AD join). **Device Registration** - The device **must not be registered** or added as a Windows Autopilot device. - If a device is already registered with Autopilot, the **Autopilot profile takes precedence** over the Autopilot Device Preparation policy. ## Set up Windows automatic Intune enrollment **Automatic enrollment** enables users to seamlessly enroll their **Windows devices** into **Microsoft Intune**. When a device joins **Microsoft Entra ID (Azure AD)**, it is automatically enrolled in Intune, ensuring centralized management, security policies, and compliance are applied without requiring manual steps. Follow the steps below to configure Automatic MDM enrollment from the Entra ID. - Sign in to the [Azure portal](https://portal.azure.com/), and select **Microsoft Entra ID>** **Mobility (MDM and MAM)** > **Microsoft Intune**. - Configure MDM user scope. If you **select** Some, then you need to choose an Azure AD Group. ![Intune - MDM Scope](https://techuisitive.com/wp-content/uploads/2023/04/image-70.png)Note: MDM user scope must be set to an Azure AD group that contains user objects. ## Allow users to join devices to Microsoft Entra ID The user must be able to **join a device to Microsoft Entra ID**. To enable this setting: Ensure that **Microsoft Entra join** is enabled for your organization. Sign in to the **Azure portal**. Navigate to **Entra ID → Devices → Device settings**. ![Microsoft Entra join and registration settings](https://techuisitive.com/wp-content/uploads/2024/11/image-2-1024x417.png)## Create a Device Group for Windows Autopilot Device Preparation Windows Autopilot Device Preparation uses a **device group** as part of the policy. During deployment, devices are **automatically added** to this group. To ensure proper functionality: The **Intune Provisioning Client** service principal (AppId: `f1346770-5b25-470b-88bd-d5744ab7952c`) must be configured as the **owner** of this device group. ### Steps to Configure Follow the steps below to create a device group and assign ownership: - Sign in to the Microsoft Intune admin center and navigate to Groups. - in the Groups | All Groups page, click on **New Group** and provide the following details. - **Group type:** Security - **Group Name:** Windows Autopilot Device Preparation – Device Group - **Group description:** Enter an appropriate description for the group - **Microsoft Entra roles can be assigned to the group:** No - Membership type: Assigned - Owners: Click on **No Owners Selected** link. - In the **Add owners** screen that opens: - Search for **Intune Provisioning Client** / **Intune Autopilot ConfidentialClient** with AppId of **f1346770-5b25-470b-88bd-d5744ab7952c** and select the same from the result. ![Windows Autopilot Device Preparation Device Group | Autopilot v2 setup](https://techuisitive.com/wp-content/uploads/2024/09/image-9.png)## Create a User Group to Assign Device Preparation Policy Windows Autopilot Device Preparation requires a **user group** as part of the deployment policy. Members of this group automatically receive the **Autopilot Device Preparation deployment** during setup. The specified user group must be a **security group**, which can be configured as either an **assigned group** or a **dynamic group**, depending on your organizational needs. Follow the steps below to create a user group for Windows Autopilot Device Preparation. - Sign in to the Microsoft Intune admin center and navigate to Groups. - in the Groups | All Groups page, click on New Group and provide the following details. - **Group type:** Security - **Group Name:** Windows Autopilot Device Preparation – User Group - **Group description:** User group to receive Windows Autopilot device preparation policy. - **Microsoft Entra roles can be assigned to the group:** No - Membership type: Assigned - Select **Create** to create the group. ![Windows autopilot device preparation user group](https://techuisitive.com/wp-content/uploads/2024/09/image-10.png)## Assign applications and PowerShell scripts to the device group During **device preparation**, you can either **install applications** or **run PowerShell scripts** as part of the provisioning process. To ensure they are applied correctly: Use the **required assignment** so that these apps/scripts are automatically deployed to every device added to the group during Autopilot Device Preparation. Assign all required **applications** and **scripts** to the **device group**. ![Autopilot device preparation - required assignment](https://techuisitive.com/wp-content/uploads/2024/11/image-1-1024x540.png)## Create a Windows Autopilot device preparation policy The **Windows Autopilot Device Preparation policy** defines the settings that will be applied to configure a device during Autopilot provisioning. This ensures a consistent and streamlined deployment experience across your environment. ### Steps to Create the Policy 1. Sign in to the **Intune admin center**. 2. Navigate to **Devices → Device onboarding → Enrollment**. 3. Under **Windows Autopilot Device Preparation**, select **Device preparation policy**. 4. Follow the guided steps to configure the policy according to your organizational requirements. ![Create Windows Autopilot Device Preparation Policy | Autopilot v2 Intune](https://techuisitive.com/wp-content/uploads/2024/09/image-11-1024x550.png)On the **Device Preparation Policies** page, select **+ Create** to begin configuring a new policy. ![Device preparation policies Intune Autopilot v2](https://techuisitive.com/wp-content/uploads/2024/09/image-12.png)On the **Create profile → Introduction** page, review the introductory details for the **Windows Autopilot Device Preparation policy**. Once confirmed, click **Next** to proceed with the configuration steps. ![Device Preparation polcies Create Profile](https://techuisitive.com/wp-content/uploads/2024/09/image-13-1024x609.png)On the **Basics** page: - Enter a suitable **policy name** that reflects its purpose (e.g., *Autopilot Device Preparation – HR Laptops*). - Provide a clear **description** to document the scope or intended use of the policy. - Once complete, click **Next** to proceed to the **Device group** page. ![](https://techuisitive.com/wp-content/uploads/2024/09/image-14-1024x600.png)On the **Device group** page: - Select the **Device preparation – device group** that you created earlier. - Confirm the group assignment to ensure devices are automatically added during deployment. - Click **Next** to proceed to the **Configuration settings** page. ![autopilot device preparation policies](https://techuisitive.com/wp-content/uploads/2024/09/image-15-1024x559.png)Under **Configuration settings → Deployment settings**, configure the following options: - **Deployment mode** – Choose whether devices are provisioned for user‑driven or pre‑provisioned scenarios. - **Deployment type:** Single-user - **Join Type: Microsoft** Entra Join - **User account type** – Specify if the device should be joined with a **standard user account** or **administrator account**. ![autopilot device preparation intune policies](https://techuisitive.com/wp-content/uploads/2024/09/image-16-1024x491.png)Configure the following settings under **Out of Box experience settings**. - **Minutes allowed before showing installation error:** Default is 60 minutes. You can adjust the value as per your requirements. - **Custom error message:** Error message that the user will see when device provisioning failed - **Allow users to skip setup after multiple attempts:** Yes/No - **Show link to diagnostics**: Yes/No ![Autopilot v2 setup](https://techuisitive.com/wp-content/uploads/2024/09/image-17.png)Under **Configuration settings → Apps**, you can assign up to **10 managed applications** to install automatically during **device provisioning**. Ensure each app is set with a **required assignment** so they install consistently on all devices in the group. Add the required **applications** that should be deployed during Autopilot Device Preparation. ![Autopilot v2 policy](https://techuisitive.com/wp-content/uploads/2024/09/image-18.png)Scroll down to the **Scripts** section under **Configuration settings**. Here, you can assign up to **10 PowerShell scripts** to run automatically during **device deployment**. **Steps:** - Navigate to the **Scripts section** within the policy. - Add the required **PowerShell scripts** that should execute during Autopilot Device Preparation. - Ensure each script is set with a **required assignment** so it runs consistently on all devices in the group. ![Intune device preparation](https://techuisitive.com/wp-content/uploads/2024/09/image-19.png)On the **Assignment** page, assign the policy to the **Windows Autopilot Device Preparation user group**, ensuring that all users who are members of this group automatically receive the **Autopilot Device Preparation policy** during deployment, and then click **Next** to continue with the policy creation process. ![Intune device preparation](https://techuisitive.com/wp-content/uploads/2024/09/image-20-1024x484.png)On the **Review + create** page, carefully review all the configured settings for the **Windows Autopilot Device Preparation policy**, confirm that the details align with your deployment requirements, and then click **Create** to finalize and complete the policy creation process. ![Autopilot v2](https://techuisitive.com/wp-content/uploads/2024/09/image-21-1024x729.png)You can view the details of the **Windows Autopilot Device Preparation policy** by navigating in the **Intune admin center** to **Devices → Enrollment → Device preparation policies**, where all configured policies are listed for review and management. ![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABngAAAIHCAYAAAC8OlKsAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAJkDSURBVHhe7P0JnBXVnf//v7s1EDUNUbsNShNlSWQxgvJnkQQiXyQYzQBpFeM4CqLiHp1gUIkLKkOUkYmOGiMiAv6McesAUUYGGRyIiBDENiKYQGMCToiNGuhoAtHu/zlV595bt+7ee8HryePSt5Zby6lTdeueT51zir7So3u9AAAAAAAAAAAAEBnF7i8AAAAAAAAAAAAiggAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFT1PmYo+vdewAAAAAAAAAAAEQANXgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEEeAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8ERdp3mqm7JZ9X3dcIuZqLrLNqtuxEQ33MZ46bJOdZ3ccN8X9NmUF1TvBgEAAAAAAAAAiLImDfDUj9usz8ZNd0PJ6kesyzitrelcXq4zzzjDDTXEdNVPMWmR8goEHA4AXn5ISQOCLA3R+DwJAAAAAAAAANifUIMnjfd27NDf9/690QXqxUt76qCZgdfS91V/4eamDXTtnKBis+yiKjfc1rz7bHIazDxTRW7SgcoLdl42r6BAV1PlSQAAAAAAAADA/oEATwbLl/+P93fUt77l/W0SVWfqoAVrVHTc2a3QpBqirlnyJAAAAAAAAAAgklo1wOPVZAg23xWq2RJr8i3Y1Jff54vf/0vyuKBQE2kF1paIeWHJEh188MEaMeL/uTFNYOcEFb0r1R2fZl/j2xxryi1TPzf+/nlBonBfM55wE3HB6TnSxuurJjC92ZrVS+xb0r4nbU9snunx450IjGXbx9yaJ2/l2ic3vX+J1HGw13dSoXmzWfIkAAAAAAAAACByWi3AYwvA6/q/7zUv5jfdNVNFh5+dWuB93NnSO26epVtV33+KPpsyRUVrguOuCAUwzGcCzaMVfzRYdQUWpMfYAvUvfOEwffObw9yYJvBBrXR4eXx7vLRQoCkzryk3G7CYq6IttarvMSxp2+tHjFLd7jVSumbZvIDP2apfPzOx/+vfdxNzpI397KijVLQgNv3ZZs8g9njGj69dX8fBZv+Sgyr1/UdJi/x5vKbo0uxjrPm7gmpGNVPeyrxPc1X8sD0e5vib4+fl/YcnFNxkXbPkSQAAAAAAAABApDR9+f1xZydqLgReXq2FmE7zVH9crYoWBPtjmaviRWtU1LGP6oM1Md59NtG/TNVzKtpt/qaMM8vu4wcFvOBHcLpRtDLNcguwaNGv1KnT0Ro4YIAb0zhFu2IBF8NLi60qfvpmN8II7FPRxo2hbZ+o+h4lKtqyMm1goH7YYNWb/S9ePteNMetbfqaKd+aRNl8qU73eV5GZ13ezioLb1RDh/BCuEZS0PWZd61MDWnp3qbf9Men20TZ/V5ymZlRWwXU3Zd7KZ58aqanzJAAAAAAAAAAgWpo+wPNuuFN9/+XVWoixgYTdGwOBBGfnSml3iYq+5IYzKPqg2r1L48iS1KDChYMbVbh+9NFH64jDv6hNmza5MY1TX3qUe2d4QZXufnNd8dcU1Xd0070m3RJBBnUaJnXcqqJgcCNuouoPNwf1nQxBmVxp4wU0/G1JbZqsgcL5IRQwynosneR5Mu9j0Ttbk2pGNURT5K189qmxmjpPAgAAAAAAAACipVX74GkuRcGmu+KvAUm1QPLVubxcY0aP1oIFj6v2r391YxvpyFANnFhzXaFXrIaKDVzEaoDU9+mj+nc3FNysV0z2tPGbELPNihV5zZU1YaBnP9GUeauhmiVPAgAAAAAAAAAipXUCPH+uSd9kmlc7pVb1f3bDDfFB0zWHdeyXv6wzz/i25i+Yr48/+cSNbaS+L6juuEANnExpEVS1QcXePH7zbBlr6Giuij7K0kxZ3mlzs4pm+rWumrppscbLvI/1x3eXPtrR4OBXTk2YtxqqWfIkAAAAAAAAACByWifA45odq7/whUBh+UTVjbF9qyT3t1Iov88as5ykmifTVR/u+yUHW5A+6lvf8mpJ/O1vf3djG6d+3GZ9Nuqo5L6HXLN09WNCHfWPC6aN7cfF/Bl2lvlvjRToAybM6xPmuLOTat7Uj3hBdZ3ySJu+Zp19/bdtWbp99ANntWZapuBX4zVV3vL6YOpY5oby1xx5EgAAAAAAAAAQTa3WRFvR0z1V/G6w75kp0paZKX20FGznBBUvWCO5Jsb81yjVF1Dwf8wxR2vkyNM0//HH9fe/N7wgvW5UbP3+q062P5pwc162WbSZKtLgpH546j94Lqkmig0u6LjuJo0CTbulk2b/63rU+P0d5ZE2wW2u67HRbNuExtWICfdZY16NDiKl249RJjM3d1NpTZC3PIG+jj67LDmwl0lT5UkAAAAAAAAAwP6hqPMxR7dmi1OIrImqu8wPysX6CgIAAAAAAAAAAC2j1WrwAAAAAAAAAAAAoGEI8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIoQ8eAAAAAAAAAACAiKEGDwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEHdSgpmebeH/D6jL9dN184VqccvV0vV9W4sUAhumj0D36kK88eqT6ff0evvrPHjUejHDtGk2+4Qt8b0Ufttryqd3a78Q114oW6fcpF+u6Qo7T95SpxtgMAAAAAAACImqLOxxxd794f2M6Zq7Uzh6vMG9ir1/+jp8663xsA8tbllue1bGIftfeGtmvxBcN07a+9AeRw6ZNVmjq4g/d+z5oZ6nveI957GzSb+sIyXdrbT1X9YZHOP/U6rfaHGmCc5q69W8P9k117181Sz3EP+AMAAAAAAAAAEBFN3ETbpXqiapu2bcvw+v1mbX6rSisXPaH7fjhOQ451H2sLTurigjtWe3Xo4t4CBRj+1S4uuGN1VOlX3Vs0wnD16ZRIVR1epj7ubcP0V5fEya72R3CyAwAAAAAAAIielu2D5+D2an9YB3U5cYhGX3m3nnipSstmXdjIwtom8vDTWrFjr/d2744VevpB7y2QcOwQnfvDe/XEi2tVtfYJXepGBy2Yt1AbXatse95cqDlz/fdojAWa86uN2vOpefvpHm385RzF6vY0zAN6evl2eWf73u1a8TS1dwAAAAAAAABETxM30WZr8EzVEL+VJe35wxa9/3f/va0Vc1T5UWrfvr3aH+xGOXvfeVpXnH6DVrhhoE2a+ISqbhkiL3vvWa0Zfc9vZKABQZmbaAMAAAAAAAAAhDVjDZ49emvBSI08PfYapr4n9FTPr3xHN85foe2BvufbHz9O9z55qWgoCQAAAAAAAAAAILeWbaLNs1FPTZuoYaNnaPWHbpTRYfCluv0cNwAAAAAAAAAAANBK7r33XvXt288NZXfwwQfrJz/5iRtqOa0Q4HH+8IjOn/KitrtBqUxDzrnavU/WZ7zfX8/m32/Ttm3+a3PVWj0f6r9nyH0r49O3/f55TXXjw0bPWZuYb+1cneuNvVvLYuO2LdNd3rhUXQZfqrueXKaqtzYnlmFednuW3ZeuV5YuGv2Dh/T8q6HtX79Mc28ZU3CtJduMVWwZVU/a9Znl3zJXy9YHtmdzlZY9NlWjj/U/k8Q2Mxabr8rvR2b4TU9o5Vtu3Iu3+/PFHDtGk3/2vNZWBZb/+82qemmupo5Ot/Vp0vHEC3XforWqCux/1avP677xGXpfOnaILp3xhJbZNNuc+Iy/3id0V9rPpa63y7/ca9LFjTPH+UJ/RqOPzv3hQ3puVZrlm+362Q+Sj0s8zWPNs1kdhmhq7HPbqvTERDc+Tfqm6qIhk1yezmP9CWn2cfRUzQ2eG3YZL96rC0/0P1GIu16KLXubls20Y/rowln22CfGb0tz3qWIHT+TJ4N53ubLtYse0uS0+Sa71HyfXp9zJutnNq+F0nXz+pV6why/mNR9TaPgvG94n6nUyuD5aF6b36rSysenKrEFAAAAAAAAANqyn//855oz5xGddNJJbkx6Nrjz4IMPqEPHjm5My2m9AI+1fIZWvO3eG+27nxIohLf66Oon1+r5aeM0pHuHpL572ncoU5+K2/XcS/fGAxmr/+NVbfHfmlTtof4/cO+TDNEZx5e599L2dXP0lHufXReNvvN5Pf/kVJ07uIc6HNbejffZ7enRp4cbco4do/teXKb7rjldfTqFtv+IHho+8V6zvKuzF5bncOnjz+m+icPV44jA9rTvoB6nXqr7Kp/QpemCPEGTntC9k4aoy2Fu+ODPuzc2eHCvli29V1eP6qOyDoHlH9xeHboP16X3Pa8nrsmx9SPu1rKnb9foE8vUIbD/HTr10ehpz2nZzOFuTMyFmvvME5p63hD1sGkWTGZvvUN07rSf64lJOYIEZr1zbx5j0sUN276f3NvbX3xed115uk4uT7N8s12jrjGfTdmuJmLyxO0vmHS7yeXptOs3+eKF25VrCw6ZNFfPzbxUw4Pnhl3G8WYdj+Vx7LMarrtefE63V9hj70ZZ8fPu7rTb12X07Xp+sTt+Jk8m9bdl8mXZiafrapNvnp/W1OlrrhWPrTXpcbVG2bwWStf2R3TRCb3zP9MalPdH2H23nzlJXYLno9H+sA7qcmKfRp3rAAAAAAAAAFrO2rVrddVVV2n27NkZgzwHH/w5L7hz8Ofa6bJJl7mxLad1AzzarqXvJurw6Iij1Nu9tS59/OeaPNgFYz7doy0vL9CsybfpgcoNqtnrj27ffYzunO6e6P/DA1q/1X9rpqjP4DQ1gr5xgXqXu/dm/RueXO3eZzd85lzN/Jc+iRocZnu2v7laSysXafHLG7Rla432uG3yDdFdD9+t0ce7gt692/V65QO6bfIsLXh5i2JdEHUw23jvjIY919/+q1dr8jdM+uzZro1rXtTiJau1JZYw1hFDNPmnUzPUBrE6aswlgVopQd+wQY4x6hHb/B0btPint+naf1+gFe/Et15DrrpXd33DDaY4St+eOc4sY69qtm7QCpNWK9Zt155P3WRzjHqcY9aT1DRfez/o8an5zDs2fe0xN2lm9i3Rb5NZ7/fvU/r6XlZ7nfADu143GBILOuwx+7Si8mk9MM3kqSdXaGM87ex23a773H5tXLFQi73jvEXx1P14i7c/3vjKhXr5d258VsN116N368LeiRTfu3OLVi9xeShw7Dr0vjBHv1RH6dSrhqvsIHNe2GNfGdx+wxz7S6eNcwOFO2rEvTrX5N29NVv0+sv+9iX1m9V9nO6eE1q+DarNvFB9YrsXP4b2uG+Jn7P2+PUZf2/uIF3euujSJ8214tQyc+Scj2u0Zd0K7/gsXbNRW3bs0d6/u2m5NCjvD9F9twT23ZyTq5e469WTZv/frNHewOEBAAAAAAAA0PbFgjw/+9nPNHDgQDfWZ4M7D89+2HtvgzuffvoP731LauUAj7R6Z6DUOOicubr0G/HSUq3+9+9o5EU2uGMLTSs08JYVqnFTO3xjnO7yaits14O/3uiNs9off0pKE1lDzumTKDR/e4Xu+bV7n8037tbU7/aIFx7v/cOLuu20vho25nxdPvk6XXtRhUaeNlB9z7zBzSF1uWWqxsaDO1v01FXDdJYNVNggz0Uj9Z25G12woL16nHlVhqa8smt/hEmfrU9rYt9h+s55V+jaq87XyIEjNWNNIk3b9z5dP8oUgOnQR33KpJp1C3TjmK7q2tW8TrP70EVTbwoUcJt1XDG0wivgtgXdE0//jh5525VWt++hb1+Vaes7qMMR5tj9eKQGnlahiSatJo4bpr6XP60t8cLuMg05b7J7b+1V7dsmfc/qqYGn2/S1x9ykmdm3YT8INOl3WHedEmsWLUUX9entH6cZ5w3z96vv+XrETd27fYMeudZsh9mniZNv0Kz5Jk9NnajvnPOIXv/YzWSW0ds1w7V69m261h7nVe8nAjyfva9X7TjvdZseySMfdbllssZ2j+WiPXp99kT1PGWkzr/K5SFz7K6tTASRsvdLZdK2vclXl/fVSHvsJ5vtH3iFFv/BTTbK+pyu0e59oTqYvLVnzQxvm866yN++YX0n6qmt8RRQ2eDvKXHkTJ75QSLP6EOTxpfHjqE97iYPjLpOi+Of76Ahl9zumkdspIl36erBiaDZng2PaOIJAzVy3ETv+Fx+nrl2DO2rgRfFckA2Dc37Y9Q7XmOqRkt/MMwcV3e9mmr2f8xA9TznRr3o5gAAAAAAAAAQDTbIc/nll+vBBx+MB3liwZ1P/7FPV111dasEd6xWD/Dovd3x2ixBl1b0V6whtb1vPqUbZwdq+ljP3KZX44XZPdTf1X7a/th6bYzVEOlwgk5NCgIM0bl9E7UGNq6bE+gDKLPRE4arR6ypqT2rNWv8FVoQKEhP1UVXfbNPPCBU8/IM3bjcDTjb71yk9fHKAGY7x7v3hfh0o566+AatcIO+7XrkvFCg4ruZa0rsffsRnTXuNj31phthHXu1hveOb71e/nHqOmYsWp+ohfTVU0NN6yXUvPxvOj987JbfoNuWJsa1735yIMC1QJefZ9I3uD0xyx/X2zvce3XQUT3d23RqVui2U6/QI2tSj/BtF1VoxuI0R/4Ps7T6d4kAxlFdTnfvmkJynti7YYGu+3Fyqtp0XTx5hl7e6QbNGXDCqDHufartS28L5asVunbxhkQQqqxLw/t8Mek3w+Sj5FRaoRunJQfZTp7k3iflmb16/YlrNSOU5/WHRbrW7HMsMKuyEzSqwr1vhKlnBWqhmXVcVzEjlF8L0CR5v71Kuqc55/6wPZSeAAAAAAAAAKJgw4YNuuKKK3Tvvffqm9881Wu2rXbPHhfciTdZ1eJaP8DT86hE4WzcEPUvT4zd8psZaQpGt+utPyVCQ0d1dSGCP9ym1fHmsjroK0MCBeTHBp6y/3iDVkzLp7i1i0b0CPTZ8+sH9UjW4I41Tl/p5N6qRm/9d7ri5ke0PV7S3UFHNaRzjt+t1m1pt+UBrQ+M73hMpkDFHq1/Lk3anvUVs9dOzVtaEi6ot2bv0PvubbhpvQSz77962r1Ptvp/tyQK+jscpe7ubdyxQ3TuD+/WfY9VatmLy7yO7jf//gmNijevl92Wl2/L0bdSHw2/8nbd9+ATet4s33aKv3nzNl19Uqxwv6kF84RJ9xdnZSjsX6ElG+Mpo7LjMoVoarTlf9M0L/juX9IGTAtV8+ai9On36xXaEsy3sW6ngnlmz3q9+B8Zzq3lL+qtRIRHXQa7tw12qfrE88Revb74uoYHd6wG5/1Fejt+znXQkJtMnl30kCaf03Z63enQoYPWr1+vsWPGujFS+/bttWbNGl1wwQVujG/Fipe9qqcAAAAAAAAAfL/5zW/0/Wuv1cMP/0x19XWaPHlyqwZ3rFYP8Fx49FHunbHnffld6PRRSSDq02fiNm3blvqaGmiWKWjG8kQthrITx8Sbqepy1cmKlUfvfft/NMu9z+50lR7u3mqPtlfl02fPUepwmHurMg2flX77z02JahRmz55EICCsZk8+xfzva/tc9zaoU0m8ponKhuu+NNu+bdu4eFpmtlvvV7q3YZU1Zmo6trP8ldr80hO668pxGn3qSepxfA+vo/ukDvuz2qP3N2cK3nXR6DufV9Xvn9fcH16o0WcMUR+zfNspvtf3T7MJ5gmT7rPd2zQWfxhImcPLM9SOypC2GdO1MLs/XOTehS3S++myVjDP1OyIN4eXKvnzRx2dqe5XvnroqPhl4H3teM69bagG5/3VuvbOYNOD7c2153RdPfN5bVu/THNvGZMIHLWSPeaa8MD9D2jdb9a5MeY6uHevGXe/XnnlFTfG98AD9+t//idddAsAAAAAAAA4MB188MGaMH683njjDX3thBPUt29fN6X1tHKAZ5xOPT4QpNmxMUvBcAH+43+0MdZEWVkPneH1QdNFV50cK5a1NSgecO8L1LoBuaYVD6i1HZc+bjvL7xIP5uzZsUErKhdpwb9fp2sv+Y6eymuDMwSujCEz5mrmv/RRB7f8vTu3aPWSRXrKdqJ/1flJ/Re1CZ/t1V/c2/3R3r1NEY6K2au/5axd14yW36CRo67TIy9v0Z7gdeKIHho+8V49/8LtGu5GtZbH5j2m9957zw35/r8nnlB1dbUb8j333HPatGmzGwIAAAAAAAAObDa48+CDD+iQQw/Vv/zLBbrmmmv08MMP66STTnJztI5WDfB0ueVCDYm3frZXr784I/4+EUgx4+fHOrPP/JpyX7D78ge0ItYRurqo93lDpGMv0Qmx5tlq1mtxhgBAquC2dFCXPoU+h79dS6em3+bga8b/52ZvEl10wtGJwNnej+MNSuUnWDi940XdmGZ7k18z9LibPVl7HRLveD5kUrnidbc+3euaFZuqMfFaWXu0+sfD1HdohSaaddz200VavHyPDsm7Fk86Y3TJaT3iNTS2V05Uz1NG6vyrrtONthP9JfnUzmqo3dobT9ej1CXWd00ao4/o6N4ZH9ZosXvbktoflCmfX6ouiRYLtbfWvamNV12RysoDfSqFjQnUuDGp8n6mmkINkT1d89LYvP+HRZpx0Uj1/cp3dONPX9TGmkS6dOh9ribf0tr1eAAAAAAAAAAU4uCDP+cFd6zLJl2mTz/9h9auXet1cWD74mnNIE+rBXi6/MtDeuL8RKfz+sOLeuB+914LtDHe0Xx7dTm2vRZXLsr6WhrqTP+BFxMdoXc5foz6XNRffVxwIGP/Imkt0Ot/SBTSdhk4NY+n8FcH+tfpovLjX0+7zcHXijfd7AXo0P0UneveJ/nGZJ0UD6zs1faqAgvRf7M90T9Opy7qvT79NideK7TRzZ6si7pflL5A++rT+itezv/eFr1s/07soy6xAM7HW/X67HAza+NUXureNsiQQHBiu97+Zbi3luS+n5rWy9oRz9MddMLwTCGQ4Trj+ECfT1ubMgCSvy49LzFHL41rvq3+8STarq2xJFyxPdGnUIcTdOpE9z5sxOlKdGllPr/EvW2wRdq6w7016dr/9MnptztfTZb3N+qpf79C3xl4hRbHaxWZa1nvTP1hAQAAAAAAAGhrbHDn4dkPe++vuupqL7gTEwvy/OxnP9PAgQPd2JbV8gGeE8fp9sdW6vk7T1eXWHRn7xY9dWdy5+gzfr3R1p3xlH3jav3sXwostp27SOtjJbXdT9YdJ8aaZ9uuV+cVVmg+a8Xb8W1R+em698mrldJ1+olX64nHbncDi7Tw9UT/OH2++5CmjnADTalsuK6aFe7bY7jummbS1g3p47e1Ih44y1PlIr0eC0Yc3Edj/zOfoFZ6fb57n64+0Q04XSY9oUsHxEN72l71tFLqzhxWrq8kpVkXXfrkhTo53o9NYx2l8qGhlJt5u06Nd9ifQ4cu6u81/Zev1Vrw6hb33nx8sMkv14RzUReNnjU1sQ2fbtHqJ5uzVlEWvcfq3vD2HXupnphwUiAo+7qe+rV7/+vHtTrefF4HDbnqiZTjrmPH6L6bhify5tZXtSD2+QYz6fp6IhDY/qRLNTflnDApO/pePfFgHv39NDjv91Gf8P56VuitP7WxZv8AAAAAAAAA5NSuXTsvuPPpP/a54E6w+R+fDfJcfvnlevDBB1slyFPU+Zij6937JnCpnqiaqiHuCf89f9ii9//uv9dhR6nL4e3V/rBEwb5nz0Yt+MF3dFtKf97DdddLD+nc7on592xdrVerahLBliO+rN49u6vjlgc08ILU3nvOfWyt7jrVVRewaW9rh2x9WsNOuyFR2yDubi2Ld56+RU91HakbvfdWF02uXKarTwps+8c12vLb9Xr7//aqpMcQDeldpvZ/eFpdzbI9tjC80qTFEf6gbYas5m2z/VsShb3tj+mh3l/tob3Le2rkFDcyh0ufrNLUeDNmvr07N2r16i2q/XyZen9jiHrEJ+/VlicnauTUQJBg4hOqumWIX3tmz2rN6Ht+2n6PbBDm+ZvcfJbZ343rVmvrh25Y7VXao49OOH6v/qtnMK2C6eh8ukdbfrM6kVYnmrRyk/Sh2Yb+sW2Yqud/f2m8ppX2bNfqX7+uXX836+prPmfywt69Jg+5D295pmsg3bIdv5gxmrv2Xg2P1SDZa/bpVX+fYttlM1ds+XvWzFDf8wKp842HtPLxQPBszxateGmjZNJh36KRutw2+5c1fdPk6R0btH7tH/1jN6C/epTFpplj98wVZv+CYc989jGfedK766VtZtvcgBM/547ooVNO6aP45tkm9O7sq/ODTR2OMOt+0Kw7No857ts3rNeG7XtMXu+jk0/qkfi8DepeZbYtcN4H83Y47bNNs+n6s1VzNSoYnPtwu15/83Xt+DCWdzokfS64r8n5qKF53+z778eo49b1en3jFr31yuva092sd8ApOnVAF5ff92rj7J76zo+9AQAAAAAAAABtmA3a/OMf/9D111+fNrgT1L9/fz3wwAM65ZRT3JiW0aw1eDoc20M9jnev8g6h4M5e1axboGtHpwvuWCt048WztDpREUYdug/RqIoxGh17nXqSenQyy83QL8tTv3or0dySm2fjrx9IE9zJZbtmVVyhBW8HnsQ/rEw9Bp/ubcdwG7AIb8MfHtH5U57Wllg06uD2KjtxeGLbzWvU4D7qckQwTQqzZ80irf5Qat+pj4bbZZ4RDO5INb+epYnB4E4Bts8+X9c9s8XGO3xmf/ucmtj20RWna8iJXdQh6+Zv0VK7jIM7JKeVm+oV8k8JBkBmaNYvA+vs0EVDznDr8groZ2lpvDmuhlik2+asjjfdp/aJfbLbZYN/CzZkqW3x6xl6Md63k9Ghh5fuw088SiVuVHZ+nl6xI7GMDuUnJY5dILizfckMTUwK7rSsLUv9vBs/504NBnds8Om65OCOtfwGTfyPFdoe2z1z3LsM8PP8qMHB4M52LZ0+MSm40zgrdPm/zNCKnYFjc0QXnewdWz/vFKLBed+e48fb9LpQk2fdq9uvHKdR8eCOfz5eQXAHAAAAAAAAiATb/Np1112XM7hjrV+/vsWDO1bLNtG2d6/27Nyi1ZUP6MYxPTVw3G2B/inSsEGSgd/RbU+u1pYPA4W31qd7tdc+pf/yAs36cfBp/oDKRXorECDSpxu1elrh4R3fCt125nd07f0v6vUdewId5ht792j7ukWacbPf0VLc8hs0ctR1emDpRtXsCW1/IC3uf9CNK9hGnV9h0vDNGu2JbY9Jlz07N2rp/dfprAseaUAwK2HFlJEaee0DWmqXH978j/eo5p3VWnz/A8q2+X8xy7hi9ork42fSa8uap3XbuOQaHNaKKRM1Ze5qbQ+ucE+NNlbepn8+7xH9zY1qKFt4/8/TFqVuz8uPaMrFNyQCgmlt14wrb9Aja7Yn0tuw+XD7X9xALiZPTxx6lm6cb9JkZ2o+qnnzRT1w7UgNu2pBo45do+0xefeqR7Ria2Abbd7aulpPTTsrVLMoYfvsiRo27gYteHlLSp7fa4/j0gd07ahhuvz/a+K9s+l6yln+tSKUrna9W8x1Ykam60Qahef99Vq9JnWfvWNq5n1q2ne8WoatekwBAAAAAAAA7FeauIk2NLfsTVW1BQ1vIgytK1uzZQAAAAAAAACAtqVla/AAAAAAAAAAAACg0QjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAipqjzMUfXu/cAAAAAAAAAAACIAGrwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEEeAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQR4AAAAAAAAAAAAIoYADwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEEeAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQR4AAAAAAAAAAAAIoYADwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABETFHnY46ud+9b2STVXniS2i+4Qu3cGDTClx/Se6f2cAO+Di+PVMkf3YB16CR9YmZpv+kJHfSPj91INKuO0/XhmCP1BfI5AAAAAAAAAKARqMGzv3pvlo5+ZpbKfvehDnajUnyunerKx6jm3Ke1+8Rz1EYifQAAAAAAAAAAIAcCPPur+k76xynX6MMuf1XHXz6gw3e78UG7H9AXlpypTov+R0XHT9Ku/zdZdeQIRMBnPR/XrrNf8F8jb9JnbjwAAAAAAAAAHCgozt8vfVn/OOUmfXToBpVVXqzP19a68RnUzlKHygd02KGn64NTJrVeTZ47F+vN375lXq9qzgVuXBOattgse/EdbgiR1q5Eez/ZqJI//lV7Dz3MjBijv3/9If21wNcn5Sf5y2tJFzyqV5opjwMAAAAAAAA4cBwQAZ7xc191gYPE65W5E9zU/dDR1+svXXbqiP++WQd5VRs+0sF/3KLPZetm57NFOvS/F6l9lzH6+GhbYJ6vO7QwlLYNSl9b6D22TGtnnqATv3aKLnncjUdO6fJ3cwXJ2pTPH61/HNHeDbScA+56AgAAAAAAALQIW9acvVzTL5vj4emY/TzA4wcfJpcu04lfs4ED95r5mlTazc3TTLzaKIs1zQ22nEH628m9dHDVbLXb50Zpg9ptuEKf/8ANZrLvAX2h6q/affL1qnOj8lW9MJS+A64vrND7q2UqUY12ENhpmNrXNCuYx9tMkMw/Bxfe6QabSNGHb6njn/9q9vtP6vjHP6pIi/T5V67QFwp8Hbpjg1tiPlrxetIWHTdWl130dZW6wdxK9fWLLteY49wgAAAAAAAA4HitL/22QrlK2eZPPCW57NOWw69+VOPd4IFmPw7wTNCc1RUqW3ePThx9qxvnPH6xvh4et7845P9p7+F/1KFbXnMjClO8ZZVKDj9Jf+/oRjSESd/Z62pVciAWeqNFFP/5CR36+mz/9faLLXAhO0CvJ9m895r++KVxmnJ5PkGeUn398ht09pf+qLXvuVEAAAAAAACAYWvlVJTaB9grVe3GIT/7b4DnzgoNLKnWsonz3IgMYjVtYv2/BKJ9ftQw9gpX+wo3TZaoreN9bqwNbnRTRWia3/9G4HNN3SdMpx76eNcWfe4fbrhQ/3hF7XYdpk+PKKSZtlRdS0vcu5hQeoXTOZhe3jRboG6bvrrD+2s/E68FkiMNk49bau2R5Ca2WqOWVctJV2XRH+f2O17TLPn4pNa+8o9HIt3C6ZrmeL1gl+1H3buNTfeZhvus14/1p4rp+nD0TP3p9En6TEeo/pCTVFfo63N55vN8ryee8LUhj2ql4etAuJ+e8HXKvtw5lJSfk55WiB2TCcnnRNI8RnCZ9pXvNekff9J/zbpLK76YK8jjgjtfXKGZs5boTw29NgEAAAAAAGC/5NXKGXKx5rvhrOLlmYFy5ZJBmhwq10ouIw6WAftldwvvDJbh+dOTytmSyshC5X35lp+1gBYL8NSVT0/byXniNVT7dLQ+STst8cq3U/Rpfc2B3fZG4MBl000Vfd/wm1tyGclmgApVJpphWlijgVMSBa7j5/bTLq+/GP9Vuc0swxWcThtt57exxmpVetNH+9thC22n9Nam+Ofu0drSiibNEJ+VHCn97YNGHNgNKv6b9Kk5KRrMnGQVXWu19plYrQZ7AlRIgWbcKneZky5TegVO5pIBI6WH/M+MvcWMyJGG9iT0o71uurfcgK4VmqSHE5+tNcetOU/IQ05SvXubUfFJqmvn3jcxe3Gs3Faigee4fTTpN2mAtHamy5MeG1jrpzdiaZbSxJ49ftdr4K7A+WDmKRubGghKOl5njjZ//ah7rAk/7xg2lR2LVPrqFjdwtv56zkz9qcDXX3rll8/zvp54gRlX0yeWVt61oymCW4HrlE1X98WVaDLOHzcp5Zhcr35VblvC89jtjfd95ab7U/Jjgzx33ZklyJMI7vzbXQR3AAAAAAAA0HTi5cqx7itcKzvhsv1Z68riZfcx3cbGykNdGXGwnG3ma6rtWuHK8wIt+8Tm3+Utok3Yj5toM8d1V75FlcFghHHBoxrZtVqVwWaXbqk0B7pEvYb7BaPzJ45O6uNkWpVZV0mZurrhdKadM0ha93Dgc/N0yXLzua798gxEtV2xGhreyyuETrSDOH7uSHXbVplUuD/tGXOSlPTW0Cw1GzzbliWnc4409GoO7XovEe29ZXRyUMGc7LPjtTCaO/0H6e/DZ2rXNydlDvIUn66/nzZd7w+dnDsQlE0sSh17BS5YXlp3Hak5F5iL0RXh9LNM/g8GfGJN7PUc6i3DO372Ihk8H0LzxIWOV7M69hy9d2oPNzBbJQtGqnOBryPe/B/3+dzyuZ7Y/Fli8vrXgzV9TB6s3GbOkb6NDSQGr0m36pcm/dONSz0mwXMvNE9K31e3amzwOOdlV4YgT3Jwpw197wEAAAAAAGB/laZsf/7EZaoOlUVXL4yVh7oy4mA52+MXa9k2qaxz4kHqmvcCZcoTCy0/az4tFuAp3nFz2k7OE69Vaqc/6dC00xKvQjpFz78PmFDn/l6hpx+1ixeY2xoMoVbHkqpseU2MZTNB5aX+0/SJZebzucIcVPuBdMiRqnPDhbNNV0kH1xbWh0+shoYXMY1HN31e0MWMS9rvKYNMGueWXKieOw39YIZdV4ZmsYLBn2b3mj7/0mwdVnJO+iCPF9y5Rn/53FqVrZilIje6QWJR6tgrWKXRC8ZIA6eYPGy2KRHgignlf2P+ezXxgKU9frWbV6Wk2/wVb6s2FNTMP6jaOAdtuklHPzPFf704Wwe58c0p9/XEz5/VVakXeC8AXNo5OfDSFGprZL5rssp6TLzAtX+tS22WrxCBIM8lJ+sQ8++kSwjuAAAAAAAAoIWlLdu33UiUqPSrbp50MpazzdOqzbV+BYdw1wdtwH5bg2fbrtrGFaiGC8zdy38y329zb3LPtzM3BZZBPBCS9Ao2l9VIH/5Jh5T20D8+54YL9bmva1/pxzr4w4/diALdMlqz1pkMPyI5s9cGm6yKvxK1fAqRNQ1th/d22DWLlav/k2a37xkd+t8/1yFHnKMPvh4I8gSDO/91uw5qeEQuL17AZj/yWfep+vDM6f5r2Pn6zI1vLo2+nrRZ83TJEHv+VKrGBU4bHuhxQZ7S8Zox8y5dWEpwBwAAAAAAAK2h2nWdkvxqaPcRXh9B5vNetyONKj9revttgMevXTBI321Ivxe/q8nefNid/dTNZpJ8O37yzNOOXU3RTFMOu3+lQz76sj7p0bA+dOp6DFXtRxv0+d1uRAP4Vd4S/XzYwvGUZqMapIA0vMX2/2LbT0w0q9dq9j2mL7zwc33+qHP0wTe+ojrb11QLBne8gKTXz4pJD6X20ZJOsM+ZTMdv/PDeKsmjBkmzaFeivZ9sVMkf/6q9hx5mRozR39P02ZXrlW+fXvldTzLnTy89s9UeCwePvCcNWtKtGmu+pGxwtnHnqh/kWfTrhQR3AAAAAAAA0PJs2b7KVN4MD/17ff54/ZdXNF2FjUbaf/vgsTU5FlZ7VadSImq2Y/FsHes/vkqbaks08IrkWijTFi/2D1xKJrEF6KHmm9JkJK+ZplDzZXZbFjZpxO81HfL6Jn3ad5L2Fdpxf7ur9de+X1DH1+9pZMa4VWNN2pcMuMyrPRMrHE8OLJg0y3YMMsiVhvFj1NbEgjztjtBeHaa/t9vQQsEdvxOwbl7fOH57krHjktAtuZOxOxeromuiqbFYwG5y8HiZNJ80oETVy3MFOatlK78E26tsMp8/Wv84or0baGZ5Xk9iTQQmzeOlZ6ifr4DU4FGa60lzMduWdC41iV16efEKgjsAAAAAAABoGcFuJLz+c8Jl+xM0Z3FDm1cLlWO3+IPZ2e2/AR7Lq8WRaHoo/prSW5syFLb6bLNFfm2HYMf1I3dVxpsB8/s0iU3rpzfCTbTFMpI3jws62O1xhcSJbSnTGyl9ojTSnx5Sxz910offmq7P8u2c5KAx+uRbY7T3T4t02J8a2DxbkNe3hzuRbOG4F9kMHoeR2pX1GGSQMw2D7Ster16b70nu8L41eUGeZ9TxvV+rbMnNTRvcsQGY+H77LxtkmLbY9h0V6CDMpF+lly+DgTAzfXlZ4vNju3nN4AU75h9rzqPqYD9K9hyamU+1xlhQyT/2TRVMKPrwLXX881+l2j+p4x//qCIt0ufT9NmV61VIn155XU/S5fWxUmW25gi964lrx9P7jLmemGXUusnNLXguTbbNThZUMxEAAAAAAABoRYE+pt+MPYQ9Oly2f71Kqxpa5lWtXaWBclGvrK8Ju1xppKLOxxyd0vd765ik2gtPUvsFV6jQiidIo/gb2nvqTfroyJ364os/1OdrP3QT0iiZrD2nn669H7yoI1+epeJmr1WCNuPOxW3uogQAAAAAAAAAyI0Az36tlz49car+cmIn6cMtOnTT/6j9zi0q8qYdprpOp+vvvU7SX4+QDnlznjq8+YybhibT7iTV5VOL6tPfqfgfTVBzqlAEeAAAAAAAAAAgkgjwHAg+d7r29RqjT7p+WXtL2ulT2zBfndS+dqc+v22VDtn0hA5qjeDCAWDfN5ep5lg3kMUhb/xYR7z5P26oBRHgAQAAAAAAAIBIakMBHgAtjgAPAAAAAAAAAEQSAR4AAAAAAAAAAICIsY11AQAAAAAAAAAAIEII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQR4AAAAAAAAAAAAIoYADwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBR1Puboeve+UTp0/KJ7BwAAAAAAAAAAgFz27P6Le1e4JgvwAAAAAAAAAAAAoGXQRBsAAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQR4AAAAAAAAAAAAIoYADwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEEeAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACImKLOxxxd7943Su/evTXu3O+pU6dObgwANK+dO3fq6ad+obffftuNAQAAAAAAAIADQ5MFeKbdfocW/rJSb7zxhhsDAM2rX79+GvvdCk277VY3BgAAAAAAAAAODE3WRJutuUNwB0BLstccag0CAAAAAAAAOBDRBw8AAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIafsBnoP+n/YOflwfnrtM713ov2rOfFSfdP9/bgYAaALtzlf9iBdUd0WVPrt+sz6bYl7mb93FL6l+8HVmupsPAAAAAAAAANqANh3gqT9qpj763k2qLfmTDlt+u45+Zop53a7Df/+x9p58k3aeOV2fHeRmBoAGKZf6vaC679+iuu5mcO1jKn7keh30sHk9cq+Kf79L9X0v12ffX6f6E77jfwQAAAAAAAAAWlnbDfAcPl1/+VYfHbx6ikqXTVH7Xb9W8d82mNevdfDvvq/Dn7tdh//tJNV8+zZ95j4CAIX5pvTtX6rumx2kxdfroNlnqnj9vSra/bzkvX4mrfyeih/+ropXvK/60/9Ndd+Y6D4LAAAAAAAAAK2njQZ4Bunvgwap/q37VbJtgxsXUvdrtX95njq0+4Y+7v5lNzKivn2jfvbwjfq2GwTQQgbeorqvvq+ieeep+HfPu5HpbFLR+jNV/PMNKhp8repPGOzGAwAAAAAAAEDraJsBnpLT9bfSP+qwjS+6ERnUPaND3typ2q+crzo3Kh/HX/Tv+tnDswOvf9fFvdxEAAeG9veobliZipbfqaLdO9xIp+N01Z/1n24g4P8mqGhljeqHXReFHswAAAAAAAAA7MfaZhHl4Z30Se2fdPA/3HAWRTV/0CGlX867mbZv3zhb/9rrHf3kskm63L1+suYDNxXAAcPWEnz/f1X01ho3Ik9rn1WR+qnuZGrxAAAAAAAAAGg9+8cz6GYv6t3b7M7Q17ru1rrH5ugdN8Z657G79OgmNwDgAPAd1XcvU9Hmn7vhkNrnVfTSc24g7GfmolErHfsdNwwAAAAAAAAALa9tBng+qVX7Qzrk1+zaFzro09oPdJAbzK2jjh/c073PoNclmhlswu3GM9wEX7iJt5kXBZbnffbfdfG3Y8sI9K3j9bWT+NzPZl6i490kT2i9U+iUB2gmg6Uja6U/Zqi9c9TlqrtsSsbAcdGu91VfWp5nYBkAAAAAAAAAml7bDPDsekOH1HfX37/8ZTciky9r7/G9dNAf1+UZ4FmimQur1WHwD1KCNnE2yHLd8Xrn3lgTbv+hdUeMDcx/hsZ8aUW8ebfL710rmeUlB2M6asBw6VFvnrv0X2aMFxQae6TWBZf7oT+3r5vGXBT7jG02bre6jQ0EhwA0rf2j/iIAAAAAAACAA1QbLeL8uQ5d/6E+PuUm7WvnRqVR/+WbtOeoP6rkt4vcmDz81126/LKFqu461q8pEwr0fHvMQGnNo4Em2zbr0RXVUtcTXbBliWbetcR759n0a72zWyrtlFwrqHpFsBm4MzRmcEdVL/xh8nLvCs6T3HTcO4+tULW66WtEeIBmsEfaZ/4Q5AEAAAAAAAAQUW23eHPfX3VQ+x6q+e7j+uToQW6kc9Ag/ePEx7Vr2BE67H/uUTtbUFuQJZrp1ZSJBXpiNWV66pgj5NfwCTSV9rOx3bypCWdoSnz6DzSgoxsdt1sfvOveWr2OUamq9VtblSejD/R/9AMEtJC3zWlaInVrYD86x5RLO99WkRsEAAAAAAAAgJbWJgM89V9+SB8M/bI+//LN6vSbv2rvqdO187wXtOts/7Xz/On68Ni/quPCiTr0/cZERWyg5z+0bnc3DQ/0o1O9MNaMWvAVaGrt4bFSfB77ef9zAKLieRX9vkb1x/+TGy5A8S3mc+1V/LufuxEAAAAAAAAA0PLaXIAnFtxpv+p6lfzxNR209Qod/uS5+tLz89Rh/X+pZM08lf3CDP/qCrX768fuU42xWf/3odThS7aWjv++W98M/fOop77Rq6P2rPkPzcxaGydk0/9pF82tAW3L6l+p+AvfVF2/b7oRAR+tVPHyZWlq6JRLw0er/m9rzHm9w40DAAAAAAAAgJbXpgI8ycGdYM2cD1VU+4zabXtA7Xc8o4P2fejGF+oMTQn1uaNel2h4V6m6yu9X57+qbH87YzUlGIwx80zxavgEg0G+4y+6OE0TbWFLtGjNbnUb+++6uJcbpZ66+MZLdLwbAtDC6maq6OWt0mn3qO7L8RPTt3eutP5eNxDQ92HVnWT+/upmmmcDAAAAAAAA0KraTIAnc3CniXl97gT617nueL1z76REjZz/ukuXL6xWt7HBeUr128c2u8mxfnv8aRdrRV5NtL3z2A/1kzXSgOtiy/2Bjv/zr/WOmw6gFVRdpuI1f5fGLVB9//PdyDSKvyONWKW6keUqWna9iv+P2jsAAAAAAAAAWldR52OOrnfvG8UGLWyfNA3RYsEdAPudxlx74rrPU90Zg6XP1aqo6lVp22sq+mC31OlU1R/XT+pTrrqPt6r4l9erqFH9fgEAAAAAAABA02j1Gjz1nf9THxLcAdCatk5Q8YMTVPTC69LRp6j+zCmqu/DfVPetb6q+4y5p4c066OEzCe4AAAAAAAAAaDNaOcBzkT4e9mW1f5ngDoBWVrdGRe9cpqL/b4CK7+/rXub9099TUfWzbiYAAAAAAAAAaBtaOcDzmL7w5Fh94T2COwAAAAAAAAAAAPlq9SbaAAAAAAAAAAAAUBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDFNFuDZuXOn+vXr54YAoPnZa4699gAAAAAAAADAgaao8zFH17v3jdK7d2+NO/d76tSpkxsDAM3LBneefuoXevvtt90YAAAAAAAAADgwNFmABwAAAAAAAAAAAC2DPngAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEEeAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQR4AAAAAAAAAAAAIoYADwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEEeAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQdWgOfOxXrzt2+Z16uac9+jesW8X3inm7Y/8fbT7OMFbrihLrBp1ATLOeBM0JzVJp8tviNp+JW5E9xwc2vi9Xn5YD89V1rYtMUmX6x+VOPdcMtqpnzoXW8Wa5obhBH8rtnfrp/NdT1oS983oTzd4udtC6aFt2/x76pWEN7XVrieNEsacF1sJuH7q/1ZS987ZtJWtqM1FJjfWvJ7rBHfU617L3rgaNHv1+a6NztQeOdTPufugfQddKCaqLrLNqtuxEQ3HHGd5qluymbV93XDDbafpUsLqh+3WZ9dNk/13lDLp6O3/nHT3VAjNVl+QnNp/QCPuyHxC8PcqzluOu16xpZp7cwTdOLXTtElv3Hj26IsN2kZb8rzvjHZP3jpQOEJgLYm/F3zuBsPAAAAAAWZrnoKVQ9QfkAgbQF93xf02ZR1quvkhuP8/HKgBGO8AMaUF1wABTiwtWqAxyukn1KmZV+zBWGx1z1aqzJ1dfM0ma+WqUQ12hErbHv8Yn3drG/sLW64LXl8lTbVSmWdw0/L3aF+NmFKemtoKJAzvnOZVPu2Vtn9u2X0/l2weMGjGtm1VrW13dSvoU8qNevTtfN0yRCTl0ff6oYbZvzcV9vGE3Zt+Vxpw9Idv2mjTb4YcrHmu2G0NU3wpHL4u2Z/cwBeD5r1vG2276I7tDDDgyJAYVqgBkfa8yDdepvm/mp/0WbuE/cL0c5vhXxPcS+6H2rQvVnjr+37zTUo77ITvoPQxLwgTbbgxFwVbamVDi9Pmaf++O7m/xKpTyiQ08nOaz6zca60c4KKZ/ZUUZWbtr/pNE/1x9WqaLdJi4YGQHMeg8YperqnDnp4gorccEPUj1gXqAXUivb3/LQfaLUAj70hqCh9TbO+Njr0g85+cYbHHWjmadXmWpX0HJp8w3RnP3UzF+va2hL1Gh68GZugoT1LVLt51QFxsz5+eG+VbFum2SaNuo3ghy0AAAAAAAD2H0UbN6qoYx/VJ9XUmS4dZ6btrlV9j2FJBf/1fcy8u81ndroR+zFvX99d6gXB6ga3gQAI0MpaKcBzh747oETVy/N5esh/uiTYhFvyE6mJp0/8ZrvcK/A0iTd+bDfzrpsqYtO8ZtDCTZr5T7zGl7H4Dv+z8XZW7fTUZtCS5okt906/mbXgE4neUy6B5Wd7snb+ezUpNXW8WjrblmnZLjOp1O6Pc8FQ9Sqp1aYV8/zh8JOQsWHX9Fum9Sdvn9mHr7oJSUJpFEyPdGnqrTt5nLeepPQKLC/nU0B+MKu66lbNn7hM1Sm1mfz8kHbf3LJT8kPSU6NZ9s+K72MoXya1xZvPE1HZ8rU/bbI5R1QySJPt9GzpEkrDV+YG8kZcaL/iy8u0rf783jalO65Z0ynTutKLnz9eXol9LrS+WB6OzRNYpvf5DJ/La9lG8jJC+SfTujPm3czHL749QUnbFlyOE1t/aH3hPJ4ir3zRNOmXIts+xfbHDcYkztFYnrwj6Rzx9zc5b6WkQfiYBNM6no+TlxHP+9706zXQHrYB1ydPC+9P+Bg6XnqFv2vS7E9iu7OdR0Zsm+PfJ/bl0i5pm1LTMyxrHk8n0z7H09EfjB/PUNqHl5/y/eLtU2h/w0LLzJTuvsS1LHldadImvG/hcy4k3XmbvA43PZYWbp6Y4PdPUEp+SflshrzqZDym3nZUmKWaJY8NTcskKU2Sj4u3/eG0b6p8kPY+IyRHPigsb4fOuQx5KnmZyekRzw9Z0iytpPnNq6Wui+F9TsqLifMmaZ9j83hpn+G6mMJfVnwZ6fJRfFpiO731hs+DjOtNbK8nng+znyvpjnv8OMaEj0+GvJFOcn4JHYM8z41wPs/0ne3z0yHbfUZsm2JpEU7/1DQKH790eckXW3Z8eoFpl5xeoXMnlA7B/Jo1ncOfC25DrnziTc8jvxm50zGbxPKSl5N67me9XqQRO+5B4W2NTc9n3uRjH84beVzvnKzpFT8uoeUnbVueaZYl3+SS3zYWfo3JKcc25zp+sfPB25b4dnqzBL5TCs3zRl7ns39cMv9WDaVHzjyT33FOu++ecB4N5uHEspP52+jNF08vJ+OxSbesbOu2Ep+JbXfyMpuG30xV7BVutstvsisxPbm2QqyPjtgyvKa9vL427HKSP5u92a9Y/yLT/WbF3Gf8puWSl5Pa3Fx4G0P7ENuevn4fIMF98Go3BD6bqym78PyZ9il5vjQ1PLyaH4nlhGtYeJ8PN60WT1eX7qNsLZzuKfuUZOcOFYVr6ni1dLaqaM37UscyN9KaqPoeJSrastKvMRJYnydWW8Ubn9j2lDQLTa8bke6exDUfF5gvsZx0fc34xzhpnLcet9+hdeauseLva/E7N6to+VIVpwTBGnsMsu2fldjHbHkldn5llkc69jfHv+NgfxuzpkvoPMqw3ti57r8S+SP9tgaOZSDtErKdu6FpbaEW0n6udQI8Xk2Uar2Rsxqx/eI1Nx+7KhNNuM18TWVjU7+k7c1Jvyo3z9cqVW1uNia5ebyq6AurzbtqVdrpaaul23VVqGzdPfF1zdo1UhUNaiuuRANHSLO95fi1kezNyuSeb2uWW3ZsP5JvAAJuecNsbYlK44UficDGtCqzL137JW5C8moSyPxwviK2TWbf1tWq29jEjYy3fQNq/PTxXstUOnaQ/SpJ8G52ktPoxIU1GjjF7YfXtFxy7aJpfe2XQXCcq220yx4Pk+ZTBqlmYWyd92jtLn+ujO6sMDejsbxzq97YZtL6nDxuogNS8kOsFlmu/Ysz65xymfSQm8fmt64V+d3Me3Lla7/6tz1GqrW13Mz0TE0p2G1OSsMTtKzUppGb7vHztgLzVO4yN+PejWX62mLj545UN7PuX6Y7R9Ok06x1NW5itnVlYdOv7xuB5cmkcfjHgMnDsXlcetgb5QoF0tE7XqHP5Vq22Z9+u4LHvNqcG3ms+5xg85K2aUmzn14eyP/4eT9i4v21+C8vvVJ+7Gc/f1PklS+aKP1Ccu6Td20LN6+YWguxZMDI+Dnm76/9QTRSu9xyU9LA2+fe2hRfrzkmZp+Tz0t77vbTG2677LEuGXCZvy9e8xbmM/awubz99Ynz/OUm7Y853/2Fpcj2XRPcH68JjTTnUcbrTfz7xG6fKwQdUeO+T9y4bNefvPJ4QAH77MueP/P6fgnL63imsvcCk/Sw+4zJe9tseiVvS37nXGb2vEneH5c+eebtmIzfRZ4sedXKdky9pkb8bap214CszbYUeI5n1vL5wC7Trw3upnvpmUl+93n71XUxz+/kjPfQma6LaUxbnHxfk7gvcMc+wz1w2vOggPXmPFfyOe4FX/MCsp2LcdnPDT+f5/7OTshxn2HyZ+x4+ul2h75buiy+bJv+Msc88V1j0yh0X5rhXPLOua7+sYp/lxWQdtnPL7MdGX4XZD3Xc1wnfA34/k+RKx3z06rfU2lkOz+tbOd2dvmklz0uuX9TZU+zzPkmt3y3sZHXmBTZtznn8Us5x9OxaRTYbrdv3m/NRt/zZrkG2WXkdX+bKte54Ulzfcv1u7qw37qF5Kdc607I+D3bBGyhbJ2e1UEze/qvpe+r/sJAoe2Ik1S/wE0zr+J3u6suXNB63NnSO2768rluZIlZzklSfLlbVd//ilDhbqr6/qOkRW5Z62tVN8oW7o6Kb4M/LlAI7hUan6369TP99XjrsvsQLlA32zNYKvLmOdMLYNiC9boeG71mo7zPLVijerO+lIBF3HTpyKWJ9Zj51X9Kyvz1dpweis/npVmg4N4r0B91lIqC6fqRLYBPLtzPxmu6y6SptNVtv79PqW6W3jXrPDIRZPFrrmxQUdUGFSvYPFk3FXU0y94VO4bpmH0ZE0vHDMfjwsEqWprYt6IjzfExy02wBfcmjT4K5DuX9n4Ax29aLql2Ud+TTD412x4Y5+3HbvudYpaXtM6ZKvrInyejvmeZbTLp5zUXZtPI5I9h2QIpqTIfg1z7l5Arr2SXOx2LH/aPkXav8bcxY3NvdlnJ51HxB6NUd5yb7GS7XhS9Y9LiOHO9cPN6XDoXxa8LAWnO3eL177uJ/vYokI+8c4QgT7NqvT54amu0zb3NJPbFOyvYzqm5IZltbiZSmi/bVhkowLhVv0w3Txaxdc0O3CTNn3iKubFwAwVKrp1kayxJax8KjDP7scwsu1vfTIVVNngRmO5q6ez6nXkfKgjwgijb3shx01+btH6v9kt8GXb7SlS9MFi4dKvGmhsUcymJm3bOIJWYdE66kbxltJdG/na6G6h47SLbZ1CtqrcFx3VTaay20QWdVWbW4O2Tx9wsjg6mW6rwvqYEuxoh9/4lVC8MttNr0sr+0MxzOwrK1znEtjlYeDdttH/DHuOtLzzPM+bYutpP81e8HX/vy1wgaaVLp/kTR3vpkWtdGYXSY/7Eh80+hJsiNHn4mUCamR8QI20hQzAdb6lM/VyuZZu0H5t0zMPBVSu0bmPa6OD54ud9lXYu4PjFzrvkNp+njbY/psIFfdnO31T55IsmS78k+eyTf31OOqe861u1lgWOQ+26h+PL8Pc33bjAddDsswLTvevJ8tTzMuk6l25/w1IC6OZ8D6ZZvrYtS06TvK83wWPv9induGzXn7zyeEDB+5wtf+b3/RKW7/FMEUrT5LxXyDmXgXfemP2dGdofL33yy9v5yppXCz2m2RR0jmfT8vmga2mJtOu9+DrtORS87gXldZ+3n10X8/5OTpqn8Htoe99QXmq2xXt4xxe7L/D3v9B74MJkO1fyOu6Nuc7new+R8dzw83nO7+xCmP1NLrQM7U+or89YGgXzdLpzyQsE2GMZvP4Vkna5zq8svwuynevN9v2fIns65q1Vv6fCcp2f2c7tXPJLr+R9NZ9J95sqW5o14PdkQr7b2MhrTFi2bc7n+KWc4+mElmGOa87fmk1wz5v//W0aWc8NJ7Tvaa9foX0t6LduAfkpn3XHJV3jG/I9m0Gneao/bquKn77ZjTCqnlPRbnPNdDU+ipafqeJAc11eIW5SrQ9j9xpXUJ6seGkg6BBabiZF6x+Kr8+rWZF2XCIoUT9ssOrffTYQWDKqzDa/K9Udn1xgX7wmWLhtpvU3y1sUGLfTvE/zuYSbVRRMq50rzb6bbSgN7VNoe4qeNsPxbbbrLTFpMyA5XZPmaVrJBe+uls4H9rrsB3/i++sFUWJBj0xqk9Is0/EI9rNS9PRMc+zdgFE/YpTqbMAhKS3NMtcngjp+03KJfGb7DCp6d2vSOB3pahu5foPq/+zG28DG08Fjncrrg8gGudxw2uBEA+Wzf3FZ80p2Ba0nh9iygoGYouUmj5r8EZfrepESMExN56B0527seuNtTzgfrTTbl6amFZpO6wV4SsqUq3KMvZlP98Xrf0knfz5449kQmdbVMMGbAsO7UbBP/7gque6Vq3ZQMHjh9TtT+7ZWeTdcfvDHv/m0QRRz41mV6+YreLMW4m1frhpV/g1+uvV42+kKtr2m5WI35Xa5Zpt/+Yw5XrFxtvZWbD+8HxAuXXI8le3zA0ZJBe2hYFfD5bd/vtDxtX5XY8aWqTxbEMMpJF9nl3mbg7wfxfZpuEDee3OKufl202PHIf4jN2uBZPZ15lxXJsEf7Z552rHLXCaCTRGG87D3I8Q+2RVYl32KKryyfJZtfkwlquL7TRslS3/+2CfsYuv2mikoRMbzLnh+x2Q5f1Pkly+aNP1i8twnL68Hfrz7/WrlClKbVHgvXZ60/H22T8cl9sW8vGZ/gtKcu7l4P+T9dAo/jVeI5O+oQq436RSSH5yceTyg4H1u7PdLWL7HM1XqvUC1dsUKawo65zKw5038uzhVQ/N2qjzyaiHHNJtCzvGsWj4feMEK7zsnd42jvO7z9qvrYv7fyY29h7b7bwvU/WMVetra2//C74Hzl/1cyeu4N/Y638B7CF+e39mFSMmfln3SPLaNyXk6rzTqeZkL7iQHHgpKu1znV5bfBZnP9Wb8/k8rczrmq7W/p5LkPD+znNt5yZVe+f2myppmBf+eDGvANgbkdf6EZdvmfI5f2nM8LPW64zcBn+W3ZqPveRt3f5v1OMeE9j1T+if9ri7kt24B+SmvdTuN/57N4EtlqleseanYa0qotoUtbA00IeU1SRXykW0GLCxY4N44mWuUTFT94fKa2QrzCuwPtwX/MaHt8YICtpZRcN83p9RYSGVrFsTmT00ryw+eBFWrPhYIcs2jpQZRzD7YmjbhYFFTCBa8dxomdTQnxkY/TYPplK0wPuH9LP3zZD4eSWKBGTcYkxTU8ZqWiwUL7HLNNq98TtodGzddOs7thxeYc8cya3NmMf5ni1YGAxWpwYkGy2f/nKx5JZcC1pNThmUlyXm9MOlpa3TFA6Rp0jkuR14x22NrBibWY14XDg6cz2gOrRPgKaAwfP/hN2cQr74be2V7KiYQvAjfQGwzdzveUx/ejXlT/WhpAoFttoUTstvsPQ3lj7M1cIL74TXNYas+26YU7I11lhsp7ymZlB8hrp+BEU3bju3+Jlb9PvmV+JFub7pjTxE1vEDSl2tdTco+NZWyrmzNFaTygjRJTXvYp8VycIU5wWZGvGYKoqYJ0q9BAtcE+2NwaE+l1JBqiOpA8zaJV/AJyIaY5zVDYfNFjStAakygpzUUnsfbxj43z/FsZs2Ut8MadN2KqKz54HHbzIwZds2/FNI3REb72XWxxb6Tb7FNA9rvwjJXgB8sDG7APXCLavg1Lwrnotfkl7lfTjTVV3jtIFvmbX55pKklWGDa5Ti/Mv4uyHGut8T3RVOkY9uU4/zMem5n1pLpVcjvyaDWPKYN3ebmFf173kwK+a3bNo9NFrYGgGsCKfjyn6r3gxlJzZh5TVLtL2JNa4VewRoKAX6gK9hsVHLNlLbL7E+spo4tpN+9MRGk+XONqxXhF7inBhxaS2CbbVBKdpv9ptu8cba2UWA/vObS7PE43AUFsgR6vNohKcG9s70m4OoG0wRYVlmvFy64FKsJFTpGhSoKNrsYfyXXfEPTap0Aj/cjtiRn3ynxIIYbjvG+lPNo4q1Qqevyn0JJFv5xk26ekMffU40LehQm9tTKo17NFa9ZM8d/MqS3vnuOTYs8n9LKKs32eU/axfhPp6arWu01mxZ/mib2hNkdXuGEv81+81V2XHlp8n743M1k1mbOXFXqdAUV9nOh5kbCT7jZAFl2+e5fen6ezO84NHW+Tt1m2wyee2tkWl8SG5jz0tBP58xPkmZOJyuvdeUlj5ppNlAcbmYmL8Flu/ehpjBy8Y9VqEp+oTJeF/xtyvZUdj5y5YumSb+QvPfJnPPLq/1ttE/RqbHXsOz5smncqrHmemMDeY3P44273hSmYXnc11T7nOv7JawJj6f3lKb73mmKcy7nedPUeTudxhzTfKQ5x8NP3WY9fpk0Yz7wCiBtwVz2JpdS83HoHm6/ui425Xdy/mzTRH6Qw+1zg++Bm07O4x5X6DWv6c7F1Hwe+s5usMT9c7jJtZh88knt5of1dXO/bft9St+PRh5pl/f5leV3Qcq53hLf/1budGywFv+eCijg/Ew5t7NqeHrl9ZsqmGZx+fyeDGq6Y5r/NSYszTY3+Hsot3BT55k19P6vie9v0x7nZHn/rs77t25M7vyU97qbU7xw3w2HuSa7ijP229Ha5np9rSRqDCR4tVHS1ixykmqI5GOi37TZ+plJzUblJVhrJuN6zT4cp+TaSkk1kAyvBkUDfWDWb5ZXZ5s6C9bU8JqZMzcMw85KqtnTGKnHw+/bJ85sS7omxOrjfer44rWLzHi5bfYCCHZc6VFpapz4fc54QciMza0ljmNK8MB+Lnw+NOQY5Ll/aYVqWGXVmPWkkbosP+gXl+t6YXn5yc/fXrN6GWsFZT53PRn2Dc2rlZpos1+Y5gbRVrVP6Xx9guas9p8M8tqoLhnkOi53LnhUk2zbxEl93DSe3yZ5cmd34+deFqqm7QcvgrVFUudJx30uqeNb+9nFOZ40jXUK2Ftl5vY7qZq1C5J162puTNNUDS6IVxU5vH13aGGoeYNY8whJT/LcuVgVoWbTvCdkBlRoYKBwwlYJ98aVBPbDHMuF+T4VlO0Gz6tOnvih56WZWVd8X7xtdO9j7M1zqBZZvvtng3wDpwTSyuXJfI9Dvvk6ZzV6ex4ttzedFUk/tqctTm4exA8GhjtyNMc36Wkk2xaw1OucCvVS9nad06VTLC/nt640Qsvz9yFHcz6xQPEVydeQaYtDTxZmXXZq1f9w+qWTcmzc8QvKffxcnwuhzpi99dfm07Z2Jvnli6ZJv7AC9sn+0DI/mOaYH0FeTT83uqG8ph9C+1zQNcbj/zBNambJXANydQrbEPlfbxqrAXm8Kfc5z++XsIYeT9uMTOIz5n7iikGBgqImOOe8/Ql9B4SvcYXk7TTfRbnlc0zTNGuSSY5zPHZd/248XXMfvxTNlA9SrldZ5HWft59dFxv8nZwkzXUxhTnXFofv52PyuAdOex7ks97c8jru2a55Zlrqb5WYht1DJMvzOzuN3PcZVmo6hvc/7X1pujSxwZVwkKeQ74tc51eWa3y2c73Zvv+T5E7HfLWJ76m4XOdntnPbLDNjrcl80yu0nea4pftNlTXNsh7rptjG7PK6xoRl2+aCjl823VQRvHaZc9X+Hk4ENtLk+ULOZyPdNagx97fZz4308i8vsudWHr91C7h2NFlZlfmMbRmikLSPc4X79WOSay3Uj3OdvNsCXR0VKNCdrvp0TbS1Iq9fjuPOTu68vu8LqsvYNFSMqyEyKrlD+/oR5rNpC7D9Aun6IxN5vn7EFWmbaPM6zo8HcCaqbszgQK0Zs17bjNUov2P6mPpxZh92J/oy8pvZGhwIBKVJ+5Tjk5m/vD6SraWT1OSdXyum/rjuyTV7GmSuitfY4MrZgf13++beW16/PWbf6oK1bGz/LrZvomA/SbbZNDtff/M+FvCwATJvXEliP+xng8c/m2wBlHD/Uw08Bnnvn5E9r2SX73qKdr1v9jl7k21+/zZm3YF0TMnfua4XHj8P1B3/gskHW802Zg5UpTt3Y+dfLO2Tj6tJ/7ya4ENDtV4fPOZL1j4ZUrnLfCnaqq/x1/XqtbnS3dDYeVwgKDbdNYPQ5E9PmZupr898TXLVke1rkh5O6SDR6+zPfpFnmScdW9W3cltyu9OTS9/I+cSf/+O8JE01Yv+mzDaYkO2plnylbl8/vRHu/DhNGr05VqoMN/VhCyjMn6Sbczcu/NRQWcqy0jen4HXYmPEGLzmo43d2HNiXvm94TyAlid8823ncDXS++2dSZe3CGo2MzTPFdu56TwHNt+SZrwPtIGcsXAj82I4tq19VqHmBdPv125HaFbrJtnlNXc0NT65CpTTLm9yzxj82ea4rxbZKLStNfKbCdsKbs2kNGyg2+6rka8jIXbHrh5N12WYZDyVvb78q+3RiDibdk86XK6Rl4TyWx/GzT0POMj82gs0Oes2+DWlkADuffNEk6Zcq/32yhQrdNHBATYM6oE+RZp/fnFKmNwpcduyHqf187MdpcJmTe76tWY09Plbe15vGalgeb8p9zuv7JayBx7N2XaV2jYh95noNND/ig9veFOdc6v5UmB8UwWtcAXnb5IOU76Kc8jmmZp7lsX4TchQa5DrHzTbaDoMTxyKP45dG8+SD4PLs/WOW7+I051zqPdx+dl1s6HdySLrrYorSYJr5TR7F7mly3gNnOA/yWm8ueR33zNc8+9R55gd4GnZ9TZHXd3Ya+dwnGt5vl8A95yQtCy07zX2p+T5KG7A022rvqb1tdYWamdIuVe7zK/PvgiznejN+/wflTsf8tI3vqYSc52emczvYr2oa+aVXfr+pcqVZxnzTJNuYQ57XmLBsv4ELOX6Zme+l5WWJYze2m9eUYfC3ZqPvedNdg9J97+R5f5vrOKeXf3lRvr918y2fKGTdTaFuVLA5KvO6zBbS2hoPM1WkwUn9atR/8JxfOOx12K5AU1YnSW2tiTazjcUL1kj9p8S3/7NRUnEeTTnZZr2K303uU6TuyA0ZP+d1gB/oF6ReS9M20Va0/lnVD44tc4qZb01SLSiv8/qkdDXr1bM6KFhTynWWnzhuJu3NfgaDA0l9z0xJDlSliBXOdzTHL1QDyQsA2L+5+mDJR9WZXk2YYH7TO+Gm7G5W0czktPzswj5m/3qGakf5QTglBTzcuFA/RjZQEl+Wd/zPTLsvXsf+GQMoLtjV/yw/LRt8DPLdv9x5Jbs81+MFrlw+9877NNKcR/V6yJwfbronx/UixgbmjjPry9WfU5p11vWo8Y9NmmmfTRml+qxBWzRWUedjjs56HTnQ2ba1vZvqNtNOOFqVfcLGu3Fr6kLYA1dznmOcv43T3OnH8TmANfm1dILmrM5RwN+CyNv7L66L+4f80tleVy6THuKeD02hbX1PNZbtv8YGMhq8L3ndBzQuzRq9jVF15+IcgYm2Zv86NwAcCCaq7rIp0paZ8f5rgNbWijV4oiBLm+oAgEbg+nogy6uN/cgib6OhyDstI9907qbSZulHC4i+rqWxvlbbrihsIwAAQFMgwBNjnyJKatvWPklSQHvHAIC8jZ87kuvrAWLa4lD793cu1uRC2yePEPI2Goq80wwadX9/q8YW0CwWcCCZNrrt12yLwjYCAAA0BQI8MY+/p5pg+6l5t/sKAMibLWwz19jJA2pUyfX1gLBtV3JfAunagd8vkLfRUOSd5sP9PQAAAID9HH3wAAAAAAAAAAAARAw1eAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOAp9lNVN1lm/XZuOluuIV1mqe6KetU18kNNwl/n+pGTHTDAAAAAAAAAACgJRHgAQAAAAAAAAAAiBgCPE0qXc2WuSp+uKcOevpmN4y2Z7rqp2xWfV83CAAAAAAAAABAG0eABwAAAAAAAAAAIGKKOh9zdL1734JsTZcp0paZKtIVqutf4sZvVfHMM804X/24zarTsyrW2ao7zmzs+pkqXj7XTLE1Lsw4fzZp9xoVPzzBfS6/ZacsI891149YF1hmYJtsXzcXDlYwMf1pim+Pv+2+8HL07rOBWj6BfThyird+T9J+ppe83FoVLd0ojeojLRig4p1udHhbg+v2ptn5H5LGTFF9R390pu3Ld59i6ZlckymwnI3D/PV62xvbNndM+r6gz0Z198akHsfU9RYv7amiKjfgfdaMW1Cj+sA+x+dJWrYvNs3b5ljaG0nLBQAAAAAAAACgFbVqDZ76/lNUr4d00Mye3qv43e6qm/JCUpBEx50tveOmB4I7WuqP88Z/NFh1l81L+lyuZdePOEn1CwLLsNNDy0i3bh25NP6Zgxaskex6bNNeOyeoeOZMFe32AzuJz6TyAgf93zfzx9ZvPnf42foszT7E1n/QzGdV3HGw2e5g82/J/EBHcLlLVRQPljjxAE5sHrfucWbf4kpUf+EV0qLYPGbdJi2S50mWa5+K3tlq0tOkuT+7r9MwqWOttDGWTma9g828sc/vtsdssz4bXOOW68YFtsPb5x4bE+s1x6R+VLi5NfOZMbHlmuOyvlZ1o1xeqDrTjLOBPD+AY6d7wR273MPXJJa71Gw/AAAAAAAAAABtROs20fbus0lBkKKnbUF7dylYOL97jRSoNVE/YpTqzOeCNSmKVq5RUcc+qu/kRlg5ll20/MxEjRbDC0B0LHNDTmjd0s1mOYEaKDtXmnnMNpVmDrqk6DRP9cfVqmhBsBbKXBUvSr8Pif00611fq/oew5KDJHHTpf4lKl4aXK7Z3gVmuW7Iqh822CznocC+m3WvSQ2+FC8N1Pixy7EBjnCAJiaffap6zgvOBI9tfR8z7d2lgfWYZSyK1VBy25VuXHw77D6bYxefbuw079+V6o4PBqOCy7DH3qwznM/CjiyRPtqRWG6V2bekvAAAAAAAAAAAQOtp1QBP0QfV7l1MterDAZNgIbtlC95tbRJbsyP2CjWNZuWzbFtLI76MUDNdnvC6PX6H/P7nAk2Y5etLZWY7NqooEFzyeMGiEhV9yQ0bqfuQRadykwZbQwGpsImqP9zsd/8pif1Ou++1qv+zexvz5xqTFkclB6Bi8tqnuSraUhsIvJht6VGi4neCTbal837qcmO8fba1jQL7Yl7BZtV8WZaRgRc09PLZOtWl22cAAAAAAAAAAFpR69bgaaBYE2jJr2CNk1z8IE1S0155NMHlB4SCzcPZJsPcxAiJNUWW/Eru16Y5FG3cqKJY7RvbPJvCNaQawvbJk2Z/kvr6aQCvyT2znKXvuwASgR4AAAAAAAAAQNvRtgI8KX2ypPFBtmbKsgguu+9JqrOBgYcDTXvl5Nc4scGlRjXVZWvChJtis9z2pdScKUiaZsds7Rr31qtF81G4+bL8eM2ppaulY+W7T17zaf422uVpy8rGBZV22hpWOZpaayyvjx4byCuR+hTQFB8AAAAAAAAAAM2oVQM8tqmwRGf4E1U3ZnDmIILj1QLpaOYbESxsn676QMf7VtZlpzQ3Zj6from2JH5wpP7Ibm7YvB9xRaiJttR5UnhBDtusmOvk3+O2L6k/mgLF+p4ZFVxu6n55fQ0dd3YgbQzbh05Seoa2z07vX6KiTAGZAvbJrr/ueLO8HmYgWyAvLzdLKftsj8sLBda2SdN837jkZQbVj9uszy4z++CGAQAAAAAAAABoaa3bB8/6Z1U/ONZ3yhTVa03uWjW26awFa6SkfmRGqX5lcpNcWZdtAxLrFei75SQpjybaip5+VsWB/n/qtTSlibZE3y2bVZcUNEkoerqnit/trjq3HLt92jKz0c2KpS7X7JdJq6T0tDVSzL7WjYrNY14XlknLg8GWWhUtrUn0NXThYGn9TBUnzZMs732q2mDScLDqP2pEMCsgdb0m3Y806yho2XNVvGZrvG8iP/iVui/Z9h8AAAAAAAAAgJZU1PmYo1uhIsJE1V3WXIXmzbnsA0Cneaq7sI+0oJA+jQph+z/y+zFqVFN3AAAAAAAAAAAcwNpWHzzY/7n+j0RwBwAAAAAAAACABiPAgxY0UXWDu6to/XPZm+EDAAAAAAAAAABZEeBBi6gfsc7ry6b+o2dpOg8AAAAAAAAAgEZqpT54AAAAAAAAAAAA0FDU4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEEeAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQR4AAAAAAAAAAAAIoYADwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiGn1AM+0xW/pzd8GXhte1ZK51+uMLm6GtCbowRVm3hU/1Xg3pmGaajloDrG88ZvKOzTQjYsZP/dVb9rCO90IAACAA83Yn2qFdw/9uh6/zI1rhIG3LdZvNryuhbcNcmNayZ2Luc9Dei5vBF+/ee1VLZx7h77Xx83TaPxGbFFdztNdlf5vuzd/+6rm/OgOLVyf/jdgW+D/Rl2saW64xVzwqF4xafTK3AluRMtJlNm8qLtOcSODuvxIT23w52n09iVd/9Oci82RX1oxbQEAaAptpAbPLlX96gUt+dVKbfpLe5UPmKA7/uN6lbupqUrVoYP5c1B7f7DBUpdz6b0v6pX1L2vOBW4EWl27r3xHk6dkzg0AAAAHoopv9daR3rt26jXs+967xijt0E7tDnYDQBv2wZv2t+NLWruxWu/vLVG3ARWaumCxpp3qZmiUpvqtiXycMeUynfGVEtX+fqWW/PcG7Tisg9rRzkgLmaSfvPiqfrPi0TyDmeU68ezUBwDKJw1Sr2b57kg9F8kvAACkaiNfhXu0deoNunHqlTp3+HSt2mV+pvYcpksy1uK5Rxf0P0EnDrtY892YhkldTudu5Sppx81827FP+/a1U6+z7tY1WWt1AQAAHEgm6Ix+pdKuKlXZe+feQzXZTWmoJZNP14lfO1ljb3/NjQHapt3V9rfjdbrke6N1xrDTdeOvqrWvXTdV3PZTVbh5Gq6pfmsiH2WH2d/etdr0yyt14+QrNc0c1zNOOkH/v4pbtdafBc2mXF07lyi/4o9a1daaT5w8PnSODdLV/buZ76Jd+sCNaTqp5yL5BQCAVG3wWYdKrd1m7hxUpnL7BJarortk7k+15DVbDddWh56gOavN+9WBJ036+FV1f+OqBr+5/lUtvHeSernJuZfjv6/oamcu0cApdvwiLbRVgn/7sh78J28pvinPeMtCS9ihVUt3SIf21fdun5C5VtfYO/TUS4Hj/9qLmvODYW7iHVpoxy2+V5PnvujPs+F1LbnfLO/UH+mple4zG17W4/HPGC5PedPM6zcrF+uuc6lJBAAA2oDLRqpfifTBWz/Xk2/tkg7uZe5f3TRPL11672K9sj52n2PujWecacaX64ybn9AKew/sjX9dr8yd5H8kpWk0s4yfvqhXYvdXK5/Rg78INpObuJeeOsOsy833mxd/qvGBB3N6/fPdWhi/3zLrq7xb34tPL9f4WYnP2nVMNfsF5G+Hlky9Us9vM29Le2tE7Hdbpnt591vuN08Ea71N0uP2N+JrT+jSdL81bbNQv3g5kU/N+fT4D/xJ2fN3mD3/nkmcl+Y3y4Pm94l9H2seym+K+lU99VMzn12f2w5/Pa/7nzMvuz8/uSz+azdt02HJ42K/ie7W+PvdbyK7nBcf1eQsNZ/Kz73b+50VW++bq5+IB5NzbVNsX+bcHEgju88X2d9UfjpPHmBP+Njvb7uvse28w1tGIWkWbIUjeVzsmCauYf5nzbKnPOrKB8zLNRc/1H7E6jJBP1mc2PdXfvEjdXST2pZBuub+wPXebmsgH5af8SM9HjiGv1n5qC71miWrUDc7Q8kgTbafydpEWY02ba71z7GxbpQ1drwGmfXs+ON7audGxeTKHzb9s1//g+divvkl9zk59CbzHRg75jY/BTcJAIAIaoMBnnL16mS/tHdr18v+GKv8pG56575zdOLXRqdp79Z82T/0I53xlfZ6/82XvOr6VR+1V7cR39dP709+viTzcjZp1ZIXvCcgba2R6lUvaMmSX6py7Q4zXKqupyaqIl/Tt7v5345HS9g9dYaWv2du4wZM0E3Bm8mg/v1U/snbemnev2nGnJXacXC5Bl5wjaYGf1x1PU0VX6zWS/9TpQ/q2qn81O9r4ayzdNQ2k2dWVav24FL1Pfcy86POcnnq2L2qevY/zTJfMsvsZn4A/ESTM/5gAwAAaBmXDumldqrV1rXmnnXtVvNO6jXgR+ZO2jfw7p/omhHdpN+/oEd+/J+qfHO32pWWSZfdrTvO7auSv7ymX9z3b3rkf8097RfTP8AydIZZxtBylfytWqt+9YKWbyvToD5poi+HDNKZA2u19r9e0Krf16pd52G6ZroLGl3wqObcdKbK91WpMra+r5yp611zzENnzNHkb3VLWkeF3W6gIDu05Pf+77bOJ9vhLPfyT76mTZ9K7br2TQRwLhikboeaX4Gb/1ePuFEJwzTtwR/qjD6l0vbXtNzmU3M+yZ4KOfJ3WPlFt+tH5/YyH92hqv825+76feo3IN2cJerVT6r80ek6ccjFmu/W0+2w9/3P/XeVag/rphFXP6QHM/0+yqTzSE3q9YFWxc/XQRo/5e70/ZeceocemHKmeh0pVa9zv7P3+Lse2/fc21SigWcMUu06M4/9zXVouYZefrf5zeX//l61bZ+ZJ/b7e5UZmyz/NMtDSS/103O68YwT9PWJ8zTwtp/qDnPsO773krtO7tVRtrl4rwxhmO56+HqN6OqaAzP7Xl16lhn2F9W29FLfr3TQjtee1P1TzX5srFWJyYeX3WT3Y5J+fNt56nv4bq39eexcKFPnLav0wq/M72L78U/86+8Lq8Kpn2zH4g1m/lIN+q67vht+U6HVWvvy390YJ4/8Udj1P7/8kuucLL/oUd31z3115MGB/PTtQX6eBgAgotpYgKeXKm77iU6zBejbzRfydn+sVbvhF/rXn6e/4Sg3X+ADD5c+WDVdZ4y/zquuf8FF81T1iXTkwLN0jZvPyryc1zR/+g3aan8da692vXqDbpw+TwseWGtuV8w6elW4m97va2CPdt72oaWs1L/+bKV3Mzn08nsTT1QF3TJaXx99sW6870n94r4r9VSVOZAHl6tb8Gm0T6o0r8JW5T5fN7xsfwC2U7vq53SBzTNXXqlVNr8d2k2D/jmRpzY9+y+64PbZZpnX6Wr7mXa9NPA8b2kAAACt5Psa1tPcj9a+rVWPm8HHV2mTvYft0U8XugdRepXZ58z3acfa+3X/z2dr2vjTNenOl8xNTon3lHXt7+Zrxpwndf91o3XutbO9zyQ7T+O/US59ukm/OHe0rpp6g/51/L/oyY22cC3k4B1adcv5+lczz1XXLvPundt9uZ/OULmmjh6kErOMyovO1zRvff49V7seg3SuJmj8qXmuA8hh7Scu3xyc617+Hv36bTNvSW8NdTU+xg/vrRLt0mu/THMuTLlGFV3bad+bs3Wu+b1h8/m/mvPpgttz5e9Ul/yTLUjepVV3ms9PNr83rxytG5d7TximqF7+r5q1xP5mcesJfs78nrngsSpzhpdq0DkF9r9lzzezvd75WnGdltjfQF366rw0nedPvqpC3drtU9Wj52jsRPc7+3SzrwVu045VN7j9vVLLbE2rQzur3z/5v7/X7tprRiR+f4eb2SokzXKr1rIf3uPvsyrM9aeb2u1aqVkmHfzr5Dy9Ya6lR55wms64YLyG2uvp5id1rv0N6ZUx/FybPrGfbWvm6ZLTT9W5V/6bHvmV2Y8frvQeRz2yvJ/5v1wlh5o/H23W/B/758LYc6/UnFfnacbUrdptP/5Zjdaa/DDjsRzNcy6cr9ds/u75TfdQ5CR9t3+pSaPXNOdTb4STT/4o9PqfT37JdU6W65LvpslP/9vQ/AQAQNvQRgI83VRhq8f+9hlNO7uX2tWaL/mZ5svbTbVq3pvn3qUa8RX7LEattr5a6Y+wtv+ntv7Z/D20RH7ns75sy0lr+2yt3Wz+dumlM+wN3mWD1MvcIFWvv9+bjBay8ErNe9XcbXc+TTfNCDSjFtPnPE2b+4yWrHxdv1kfq7od8uet8SfyYj8Ad/zxJe/m1z71t2mnF92TDorlKVu926/+b19L/skf157HewAAQGuaMlR9bW2DbVWuX4J5qrJPNdtm2ib59yvzV7xt7o7bqddFL+o3Lz2jn1x9prmvNXc9S95QtZn1yBE/1ZsrF2vObeepxI5P0Uulh5s/f6rWAq8w1NqhWV4tiZDa97TpVfd+e7V22Vuq9u1VptPUrbN5b7bre0tcczi/fdG/pz64vUrMb4BSe1+VzzqAHM74ou2NfZ9qzW/AXPfy97+6ycxZou4DbbOFFRrY1Yzc9baWL/RmSTK+p/1crd546T/d74aYXPk7bILKO5k/tVu1NrCeVev9GnjJarXrd7G1ufWEPrfjga3e9rQrKfVH5Mv8Jro/fr695n4DdVRJD39MwgT18ta7QS89ED4nC9mmWv3fW7HAwQ5t8y8Qav9Ff0x2haRZHmprtC2+7/3U2W5m6TBNc3nkzd9er4H2wNnr11fLvGO44/fzE8d9+z3aZMsY2pxynXH1vXp88ct65TXze3jxmWZMzAt64/fmov+l0/Sgbapz7h36Xocdobycr9dU+VvzyUP76rSbzBqu/qZ6HbpPVf/7b6Hl5ZM/muP6n+ucPE3ldtVNlZ8AAGgj2kiAZ5eqfvWClphX5Zxbde6QczQj0Dxb69qhGetsjZ9u6vUv5Ro/qJvafbpJa2c35sYDDTH/zoe11tx5lY+6XkOTOoKs0IMP/EgVA8q1761lqnzoBs1/M79btH2fZHtKqVZVj92gG6cmv2b9wk0GAABoceWaOsDvMKDdiZNcAdZbuvREv/eDbv2v8WudP36xzp14j5a8vkN7j+ylEZfdrcd/OkF69VaNvfBW/WJVtT44rJsGnv0jPV55R/rmmaxP9yYV3A08NNzLQh5qqzQ/dD9149R79JSbHF5H+UENWAcOcMM0spctud2hrYv8MVnv5R/4X68mxpEnnKkz/uk09TYf/eAt81vU/2B6STUUAnLl71w6fl559XGPhKZMs+0vhY6deU2breVu8r7Pkq5O+vzB7m0bUj7lJ7rjstPU69D3tHbJPN1za+whRus1Tas4X9N+vlLVf2mvbgMqNHXBYk1LU2MrH2sfWOU1cdjr5PGa+s2+avfJJq18wE1siOa4/hd6TrbBYwoAQCHaSIBnj7a6L95p91WmtqOaw/L3asz/Jep+SqC/nS7fV/cvmb+f1Oo9f0zDzVzmNffW6+SpGtqzRNrymmbEnzJBi9k+z9yYVmlfu27q1yNwS+9+lGnbMo298gbNmFOl9u1Sn5krRCxPlZv12MBj8LVqoz8PAABAi+syXn3tk/af7tDapHuUlaq2TQd16auKU6TyLuXasW6ebhx/ur4+ep5fmN1vqMab8eUbKzXjytEa3v9KLf+z1O4rtjm1sF2qtcv7Uq9A/4PlOu3LiefCc3tJO2zLNyWd1e2g4Lb627spwzoudLUvgPz00qWz79AI89uv9tVKTTO/03Lfy8/Wys37pNJuqviu7UNkh974+Qt2QorYsnoND3dAnyt/h21S7R7zp6S7+gWaka7o3Tmlc/pksfV018BA3zblV3f3amns+yhYPN5OHWMF912uVy/7ezispFSJX82u9pJqtCPlAcvYehNN2SUUsk2NUUiatVd72zKlZ5j6fTnX70FX2/Dozur3Ruj4/fdr2vHnWtk2H8q/EuhPyVx/ux7t3rch5w7w+2R7Y/75+tfb/1O/OKidDnHT7DW1vMsmVf74So0dfrKuss3b2d/TqRf9/Gz/N63dYv72OEsV5rvog/XPpem3Kp/80RzX/1znZIb8NKC7OcMBAIiuNtYHT8PsmF2ptR+ZH61Db9aS+ffqrhn36vHHJqjvoftU/d8Pp7nhyMyvMm5u4M+8Vz+5/w59zxvrfgD0GKaBJbYK8j3eWLS8HQ/coCfNsWgXfHr0jV1+28GdB2rObXdo2uw5qujpTWmwHbPNDaBtvsTlqak3/Uh3zXpUCxf/NNEZKwAAQAsrnzRIvezTxlte0iVJTydfqRfs/arKdeLZgzTiljnmHuZuXfPP5+maKwap3PbBsOs9bZr0Uz1V+VNNveRMXXrTeB1vm2GzzRaZP8n+Uy9tNPfFh/bSeY89oZ/MuFsPVj6j7xV0j7VDc35tm8Iq1dBbXtTjs35k7qnu1k/mLtZCW5uoSdaBA1HHbneb33wmv8xfrCWrn9E1p5Rq3+8rdeMkvznufO7lH1lt82a5Bg4ole1f9clYM4Mhsd+aJQO+rxW/+Km33p/MN/n5tlz5O+w1PbnO9lBVqhEzFutBt5ypZtuzM+v55Wuqja/H7PusJ/T4RX3Vbl+1nn/M7zdobbUt2S7X0DvtuWR+Dz9ylrqnixyVDtNkcw3w0q/yhxpqVr/vzZc0J+UBxth6SzTwupf11E9tmpvlvviEpuW5TY2XX5rNf2uHOQ7t1Pef/XkerLxbQ4PttKc1T0vWmzSzzXk9ZT53mzl+t5nP/uJlc2zN5AeWef3xtOvzz3rcK2P4qRY+dZ5//W1F7UsHescu/rq2QrtqY2UYd2vabffqqWuHBZqpn6QH7P7dNElnXPIjjf+qbcrQNgFop7kgV0lvnTHrXpMG+XU2O+ulKu07uJ3aHbxLb/93unpv+eSP5rj+5zonG3oOAgDQtu0XAR5bs+OSW+dp1ba9Kj/5NK+afd9D96jqqVt09S0r3Uz5mb/geW2yN/B9TtOIExJf9I/8co0+sDdzja2CjEbaoVn/8bzXdnzc9ls16+ebVFtsfqCdXaHvfLlaL62zd6qNsP0eTb7lSVX92c9T3/vn83TGqb3VbufmNE/jAQAAtIyr+3cz/6d/4MgvsJa5dxmvzrv2qeOJNojzI1367e7Stpd0/023au2OGunYYfretTb4M0gdP6rSL6bf5vrySTb/tun6xcZatftSX434pzPVTyv1C+8ey+/nJB87Zv6rbn2qSh/sLVffb51n7qnO1NCe7bTrbf+OKvM6gMyONHn7DJNfhp7cTUd9Wq21z/6bLqi4Vavc9Lzu5R/2C/At279quHP/uMBvzSP7DPPWO+Irn9eenbnzd9jaW27Q/at2aN8h3TTUbv+X3tOT/2sLnKXdH2X+lbHjsYt142MrVf2xXY/Z92/1VTt77t5ypaa5mjdLZj2s5dvcufTtYTry/57zOpdPYa4FL+w7yU+/ru1Vu/FJ3XpjuH8hX2K9peo11G/OrtvBu70WMvLZpqaQV5r9x/168vVd8XnsdaRyQ+7rSOU1V+j+5dWqbW8+d7Y5fmefqUHH7NHWKjt1nqZNf1KbPmqnI20Zw7dPkl5+0msyvDW16+rnwfhrRD9zHX1Yq97bp5I+Z6pi7CDpv1+Sn0LWDu36tFxD//n7uuva8zTwi7acZLqmPW6nzdP8X5nf0Z+WqNe3XKsY+YidO++9ofmBvmyC8skfzXH9z3VOZstPAABEVVHnY46ud++RRfnVT2jhZX21d909+vpE/8kwAAAA4MAxTHct+anO6LJDyyedrn/NUOMBQL7KNX7uM5o8oL2qHj5ZFzTrg4R3aOFvK9RtW6VOHH2rGxdFLZlmAAAAbR8BnhymzX5GHWv3qd+pfXWkqlU5eXSTPpEEAAAAtEXjZ7+oCaXv6Y3Nu7RX7dX55GHq27md9m2ep7Hn3JP2iX8AWdy5WK8MqNUbr++QradQ0nOYhn6lRNq1UtOGX6l0jV01nYgGeFo1zQAAANq+/aOJtuZU2ksjvtVXR35crSUzm7a6OQAAANBW1bxXq3bHDvKazvGaQC7bq+pV83TrDwjuAA2yY4f2dejlNQ3lN5EmfbDxBc24mkBFRqQZAABAVtTgAQAAAAAAAAAAiBhq8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQR4AAAAAAAAAAAAIoYADwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFT1PmYo+vd+0bp0PGL7h0AAAAAAAAAAABy2bP7L+5d4ZoswAMAAAAAAAAAAICWQRNtAAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQR4AAAAAAAAAAAAIoYADwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHuyHJqruss36bNx0N9xw9eOaZjkHnL4v6LMp61TXyR/cL9Kx0zzVTdms+r5uGA3UdOdnm+byy2dNlmf8dKsbMdENt6TQujkXAAAAWt6di/Xmb99yr1c15wI3PsUEzVn9lhbead5e8KheiX/GvBbf4c8S58+beXrC+LmvxqdPWxz4TLptCa3X25a40Dp/u1jT3JRUd2ihnSfLdiVrwLKDr9WParybmnt6SNbjk386W8np67+S0tCt65W5E9yINNw8yWkPANgftakAT/CGAQc2LyBw2TzVu+G4jAWLB0ihcYwXQKGA1fLyiitID75apyC8EQIBgcQrESRD82rafDRd9RcOVtHSnjpoZk8VVbnRrYF8Bex3vEKfDAVM3jTupbG/8gorMxRqe9OyFeQCEWcDJmPLtHbmCTrxa+a1sEYDp2Q6Hyo0UK/pl7dM0JwryrTMzu+97tHa0oqkoMC0xddr4K7KpOnpv0fu0HcHSGufudU730buusd9JrYtwfPvDi2cMkg1C930ma+pbGxiW8fPvUyly90085q1rkwVGb7Xxs8dqW7ufT4KWbavWpVuXu815GLNd1N8uaY7aY9PIk3yT+eE2nWBNPbSMDVYUzKgIsN1zxz7EYWkHAAgytpEgCf2dMLkASVuDA50Re9slTqWuaGE+j59vKBP3fHhQE43FXU0Gfqdm837uSp+uKcOetq+3x9NVN3g7iraXZsmHfLVzLUBqs7UQTMHqHinG24IL4j1QmqQL513n/UK0hOvZ1XUf0r+n8/HzgkqbvbC+loVLUjsR/F6k+cvjHJhfLp81obPz6bKR53Kzfy1qv+zG24m9SPWpQ+Ep2jifNUi5wKATKY985pqSwbpu+Enci94VCO7Vqty9K1uBLCfuaVSa2tLNPCccKGoX5BZvXA0AR7st6adM0ha97AuedyNuGW0KreVqNfw1Boc0/p2U+3mVZqvebpkSPC8MMPLq1XSc6gf8Ej53jDTHzLfMV37pZ5Ld/ZTt9q3tcqu36z76xPn+eMt79zspn7ue8kLymyr1Nhb/GE9frGWmW2NnbvzJ56SmGbMn7hM1SW9NTRNLaBJA2pUvc0N5yHvZVsXdFZqiUNArukBqcfHT5ORNphWSDpnYtJw9rpadesbuP7VVqs6kO5JLhiqXiW1qq11wwCA/VrrB3juXKwK+2X3tRPMDYobB1RtMJmzu5RUQ2Wi6nuUeIENHXdScqFm35NUp63mc254f9ZpmNRxq4oWbVTRcaN4Ej+tm1U0c6bJK91VF+FaXUXLHzL7UCL1iVhtpP3G/pGPwshXQMTFCnlGBJ9Itk9p28KlSgq4sR+LFYqOTKq1YJ/Y92sruBHAfqi8VKp5LxBUMbbtqlVJabiWxh3q17VWm1Ykz5vWV8tUUlujpGKYx99TjcpUHgqIJIJGuXUtLVHtrmo35JtWZYZLO2epSRPmf6/VLBytN9yYRrO1bJqqybKkZU1Ic3zmadVmd3wKSOecktKwRm+YdSTfD/j8gNMybXLDAID9W+sHeG4ZrRO/xtNWCKtW/e5wTR1bS6dWWrNRRTpK9YHARv3x3aV3N5jxVrr+IuzT6tNVH2imKLX2SvL0TM29eU/NZ5gvta+ZdE3H2fXEnp530+PLy/1UvVeLye7rzgkqejdNIa2t+ZLyVL+/b16Tbl56TFF9R7Msr3ZCclpk2z8rvo+umTj/FdruPGrf5EzHUeaYqrtrXqohNXHmqnjN1pRgYHJTXIntTj12ViAvxfORm+QJ5ZnQ9Ezryt9cFX1klnOk/8Mtto2x5SaOW2g7ko5/Yh+S0zycpuF9SZ6ead3h4xjfpoz5LHR+OtnzXWAfgmmaV+2VxiowH9n9uHCwmbdE9RfaabF0zJa+/v6Fm1z0lpV2H1169Dfnf8fB/jlSUFok56vY8hLblqP5x7TnQrplJI5bMj8taGISaDj/ieRALR7bHE9JtZbFnqh2BU+xdvvDzcCE2/anfX5ERqgmgN9sVImql8eaTQr1mRFumsn1SRF/0aQhImLHLqmsc5r+VkJBE7/2zLJETZIQG6jRrvf88+V3NaotKVNXb0pQiUq/6t5argZK/DsmzNUW2fU7O5Au2JGDrR2kGu0IbLMXuN0VqAXUUMFle0GVsG6qiF8T0jXzmGF60rK6qTS+/2nkm8452MBZ/Ng529LWUIoF+ZKDbACAhF4DBqncvU9Wrl590k9Rl0Ea2Me9b2PaVB88QMJcFW2plQ63TR05tpbO7o0qqlopJT19PlH1h0tFH2S7gbGFrSdJsaaXlm5Vff8rAgWUtsDxbNWvn5loxuiDUao7zk12bKFuXf/3veaJ/Plmqujws+OFq17TcsGCYK+2jfkbHOfVNnpfRTvt8qao/qNEs1DF6993M2UyXepf4pqi89dX3/+sAgp2Da95JVsrwXze7W/x8rnepFz7F3ecGXf8hsB2m88W0ORTznR82owzx0ja6uY50wXvCvTnmqRgoLdeBZrhWvp+fLtTjp3V16StrS3l0ieJV8gdyjOB45dtXflLk7dN2usdtz5vu/y8K9ffizf+o8GqCx0zG2Sp10OJed61wbNEkKF+hNn3YDNednqa4x5et45cGv/MQQvWmPxp1mML7rPks7B8853dh9j6bfNpxR0Hm+0OBw+aQSH5aPkALx2K4s2i+Xk3r/TNm9/MXfF6c43cvcZPt4cnFHCOBPOVzT/J1yG7/fWjzD7mnbZpluGdv/51vL7HsOT9PJBqXALN5lb9Ml6Lx2+eqjZWe8cGd6b01qZYPwChtv5tn5cVpa9pVqxd/4UUACFavGYKXS0erzC7NlZ7xwZ3KqRYvx+2hYhdgzQ5FuSx50awj4yvVYrcj6iwNWBKBlyWqL1m8vOklCbuJ2hozxJVV6VvqtO7/gebCnt8lTbVdlNFINA5bXGFwnWCxg/vrZJtb2R4KNfvbyepebJM0gU5vPMy1MSit281jW9yNGXZt2qsOfeDTcd93V0rvOvFNhvMCQZxsk0PLSsTG4DLM52z8lq+qfX7QEpi7weU1HRlriAfABzozrj3ZT0191Et/MX1bkzMIE2rXKynfrFYC28z321JrtdTCx/VnF+8rJ/8kxvVhhDgQZtVtHGjijr2SRSq2lo6H+1QUbjQ0Aui1Eob0xcexxQvDQQJqp5LaqKofsQo1e1ek1SQbwtqi991A1aneao/zhbaBoMNc1W8yHwutp1e03KBgmCvts3W5HGlR7naRqmF90XLz8zeb024YDRtU3YNlM/+xdhC5UAfKgU1+VTIehprp80vjrdecyyCfb8E80GatEyuGZasfthgc2yfTQpaxI9frnXlyQsAhgNMJu2DBeNe3jXbEewPpWhlmrQMb+vTZjiwv+G8l7YfrNC6vSbMgvu40wZfbR7Pfx8Lyg9J+2nWuz5N8KA5FJKPMsgrfVtIMF/Frn1J+2NrBxaQtmmXUWWOpzlWRcuXqjh0HO15VbTepJkbBtAw8Vo8i/3OtGe7J6tT+gFwfS7ItfWf8gTwLaMb/4Q00JLitXgW+52+P+TX3knp98Pw+6xyT7fbZpKSagncqrH0WYWoMNfqWbYgf4qrTTKlTMtsgD54Pfdq0lTrjTTXdFtzc7INmiS1nmK+H4ZUqrprhauh8pZG7rJ9xwRro2QJGtkAym8rVLbunuQ+eTIJN1Nma9RNsc2wBQMlNmBkH1JoZCsvaZed3bTRNuiboU8bI9f0tLzjk086pyoZcH18/jfHyhy7U9IGbeaveFuJ/nyyB/kAAPsnAjxou7zC4lih6XTpOJNhYzVXvOCPXzjqBVFszZ5sgZFcHZ4fWaKiLSuzFzh+qSz9etx2Fn3JDtim5QIFvWa5xe+cKcWbUpvo9SPk78dcr+knv/mqcHNZ6aUWjJrlvBtuyq6B8to/xwu0BYWbfMqikPU0ltfZvWPXG2/yLfayBd1uugsYJNLS5rlaFa0MFFrH+cG5WH5MkXNdmcSa9fJfdYfb2hnBwIcRTnuTx7waVcF1eU2EJUut4eY3gxgMxiQ1k+Y1kReSctwtv7kt/3P57GNIAfkhey29sAKbHcumoHyUWc70bTZZ8lWGa1/wGptT1uunvUYFronuvMoVkAeQD1eLp2u3QPNUftM4SYVCXsFQ4vvZr/1gC5leTerHBIgSPx93S3pK3QteBgpQvdeUQeZb0HGdntvmll6xHZ8DETN/4inx2iS2mfttncuS+rqxNW1S+2KboDmr31KFKr3PpAZN/JooseV+3dyylZYEAqE2aJSujysvgOLXFk0O7szL3JxcgK1N5ActkgMwXqDWnLXxQJZ5VdhqP965na4JtVSZlp1btXaZ29TMMk2343M1t5YjndOoXXdPfP6s3Rp4Qe9uGmmva7bJVvokA4Csllx3qs6deLHGfu8eNybmNU2rGK1zvzdaY29/zY2LuUfnjr1Yl3zvVP3rr9yoNoQAD9qwQE0dr4A1UHPFe6Le1T6wBdxpC55bQ7B2kS3I9LfZa0rN2w9b2yhYA+dMv7mm9Ue5AuMsgR6v5oBcQChQWGubkTtuVIFNfx0gwsEDW8sg1oRU4BWr2eIVaseaabO1pdIFHvKVY13p2ZosgfnzbHYr1gRa8mtA9tpgSfwgTV2PjYlt9prYys4PWASbh/ObZGsb5nrNmAXTJFjLqSAF5qNUDUvfptOwfNVU4tc/O2DPq3eXFpA3AWTjPbVr/oWfAK4ONFGVUjgUa3JmYY0rQCPQgwjymjwy33ChjtyTC0Rjr9hT7/YpejtcqRoXBCXQg+iy/U9Jm1bEgivhYd+0xder12ZzXuRZW82vCZdojs2rFbp5VaKWkOU1fZa5Rsm2XbUqKU1+8M/2/VMbW86dizW559ualSZokRzE8l+VttrPtkwBqpAsy87N9qXj3qaVaXq6oFau5vKS07mxvCb8eg7VnGA6AwAy2rTuNe1w75Pt0KaN6ado+2tau9G9b2MI8KBNK9r1vteMkd/UWbCprFjNlRcUrNnTGKnNEfm1NOJsPxzpmhBzTcTFagjFn3z3CjLdNtvmv+w4W1Ccpskvr98O26dIoMmsML+mUrqCZfs5c6cZbB4q/OR9sAZCJnnuX3o2mJXncWjUegoxXfWjuqt4jSvMzrTeIK/WiH8MvNpSGWsl+DWWMtacymddTeWDWECxQMGmDW1etf0dFdqPS48SL7jU4MCJ1WL5oaEakI/C8kzflKbtbPC6uWXIP/71JrUb2rRy5UHbhJ38NLPnVVNcrwFk4hcydeubR8fxt4yW1z9PbYl6DaeQG9HnFSr3HJrU4Xx6/pP0s9blOz/Q1thaORXJ/azc2U/dat/WqmDA5YJHNbJrtZbl03yaZYMjttnDeD8vsc76Q0EjrynQcE2hBL/JsAotjDVllrQdfr9xiZqnhbJ9bWV6MCHXsu1n34pv1/i5i5OW4/WLE+/TK9f05GWl9JGUrSZNSjo3AVtDUYM0sJDjDQDYbxDgQdvm+rSRLUgONc/kd4rfvUk66/b7LEnusL1+xBXJzS7ZfinetU0dBWvZTFTdGNsXS+CJdBckqLOFwvGCTNsclj8usR/ms+Pm5Vkw7wrT0wYczDqC/WW4vmQS++K20Q350jSplu/+WcedndQBe/04M5zvcch3PbYgPdB3UUH6vuDVLKkPBh9ck1/1Y5LTvH5ccDv8ZvP8wGGo75sQL8+E02HEC35NqrzW1TT8gGJy3vWCEuOSg0+25leiiTKX3rFaKSlp7Qc1skvNQynnTLp8FlZIvmtpDc5HITnT19X8639WYhlm3V7tvCxiAfDG8PvIGWyuRYH8YmsL9i9JBLVySLsMs/2J/Gb3z/zpY35sulqNAJqPLWSyTdnEC9asCx7VQldTYdri/Jq4AaLGK1QuGaRJSbVy7tDCWMfmdy5OPi+AKPH6u4k1W5ZaK8fWkEkf2PCbJYw1dxZ7xQMTiwPjw7VybNAoQ2f9KU2B2tfqR/2Aqa0pOvM1lY1149P0qdMtNi34ip2r2VzQWWVJfWmlyn/ZZclNwdlm7IYE0zDX9AD70ES8Zqx52bQMzJs1nZvEPK3aXKvaLIE3AMD+q6jzMUc3dXljg9kvPe9Lk84uEVA/zjZDZpsYCjU51Wme6mxfI+8+q4OCnXvbwuHLpkhbZvpNJnnz9ZGSPh+ax4otzx/yayYcOUV1Sl6+vz1uwLDzhZtmsk1X1fV/X8H+U/xxZv74dvjbECwQL16aoRkpW9A86qjUNIhx214U+7w3f6wA2abdUhVd6DelFV9+YH+D+5Br/7zpJk2KdXZgvq1J++qv3+yPGxf7TMHpGJ8ntPyA8HJ8meZPTfPU9U5X/RSzb+F8lS4fhfKM13RXvJZGPusKSLf8kHTp6Alvh3fMk/OZtjwr9Tg7sT1J22qW7eXPWI0Rk35LpbocxzCeVm6oaL2/jkznlb//Zrnhc8/Inh/SnK+Gt8222bMmaHKsSfNRmmOZK31TlmnyX/EHowL7ly4NAp8JHc+4PPJV+Dgm5x8rtO60ywwvI5R2Lh8o2zkAoHC2wM8rOAsVFN25WMF+d+yDJrGOtb37bdufgWObtMqrc2ygTbE1GPxC7qT8650TgX53zHfa2tj5ET4val/TrEyFtUCUePm+TMsa1CxZJv45Vrq80H5smpk9j/u+QZkRAAABbSrAA6DtyxhkQBuVLjAAtLC8Ak0AAAAo1Pi5r2py6bKmDXo0S9Co8ey+fve9U9pW0AkAgFZGgAdAQQjwRA0BHrS+pqxtBQAAAAAAAB998AAAgGY0XSqgTx8AAAAAAADkhwAPAABoFrbG32dTzlb9+pnp+xcDAAAAAABAg9FEGwAAAAAAAAAAQMRQgwcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEEeAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACImKLOxxxd7943SoeOX3TvAAAAAAAAAAAAkMue3X9x7wrXZAEeAAAAAAAAAAAAtAyaaAMAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAAAAAAAAAAihgAPAAAAAAAAAABAxBDgAQAAAAAAAAAAiBgCPAAAAAAAAAAAABFDgAcAAAAAAAAAACBiCPAAAAAAAAAAAABEDAEeAAAAAAAAAACAiCHAAwAAAAAAAAAAEDEEeAAAAAAAAAAAACKGAA8AAAAAAAAAAEDEEOABAAAAAAAAAACIGAI8AAAAAAAAAAAAEUOABwAAAAAAAAAAIGII8AAAAAAAAAAAAEQMAR4AAAAAAAAAAICIIcADAAAAAAAAAAAQMQR4AAAAAAAAAAAAIoYADwAAAAAAAAAAQMQQ4AEAAAAAAAAAAIgYAjwAAAAAAAAAAAARQ4AHAAAAAAAAAAAgYgjwAAAAAAAAAAAARAwBHgAAAAAAAAAAgIghwAMAAAAAAAAAABAxBHgAAAD+/+3ZAQ0AAADCIPunNsc3qAEAAABAjOABAAAAAACIETwAAAAAAAAxggcAAAAAACBG8AAAAAAAAMQIHgAAAAAAgBjBAwAAAAAAECN4AAAAAAAAYgQPAAAAAABAjOABAAAAAACIETwAAAAAAAAxggcAAAAAACBG8AAAAAAAAMQIHgAAAAAAgBjBAwAAAAAAECN4AAAAAAAAYgQPAAAAAABAjOABAAAAAACIETwAAAAAAAAxggcAAAAAACBG8AAAAAAAAMQIHgAAAAAAgBjBAwAAAAAAECN4AAAAAAAAYgQPAAAAAABAjOABAAAAAACIETwAAAAAAAAxggcAAAAAACBG8AAAAAAAAMQIHgAAAAAAgBjBAwAAAAAAECN4AAAAAAAAYgQPAAAAAABAjOABAAAAAACIETwAAAAAAAAxggcAAAAAACBG8AAAAAAAAMQIHgAAAAAAgBjBAwAAAAAAECN4AAAAAAAAYgQPAAAAAABAjOABAAAAAACIETwAAAAAAAAxggcAAAAAACBG8AAAAAAAAMQIHgAAAAAAgBjBAwAAAAAAECN4AAAAAAAAYgQPAAAAAABAjOABAAAAAACIETwAAAAAAAAxggcAAAAAACBG8AAAAAAAAMQIHgAAAAAAgBjBAwAAAAAAECN4AAAAAAAAYgQPAAAAAABAjOABAAAAAACIETwAAAAAAAAxggcAAAAAACBG8AAAAAAAAMQIHgAAAAAAgBjBAwAAAAAAECN4AAAAAAAAYgQPAAAAAABAjOABAAAAAACIETwAAAAAAAAxggcAAAAAACBG8AAAAAAAAMQIHgAAAAAAgJTtNqmFtA42Y9kAAAAASUVORK5CYII=) ## Add a Windows device to the corporate device identifier **Windows Autopilot Device Preparation** does not require a device hardware hash. However, to ensure the device is correctly identified as a **corporate device**, you must provide the **device serial number**. This allows Intune and Autopilot to recognize and manage the device under your organization’s policies without relying on the hardware hash. Follow the steps below to add the device serial number as a corporate identifier. - On the Intune admin console, navigate to Devices > Enrollment > Corporate Identifier and select Add identifiers - On the Select identifier type, select Serial number - Under Enter identifiers, enter the Serial number and details, and click on Add. ![Intune corporate identifier](https://techuisitive.com/wp-content/uploads/2024/09/image-23.png)You can now see that the device serial number is listed under the Corporate device identifiers list. ![Intune corporate identifier](https://techuisitive.com/wp-content/uploads/2024/09/image-22-1024x315.png)## Reset Device to Factory Settings The device should be reset to the factory settings to enroll in Intune using Autopilot device preparation. Please follow the article below to reset a Windows 11 device to factory settings. [How to Reset Windows 11 PC to Factory Settings](https://techuisitive.com/how-to-reset-windows-11-pc-to-factory-settings/ "How to Reset Windows 11 PC to Factory Settings") ## End User Experience Once a **Windows 11 device** is reset to factory settings, the first screen the user sees is the **country or region selection**. At this stage, select the correct **country/region** from the list and then click **Next** to continue with the setup process. ![Is this the right country or region Windows OOBE](https://techuisitive.com/wp-content/uploads/2024/07/image-25-1024x735.png)On the **Want to add a second keyboard layout?** screen, select **Add** if you want to configure an additional keyboard layout, or choose **Next** to skip this step and continue to the next screen in the Windows 11 setup process. ![Windows OOBE Is this the right keyboard layout or input method](https://techuisitive.com/wp-content/uploads/2024/07/image-26-1024x735.png)On the **Want to add a second keyboard layout?** screen, select **Add** if you want to configure an additional keyboard layout, or choose **Next** to skip this step and continue to the next screen in the Windows 11 setup process. ![Windows 11 OOBE Want to add a second keyboard layout](https://techuisitive.com/wp-content/uploads/2024/07/image-27-1024x739.png)On the **Checking for updates** screen, Windows 11 will automatically search for the latest updates, wait for the process to complete, and once finished, the setup will continue to the next step. ![OOBE Checking for updates](https://techuisitive.com/wp-content/uploads/2024/11/image-1024x737.png)On the **Please review the License Agreement** screen, carefully read through the license terms, and once you are satisfied, click **Accept** to proceed with the Windows 11 setup process. ![OOBE Please review the license agreement](https://techuisitive.com/wp-content/uploads/2024/07/image-35-1024x737.png)On the **Let’s set things up for your Work or school** screen, enter your **organization account credentials** (such as your work or school email address) to connect the device to your organization and continue with the Windows 11 setup process. ![OOBE Let's set things up for your work or school](https://techuisitive.com/wp-content/uploads/2024/07/image-36-1024x740.png)You will now see the **Setting up for work or school** screen, where Windows 11 begins applying your organization’s configuration. This process may take some time depending on the number of **applications, policies, and scripts** assigned to the device, so allow the setup to complete before proceeding. ![Windows 11 Setting up for work or school](https://techuisitive.com/wp-content/uploads/2024/09/image-33-1024x649.png)Once the setup is completed, you will see the **Required setup is complete** screen; click **Next** to proceed to the following step in the Windows 11 setup process. ![Windows 11 setup Required setup is complete](https://techuisitive.com/wp-content/uploads/2024/09/image-34-1024x718.png)On the **Choose privacy settings for your device** page, configure the privacy options according to your requirements or organizational policies, and then click **Next** to continue with the Windows 11 setup process. ![Windows 11 setup Choose privacy settings for your device](https://techuisitive.com/wp-content/uploads/2024/09/image-36-1024x731.png)On the **Use Windows Hello with your account** page, simply click **OK** to enable Windows Hello and continue with the setup process. ![Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide Use Windows Hello with your account](https://techuisitive.com/wp-content/uploads/2024/09/image-37-1024x732.png)On the **Set up a PIN** page, enter the PIN you want to use for the device, choosing either a **numeric** or **alphanumeric** PIN, and then click **OK** to continue with the Windows 11 setup process. ![Windows 11 Setup Set up a PIN](https://techuisitive.com/wp-content/uploads/2024/09/image-38-1024x735.png)The **Windows Autopilot Device Preparation** process is now complete. On the final screen, click **OK** to finish and begin using the device with your organization’s configurations applied. ![Windows Autopilot Device Preparation ](https://techuisitive.com/wp-content/uploads/2024/09/image-39-1024x723.png)## Monitoring & Troubleshooting Autopilot Device Preparation The **Windows Autopilot Device Preparation deployments Status report**, found under **Devices → Monitor**, provides a **real-time view of device provisioning** using the Device Preparation policy. - The **deployment status** clearly indicates whether a device is **In progress**, **Success**, or **failed**. - The report also breaks down the **policy installation**, **app installation**, and **script execution** status, giving admins visibility into which components have been applied successfully and where issues may exist. This makes it a central place for IT admins to track Autopilot provisioning health and troubleshoot failures quickly. Would you like me to draft a **stepwise troubleshooting checklist** for interpreting and resolving common failures shown in this report? ![Windows Autopilot device preparation deployments status](https://techuisitive.com/wp-content/uploads/2024/11/image-3-1024x293.png)Once you select the **Windows Autopilot device preparation deployments status** report, you’ll see a list of all devices that have been provisioned or are currently in progress. From this view, you can click on a specific **device name** to drill down into detailed information about that device—such as the progress of policy application, app installations, and script execution—helping you quickly identify where provisioning is succeeding or where issues may need troubleshooting. ![Windows Autopilot device preparation deployments status](https://techuisitive.com/wp-content/uploads/2024/11/image-4-1024x309.png)The **Device deployment details flyer window shows the device information, the** status of the app’s installation, and the status of the script execution. Select the **device name** to view: - **Policy installation status** → Confirms if configuration profiles were applied. - **App installation status** → Shows which apps were installed successfully or failed. - **Script execution status** → Indicates whether assigned scripts ran correctly. ![Windows Autopilot device preparation deployments status](https://techuisitive.com/wp-content/uploads/2024/11/image-5-1024x442.png)## Classic Autopilot vs. Autopilot Device Preparation (v2) The table below highlights the key differences between **Classic Autopilot** and **Autopilot Device Preparation (v2)**, helping IT admins quickly understand how the new approach streamlines deployment compared to FeatureClassic AutopilotAutopilot v2 Device PreparationDevice IdentificationHardware hash import requiredSerial number onlyRegistrationMust register with Autopilot serviceNo registration neededSetup SpeedSlower, manual stepsFaster, automatedUse CasesStandard provisioningTenant migration, re‑provisioning## Conclusion Windows Autopilot Device Preparation (Autopilot v2) represents a major step forward in simplifying modern device deployment. By eliminating the need for hardware hash imports and leveraging serial numbers for identification, it streamlines provisioning, reduces administrative overhead, and accelerates onboarding. Whether you’re re‑provisioning devices for new users, migrating between tenants, or standardizing enterprise setups, Autopilot v2 ensures a faster, cleaner, and more secure deployment experience. Following this step‑by‑step guide, IT admins can confidently adopt Autopilot Device Preparation to future‑proof their Windows 11 deployment strategy. ## Frequently Asked Questions (FAQs) ### What is Windows Autopilot Device Preparation (Autopilot v2)? Windows Autopilot Device Preparation, also known as **Autopilot v2**, is Microsoft’s streamlined provisioning method for Windows 11 devices. Unlike classic Autopilot, it uses the **device serial number instead of hardware hashes**, simplifying deployment and reducing administrative overhead. ### How is Autopilot v2 different from classic Windows Autopilot? **Classic Autopilot:** Requires hardware hash import and device registration. **Autopilot v2 (Device Preparation):** Uses serial numbers, no hardware hash required, faster setup. This makes Autopilot v2 ideal for **tenant migrations, re‑provisioning, and bulk deployments**. ### What are the requirements for using Windows Autopilot Device Preparation? - **Operating System:** Windows 11 version 22H2 or 23H2 with update KB5035942 or later. - **Identity:** Only **Microsoft Entra ID join (Azure AD join)** is supported. - **Device Registration:** Device must not already be registered with classic Autopilot. - **Licensing:** Users must have **Intune and Entra ID Premium licenses** assigned. ### How do I configure automatic Intune enrollment for Autopilot v2? Enable **automatic MDM enrollment** in Microsoft Entra ID: - Go to **Azure portal > Entra ID > Mobility (MDM and MAM) > Microsoft Intune**. - Configure **MDM user scope** to include the required Azure AD group. - This ensures devices joining Entra ID are automatically enrolled in Intune. ### Can I assign apps and PowerShell scripts during Autopilot Device Preparation? Yes. You can assign up to **10 managed applications** and **10 PowerShell scripts** to run automatically during provisioning. These must be set as **required assignments** to ensure consistent deployment across all devices. ### How do I add a device to the corporate device identifier list? Instead of hardware hashes, Autopilot v2 requires the **device serial number**: - Navigate to **Intune Admin Center > Devices > Enrollment > Corporate Identifier**. - Select the serial **number** and add the device details. This ensures the device is recognized as corporate‑owned. ### What happens if a device is already registered with classic Autopilot? If a device is registered with classic Autopilot, its **existing Autopilot profile takes precedence**. You must **deregister the device** before applying an Autopilot Device Preparation policy. ### How can IT admins monitor and troubleshoot Autopilot Device Preparation deployments? Use the **Deployment Status Report** in Intune: - Navigate to **Devices > Monitor > Autopilot Device Preparation deployments**. - View provisioning status (In progress, Success, Failed). - Drill down into **policy installation, app installation, and script execution** to identify issues. ### Is Autopilot Device Preparation supported for Windows 10 devices? No. Autopilot v2 is designed for **Windows 11 devices only**. Windows 10 devices must use the **classic Autopilot process** with hardware hash registration. ## Related Posts - [How to Fix Autopilot error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/ "How to Fix Autopilot error 80070002") - [Windows Autopilot Device Preparation – Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/ "Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide") - [Windows 10 Autopilot Deployment Guide | Intune](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) - [Intune – Configure Enrollment Status Page (ESP)](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Bulk enrollment of Windows 10/ 11 Device to Intune using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Enroll Windows 11 Device to Intune through Azure AD Join method](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Windows 11 enrollment with Provisioning package failed with error code 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/). ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Windows Autopilot Guides** ](https://techuisitive.com/autopilot/ "Windows Autopilot") – Continue exploring Windows Autopilot with related guides covering device enrollment, provisioning, deployment, troubleshooting, and post-deployment management. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides, Windows Autopilot **Tags:** Autopilot Featured, Autopilot Guides, intune featured, Intune Guides --- ### [How to Manage Local Administrators Group Membership on Microsoft Entra Joined Devices Using Intune](https://techuisitive.com/how-to-manage-the-local-administrators-group-on-azure-ad-joined-devices-intune/) **Published:** July 26, 2023 **Author:** Equebal Ahmad **Excerpt:** Starting with Windows 10 version 20H2, you can use Azure AD groups to manage local administrators group privileges on Azure AD joined devices with the Local Users and Group MDM policy. Organizations can use Microsoft Intune to manage these policies using Custom OMA-URI Settings or Account protection policy. **Content:** Managing the **local Administrators group** on **Azure AD joined devices** is a critical part of securing enterprise endpoints. By leveraging **Microsoft Intune** and **Endpoint Manager**, IT administrators can centrally control who has elevated privileges, reducing the risk of unauthorized access and ensuring compliance with organizational policies. In this guide, we’ll walk through how to manage the **local admin group membership** using Intune. This approach simplifies **Windows device management**, strengthens **endpoint security**, and provides a scalable way to enforce **least privilege access** across your environment. Note: Azure AD is now Entra ID. As of now following local groups can be managed using the Local Users and Groups MDM policy. - Administrators - Users - Guests - Power Users - Remote Desktop Users - Remote Management Users ## Step 1: Create an Azure AD Group We will create an **Entra ID (formerly Azure AD) Security Group** that will be added to the **local Administrators group** on **Azure AD–joined devices**. Using an **Azure AD security group** simplifies management because you only need to add a user to the group to grant them **local admin rights** on targeted devices. This approach provides centralized control, reduces manual effort, and ensures consistent enforcement of **Intune security policies** across your environment. Create an Azure AD group with the following details. - **Group Type**: Security - **Group Name**: IT – Helpdesk - **Azure AD roles can be assigned to the group**: Select Yes. - **Membership Type:** Assigned - **Members**: Add the user if you want to add any at this point in time. Follow the [Create Azure AD Group](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/#CreateAzureADGroup) if you need any help in creating the group. ## Step 2: Create an Account Protection Policy The next step is to create an account protection policy. To create a local users group membership policy, you need to log in to the Intune portal [https://intune.microsoft.com ](https://intune.microsoft.com) 1. Navigate to **Endpoint Security** 2. Select **Account protection** 3. Click on **+ Create Policy** to start the policy creation process 4. From **Create a profile**, select the following - **Platform:** Windows 10 and later - **Profile:** Local user group membership 5. Click on **Create** ![Intune | Account Protection policy](https://techuisitive.com/wp-content/uploads/2023/07/image-35-1024x452.png)Enter the **Name** and **Description** for the profile and click on **Next** to move to the **Configuration Settings** page. ![Intune | Account Protection policy](https://techuisitive.com/wp-content/uploads/2023/07/image-36.png)## Step 3: Add Configuration Settings for Managing Local Administrator Group Membership On the **Configuration Settings** page, select all required settings. The following settings are available and need to be selected. ### **Local Group:** Select **Administrator,** as we are adding users / AAD group to the local admin group in this example. Other local groups that can be managed by **Local Users and Group** MDM policy are: Users, Guest, Power Users, Remote Desktop Users, and Remote Management Users. ### **Local Group and user action**: The [local group and user management policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-localusersandgroups) have two actions available. They are called **Update (U)** and **Replace / Restrict (R)**. - **Update Group Membership:** Update a group and add/remove members. When using update, existing group members that are not specified in the policy remain untouched. - **Replace Group Membership:** Restrict a group by replacing group membership. When using Replace, existing group membership is replaced by the list of members specified in the policy. Any member not specified in the policy is removed. In Microsoft Intune, you need to select one of the following options. - **Add (Update) :** Add members to the specified group. The other member already present in the local group will not be touched. - **Remove (Update):** Remove members from the specified group. The other members already in a group and not listed in the policy will remain intact. - **Add (Replace):** Replace the existing members of the group with the members provided in the policy. ### **User Selection Type:** - **Users / Groups:** Allow you to select Azure AD users / Azure AD groups - **Manual:** allows you to add the following - Username - Domain\\Username - SID (Security Identifier) ### **Selected users/groups:** Select Users / Groups or provide details manually based on User Selection Type. ![Intune | Add user to local administrator group](https://techuisitive.com/wp-content/uploads/2023/07/image-43-1024x743.png)## Step 4: Assign & Create Policy On the **Assignment page**, you can assign the policy to an Azure AD group, All users, or All devices based on your requirement. Since we are doing this in the test environment, we selected all devices. You can also use [Assignment Filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/) for more granular targeting of policy. Click on **Next**. ![Intune | Manage local administrators group members](https://techuisitive.com/wp-content/uploads/2023/07/image-41-1024x552.png)On the **Review + create**, review the details and click on the **Create** button to create the policy. ![Intune | Manage local admin group members](https://techuisitive.com/wp-content/uploads/2023/07/image-42-1024x699.png)## Verify Result on Targeted Device To **verify the results**, perform the following steps on one of the **targeted Azure AD–joined devices**. This will confirm that the **Intune Device Configuration Profile** has been applied correctly and that the intended **local administrator group changes**. - Launch **Compmgmt.msc** - Navigate to **Local Users and Groups / Groups** - Double-click on **Administrator** - Verify if required AAD groups/users are now members of the local **Administrator** group. The highlighted SID is for the Azure AD group that we have selected in the **Local User and Group** policy. ![Windows 10 / 11 | Azure AD local group admin](https://techuisitive.com/wp-content/uploads/2023/07/image-44.png)## Related Posts - [Block USB Device Access with Exceptions | Microsoft Intune](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows Local Administrator Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [Check OS Version Compliance with Device Compliance Policy & Notify User | Microsoft Intune](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/) - [How to manage the local administrators group on Azure AD joined devices | Intune](https://techuisitive.com/how-to-manage-the-local-administrators-group-on-azure-ad-joined-devices-intune/) Tags: [Endpoint Security](https://techuisitive.com/tag/endpoint-security/), [Intune Guides](https://techuisitive.com/tag/intune-guides/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Endpoint Security, Intune Guides --- ### [BitLocker : The encryption method of the OS volume doesn't match the BitLocker policy](https://techuisitive.com/bitlocker-the-encryption-method-of-the-os-volume-doesnt-match-the-bitlocker-policy/) **Published:** January 6, 2025 **Author:** Equebal Ahmad **Content:** We identified a **BitLocker encryption issue** impacting **Windows 10** and **Windows 11** devices managed through **Microsoft Intune**. During deployment, several endpoints failed to encrypt and displayed **BitLocker error messages** related to policy enforcement. After detailed troubleshooting, we discovered the problem is isolated to two specific \*\*HP EliteBook models—830 G6 and 830 G5—\*\*while other HP devices successfully complete **OS volume encryption** without errors. This highlights a compatibility gap between **BitLocker policies, Intune management, and hardware models** that administrators should be aware of. The BitLocker encryption was failing on multiple devices, resulting in the following errors. Error1: ***The encryption method of the OS volume doesn’t match the BitLocker policy. To encrypt drives, the BitLocker policy requires either the user to sign in as an Administrator or if the device is joined to Microsoft Entra ID, the AllowStandardUserEncryption policy must be set to 1.*** Error2: ***The encryption method of the OS volume doesn’t match the BitLocker policy.*** The devices were showing the following details: - Encryption readiness: Not ready, Encryption status: Not encrypted - Encryption readiness: Ready, Encryption status: Not encrypted ## Cause & Solution Following guidance from **Microsoft Support**, we enabled specific settings within the **BitLocker policy**. After applying these changes, **Windows 10 and Windows 11 devices managed through Microsoft Intune** began encrypting successfully. However, Microsoft could not provide a definitive explanation as to why the issue impacts only two hardware models—the **HP EliteBook 830 G6** and **HP EliteBook 830 G5**—while other HP devices complete **OS volume encryption** without errors. ### **BitLocker Base Settings:** - Warning to other disk encryption: Block - Allow standard users to enable encryption during Microsoft Entra join: Allow - Configure encryption methods: Enable ![Intune BitLocker Settings](https://techuisitive.com/wp-content/uploads/2024/12/image.png)## Related Posts - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Device Configuration Troubleshooting --- ### [Manage Windows Drivers Update with Intune](https://techuisitive.com/manage-windows-drivers-update-with-intune/) **Published:** April 17, 2025 **Author:** Equebal Ahmad **Content:** Windows Driver Update Management in Microsoft Intune allows you to manage the drivers for Windows devices. You can review, approve, and pause the deployment of driver updates on managed Windows 10 and Windows 11 devices. Microsoft Intune and Windows Update for Business deployment service identify the required drivers for the devices based on the driver update policy assigned. These Intune features simplify driver update management, reduce manual effort, and enhance control over device updates. Windows Driver Update Management is available with Intune Plan 1. Driver updates are supported for Windows 10/11 Enterprise, Education, and Microsoft 365 Business Premium devices. Table Of Contents 1. [Key Takeaways](#key-takeaways) 2. [Allow Windows driver updates through Software Updates Ring](#allow-windows-driver-updates-through-software-updates-ring) 3. [Create Drivers Update Policy](#create-drivers-update-policy) 4. [Review and Approve Drivers](#review-and-approve-drivers) 5. [Monitor Drivers Deployment](#monitor-drivers-deployment) 6. [Conclusion](#conclusion) 7. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) 8. [Related Posts](#related-posts) 9. [Explore More Intune Guides](#explore-more-intune-guides) ## Key Takeaways **Centralized driver control** – Intune lets admins manage Windows driver updates directly, reducing manual effort. **Approval flexibility** – Policies can be set for manual or automatic driver approvals, balancing safety and efficiency. **Pilot-first strategy** – Separate pilot and production policies to ensure updates are tested before broad rollout. **Visibility through reporting** – Built-in driver update reports provide clear insights into approvals, installations, and issues. ## Allow Windows driver updates through Software Updates Ring Before you create a driver update policy, you need to ensure that the **Windows drivers** update option is set to Allow in the **Update ring** settings. ![Intune software update ring - allow windows drivers update](https://techuisitive.com/wp-content/uploads/2024/08/image-11.png)## Create Drivers Update Policy The next step is to create a driver update policy. The driver update policy determines which drivers would be deployed on the devices. You can create more than one driver update policy. For example, you want to test the driver update on a small number of devices before the production rollout. You can have a separate policy for pilot and production deployment. Follow the steps below to create a driver update policy. - On the Intune admin center, navigate to the **Devices > Windows Updates** blade - Select the **Driver Updates** tab, and then select **Create profile** ![Intune Driver updates tab in Intune admin center](https://techuisitive.com/wp-content/uploads/2025/03/image.png)On the **Create** **Driver update profile > Basics** page, enter a suitable name and description for the profile and click on Next. ![Intune driver update policy](https://techuisitive.com/wp-content/uploads/2025/03/image-1.png)Select one of the options on the Settings page. These options determine whether you approve each driver manually or allow Intune to deploy recommended drivers automatically. The approval method cannot be changed once the policy is created. However, you can change the approval state of individual drivers. If you want to change the approval method for a policy, then you need to create a new driver update policy. - Manually approve and deploy driver updates - Automatically approve all recommended driver updates ![Intune driver update approval method.](https://techuisitive.com/wp-content/uploads/2025/03/image-2.png)On the **Assignment** page, assign the policy to an Entra ID group. Select **Next** to move to the **Review** page. You can also exclude the groups from the assignment. ![Intune driver update | policy assignment](https://techuisitive.com/wp-content/uploads/2025/03/image-3-1024x668.png)On the **Review + Create** page, review the policy settings. If everything looks good, then select Create to complete the policy creation process. You can select the Previous button to go back if any changes are required in the policy. ![Intune device configuration profile | review + create page](https://techuisitive.com/wp-content/uploads/2025/03/image-4-1024x792.png)## Review and Approve Drivers Once an Intune driver update policy is configured and applied, the device syncs with Intune to receive the driver update policy. Intune communicates with Windows Update to identify applicable driver updates for the device. Initially, you may not see any drivers under **Drivers to review** for the policy you created, as the driver identification process takes time. ![Intune Drivers update policy | review drivers update policy](https://techuisitive.com/wp-content/uploads/2025/03/image-5-1024x458.png)Once the scan is completed and data syncs with Intune, you will see the number of drivers to review. Click on the <**x to review**> column under **Drivers to review** column. ![Intune driver update policy.](https://techuisitive.com/wp-content/uploads/2025/03/image-6-1024x98.png)### Driver Version Management in Intune You will now see two tabs, **Recommended drivers** and **Other drivers**. The latest driver updates published by the driver publisher are visible on the **Recommended Drivers** page. ![](https://techuisitive.com/wp-content/uploads/2025/04/image-8-1024x342.png)- **Older drivers are archived**: The older driver versions are automatically moved to the **Other Drivers** page in Intune. This keeps the active driver list clean and focused on current deployments. - **Automatic version updates**: Intune intelligently detects when a new driver version is available and automatically picks the **latest driver** for deployment. - **Streamlined lifecycle management**: Admins don’t need to manually track or replace outdated drivers—Intune ensures devices always receive the most up‑to‑date, approved versions. - **Reduced risk of compatibility issues**: By maintaining only the latest drivers in deployment, Intune minimizes conflicts and ensures smoother device performance. - **Visibility and control**: Even though older drivers are moved to the Other Drivers page, admins can still review them for historical context or troubleshooting. ![](https://techuisitive.com/wp-content/uploads/2025/04/image-7-1024x464.png)### Approving a Driver Update in Intune To approve a driver update in Microsoft Intune: - **Locate the driver** - Navigate to the **Driver name** column in the Intune admin center. - Select the driver you want to manage. - **Open the Manage Driver flyout** - This window provides available actions for the selected driver. - **Choose the action: Approve** - Click **Approve** to authorize deployment of the driver update. - This ensures the driver is validated and ready for rollout. - **Set availability in Windows Update** - Under **Make available in Windows Update**, select a specific date. - This date determines when the driver update becomes visible to end‑user devices for installation. - Scheduling availability allows admins to **control rollout timing**, align with maintenance windows, and minimize disruption. ![Intune drivers update - Review and approve driver](https://techuisitive.com/wp-content/uploads/2025/03/image-10-1024x530.png)You can see the driver’s status as Approved. ![Intune drivers update approval state - approve a driver](https://techuisitive.com/wp-content/uploads/2025/03/image-11-1024x74.png)## Monitor Drivers Deployment Intune provides reporting options for driver updates to help administrators monitor and manage the update process effectively. The Windows Driver Update Report provides insight into the status of driver updates on the device. This report shows which updates are applicable, approved, installed, or paused. To check the driver update report, navigate to **Reports > Windows Updates** and select **Windows Driver Update Report**. ![Windows Driver Update Report](https://techuisitive.com/wp-content/uploads/2025/04/image-1-1024x365.png)Click **Select a driver update,** then select the drivers from the flyer window. Select **Generate Report** to generate the driver deployment status report. ![](https://techuisitive.com/wp-content/uploads/2025/04/image-2.png)You can now see the status of driver deployment. ![Intune drivers update deployment status report.](https://techuisitive.com/wp-content/uploads/2025/04/image-1024x421.png)The following articles may help you troubleshoot Intune driver deployment-related issues. [Intune Driver update – Device not reporting correct status](https://techuisitive.com/intune-driver-update-device-not-reporting-correct-status/) ## Conclusion Managing driver updates with Intune gives IT admins the ability to balance **control, safety, and efficiency**. By leveraging approval policies, pilot deployments, RBAC assignments, and built-in reporting, organizations can ensure devices remain secure and compatible without overwhelming manual effort. Whether you choose manual or automatic approvals, Intune’s structured approach reduces risk and simplifies driver lifecycle management across Windows 10/11 environments. ## Frequently Asked Questions (FAQs) ### **Which editions of Windows support Intune driver update management?** Windows 10/11 Enterprise, Education, and Microsoft 365 Business Premium editions are supported. ### **Can I switch from manual to automatic approval in the same policy?** No. Approval method is fixed per policy. To change, you must create a new policy. ### **How can I safely test driver updates before broad rollout?** Create a **pilot policy** for a small group of devices, validate stability, then roll out to production. ### **How do I monitor driver update status across devices?** Use the **Windows Driver Update Report** in Intune to track approvals, installations, and paused updates. ## Related Posts - [How to Enable Azure Single Sign-On in Google Chrome](https://techuisitive.com/enabling-azure-single-sign-on-in-google-chrome-with-intune-dont-miss-this-key-setting/ "How to Enable Azure Single Sign-On in Google Chrome") - [How to Allow Copilot in Microsoft Edge Using Intune](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/) - [Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [How to Configure Google Chrome settings using Administrative templates | Intune](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Manage Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Edge Chromium Favorites with Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune Guides, Windows Updates --- ### [How to Manage Windows LAPS with Intune](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) **Published:** June 22, 2023 **Author:** Equebal Ahmad **Content:** Windows LAPS (Local Administrator Password Solution) is now built directly into Windows and does **not** require installation of the legacy Microsoft LAPS. All modern features are available without referring back to the old solution, making deployment simpler and more secure. In this blog post, we’ll explore how to use **Microsoft Intune** together with **Windows LAPS** to automatically manage and rotate local administrator passwords across **Windows 10 and Windows 11 devices**. This step‑by‑step guide will help IT admins strengthen endpoint security, enforce password rotation policies, and streamline management of local admin accounts. Windows LAPS is now built-in with the following OS versions installed with the April 2023 Updates, or any later version. - Windows 11 22H2 - Windows 11 21H2 - Windows 10 - Windows Server 2022 - Windows Server 2019 Table Of Contents 1. [Pre-requisites](#pre-requisites) 2. [How to Manage Windows LAPS policies with Microsoft Intune](#how-to-manage-windows-laps-policies-with-microsoft-intune) 3. [How to Review policy assignments from the Intune console](#how-to-review-policy-assignments-from-the-intune-console) 4. [How to Retrieve Local Admin Password for a Device](#how-to-retrieve-local-admin-password-for-a-device) 5. [Review the Windows LAPS policy assignment status on a device](#review-the-windows-laps-policy-assignment-status-on-a-device) 6. [How to rotate the local admin password from the Intune console](#how-to-rotate-the-local-admin-password-from-the-intune-console) 7. [Conclusion](#conclusion) 8. [Frequently Asked Questions (FAQs) for Managing Windows Local Administrator Password with Intune & Windows LAPS](#frequently-asked-questions-faqs-for-managing-windows-local-administrator-password-with-intune-windows-laps) 9. [Related Posts](#related-posts) 10. [Explore More Intune Guides](#explore-more-intune-guides) ## Pre-requisites Before configuring Windows Local Administrator Password Solution (Windows LAPS) with Intune, you must meet the following requirements. ### **Operating System Support** - Windows 10 (version 20H2 or later, with April 2023 cumulative update that introduces native Windows LAPS support) - Windows 11 (April 2023 update or later) - Windows Server 2019/2022 (with latest cumulative updates for Intune LAPS integration) ### ****Licensing & Intune Requirements**** - Active **Microsoft Intune subscription** - **Azure AD Premium P1/P2** for role-based access control (RBAC) and conditional access - Devices must be **Azure AD joined,** or **Hybrid Azure AD joined,** and enrolled in Intune ### **Permissions & Roles** - Intune Administrator or Security Administrator role to configure LAPS policies - Optional: **Helpdesk RBAC role** for password retrieval without elevated rights ### **Connectivity & Updates** - Devices must have internet connectivity to sync with the Intune service - Latest cumulative updates installed to ensure the **Windows LAPS policy CSP** is functional - Verify **Intune Management Extension** is running properly for policy deployment ### **Security Baseline Alignment** - Password complexity and rotation interval are defined in the **Intune LAPS policy** - Ensure compliance with organizational **security baselines** for local admin accounts ## How to Manage Windows LAPS policies with Microsoft Intune You can leverage Microsoft Intune Endpoint Security policies for account protection to configure and manage Windows LAPS on devices enrolled with Intune. This Intune LAPS setup enables secure local administrator password management and automated password rotation across Windows 10 and Windows 11 endpoints. By integrating LAPS Intune policies, organizations can simplify configuration, strengthen endpoint security, and ensure compliance with password rotation best practices. Intune policies can: - Enforce password requirements for local admin accounts - Backup local admin accounts from the device to your Active Directory or Entra ID - Schedule rotation of those account passwords to help keep them safe - Enforce password requirements for local admin accounts You can also view details about the managed local admin accounts in the Intune Admin center, and manually rotate their account passwords outside of a scheduled rotation. Let’s understand how to configure LAPS in Intune. ### 1. Role-based access control for Windows LAPS The following permissions are required to manage LAPS policy. **Create and access LAPS policy:** The **Endpoint Security Manager** built-in role includes necessary permissions to manage LAPS policy by default. For a custom role, your account must be assigned sufficient permissions from the Intune RBAC category for the security baseline. **Rotate local Administrator password**: To use the Intune admin center to view or rotate a device’s local admin account password, your account must be assigned the following Intune permissions: - Manage Device: **Read** - Organization: **Read** - Remote tasks: **Rotate Local Admin Password** **Retrieve local Administrator password**: To view password details, your account must have one of the following Azure Active Directory permissions: - `microsoft.directory/deviceLocalCredentials/password/read` - `microsoft.directory/deviceLocalCredentials/standard/read` **Related Post: [How to Create Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/)** ### 2 Enable Windows LAPS in Entra ID Before you start managing the local administrator password using Intune, the LAPS settings need to be enabled in Azure Active Directory. To enable the settings, go to Azure Active Directory > Device > Device Settings and turn on “**Enable Azure AD Local Administrator Password Solution (LAPS) (Preview)**“. ![How to Enable LAPS in Intune](https://techuisitive.com/wp-content/uploads/2023/05/image-22-1024x660.png) ### 3. Create a policy in Microsoft Intune for LAPS setup **Step 1:** To create a policy in Microsoft Intune, navigate to Endpoint Security / Account Protection, click on Create policy, and select the following **Platform:** Windows 10 and later **Profile:** Local admin password solutions (Windows LAPS) ![Intune - Create LAPS policy for LAPS intune](https://techuisitive.com/wp-content/uploads/2023/05/image-23-1024x471.png)**Step 2:** Enter a policy name Choose a clear, descriptive name such as *“Windows LAPS – Local Admin Password Policy”*. This helps identify the profile later when managing multiple Intune LAPS configurations. Optionally, add a description to document the purpose (e.g., *“Configure Intune LAPS for automated password rotation on Windows 10/11 devices”*). ![Intune | Create Profile for intune laps setup](https://techuisitive.com/wp-content/uploads/2023/05/image-24-1024x658.png)**Step 3:** On the **Configuration Settings** page in the Intune admin center, you define how Windows LAPS will manage local administrator passwords across enrolled devices. This is the core of your Intune LAPS setup: #### **Backup Directory** Define where the password is stored (Azure AD). The following options are available. - Back up the password to Azure AD only - Disabled (Password will not be backed up) - Back up the password to Azure AD only - Back up the password to Active Directory only - Not Configured #### Password Age Days Set how frequently Intune LAPS rotates the local administrator password (e.g., every 30 days). Automated rotation ensures compliance with security baselines and eliminates stale credentials. #### **Administrator Account Name** Choose whether to manage the built‑in Administrator account or specify a custom local admin account. This ensures Intune LAPS policies apply consistently across all endpoints. #### Password Complexity Configure password length, character types (uppercase, lowercase, numbers, special characters), and overall complexity. Strong password rules reduce the risk of brute‑force or credential theft attacks. The following options are available. - Large letters + small letters + numbers + special characters - Large letters - Large letters + small letters - Large letters + small letters +numbers + special characters - Not configured #### Post Authentication Action Configure the post-authentication action that you want to enforce post-user authentication. The following options are available. - **Reset password:** upon expiry of the grace period, the managed account password will be reset. - **Reset the password and log off the managed account:** upon the expiry of the grace period, the managed account password will be reset and any interactive logon session using the managed account will be terminated. - **Rest the password and reboot:** upon the expiry of the grace period, the managed account password will be reset and the managed device will be immediately rebooted. - ![Intune - LAPS policy configurations](https://techuisitive.com/wp-content/uploads/2023/05/image-25-1024x740.png)**Step 4:** On the **Assignment** page in the Intune admin center, you can assign the Intune LAPS policy to **All Devices** for broad deployment or to specific **Azure AD groups** depending on organizational requirements, and to make your Intune LAPS setup more precise you can also apply **[assignment filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/ "Intune Filters – Assign Microsoft Store App policy using Filters")** to narrow the deployment scope further—for example, targeting only Windows 11 endpoints or devices in a particular department—ensuring that your configure Intune LAPS deployment delivers secure local administrator password management exactly where it’s needed while maintaining flexibility and alignment with security baselines. ![Intune | LAPS Policy assignment](https://techuisitive.com/wp-content/uploads/2023/05/image-26-1024x628.png)**Step 6:** On the **Review + Create** page in the Intune admin center, carefully verify all the details of your Intune LAPS setup—including the policy name, configuration settings such as password complexity and rotation interval, and the assigned device groups or filters—then confirm that everything aligns with your organizational requirements and security baselines; once satisfied, click **Create** to finalize and deploy the Intune LAPS policy, enabling secure local administrator password management across your Windows 10 and Windows 11 endpoints. ## How to Review policy assignments from the Intune console You can review the policy assignment status from the Endpoint Security / Account protection blade. To see the policy assignment status, simply navigate to Endpoint security / Account protection and select the policy you created for LAPS, and click on View Report to see the compliance status. You can also check the **Device assignment status** and **Per Setting Status**. ![Intune | Policy assignment status](https://techuisitive.com/wp-content/uploads/2023/05/image-28.png)## How to Retrieve Local Admin Password for a Device The local admin account password for managed devices will be backed up in Azure Active Directory. You can view the password for a device from the Microsoft Intune console using the steps below. - In the Intune console, navigate to Devices / All Devices and select the device for which you need to retrieve the local admin password - Select **Local Admin Password** from the left pane - Click on the **Show Local Administrator password** link ![Intune - Retrieve local admin password](https://techuisitive.com/wp-content/uploads/2023/05/image-30-1024x385.png)## Review the Windows LAPS policy assignment status on a device Windows LAPS processes the currently active policy periodically (every hour). To avoid waiting after you apply the policy, you can run the Invoke-LapsPolicyProcessing PowerShell cmdlet. This is usually helpful in testing or troubleshooting, as you can force the policy to run immediately. The Windows LAPS event logs can be found in Event Viewer under **Event Viewer > Application and Services Log > Microsoft > Windows > LAPS** node. The event log below shows that LAPS successfully updated the local admin account with the new password. ![Event Log: Local admin password updated](https://techuisitive.com/wp-content/uploads/2023/05/image-31.png "Event Log: Local admin password updated")The event log below shows that LAPS successfully updated the Azure Active Directory with the new password. ![Event viewer log : LAPS successfully updated Azure Active Directory with the new password.](https://techuisitive.com/wp-content/uploads/2023/06/image-1.png)## How to rotate the local admin password from the Intune console There may be an ad-hoc requirement to rotate the local admin password / reset the local admin password for a device. The situation may arise due to the disclosure of passwords to unauthorized users, a security breach or other reasons. You can follow the steps below to rotate passwords for an Intune-managed device. - Navigate to **Devices > Windows > Windows Devices** and select the Windows device for which you want to rotate the password - Click on the three dots icon on the right side and select **Rotate local admin password** - Click on **Yes** on the confirmation dialog box. ![Intune LAPS | how to rotate local admin password](https://techuisitive.com/wp-content/uploads/2023/06/image-1024x543.png)## Conclusion In conclusion, implementing **Windows LAPS with Intune** provides a streamlined and secure way to manage local administrator credentials across your environment. By completing the **Intune LAPS setup** and carefully configuring policies for password complexity, rotation intervals, and account selection, organizations can ensure automated password rotation and compliance with security baselines. Assigning policies to the right **Azure AD groups** and using filters makes the deployment flexible, while RBAC roles simplify password retrieval without compromising security. Ultimately, when you **configure Intune LAPS**, you gain centralized control, reduce the risk of credential theft, and strengthen endpoint protection across Windows 10 and Windows 11 devices—making **LAPS Intune integration** a critical component of modern endpoint security. ## Frequently Asked Questions (FAQs) for Managing Windows Local Administrator Password with Intune & Windows LAPS ### **What is Windows LAPS?** Windows LAPS (Local Administrator Password Solution) is a built‑in feature in Windows 10/11 and Windows Server that automatically manages and rotates local administrator passwords, improving endpoint security and reducing credential theft risks. ### **How does Intune integrate with Windows LAPS?** Microsoft Intune provides policies to configure Windows LAPS, allowing IT admins to enforce password complexity, rotation intervals, and backup settings. Passwords can be stored securely in Azure AD or Active Directory and retrieved through the Intune console. ### **What are the prerequisites for using Windows LAPS with Intune?** Devices must be running Windows 10 (20H2 or later with April 2023 update), Windows 11 (April 2023 update or later), or Windows Server 2019/2022. An active Intune subscription and Azure AD Premium P1/P2 licensing are required, and devices must be Azure AD joined or Hybrid joined. ### **Where are local administrator passwords stored with Intune LAPS?** Passwords can be backed up to **Azure AD** or **Active Directory**, depending on policy configuration. Admins can then securely retrieve them from the Intune console. ### **How often can Intune LAPS rotate local admin passwords?** Rotation intervals are configurable in Intune policies (e.g., every 30 days). Automated rotation ensures compliance with organizational security baselines and eliminates stale credentials. ### **Can Helpdesk staff retrieve local admin passwords?** Yes. With proper RBAC permissions, helpdesk roles can securely view or rotate local admin passwords without requiring elevated rights, ensuring operational flexibility without compromising security. ### **How can I manually rotate a local admin password in Intune?** From the Intune console, navigate to **Devices → Windows → Windows Devices**, select the target device, and choose **Rotate local admin password**. This is useful in case of a security breach or password disclosure. ### **How do I troubleshoot Windows LAPS policy processing?** Admins can force policy processing using the PowerShell cmdlet `Invoke-LapsPolicyProcessing`. Event logs are available under **Event Viewer → Applications and Services Logs → Microsoft → Windows → LAPS**, showing password rotation and backup status. ## Related Posts - [Block USB Device Access with Exceptions | Microsoft Intune](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows Local Administrator Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [Check OS Version Compliance with Device Compliance Policy & Notify User | Microsoft Intune](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/) - [How to manage the local administrators group on Azure AD joined devices | Intune](https://techuisitive.com/how-to-manage-the-local-administrators-group-on-azure-ad-joined-devices-intune/) Tags: [Endpoint Security](https://techuisitive.com/tag/endpoint-security/), [Intune Guides](https://techuisitive.com/tag/intune-guides/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Endpoint Security, Intune Guides --- ### [How to Disable Copilot via Intune Settings Catalog](https://techuisitive.com/disable-copilot-via-intune-settings-catalog/) **Published:** December 13, 2025 **Author:** Equebal Ahmad **Content:** Microsoft introduced **Copilot** with Windows 11. Copilot is a built‑in AI assistant that helps boost productivity and improve the user experience. While Copilot can be useful, some organizations may want to turn it off for reasons like **compliance**, **security**, or simply to keep the user experience consistent. IT admins can centrally manage this setting through Microsoft Intune and apply policies across all enrolled devices. This guide shows you a step-by-step guide to **disable Copilot in Windows 11 using Intune**, giving you full control while staying aligned with organizational requirements. ## Notes & Consideration - **Windows 11 23H2 and later**: Copilot is integrated into the OS, so disabling requires the following settings. - **Windows 11 24H2**: Copilot is packaged as a separate app. In this case, disabling may require **removing or blocking the Copilot app** in addition to the policy. - **Group Policy alternative**: For hybrid environments, you can also use the GPO setting **Turn off Windows Copilot** with updated ADMX templates ## What gets disabled - The **Copilot button on the Windows taskbar** will no longer launch Copilot. - The **Win + C keyboard shortcut** that normally opens Copilot will stop working. - The **Copilot sidebar experience in Windows** (the panel that integrates with system settings, apps, and productivity features) is turned off ## What is *not* affected - This policy does **not disable Copilot in Microsoft 365 apps** (like Word, Excel, Outlook, Teams). Those are managed separately with their own policies. - It does **not affect Copilot web or mobile apps** (Edge, iOS, Android, etc.). - It does **not block Bing Chat or Copilot in Edge** — those are controlled by browser or service-specific policies ## Create a Configuration Profile to Disable Copilot Follow the steps below to create an Intune settings catalog policy to turn off Copilot in Windows 11. Go to the **Intune Admin Center** → **Devices → Configuration profiles → Create profile** and select the following details. - Platform: **Windows 10 and later**. - Profile type: **Settings catalog** Click on **Create**. ![Intune Copilot policy | Disable Copilot Windows 11 | Intune Settings Catalog Copilot](https://techuisitive.com/wp-content/uploads/2025/12/image-1024x445.png)On the Create profile page, enter a profile name and description, and click on Next. ![Disable Windows AI settings Intune catalog](https://techuisitive.com/wp-content/uploads/2025/12/image-1-1024x557.png)- On the **Configuration settings** tab, select **Add settings** - On the **Settings picker**, search **Windows AI** and select **Windows AI** from the search results. - Select “**Turn off Copilot in Windows**” settings from the list. - Close the settings picker window. The **Windows AI section** of the **Intune Settings Catalog** gives IT admins detailed controls to manage **AI features in Windows 11**. Key options include: - **Turn off Copilot in Windows** – disables the built‑in AI assistant. - **Windows Recall controls** – manage the feature that captures screen snapshots for timeline search. - Other AI integrations – such as **Image Creator in Paint**. By configuring these settings, organizations can decide whether to allow or restrict **AI-driven experiences** like Copilot, Recall, and future integrations. Intune helps in managing these settings centrally, and admins can enforce consistent policies across all devices. This helps in compliance, security, and user experience. ![- Turn off Windows Copilot Intune ](https://techuisitive.com/wp-content/uploads/2025/12/image-2-1024x469.png)Toggle the configuration switch to Disable Copilot (or enabled, depending on the current UI layout). This action explicitly pushes the CSP (Configuration Service Provider) policy down to the Windows 11 device. ![- Turn off Windows Copilot Intune ](https://techuisitive.com/wp-content/uploads/2025/12/image-3.png)On the ‘Assignment’ page, assign the policy to the required group and click on **Next**. ![](https://techuisitive.com/wp-content/uploads/2025/12/image-4-1024x510.png)Review the policy details on the **Review + create** page and click on **Create** to complete policy creation. ![Disable Copilot Intune](https://techuisitive.com/wp-content/uploads/2025/12/image-5-1024x728.png)The policy is now created. You can check the assignment status from **Windows Devices > Configuration > ** ![Disable copilot inutne policy assignment status](https://techuisitive.com/wp-content/uploads/2025/12/image-6-1024x436.png)## Conclusion By turning off **Copilot in Windows 11** through **Microsoft Intune**, organizations gain more control over the user experience and make sure devices stay aligned with **corporate policies**. Whether the goal is to reduce distractions, meet **compliance requirements**, or keep a **standardized environment**, Intune gives IT admins a **centralized and scalable way** to enforce these settings across all managed endpoints. For administrators already using Intune for **device security** and **configuration management**, this policy fits right into existing workflows. To strengthen your Intune strategy even further, explore related guides on: - Configuring **firewall rules** - Collecting **device inventory** - Deploying **security baselines** Together, these steps help build a secure, well‑managed, and compliant **Windows 11 enterprise environment**. ## Frequently Asked Questions (FAQ) ### **Does disabling Copilot affect other Windows AI features?** No. The Intune policy specifically targets Copilot. Other AI features, like Recall or Paint Image Creator, must be managed separately through their own settings. ### **Can I re‑enable Copilot later if my organization changes its policy?** Yes. You can simply edit the Intune Settings Catalog profile and set *Turn off Copilot in Windows* to **Disabled** or remove the policy assignment. ### **Is this supported on Windows 10 devices?** No. Copilot is only integrated into Windows 11 (23H2 and later). Windows 10 devices are unaffected by this setting. ### **What happens if I apply the policy, but Copilot is still visible?** Check the OS version. On Windows 11 24H2, Copilot is packaged as a separate app, so you may also need to block or uninstall the Copilot app in addition to applying the Intune policy. ### **How long does it take for the policy to apply?** Policy application depends on Intune sync cycles. Typically, devices check in every 8 hours, but users can force a sync from the Company Portal or Settings app. ## Related Posts - [Collect Device Inventory Using Intune Properties Catalog](https://techuisitive.com/collect-device-inventory-using-intune-properties-catalog/) - [Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) - [How to Reset Windows 11 PC to Factory Settings](https://techuisitive.com/how-to-reset-windows-11-pc-to-factory-settings/) - [How to Block Built-in Apps on iOS Using Intune](https://techuisitive.com/how-to-block-built-in-apps-on-ios-using-intune/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/) - [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/) - [How to Rename Device from Intune](https://techuisitive.com/how-to-rename-device-from-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Configuration, Intune Guides, Windows Experience --- ### [How to Configure Windows Kiosk Using Microsoft Intune | Windows 10 / 11](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) **Published:** January 11, 2023 **Author:** Equebal Ahmad **Excerpt:** Windows kiosk is a lockdown mechanism to restrict device access to pre-defined applications. The applications appears on the desktop and user can only use those applications. Kiosk are mostly placed in public area to allow access to specific applications to authorized users or guests. For example, a self check-in kiosk at airport. We can use Microsoft Intune to deploy a Device configuration profile to configure Windows Kiosk on Windows 10 / 11 device as single app or multi-app kiosk. **Content:** Looking to lock down Windows 10 or 11 devices for secure, purpose‑built use? Microsoft Intune makes it easy to configure kiosks that run only approved apps—perfect for self‑service stations, digital signage, or frontline workers. In this step‑by‑step guide, we’ll show you how to set up both single‑app and multi‑app kiosk modes using Intune. Table Of Contents 1. [Configure Windows 10/11 Device as a Single‑App Full‑Screen Kiosk with Intune](#configure-windows-1011-device-as-a-singleapp-fullscreen-kiosk-with-intune) - [Step 1: Create Device Configuration Profile](#step-1-create-device-configuration-profile) - - [Step 2: Configure Kiosk Settings for Single-App kiosk setup](#step-2-configure-kiosk-settings-for-single-app-kiosk-setup) 2. [End User Experience for Single-app Full Screen Windows Kiosk Mode](#end-user-experience-for-single-app-full-screen-windows-kiosk-mode) 3. [Configure Windows Kiosk on Windows 10 or Later Device as Multi-app Kiosk](#configure-windows-kiosk-on-windows-10-or-later-device-as-multi-app-kiosk) 4. [End User Experience for Multi-app Kiosk Mode](#end-user-experience-for-multi-app-kiosk-mode) 5. [Comparison Table for Single-App vs Multi-App Kiosk](#comparison-table-for-single-app-vs-multi-app-kiosk) 6. [Conclusion](#conclusion) 7. [Related Posts](#related-posts) 8. [Explore More Intune Guides](#explore-more-intune-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## ****Configure Windows 10/11 Device as a Single‑App Full‑Screen Kiosk with Intun****e A **single‑app, full‑screen Windows kiosk mode** restricts the device to running only one application. That application launches automatically in full‑screen, preventing users from accessing other apps or system features. In this demonstration, we’ll configure **Microsoft Edge** to open a specific **website URL**. Once deployed, the kiosk will automatically load the site, and users will be limited to interacting solely with that **single web app**. When the **auto‑logon option** is enabled, the device uses a dedicated **kiosk account (local standard user)** to sign in automatically. After logon, the assigned **kiosk app** launches in full‑screen mode. If the app is closed, it will automatically restart, ensuring users remain restricted to the kiosk experience without access to other apps or system features. Follow the steps below to configure the device in **single‑app, full‑screen Windows kiosk mode** using **Microsoft Intune**. This setup ensures the kiosk launches one designated application automatically in full‑screen, restricting users from accessing other apps or system features. ### Step 1: Create Device Configuration Profile - In the **Microsoft Intune admin center**, go to **Devices | Configuration Profiles** and click on **Create Profile** - In the **Create a profile** window, select the following and click on **Create** - **Platform:** Windows 10 and later - **Profile type:** Template - **Template:** Kiosk ![Intune Device Configuration Profiles | Kiosk mode Windows 10](https://techuisitive.com/wp-content/uploads/2023/04/image-70.jpeg)On the **Basics** page, enter a name for the Device configuration profile and click **Next** ### Step 2: Configure Kiosk Settings for Single-App kiosk setup - On the **Configuration Settings** page, select the following settings for Single app Kiosk setup. - **Select a Kiosk mode:** Single app, full-screen kiosk - **User logon type:** Auto logon - **Application type**: Add Microsoft Edge browser (Required Edge version 87 and later with Windows version 1909 and later) - **Edge Kiosk URL**: Website link (company application URL or any) - **Microsoft Edge Kiosk mode type**: - **Digital / Interactive signage (InPrivate)** – The link provided above in the Edge Kiosk URL will open in full screen. The user can navigate through that website only. We have selected this setting for demonstration. - **Public Browsing (InPrivate)** – The link provided above will open by default. However user can open another website in the same tab or a new tab. - **Specify Maintenance windows for App Restart** – Select Required if you want to limit application upgrades during a specific time. Provide the maintenance window start time and schedule recurrence in the next options. ![Windows 10 kiosk mode Intune | Single‑App Kiosk Setup](https://techuisitive.com/wp-content/uploads/2023/04/image-71.jpeg)- Review the settings and click on **Next** to move to the Assignment page. - On the **Assignments** page, select the Azure AD group on which you want to apply the policy. Click on **Next**. We have applied the policy on the AAD group “Kiosk Computers – Edge browser,” and our test device was added to this AAD group. ![Intune kiosk profile assignment](https://techuisitive.com/wp-content/uploads/2023/04/image-72.jpeg)On the **Applicability Rules** page, click on **Next** On the **Review + Create** page, review the settings and click on **Create**. ![Windows 10 / Windows 11 kisok mode || Review + Create](https://techuisitive.com/wp-content/uploads/2023/04/image-73.jpeg)The **Device Configuration Profile** for the **Intune kiosk setup** has now been created. To expedite testing, you can **sync the policy** on the device and then reboot the machine to apply the changes. You can verify **policy compliance status** from the **Devices → Configuration Profiles blade** in the **Microsoft Intune admin center**. ## **End User Experience for Single-app Full Screen Windows Kiosk** Mode As noted earlier, **Microsoft Edge supports two kiosk modes**: *Digital/Interactive Signage (InPrivate) Mode* and *Public Browsing (InPrivate) Mode*. In Digital/Interactive Signage mode, the end‑user experience is straightforward—the assigned web page opens automatically in full‑screen. Users can navigate within that site, but they are restricted from opening any other websites or applications. ![Intune Windows 10 Kiosk | Single app End User Experience](https://techuisitive.com/wp-content/uploads/2023/04/image-103.png)We will now switch the **Microsoft Edge browser kiosk mode** to **Public Browsing (InPrivate) mode**. Once the updated **Intune policy** is applied, the **end‑user experience** changes: users can open new tabs in Edge and access websites beyond the default start page, while browsing sessions remain isolated through **InPrivate mode**. **Note:** If you need to restrict which websites users can access, you must create a separate **Device Configuration Profile** for Microsoft Edge that enforces URL restrictions. Apply this policy specifically to kiosk devices. The built‑in kiosk template does not currently provide this option. ![Intune Kiosk mode Windows 11 |End User Experience | Single app | ](https://techuisitive.com/wp-content/uploads/2023/04/image-104.png)## **Configure Windows Kiosk on Windows 10 or Later Device as Multi-app Kiosk** We have successfully configured and tested a **single‑app full‑screen Windows kiosk**. Next, we’ll update the same Intune policy to configure the device as a **multi‑app kiosk**. To edit the **Intune device configuration profile**, follow the steps below - On the Microsoft Intune admin center, go to Devices | Configuration Profiles and select the profile. - Scroll down to **Configuration Settings** and click on Edit. ![Intune Windows 10 kiosk mode/ Windows 11 Kiosk mode configuration settings](https://techuisitive.com/wp-content/uploads/2023/04/image-105.png)- On the **Configuration Settings**, select the following settings for the Multi-app kiosk setup. - **Select a Kiosk mode:** Multi-app - **Target devices running Windows 10/11 in mode:** No - **User logon type:** Auto logon - **Browser and Applications**: - Add Microsoft Edge > Public Browsing (InPrivate) - Add Store App > Microsoft Whiteboard - **Autolaunch**: No - **Tiles Size**: Large ![Intune Multi app kiosk | Windows 10 kiosk mode | Windows 11 kiosk mode ](https://techuisitive.com/wp-content/uploads/2023/04/image-74.jpeg)- **Use alternative Start layout**: No - **Windows Taskbar**: Hide - **Allow access to Downloads folder**: No - **Specify Maintenance windows for App Restart** – Select Required if you want to limit application upgrade between specific time. Provide the maintenance window start time and schedule recurrence in next options. ![Intune Kiosk Windows 10 - Maintenance Window](https://techuisitive.com/wp-content/uploads/2023/04/image-75.jpeg)## **End User Experience for Multi-app Kiosk** Mode Below is the **end‑user experience for multi‑app Windows kiosk mode**. In this configuration, you should see the application icons available on the desktop. However, during testing, the icons did not appear in the Start menu tiles. We will update these details once further testing of the **multi‑app kiosk configuration in Intune** is completed. ![Intune Kiosk mode End User Experience](https://techuisitive.com/wp-content/uploads/2023/04/image-76.jpeg)## Comparison Table for Single-App vs Multi-App Kiosk When configuring **Windows kiosk mode with Intune**, administrators can choose between **single‑app** and **multi‑app** setups. Each option delivers a different end‑user experience and serves distinct use cases—from locked‑down digital signage to shared devices with multiple approved apps. The table below highlights the key differences to help you decide which Intune kiosk mode best fits your deployment scenario. FeatureSingle‑App KioskMulti‑App KioskApps AllowedOne (full screen)Multiple (tiles)Use CaseDigital signage, web appShared devices, trainingUser LogonAuto logonAuto logonFlexibilityVery limitedModerate## Conclusion Choosing between **single‑app** and **multi‑app Windows kiosk modes in Intune** depends on your deployment needs. Single‑app kiosks are ideal for focused scenarios like digital signage or dedicated web apps, while multi‑app kiosks provide more flexibility for shared devices with multiple approved applications. By understanding these differences, administrators can design a kiosk experience that balances **security, usability, and productivity** for their specific environment. ## **Related Posts** - [Manage Edge Chromium favorites with Endpoint Manager | Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Configure Edge Chromium Homepage & Startup Page](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) - [Configure Microsoft Edge Sleeping Tabs using Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Configure Google Chrome settings using Administrative templates | Intune | Endpoint Manager](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Block USB Device with Exception](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** intune featured, Intune Getting Started, Intune Guides, User Experience --- ### [How to Configure Intune Shared Multi User Device](https://techuisitive.com/how-to-configure-intune-shared-multi-user-device/) **Published:** April 13, 2025 **Author:** Equebal Ahmad **Content:** Managing Windows devices in environments like schools, libraries, or retail stores often requires a secure, multi‑user setup. Microsoft Intune’s **Shared PC mode** simplifies this by ensuring each user gets a clean, temporary session while administrators retain control over accounts, storage, and policies. In this guide, we’ll walk through how to configure a **shared multi‑user device profile in Intune**, covering account management, deletion thresholds, power policies, and education‑specific settings. By the end, you’ll be able to deploy shared devices that are secure, efficient, and easy to maintain. ## Create a Shared Multi-User Device Profile in Intune Microsoft Intune allows administrators to configure **Shared PC mode (multi‑user devices)** through the **Intune settings catalog**. In organizational environments, Shared PC mode can be set up to support both **guest accounts** and **domain accounts**. When using domain accounts, user data is retained until the configured **account deletion threshold** is reached. This threshold can automatically remove older accounts when **disk space is low** or when accounts remain **inactive for a defined period**. As a result, storage is freed up automatically without requiring manual intervention from administrators, keeping shared devices secure and efficient. Follow the steps below to create a shared multi-user device profile in Microsoft Intune. ### Create a Shared Multi‑User Device Profile in Intune - Sign in to the **Microsoft Intune Admin Center**. - Navigate to **Devices > Windows > Configuration**. - Select **Create**. - In the **Create a Profile** flyout window, provide the following details: - **Platform:** Windows 10 and later - **Profile type:** Templates - **Template name:** Shared multi‑user device - Click **Create** to generate the profile. ![Intune shared multi-user device | Shared PC mode](https://techuisitive.com/wp-content/uploads/2025/03/image-13-1024x527.png)### Configure Profile Basics in Intune On the **Profile Basics** page, enter a clear **profile name** and a descriptive **profile description** (e.g., *Shared Multi‑User Device – Library PCs*). Ensure the name and description make it easy to identify the profile later in the Intune console. Click **Next** to continue to the **Configuration settings** page. ![Intune shared PC mode](https://techuisitive.com/wp-content/uploads/2025/03/image-14.png)### Configure Shared PC Settings in Intune On the **Configuration settings** page, configure the following options: - **Shared PC mode** - Select **Enable** or **Disable**. - When enabled, the device is optimized for shared use, allowing only one user to log in at a time. - **Guest account** - Choose one of three options: **Guest**, **Domain**, or **Guest and Domain**. - **Account Management** - Select **Enabled** or **Disabled**. - When enabled, accounts are automatically deleted during sign‑out or scheduled maintenance. - **Account Deletion Options** Shared PC mode can be configured to delete accounts: - **At storage space threshold** - **At storage space threshold and inactive threshold** - **Immediately after logout** - **Start Delete threshold (%)** - The account manager begins deleting old accounts once device free space falls below the defined threshold. - **Stop Delete threshold (%)** - The account manager stops deleting accounts once free space rises above the defined threshold. - **Inactive account threshold** - Define the number of consecutive days an account can remain inactive. ![Intune shared multi-user device configuration settings](https://techuisitive.com/wp-content/uploads/2025/03/image-15-1024x737.png)- **Local storage** - When enabled, users can save files to the local hard disk and access them later. - **Power policies** - By default, this policy is not configured. - If disabled, users cannot change power settings on the device. - **Sleep timeout** - Define the number of inactive seconds before the device automatically enters sleep mode. - **Maintenance start time (minutes from midnight)** - Specify when automatic maintenance tasks (such as software updates) should run. - Enter the number of minutes from midnight. - Example: *60 minutes = 01:00 AM*. - **Education policies** - Recommended for devices in schools. - Applies education‑specific settings to optimize shared PC mode for classroom environments. ![Intune shared multi-user device configuration settings](https://techuisitive.com/wp-content/uploads/2025/03/image-19.png)### Assign the Shared PC Policy in Intune - On the **Assignments** page, choose how to deploy the policy: - **All users** - **All devices** - Specific **Entra ID (Azure AD) user or device groups** - Optionally, apply **Intune assignment filters** for more granular targeting (e.g., by device type, OS version, or tags). ![Intune shared PC mode assignment](https://techuisitive.com/wp-content/uploads/2025/03/image-17-1024x509.png)### Review and Create the Shared PC Policy On the **Review + Create** page, carefully review all configured settings (Basics, Configuration, Assignments). Confirm that the policy details are correct and aligned with your deployment requirements. Click **Create** to complete the policy creation process. ![Intune shared PC mode | Review + create policy](https://techuisitive.com/wp-content/uploads/2025/03/image-20-1024x783.png)## End User Experience Since the **Guest account option** was configured as **“Guest and Domain”**, the Windows login screen will display both **Other user** and **Guest** options: - **Other user**: Allows users to enter their **organization’s email ID and password** to sign in with their domain account. - **Guest**: Provides a temporary session for guest users, with no data retained after sign‑out. This configuration ensures flexibility — domain users can access organizational resources securely, while guest users can log in quickly without leaving behind persistent data. ![Shared PC mode - End user experience](https://techuisitive.com/wp-content/uploads/2025/03/image-21.png)When you click on **Guest user**, the device automatically signs in using a **guest account**. A **new guest account** is created every time someone logs in with the Guest option. Guest accounts are temporary — no data or settings are retained after sign‑out. This ensures that shared devices remain clean and secure, while providing quick access for users who don’t require persistent profiles. ![Intune Shared Multi-user device - End user experience](https://techuisitive.com/wp-content/uploads/2025/03/image-22-1024x568.png)## Guest vs Domain Accounts in Shared PC Mode Feature / Behavior**Guest Account****Domain Account****Login Option**Selected via **Guest** on login screenSelected via **Other user** on login screen**Account Creation**A new guest account is created at each loginExisting domain account is used**Data Retention**No data retained after sign‑outData is retained until the **deletion threshold** is reached**Persistence**Temporary, session‑basedPersistent until cleanup rules apply**Use Case**Quick access for temporary users (e.g., library visitors)Secure access for organizational users with credentials**Management**Automatically deleted at logoutManaged via **account deletion thresholds** (storage/inactivity)## Best Practices for Shared PC Mode - **Use Guest accounts** - Ideal for kiosks, libraries, training labs, or retail demo devices. - Ensures no data is retained after sign‑out, keeping devices clean and secure. - Simplifies management since accounts are automatically deleted. - **Use Domain accounts** - Recommended for staff PCs, classrooms, or environments where users need access to organizational resources. - Data is retained until deletion thresholds are met, allowing continuity for domain users. - Provides secure authentication with organizational credentials. - **Mixed Mode (Guest and Domain)** - Best for environments with both temporary and permanent users (e.g., schools with students and visiting guests). - Offers flexibility while maintaining security and efficiency. ## Conclusion Configuring **Shared PC mode in Intune** provides organizations with a secure and efficient way to manage multi‑user devices. By tailoring account options, deletion thresholds, storage policies, and education‑specific settings, administrators can ensure that shared devices remain clean, optimized, and easy to maintain. Whether deployed in schools, libraries, retail environments, or training labs, Shared PC mode balances flexibility with control — allowing guest users quick access while enabling domain users to securely connect to organizational resources. With the right configuration, Intune helps reduce administrative overhead and delivers a seamless end‑user experience across shared environments. ## Related Posts - [How to Enable Azure Single Sign-On in Google Chrome](https://techuisitive.com/enabling-azure-single-sign-on-in-google-chrome-with-intune-dont-miss-this-key-setting/ "How to Enable Azure Single Sign-On in Google Chrome") - [How to Allow Copilot in Microsoft Edge Using Intune](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/) - [Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [How to Configure Google Chrome settings using Administrative templates | Intune](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Manage Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Edge Chromium Favorites with Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Configuratin Featured, Device Configuration, Intune Guides, User Experience --- ### [Deny Write Access to USB Devices Using Intune Settings Catalog](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) **Published:** May 8, 2022 **Author:** Equebal Ahmad **Content:** USB devices are convenient for transferring files, but they pose a significant **data security risk** in enterprise environments. Using **Microsoft Intune** and **Endpoint Manager**, administrators can enforce policies that block or restrict USB usage to protect sensitive information. In this guide, we’ll walk through how to **deny write access to USB devices** using **Intune Catalog Settings**, and explore additional configurations available under **Administrative Templates → System → Removable Storage Access**. These policies help organizations strengthen **endpoint security**, enforce **data protection**, and maintain compliance with corporate standards. **Table Of Contents** 1. [Create a Device Configuration Profile](#create-a-device-configuration-profile) - [Step 1: Create Device configuration Profile](#step-1-create-device-configuration-profile) - - [Step 2: Add the settings for Removable Storage Access](#step-2-add-the-settings-for-removable-storage-access) - - [Step 3: Assign the Policy](#step-3-assign-the-policy) 2. [End User Experience](#end-user-experience) 3. [How to Manage Exceptions](#how-to-manage-exceptions) 4. [Additional Settings Under Administrative Template > System > Removable Storage Access](#additional-settings-under-administrative-template-system-removable-storage-access) 5. [Related Posts:](#related-posts) 6. [Explore More Intune Guides](#explore-more-intune-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Create a Device Configuration Profile** This requirement can be implemented by creating a **Device Configuration Profile** in **Microsoft Intune**. Follow the step‑by‑step instructions below to configure the profile and **deny write access to USB devices** using Intune Catalog Settings. This approach ensures consistent enforcement of **endpoint security policies** across all managed devices. ### Step 1: Create Device configuration Profile Sign in to the [Microsoft Intune Admin Center](https://intune.microsoft.com/ "Microsoft Intune Admin Center"). Select **Devices** > **Configuration profiles** > **Create profile**. Enter the following details: - **Platform**: Select **Windows 10 and later**. - **Profile type**: Select **Setting Catalog** and click on **Create** ![Create Device Configuration Profile in Intune](https://techuisitive.com/wp-content/uploads/2023/04/image-138.png)In the **Basics** page, enter the following details: - **Name**: Enter a descriptive name for the profile. For example, enter **Deny Write Access to USB Devices** - **Description**: Enter a description for the profile. Select **Next**. ![Intune device configuration profile Basics page](https://techuisitive.com/wp-content/uploads/2023/04/image-139.png)### Step 2: Add the settings for Removable Storage Access - In **Configuration settings**, click on **Add settings** - In the **Settings picker** window, type **Removable Storage Access** into the search bar. Next, from the search results, select Administrative Templates → System → Removable Storage Access. This section contains policies that allow you to control how users interact with USB drives, external disks, and other removable media, enabling administrators to enforce **Intune security policies** and strengthen **endpoint data protection**. - Select the setting below from the list. **Removable Disk: Deny Write Access (User)** Enable **Removable Disks**: **Deny write access** setting. ![Intune setting catalog: Removable Disk: Deny Write Access (User)](https://techuisitive.com/wp-content/uploads/2023/04/image-140.png)### Step 3: Assign the Policy On the **Assignments** page, select the **Azure AD group** that you want to target with this **Device Configuration Profile**. This ensures the USB write‑access restriction is applied to all devices within that group. If you need to implement an **exception process**, add the group you want to **exclude** from the policy assignment. This approach allows you to enforce **Intune security policies** while maintaining flexibility for specific users or devices that require access. ![Deny Write Access to USB Devices: Assign Policy](https://techuisitive.com/wp-content/uploads/2023/04/image-141.png)On the **Review + Create** page, carefully verify all the configuration settings you have defined in the **Device Configuration Profile**. Ensure that the targeted groups, USB restrictions, and any exclusions are correctly applied. Once you have confirmed the details, click **Create** to finalize the profile. The policy will then be deployed through **Intune**, enforcing the **USB write‑access restriction** across assigned devices. ![Deny Write Access to USB Devices: Review and Create policy](https://techuisitive.com/wp-content/uploads/2023/04/image-142.png)The **Device Configuration Profile** has now been successfully created. To verify deployment, click on the profile name in the **Intune Endpoint Manager** console. From there, you can view the **assignment status**, check which **Azure AD groups** are targeted, and confirm whether the **USB write‑access restriction policy** has been applied to the assigned devices. This ensures that your **Intune security configuration** is enforced consistently across the environment. ![Device Configuration Profile | Status](https://techuisitive.com/wp-content/uploads/2023/04/image-143.png)## **End User Experience** When a user attempts to copy files to a **USB device or other removable media**, the action will be blocked by the applied **Intune policy**. Instead of completing the transfer, the system will display an error message notifying the user that **write access to removable storage has been denied**. This ensures that sensitive data cannot be copied to external drives, reinforcing your organization’s **endpoint security** and **data protection policies**. ![USB Access Denied Prompt](https://techuisitive.com/wp-content/uploads/2023/04/image-144.png)If the user clicks **Continue** after the initial warning, a secondary message will appear indicating that **write access to removable storage has been denied**. This reinforces the applied **Intune policy** and ensures that attempts to copy files to **USB devices or other removable media** remain blocked. By displaying this follow‑up message, the system provides clear feedback to the end user while maintaining strict **endpoint security** and **data protection compliance**. ![USB Access Denied Prompt](https://techuisitive.co.in/wp-content/uploads/2023/04/image-145.png)## How to **Manage Exceptions** As explained earlier, **exceptions can be managed through Azure AD groups**. To allow certain devices or users to bypass the USB write‑access restriction, add the dedicated **Azure AD group** to the **Assignments page → Exclude section**. Any device that is a member of this group will be excluded from the policy, meaning the **USB write permission** will remain enabled for those devices. To maintain compliance, define a clear **process for adding and removing devices** from the exception group in line with your organization’s security policy. Devices should be removed from the group once their exception period has ended, ensuring that the **Intune security policy** continues to enforce **USB restrictions** consistently across the environment. ![Intune | Deny Write Access to USB | Manage Exception](https://techuisitive.com/wp-content/uploads/2023/04/image-146.png)## Additional Settings Under Administrative Template > System > Removable Storage Access Beyond denying write access, you can configure several other useful restrictions, such as: - **Removable Disks: Deny Read Access** Prevents users from opening or reading files stored on USB drives. - **Removable Disks: Deny Execute Access** Blocks applications from running directly from USB media, reducing malware risks. - **CD and DVD: Deny Read/Write Access** Restricts access to optical drives, useful in secure environments where removable media is prohibited. - **WPD Devices: Deny Read/Write Access** Controls access to portable devices (e.g., smartphones, cameras) connected via USB. - **Custom Exceptions** Use Azure AD groups to exclude specific devices or users from restrictions when there’s a legitimate business need. ## **Related Posts:** - [Block USB Device Access with Exceptions | Microsoft Intune](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows Local Administrator Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [Check OS Version Compliance with Device Compliance Policy & Notify User | Microsoft Intune](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/) - [How to manage the local administrators group on Azure AD joined devices | Intune](https://techuisitive.com/how-to-manage-the-local-administrators-group-on-azure-ad-joined-devices-intune/) Tags: [Device Configuration](https://techuisitive.com/tag/device-configuration/), [Device Restriction](https://techuisitive.com/tag/device-restriction/), [Intune Guides](https://techuisitive.com/tag/intune-guides/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Configuration, Device Restriction, Intune Guides --- ### [Configure Edge Homepage & Startup Page Using Intune Administrative Templates](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) **Published:** September 18, 2021 **Author:** Equebal Ahmad **Excerpt:** Microsoft Endpoint Manager (Intune) Device Configuration profiles allow you to add and configure settings, and then push these settings to devices in your organization. In this post, we will create a Device configuration profile in Microsoft Intune to set Home page and Startup page in Microsoft Edge. Before we go ahead, let's understand the difference between Home page and Startup page. **Content:** Managing browser settings at scale is a critical part of modern endpoint management. Microsoft Intune makes it simple to enforce consistent experiences across devices, including controlling the homepage and startup pages in Microsoft Edge Chromium. In this guide, we’ll walk through how to configure these settings using [Intune device configuration profiles](https://techuisitive.com/tag/device-configuration/ "Device Configuration")—ensuring users always start with the right resources when they open their browser. ## What is the **Startup Page** in Microsoft Edge By default, Microsoft Edge launches with its built‑in startup page whenever you open the browser. Administrators and users can customize this behavior by configuring one or more startup pages, ensuring that specific websites or portals automatically load each time Edge starts. This feature is especially useful in enterprise environments where Intune or Microsoft Endpoint Manager policies are used to enforce consistent browser settings across all Windows devices. ## What is the **Homepage** in Microsoft Edge The Microsoft Edge home page only opens when you click the Home button in the toolbar. By default, this button is hidden, and you’ll need to enable it from the browser settings before assigning a homepage. ## **Configure Edge Homepage and Startup page** Follow the steps below to configure the Microsoft Edge browser home page. Open the Microsoft Intune admin center, navigate to Devices > Configuration policies, and click on **Create profile** ![Intune configuration profile page for Windows device ](https://techuisitive.com/wp-content/uploads/2023/03/image-17.png)Select the following options in the **Create a Profile** section and then click on **Create**. - Platform: Windows 10 and later - Profile type: template - Template Name: Administrative templates ![Intune Device configuration profile | Edge Settings](https://techuisitive.com/wp-content/uploads/2023/03/image-18.png)Enter a Profile name, Description, and click on **Next** ![Microsoft Edge browser homepage](https://techuisitive.com/wp-content/uploads/2023/03/image-19.png)Go to the Configuration settings, select **Computer Configuration > Microsoft Edge/Startup > home page and new tab page** Select **Configure the home page URL,** select **Enabled,** and enter the home page URL ![Edge Chromium Homepage](https://techuisitive.com/wp-content/uploads/2023/03/image-20.png)Select the Show Home button on the toolbar**,** select **Enabled** ![Edge browser homepage settings | Intune](https://techuisitive.com/wp-content/uploads/2023/03/image-21.png)Select the **action to take on startup** Click on **Enabled** Select **Open a list of URLs** in **Action to take on the startup** list ![Edge startup page | Intune | Device configuration profiles](https://techuisitive.com/wp-content/uploads/2023/03/image-22.png)Select **Sites to open when the browser starts** Enter the site URLs and click on Ok. You can add multiple Startup page URLs here. ![Microsoft Edge startup page | Intune](https://techuisitive.com/wp-content/uploads/2023/03/image-23.png)Click on **Next** twice to go back to the Assignments page and assign the profile to All Devices or an AD Group to limit the scope as per your requirements. ![home page Edge](https://techuisitive.com/wp-content/uploads/2023/03/image-24.png)Click on **Next**, review the settings, and confirm to create the Device configuration profile. The Device configuration profile is now created. You can validate the same from the Device | Configuration profiles blade. ![homepage edge](https://techuisitive.com/wp-content/uploads/2023/03/image-26.png)Intune | Device configuration Profile To confirm if the policy has been applied, open Microsoft Edge and type **edge://policy** As you can see in the screenshot below, the policy has been successfully applied to the device. ![homepage Microsoft Edge](https://techuisitive.com/wp-content/uploads/2023/03/image-25.png)## **Related Posts** - [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) - [Manage Edge Chromium favorites with Endpoint Manager | Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Configure Edge Chromium Homepage & Startup Page](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) - [Configure Microsoft Edge Sleeping Tabs using Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Configure Google Chrome settings using Administrative templates | Intune | Endpoint Manager](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Block USB Device with Exception](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows 10 /11 Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Local Admin Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) Tags: [Browser Configuration](https://techuisitive.com/tag/browser-configuration/), [Device Configuration](https://techuisitive.com/tag/device-configuration/), [Intune Getting Started](https://techuisitive.com/tag/intune-getting-started/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Browser Configuration, Device Configuration, Intune Getting Started --- ### [Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) **Published:** June 13, 2022 **Author:** Equebal Ahmad **Content:** Microsoft Edge’s **Sleeping Tabs** feature is a smart way to optimize browser performance by reducing memory and CPU usage. While it’s enabled by default, IT admins can fine‑tune these settings for enterprise environments using **Microsoft Intune**. In this guide, we’ll walk through step‑by‑step instructions to configure Sleeping Tabs policies, ensuring better resource management, faster responsiveness, and a seamless user experience across managed Windows devices. ## Steps to Configure Sleeping Tabs in Microsoft Edge ### Step 1: Create Device Configuration Profile Sign in to the Microsoft Intune admin center [(https://intune.microsoft.com](https://endpoint.microsoft.com/)) and select **Devices > Windows > Configuration Profiles** Click on **Create profile** and select the following options: - Platform: Windows 10 and later - Profile type: Setting catalog Click on **Create** ![Intune | Device Configuration](https://techuisitive.co.in/wp-content/uploads/2023/04/image-157.png)On the **Basics page**, enter a **profile name** and **description** and click on **Next**. ![Intune | Device Configuration | Create profile](https://techuisitive.co.in/wp-content/uploads/2023/04/image-158.png)### Step 2: Add Configuration Settings On the Configuration settings page, perform the following steps: 1. You are on the **Configuration settings** page 2. Click on **Add settings** 3. Type “sleeping tab” in **Setting picker** and click on **Search** 4. Select **Microsoft Edge\\Sleeping tabs** category. All available settings for this category will now be visible. Please note that the user will not be able to change the settings applied through the catalog settings. If you want to allow users to change settings, then you need to select **“Microsoft Edge – Default Settings (User can override)\\Sleeping Tabs settings”**. 5. Select the settings below: - Configure sleeping tabs - Set the background tab inactivity for sleeping tabs 6. Configure the settings below under the Sleeping tab settings at left side of the screen. - Enable **Configure Sleeping Tabs** - Enable **Set the background tab inactivity timeout for Sleeping Tab** - Update sleeping tab inactivity timeout under **Set the background tab inactivity timeout for Sleeping Tab (Device)** – By default, this option will be 5 minutes of inactivity. 7. Click on **Next** ![Intune | Device Configuration | Setting catalogus](https://techuisitive.co.in/wp-content/uploads/2023/04/image-159.png)## Step 3: Assign and Create Profile On the **Assignments** page, assign the profile to the Entra Group or all Windows 10 and later devices. Click on **Next** ![Intune | Device Configuration | Assignment](https://techuisitive.co.in/wp-content/uploads/2023/04/image-160.png)On the **Review + create** page, review the details and click on **Create**. ![Intune | Device Configuration | Review + create](https://techuisitive.co.in/wp-content/uploads/2023/04/image-161.png)The Device configuration profile will be created. You can see the status in the notification area. ## Check the Assignment Status of Policy You can monitor the Assignment status of the device configuration profile from Devices > Configuration profiles blade. To check the status, go to **Device > Configuration profiles** and click on Profile name. ![Intune | Device Configuration | Device and User check in status](https://techuisitive.co.in/wp-content/uploads/2023/04/image-162.png)## Validate the Configuration from the Device To verify the settings, open Microsoft Edge and go to **settings** and select **System and performance** from left pane. You can notice that settings applied through Microsoft Intune are locked. A user won’t be able to make changes. ![Microsoft Edge | Sleeping tabs](https://techuisitive.co.in/wp-content/uploads/2023/04/image-163.png)## FAQs **Q1. What are Microsoft Edge Sleeping Tabs?** Sleeping Tabs automatically put inactive browser tabs into a low‑resource state, reducing memory and CPU usage while keeping the tab content available when reactivated. **Q2. Why should IT admins configure Sleeping Tabs with Intune?** Configuring via Intune ensures consistent performance policies across all managed devices, improves battery life on laptops, and prevents users from disabling the feature. **Q3. Can users override Sleeping Tabs settings applied through Intune?** No. Once policies are enforced via Intune, the settings are locked and cannot be changed by end users. **Q4. What’s the recommended inactivity timeout for enterprise environments?** Most organizations set the timeout between **5–15 minutes** to balance performance gains with user convenience. **Q5. Do Sleeping Tabs affect background processes like notifications or media playback?** Yes. Tabs in sleep mode pause background activity, but they resume instantly when re‑opened. Exceptions can be configured for critical sites. ## 📊 Comparison Table: Default vs. Intune‑Configured Sleeping Tabs Feature / BehaviorDefault (User‑controlled)Intune‑configured (Admin‑controlled)**Enabled by default**✅ Yes✅ Yes (forced)**Inactivity timeout**2 hours (default)Customizable (e.g., 5–15 minutes)**User ability to disable**AllowedNot allowed**Resource savings**VariableConsistent across all devices**Exceptions (sites kept active)**User‑definedAdmin‑defined via policy**Battery optimization**Depends on user settingsEnforced across managed laptops## **Related Posts** - [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) - [Manage Edge Chromium favorites with Endpoint Manager | Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Configure Edge Chromium Homepage & Startup Page](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) - [Configure Microsoft Edge Sleeping Tabs using Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Configure Google Chrome settings using Administrative templates | Intune | Endpoint Manager](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Block USB Device with Exception](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows 10 /11 Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Local Admin Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) Tags: [Browser Configuration](https://techuisitive.com/tag/browser-configuration/), [Device Configuration](https://techuisitive.com/tag/device-configuration/), [Intune Guides](https://techuisitive.com/tag/intune-guides/), [Microsoft Edge](https://techuisitive.com/tag/microsoft-edge/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Browser Configuration, Device Configuration, Intune Guides, Microsoft Edge --- ### [How to Configure Google Chrome settings using Administrative templates | Intune](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) **Published:** August 2, 2022 **Author:** Equebal Ahmad **Content:** Managing browser settings across an enterprise can be challenging, especially when relying on custom OMA-URI configurations. With the release of Intune Administrative Templates for Google Chrome, IT admins can now configure policies quickly and consistently without complex scripting. In this guide, we’ll walk through how to use Intune Endpoint Manager to apply Chrome settings such as homepage, startup pages, password manager, and theme color—ensuring a secure and standardized browsing experience for your organization. Table Of Contents 1. [Create a Google Chrome Device configuration profile](#create-a-google-chrome-device-configuration-profile) 2. [Check the configuration status from the Event Viewer on the targeted device](#check-the-configuration-status-from-the-event-viewer-on-the-targeted-device) 3. [Check the configuration settings in Google Chrome](#check-the-configuration-settings-in-google-chrome) 4. [List of Settings Available in Intune Google Chrome Administrative Template](#list-of-settings-available-in-intune-google-chrome-administrative-template) 5. [Related Posts:](#related-posts) 6. [Explore More Intune Guides](#explore-more-intune-guides) ## **Create a Google Chrome Device configuration profile** - To create a Device configuration profile, log in to the [Microsoft Intune Admin Center,](https://intune.microsoft.com/) navigate to **Devices > Windows > Configuration profiles,** and click **Create profile**. - Select the following options: - **Platform**: Windows 10 and later - **Profile type**: Templates - **Template name**: Administrative template - Click on **Create** ![Google Chrome settings | Intune](https://techuisitive.com/wp-content/uploads/2023/04/image-115.png)- On the **Basics** page of the Intune **Device Configuration Profile wizard**, provide a clear and descriptive **name** for the profile (for example, *Google Chrome Settings – Administrative Templates*). Adding a meaningful **description** is recommended to help other administrators understand the purpose of the profile, especially when managing multiple configurations. Once the profile name and description are set, click **Next** to proceed to the **Configuration settings** page, where you can define specific Chrome policies. ![Google chrome browser settings](https://techuisitive.com/wp-content/uploads/2023/04/image-116.png)- On the **Configuration settings** page of the Intune **Administrative Templates profile**, you will see three options: - All Settings - Computer Configurations - User Configurations - Select **Computer Configuration** to apply policies at the device level. From the **Settings name** list, navigate to **Google > Google Chrome**. This section contains all available Chrome policies that can be managed through Intune, such as homepage configuration, startup pages, password manager settings, and security restrictions. Choosing **Computer Configuration** ensures that the applied Chrome policies are enforced consistently across all devices, regardless of which user logs in. Note: There are other options, “Google Chrome – Default settings (user can override). You can use this template if you want to configure settings as the default one and allowing user to change if they wish to do so. ![Google chrome homepage | Google chrome home page](https://techuisitive.com/wp-content/uploads/2023/04/image-117.png)- Scroll down to Settings and select **Startup, Home page, and New Tab page** ![Google chrome startup page](https://techuisitive.com/wp-content/uploads/2023/04/image-119.png)You can see the available settings in this group in the next screen. ### **Configure the Google Chrome Startup page** We will configure the **Google** **Chrome startup page** first. The page that automatically loads whenever you launch Google Chrome is the startup page. You can add multiple startup pages, and they all become available when you launch Chrome. We need to configure two settings for the Chrome startup page. Select **Action on startup** setting and select **Enabled** from the flyer display. Select Open a list of URL’s in the Action on startup list box and click on Ok to return to the previous window. ![Google chrome browser settings](https://techuisitive.com/wp-content/uploads/2023/04/image-121.png)From the list of settings, select **URLs** to open on startup settings and select Enabled from the flyer display. Provide the list of URL’s which you want to open at startup in the URLs **to open on startup** text boxes. Click on **Ok** to return to the previous screen. ![Intune Google chrome homepage](https://techuisitive.com/wp-content/uploads/2023/04/image-123.png)### **Configure Google Chrome Homepage** We will now configure the Google Chrome homepage. We will configure 3 settings for this. Select **Configure the home page URL** settings, and click on **Enabled** from the flyer display. Provide the home page URL under the **Home page URL** text box. Click on **Ok** to return to the previous screen. ![Intune | Device configuration profile | Chrome home page](https://techuisitive.com/wp-content/uploads/2023/04/image-124.png)Select **Use New Tab Page as Homepage** and click on **Disabled**. Please note that the home page setting will not be effective if this setting is enabled. Click on **Ok**. ![Intune | Device configuration profile | Chrome home page](https://techuisitive.com/wp-content/uploads/2023/04/image-125.png)Select the Show Home button on the toolbar settings and click on Enabled at flyer display. This option will allow us to navigate to the home page by clicking on the home button on tool bar. Click on Ok to return to the previous screen. ![Intune | Device configuration profile | Chrome home page](https://techuisitive.com/wp-content/uploads/2023/04/image-126.png)### **Enable saving passwords to the password manager** We will now configure the settings to enable saving the password to the password manager. This is one of the random settings we picked up for this demonstration. To enable saving passwords to the password manager, select the **Enable saving passwords to the password manager** setting and click on **Enabled**. Click on **Ok** to return to the previous screen. ![Intune | Device configuration profile | Chrome Enable password saving](https://techuisitive.com/wp-content/uploads/2023/04/image-127.png)### **Configure the color of the browser’s theme** This is the last setting we picked for this demonstration. The setting will change the theme color of the Chrome browser. Select **Configure the color of the browser’s theme**, select **Enabled** from the flyer display. Enter the hex color code in the **Configure the color of the browser’s theme** text box. Click on **Ok** to return to the previous screen. You can use the W3Schools link below to pick a hexadecimal color code. [https://www.w3schools.com/colors/colors\_picker.asp](https://www.w3schools.com/colors/colors_picker.asp) ![Intune | Device configuration profile | Chrome theme color](https://techuisitive.com/wp-content/uploads/2023/04/image-128.png)Now we are done with all the configuration. Click on **All Settings** to view the settings you have configured. All configured settings will appear on top. ![Chrome configure home page URL](https://techuisitive.com/wp-content/uploads/2023/04/image-129.png)Click on the Next button to move to the next page. Click on Next on the Scope tags page to move to the **Assignments** page. Assign the profile to an AAD group and click on **Next** ![Intune | Device configuration profile | Assignments](https://techuisitive.com/wp-content/uploads/2023/04/image-130.png)On the **Review + create** page, review the settings and click on **Create**. You can view the notification area for a successful profile creation. ![Intune | Device configuration profile | Review + create](https://techuisitive.com/wp-content/uploads/2023/04/image-131.png)The Device configuration profile is now created. You can monitor the configuration status from **Device configuration profile > Profile Name > Device status** blade. ![Intune | Device configuration profile | Device status](https://techuisitive.com/wp-content/uploads/2023/04/image-169.jpeg)You can also check the configuration status of each setting for a device from **Devices > All Devices > \\ Device Configuration > ** ![Intune | Device configuration profile | Device status per setting](https://techuisitive.com/wp-content/uploads/2023/04/image-132.png)## **Check the configuration status from the** Event Viewer on the **targeted device** Let’s see how we can validate the device configuration status from the Event Viewer on the targeted device. To verify the settings using Event Viewer, navigate to **Applications and Services Logs \\ Microsoft \\Windows \\DeviceManagement-Enterprise-Diagnostics-Provider\\Admin**. You can see the following logs. We have captured the details for the browser theme color and Chrome startup page. ### **Event viewer: Browser theme color:** MDM PolicyManager: Set policy string, Policy: (BrowserThemeColor), Area: (chromeIntuneV1~Policy~googlechrome), EnrollmentID requesting merge: (67FDEB14-74D9-49E4-B125-2A3E931D82DE), Current User: (Device), String: (), Enrollment Type: (0x6), Scope: (0x0). ![Event viewer | Device management logs](https://techuisitive.com/wp-content/uploads/2023/04/image-133.png)### **Event Viewer: Startup Page:** MDM PolicyManager: Set policy string, Policy: (RestoreOnStartupURLs), Area: (chromeIntuneV1~Policy~googlechrome~Startup), EnrollmentID requesting merge: (67FDEB14-74D9-49E4-B125-2A3E931D82DE), Current User: (Device), String: ( Configuration profiles > Create profile**. - Choose: - **Platform:** Windows 10 and later - **Profile type:** Settings catalog - **Template name**: Administrative Templates - Click on **Create**. ![Edge chromium favorites](https://techuisitive.com/wp-content/uploads/2023/04/image-208.jpeg)### Step 2: Configure the Basic Tab On the **Basic** tab, enter a clear and descriptive **profile name** (for example, *Edge Favorites Policy – Marketing Team*). This name helps admins quickly identify the configuration profile in the Intune console. Once named, click **Next** to proceed to the **Configuration settings** tab. ![Endpoint Manager | Device Configuration | Edge favorites | Create Profile](https://techuisitive.com/wp-content/uploads/2023/04/image-209.jpeg)### Step 3: Configure Microsoft Edge Favorites On the **Configuration settings** tab, navigate to: **Computer Configuration → Microsoft Edge**. In the search bar, type **Favorites**. From the results, select **Configure favorites**. This setting allows you to define and deploy a curated list of Microsoft Edge favorites directly through Intune, ensuring consistency across managed devices. ![Microsoft Intune | Device Configuration | Edge favorites | Configure](https://techuisitive.com/wp-content/uploads/2023/04/image-210.jpeg)## Step 4: Configure Favorites with JSON As shown in the **Configure Favorites** pane, this setting requires you to organize favorite URLs in **JSON format**. - Each favorite entry can include: - **Folder name** – to group related favorites - **URL** – the web address to be pinned - **Name** – the display name for the favorite - You can also create **child folders** for nested organization. - These favorites are **managed**: end users cannot delete or modify them. Once your JSON values are prepared, copy and paste them into the **Configure favorites** text box. This ensures that the favorites are deployed consistently across all targeted devices. **Favorites JSON values:** ``` [ { "toplevel_name": "Techuisitive Favorites" }, { "url": "https://www.techuisitive.com/", "name": "Techuisitive Website" }, { "url": "https://www.techuisitive.com/blog", "name": "Techuisitive Blog" }, { "name": "Techuisitive Social Media", "children": [ { "url": "https://www.facebook.com/Techuisitive/", "name": "Facebook Page" }, { "url": "https://www.facebook.com/groups/techuisitive", "name": "Facebook Group" } ] }] ``` On the **Configure favorites** pane, click on **Enabled** and copy the JSON value (created above) into the Configure favorites text box. Click on the Ok button to return to the **Configuration settings** tab. ![Endpoint Manager | Device Configuration | Edge favorites | Configure favorites](https://techuisitive.com/wp-content/uploads/2023/04/image-211.jpeg)Click on **Next** to move to the Scope tag. If you don’t have any scope tags, then click on Next again to go to the **Assignments** tab. ### Step 5: Assign & Deploy On the **Assignments** tab, select the **Azure AD group** that you want to target with this profile. This ensures the configured Microsoft Edge favorites are deployed only to the intended set of users or devices. After adding the group, click **Next** to continue to the **Review + Create** tab. ![Endpoint Manager | Device Configuration | Edge favorites | Configure settings](https://techuisitive.com/wp-content/uploads/2023/04/image-212.jpeg)On the **Review + Create** tab, carefully review all the details of your configuration profile—including the profile name, targeted group assignments, and the JSON values for Microsoft Edge favorites. If everything looks correct, click **Create** to finalize the policy. Intune will now deploy the managed favorites to the assigned devices, ensuring a consistent browsing experience across your organization. ![Endpoint Manager | Device Configuration | Edge favorites | Review & create](https://techuisitive.com/wp-content/uploads/2023/04/image-213.jpeg)## Validate Policy Deployment Once the policy is created, you can validate deployment in two ways: 1. **From the Intune portal** - Go to **Devices → Device configuration**. - Confirm that the profile appears under the assigned group and shows a successful deployment status. 2. **On the client machine** - Open **Microsoft Edge**. - Type `edge://policy` in the address bar. - Under the **Managed Favorites** policy name, you should see the favorites configured through Intune. This confirms that the JSON‑based favorites have been successfully applied and are locked as managed favorites, ensuring consistency across all targeted devices. ![Edge Managed Favorites](https://techuisitive.com/wp-content/uploads/2023/04/image-214.jpeg)## **End‑User View of Managed Favorites** After deployment, end users will see the configured favorites directly in **Microsoft Edge**. These appear under the **Managed Favorites** section, organized exactly as defined in the JSON structure. - Favorites are grouped into folders (e.g., *Company Links*, *Marketing Team*, *Sales Links*). - Each entry displays with its assigned name and icon. - Users cannot delete or modify these favorites, ensuring a consistent and controlled browsing experience across all managed devices. The screenshot below illustrates how the favorites look at the end user’s side, confirming successful policy application. ![Favorites | End user experience](https://techuisitive.com/wp-content/uploads/2023/04/image-215.jpeg)## Troubleshooting Tips - **Malformed JSON:** Use a JSON validator to check syntax. - **Policy not applying:** Ensure device sync is successful in Intune. - **Conflicts:** If users already have personal favorites, managed favorites will appear alongside them but cannot be deleted. ## Best Practices - Keep favorites minimal and relevant. - Use folders for grouping (e.g., HR, IT, Sales). - Review and update JSON regularly to reflect organizational changes. - Test with a pilot group before broad rollout. ## Conclusion Managing Edge favorites with Intune is a simple but powerful way to improve productivity and consistency across your organization. With the right JSON configuration and validation steps, admins can ensure employees always have quick access to the resources they need. Looking for more? Check out related guides on managing **[homepage settings](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/ "homepage settings")** and **[sleeping tabs](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/ "sleeping tabs")** with Intune. ## Frequently Asked Questions (FAQs) ### **Why should I manage Microsoft Edge favorites with Intune?** Managing favorites centrally improves **onboarding efficiency**, ensures **compliance with mandatory sites**, boosts **productivity** by reducing search time, and provides a **consistent browsing experience** across all devices. ### **Can end users modify or delete managed favorites?** No. Favorites deployed via Intune are **locked as managed favorites**. Users can still add personal favorites, but the Intune‑configured ones remain fixed and cannot be altered or removed. ## **Related Posts** - [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) - [Manage Edge Chromium favorites with Endpoint Manager | Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Configure Edge Chromium Homepage & Startup Page](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) - [Configure Microsoft Edge Sleeping Tabs using Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Configure Google Chrome settings using Administrative templates | Intune | Endpoint Manager](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Block USB Device with Exception](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows 10 /11 Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Local Admin Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) Tags: [Browser Configuration](https://techuisitive.com/tag/browser-configuration/), [Device Configuration](https://techuisitive.com/tag/device-configuration/), [Device Configuration Getting Started](https://techuisitive.com/tag/device-configuration-getting-started/), [Intune Guides](https://techuisitive.com/tag/intune-guides/), [Microsoft Edge](https://techuisitive.com/tag/microsoft-edge/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Browser Configuration, Device Configuration, Device Configuration Getting Started, Intune Guides, Microsoft Edge --- ### [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) **Published:** June 11, 2025 **Author:** Equebal Ahmad **Content:** In today’s fast‑moving digital world, keeping devices secure and updated is critical. But manually patching **Windows** and **Microsoft 365 apps** can be a heavy burden for IT teams. That’s where **Windows Autopatch** comes in. It’s a **cloud-based service** built into **Microsoft Intune** that automates updates and makes patch management simple. This guide will cover: - The key **features of Windows Autopatch** - How it change the way patching is done - The essential **configuration steps** to set it up - Tips for **monitoring and troubleshooting** to keep everything running smoothly Table Of Contents 1. [What is Windows Autopatch?](#what-is-windows-autopatch) 2. [How Does Windows Autopatch Improve the Patching Process?](#how-does-windows-autopatch-improve-the-patching-process) 3. [Prerequisites](#prerequisites) 4. [Step-by-Step Guide to Create Autopatch Policies](#step-by-step-guide-to-create-autopatch-policies) 5. [Review the policies and Groups created by Windows AutoPatch](#review-the-policies-and-groups-created-by-windows-autopatch) 6. [Conclusion](#conclusion) 7. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) 8. [Related Posts](#related-posts) 9. [Explore More Intune Guides](#explore-more-intune-guides) ## **What is Windows Autopatch?** Windows Autopatch is a “set-and-forget” service that leverages Microsoft’s expertise to deliver timely updates for: - **Windows 10/11 Quality Updates:** Monthly security and non-security fixes. - **Windows 10/11 Feature Updates:** Annual releases that bring new features and improvements. - **Microsoft 365 Apps for enterprise:** Updates for Word, Excel, PowerPoint, Outlook, etc. - **Microsoft Edge:** The latest browser updates. - **Microsoft Teams:** Ensuring your collaboration tools are always current. - **Drivers and Firmware:** Crucial updates for device stability and performance. The core idea is to offload the heavy lifting of update management to Microsoft, allowing your IT team to focus on more strategic initiatives. ![Windows Autopatch Architecture](https://techuisitive.com/wp-content/uploads/2025/06/image-2-1024x683.png)Windows Autopatch Architecture## **How Does Windows Autopatch Improve the Patching Process?** Windows Autopatch brings a host of benefits that significantly enhance your patching strategy: **Automated Patch Deployment** No more manual scheduling or pushing updates. **Windows Autopatch** takes care of the whole process—from testing to deployment—covering different update types automatically. **Phased Rollouts with Deployment Rings** Autopatch uses “deployment rings” (Test, First, Fast, Last by default) to roll out updates step by step. Updates go to a small group first, issues are monitored, and only then are they expanded to the wider organization. If problems appear, Autopatch can pause the rollout automatically. **Reduced IT Overhead** By automating patch cycles, Autopatch saves IT teams time and effort. This lets them focus on innovation and higher‑value projects instead of routine update management. **Improved Security and Compliance** Devices stay up to date with the latest **security patches**, closing vulnerabilities quickly and helping organizations meet **compliance requirements**. Microsoft aims to keep at least 95% of devices on the latest quality update. **Minimized End‑User Disruption** Autopatch respects active hours and handles reboots intelligently, so updates have minimal impact on productivity. With **Hotpatch for Windows 11**, many quality updates can be applied without a reboot. **Built‑in Intelligence and Telemetry** Microsoft uses telemetry from millions of devices to detect and pause problematic updates, preventing issues from spreading across your environment. **Centralized Management and Reporting via Intune** While Microsoft manages the orchestration, admins still have full visibility in the **Intune admin center**, with detailed reports on update status, compliance, and device health. ## **Prerequisites** Before you can use Windows Autopatch, ensure your environment meets the prerequisites and follow these key configuration steps: - **Licensing:** Your users must have eligible licenses, such as Windows 10/11 Enterprise E3 (or higher), F3, or Microsoft 365 Business Premium, A3, or A5. - **Microsoft Entra ID P1 or P2.** - **Microsoft Intune:** Devices must be enrolled in Intune, and Intune must be set as the Mobile Device Management (MDM) authority, or co-management must be enabled. - **Corporate-Owned Devices:** Autopatch primarily supports corporate-owned devices. - **Network Connectivity:** Devices require connectivity to various Microsoft service endpoints. Ensure your firewalls and proxies allow the necessary traffic. - **Device Health:** Devices must be powered on, have network access, and check in with Intune regularly. ## **Step-by-Step Guide to Create Autopatch Policies** ### Create Entra ID Group for Autopatch Device Registration An Entra ID group is required to register Windows devices to the Windows Autopatch service. The group can be either assigned or Dynamic. Windows Autopatch scans these groups to discover eligible devices, automatically enrolling them for management and applying relevant update policies. While you can have a dynamic group, the assigned group offers more flexibility, as you can add the device directly or add another dynamic group as a member. Create a group and give it a meaningful name, such as “Windows Autopatch Device Registration”. ![Windows Autopatch Device Registration Entra Group](https://techuisitive.com/wp-content/uploads/2025/06/image-1-1024x538.png)### Enable Windows Autopatch To start using the service, you must create an update policy owned by Windows Autopatch. The update policy can be one of the following: - Update rings - Windows quality updates - Windows feature updates - Driver and firmware updates Follow the steps below to create a Windows Autopatch policy. - On the Intune Admin Center, navigate to **Tenant administration/Windows Autopatch/Autopatch groups**. - Select **+Create** to create a Windows autopatch policy. ![Windows autopatch groups](https://techuisitive.com/wp-content/uploads/2025/05/image-1024x463.png)- On the Basics page, enter the policy name and description. Please note that the policy name will be used in the deployment rings, configuration policies, and groups created by Autopatch. Hence, use a meaningful name to avoid misunderstanding at a later stage. ![Windows autopatch Basics page](https://techuisitive.com/wp-content/uploads/2025/05/image-1.png)- Perform the following steps on the Deployment rings page. - Select Add group and select the autopatch device registration group you created earlier. - Click on Add deployment ring to add additional deployment rings. The Test and Last deployment rings are created by default. You can manually add the device to the Test and Last rings. Other ring memberships will be managed automatically by Windows Autopatch. ![Windows autopatch deployment rings](https://techuisitive.com/wp-content/uploads/2025/05/image-2-1024x387.png)- You should now see a screen similar to the one below. The sum of the Dynamic group distribution field must be 100 percent. You can see that we have configured to distribute 40% of the devices on the first ring and the remaining 60% in the second ring. You may start with even a much lower percentage in a production environment. - Click ‘Next’ to proceed to the Update Types page. ![Windows autopatch deployment rings](https://techuisitive.com/wp-content/uploads/2025/05/image-3-1024x423.png)On the Update Types page, select the additional update types. The Quality update is selected by default and cannot be unchecked. Choose additional update types, such as feature updates, driver updates, Microsoft 365 App updates, and Microsoft Edge updates.” ![Windows Autopatch Update Types](https://techuisitive.com/wp-content/uploads/2025/05/image-4.png)On the Deployment Settings page, you can adjust the available settings. The Quality update settings can be modified on the next page. For the Feature updates, select the target Windows version you want to make available. ![Windows Autopatch Deployment Settings](https://techuisitive.com/wp-content/uploads/2025/05/image-5-1024x365.png)The Driver updates settings can be updated if required. You can either have the same approval method for all deployment rings or configure different options for each deployment ring. ![Windows Autopatch Driver updates](https://techuisitive.com/wp-content/uploads/2025/05/image-6-1024x262.png)The configuration for Microsoft 365 apps updates cannot be configured on this page. You can make the adjustments on the next page. ![Windows Autopatch Microsoft 365 apps updates](https://techuisitive.com/wp-content/uploads/2025/05/image-7-1024x115.png)For Microsoft Edge updates, you can either have the same channel for all deployment rings or configure a different channel. ![Windows autopatch Microsoft Edge Updates](https://techuisitive.com/wp-content/uploads/2025/05/image-8-1024x260.png)On the Release Schedules page, you can apply different release schedule presets. The settings will be updated based on the release schedule preset you selected. The following release schedule presets are available. - Informational worker - Shared device - Kiosks and Billboards - Reboot – Sensitive device ![Windows Autopatch Release Schedules](https://techuisitive.com/wp-content/uploads/2025/05/image-9-1024x355.png)On the Review + create page, review the settings and click on the Create button to create the autopatch policies and groups. ![Windows autopatch Intune](https://techuisitive.com/wp-content/uploads/2025/05/image-14-1024x559.png) ## Review the policies and Groups created by Windows AutoPatch Windows Autopatch sets up various policies, groups, and configuration profiles to automate and streamline the process of updating Windows and Microsoft 365 applications. Let’s review these policies, groups, and configuration profiles that were created by Windows Autopatch. Let’s see the Update rings first. Windows Autopatch created four update rings based on the configuration we selected earlier. The policies are: - Windows Autopatch Update Policy – Windows Autopatch Default Policy – Test - Windows Autopatch Update Policy – Windows Autopatch Default Policy – Ring1 - Windows Autopatch Update Policy – Windows Autopatch Default Policy – Ring2 - Windows Autopatch Update Policy – Windows Autopatch Default Policy – Last ![Windows autopatch update rings](https://techuisitive.com/wp-content/uploads/2025/05/image-36-1024x151.png)Windows Autopatch also created corresponding Entra ID groups for each update ring. ![Windows autopatch Entra ID groups](https://techuisitive.com/wp-content/uploads/2025/05/image-16-1024x438.png)A policy to enable Feature update deployment was also created with the settings configured earlier. ![Windows Autopatch - Feature update Acnchor policy](https://techuisitive.com/wp-content/uploads/2025/05/image-17-1024x550.png)The next one is driver update policies. Similar to the updated rings, the four drivers’ update policies were created to automate driver management through Intune. ![Windows autopatch driver updates](https://techuisitive.com/wp-content/uploads/2025/05/image-18-1024x421.png)We have selected Microsoft Edge and Microsoft 365 apps updates as well during the Windows Autopatch configuration. Hence, the policies for Microsoft Edge and M365 Apps are also created. However, these updates are managed through **Device configuration/Setting catalog** policies. ![Windows autopatch Microsoft Edge and M365 app update policies](https://techuisitive.com/wp-content/uploads/2025/05/image-19-1024x550.png)The following settings are configured in Microsoft Edge update policies. **MDM Win over GPO:** This setting overrides the GPO settings to avoid policy conflicts. Target Channel (Device) : Stable Target Channel Override: Enabled ![Windows Autopatch MDM Win over GPO](https://techuisitive.com/wp-content/uploads/2025/05/image-20-1024x567.png)Similarly, the following settings have been configured for the Microsoft 365 Apps update policy. **MDM Win over GPO:** This setting overrides the GPO settings to avoid policy conflicts. Device downloading and installing updates for office: Enabled Enable Automatic Update: Enabled ![Microsoft 365 Apps update policy](https://techuisitive.com/wp-content/uploads/2025/05/image-21-1024x555.png)- Hide option to enable or disable updates: Enabled - Hide Update Notification: Disabled - Office 365 Client Management: Disabled - Update channel: Enabled - Channel Name: Monthly Enterprise Channel - Updated deadline: Enabled - Deadline: 2 days - Update path: Enabled ![](https://techuisitive.com/wp-content/uploads/2025/05/image-22-1024x550.png)Your Intune environment is now configured for Windows Autopatch. You can follow this guide to understand how to monitor and troubleshoot Windows Autopatch-related issues: [How to Monitor and Troubleshoot Windows Autopatch Issues](https://techuisitive.com/how-to-monitor-and-troubleshoot-windows-autopatch-issues/) ## Conclusion Windows Autopatch with Intune makes patch management easier by automating updates for Windows, Microsoft 365 apps, Edge, Teams, and even drivers. Instead of relying on manual scheduling, Autopatch uses deployment rings (Test, First, Fast, Last) to roll out updates step by step. This phased approach reduces risk, improves security, and ensures devices stay compliant. For IT teams, Autopatch means less routine work and more focus on innovation. Microsoft leverages telemetry from millions of devices to detect and pause problematic updates, keeping environments stable. At the same time, admins retain full visibility through the Intune admin center, with detailed reporting on update status, compliance, and device health. In short, Autopatch delivers a balance of automation, security, and productivity, making it a valuable tool for modern endpoint management. ## Frequently Asked Questions (FAQs) ### **What is Windows Autopatch?** Windows Autopatch is a **cloud-based service** from Microsoft that automates updates for **Windows, Microsoft 365 apps, Edge, Teams, and drivers/firmware**. It’s integrated with **Intune**, so IT admins can manage updates centrally without manual patching. ### **How does Autopatch improve patch management?** Autopatch uses **deployment rings** (Test, First, Fast, Last) to roll out updates gradually. This phased rollout reduces risk, ensures devices stay secure, and minimizes disruption for end users. Updates can even be paused automatically if issues are detected. ### ****What are the requirements for using Autopatch?**** Devices must be enrolled in **Microsoft Intune**, registered with **Microsoft Entra ID (Azure AD)**, and meet Windows 10/11 compatibility. Proper licensing such as **Microsoft 365 E3/E5** or equivalent is also required. ### ****How does Autopatch benefit IT teams?**** By automating patch cycles, Autopatch reduces **IT overhead**. Admins spend less time on routine updates and more time on innovation. They also retain full visibility through the **Intune admin center**, with detailed reporting on update status, compliance, and device health. ### ****How does Autopatch improve security and compliance?**** Autopatch ensures devices are consistently updated with the latest **security patches**, closing vulnerabilities quickly. Microsoft aims to keep at least **95% of devices on the latest quality update**, helping organizations meet compliance requirements while maintaining a secure environment. ## Related Posts - [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) - [Manage Edge Chromium favorites with Endpoint Manager | Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Configure Edge Chromium Homepage & Startup Page](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) - [Configure Microsoft Edge Sleeping Tabs using Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Configure Google Chrome settings using Administrative templates | Intune | Endpoint Manager](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Block USB Device with Exception](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows 10 /11 Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Local Admin Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) Tags: [Device Configuration Getting Started](https://techuisitive.com/tag/device-configuration-getting-started/), [Windows Autopatch](https://techuisitive.com/tag/windows-autopatch/), [Windows Updates](https://techuisitive.com/tag/windows-updates/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Device Configuration Getting Started, Windows Autopatch, Windows Updates --- ### [Fix Device Enrollment Error: DeviceAADJoin Failed with Error 0x8018000A](https://techuisitive.com/fix-device-enrollment-error-deviceaadjoin-failed-with-error-0x8018000a/) **Published:** August 11, 2026 **Author:** Equebal Ahmad **Content:** The **DeviceAADJoin failed with 0x8018000A** error typically appears during Windows device enrollment into Microsoft Intune when the Microsoft Entra join process cannot be completed. Although the error message is generic, the underlying cause can range from enrollment limits and licensing issues to stale device objects or incorrect enrollment settings. This article walks through the most common causes and provides proven troubleshooting steps to resolve the problem. ## Issue When enrolling a Windows device using a **provisioning package (.ppkg)**, the enrollment process initially appears to complete successfully. The device is successfully joined to **Microsoft Entra ID**, and a corresponding device object is created in the Entra admin center. However, within a few moments, the device object is automatically deleted, causing the enrollment to fail. The **Audit logs** in Microsoft Entra show that the device was added and then almost immediately removed. ![Entra Audit Logs Device registration](https://techuisitive.com/wp-content/uploads/2026/07/image-12-1024x458.png)The Windows Event Viewer **(Event Viewer > Applications and Services Logs > Microsoft > Windows > Provisioning-Diagnostics-Provider > Admin)** reports the error **DeviceAADJoin failed with 0x8018000A**. As a result, the device never completes Intune enrollment and remains unmanaged. The error below was logged in the Event Viewer. ProvXML category ‘DeviceAADJoin’ failed with ‘0x8018000A’ at CSP node ‘AADJ/BPRT’. Provisioning failed ![ProvXML category 'DeviceAADJoin' failed with '0x8018000A' at CSP node 'AADJ/BPRT'. Provisioning failed ](https://techuisitive.com/wp-content/uploads/2026/07/image-11.png)## Solution This PowerShell script performs a complete cleanup of **Mobile Device Management (MDM)** enrollment artifacts from a Windows device. It removes stale enrollment records, scheduled tasks, registry entries, certificates, and other remnants left behind by previous MDM enrollments. This cleanup is especially useful when **re-enrolling a device into Microsoft Intune**, migrating a device **from one Microsoft Entra tenant to another**, or troubleshooting enrollment failures caused by orphaned or inconsistent enrollment information. By removing these leftover MDM components, the script helps ensure that the device starts with a clean enrollment state, reducing the likelihood of errors during the new enrollment process and simplifying Intune migration and recovery scenarios. The script performs the following actions. - **Backs up MDM enrollment registry keys** before making changes, allowing recovery if needed. - **Stops MDM-related services** to prevent conflicts during the cleanup process. - **Removes stale MDM enrollment artifacts**, including enrollment GUIDs, provisioning and policy registry keys, certificates, and other enrollment-related records. - **Deletes MDM scheduled tasks** created for device enrollment and ongoing management. - **Generates a cleanup summary** showing successful and failed actions, then recommends restarting the device before attempting Microsoft Entra join or Intune re-enrollment. ## MDM Enrollment Cleanup Script ``` # MDM Enrollment Cleanup # Backup first reg export "HKLM\SOFTWARE\Microsoft\Enrollments" "C:\Temp\Enrollments_backup_$(Get-Date -Format 'yyyyMMdd_HHmmss').reg" /y Write-Host "Backup done" -ForegroundColor Green # Stop MDM services $services = @("dmwappushservice","diagsvc","DeviceManagementEnterpriseDriver") foreach ($svc in $services) {     Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue     Write-Host "Stopped: $svc" } # Force remove ALL enrollment GUIDs $enrollPath = "HKLM:\SOFTWARE\Microsoft\Enrollments" $entries = Get-ChildItem $enrollPath -ErrorAction SilentlyContinue $removed = 0; $failed = 0 foreach ($entry in $entries) {     $guid = $entry.PSChildName     # Skip non-GUID entries like 'Context'     if ($guid -notmatch '^[0-9a-fA-F]{8}-') {         Write-Host "SKIPPED (non-GUID): $guid" -ForegroundColor Yellow         continue     }     try {         Remove-Item -Path $entry.PSPath -Recurse -Force -ErrorAction Stop         Write-Host "REMOVED: $guid" -ForegroundColor Green         $removed++     } catch {         Write-Host "FAILED : $guid — $_" -ForegroundColor Red         $failed++     } } # Clean companion keys $keys = @(     "HKLM:\SOFTWARE\Microsoft\Enrollments\Status",     "HKLM:\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked",     "HKLM:\SOFTWARE\Microsoft\PolicyManager\AdmxInstalled",     "HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers",     "HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts",     "HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Logger",     "HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Sessions" ) foreach ($key in $keys) {     if (Test-Path $key) {         Get-ChildItem $key -ErrorAction SilentlyContinue |         Remove-Item -Recurse -Force -ErrorAction SilentlyContinue         Write-Host "Cleaned: $key" -ForegroundColor Green     } } # Remove MDM scheduled tasks foreach ($tp in @("\Microsoft\Windows\EnterpriseMgmt\","\Microsoft\Windows\EnterpriseMgmtNoncritical\")) {     Get-ScheduledTask -TaskPath "$tp*" -ErrorAction SilentlyContinue |     Unregister-ScheduledTask -Confirm:$false -ErrorAction SilentlyContinue     Write-Host "Tasks cleaned: $tp" -ForegroundColor Green } # Summary $remaining = (Get-ChildItem $enrollPath -ErrorAction SilentlyContinue).Count Write-Host "`n================================" -ForegroundColor Cyan Write-Host " Removed : $removed" -ForegroundColor Green Write-Host " Failed  : $failed" $(if ($failed -gt 0) { "-ForegroundColor Red" }) Write-Host " Remaining entries: $remaining" -ForegroundColor $(if ($remaining -eq 0){"Green"}else{"Red"}) Write-Host "================================" -ForegroundColor Cyan Write-Host "`nREBOOT NOW then retry Entra join" -ForegroundColor Yellow ``` ## Script Download Download the PowerShell script for MDM enrollment cleanup. [MDM Enrollment Cleanup](https://techuisitive.com/wp-content/uploads/2026/08/MDM-Enrollment-Cleanup.zip)[Download](https://techuisitive.com/wp-content/uploads/2026/08/MDM-Enrollment-Cleanup.zip) ## Related Posts - [How to Fix Intune Enrollment Error 0x800705b4](https://techuisitive.com/how-to-fix-intune-enrollment-error-0x800705b4/) - [Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/) - [Fix Windows 11 Intune Enrollment Error 0x800700b7 \[Step-by-Step Guide\]](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Windows 10/11](https://techuisitive.com/microsoft-windows/ "Windows 10/11")** – Explore practical guides for Windows device management, configuration, enrollment, troubleshooting, PowerShell, and administration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Troubleshooting --- ### [Intune - Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) **Published:** February 17, 2022 **Author:** Equebal Ahmad **Content:** The Win32 app in Microsoft Intune offers enhanced control over application deployment. However, deployment failures can occur, and understanding the troubleshooting steps for Intune Win32 apps is essential. One common issue is the error code **0x80070643**, which indicates a *fatal error during installation*. This error can stem from various causes—some are easy to identify, while others require deeper investigation. In such cases, generating a **verbose installation log** becomes crucial to pinpoint the root cause. In this guide, we’ll explore the reasons behind error **0x80070643** and walk through effective strategies to resolve it. ## **TL;DR – Intune Win32 App Deployment Error 0x80070643** Deployment of Win32 apps via Microsoft Intune may fail with error **0x80070643**, often due to issues with **SYSTEM account permissions**, **MSI installation parameters**, or **missing dependencies**. The blog walks through troubleshooting steps, including: - Using **verbose logging** (`/L*v`) to diagnose installation failures - Ensuring the **SYSTEM account** has access to the required files - Correcting **MSI command-line syntax** - Reviewing **log files** with tools like CMTrace A real-world example involving **WinZip deployment** illustrates how improper access or command formatting can trigger this error. Fixing the root cause typically resolves the issue. Table Of Contents 1. [TL;DR – Intune Win32 App Deployment Error 0x80070643](#tldr-intune-win32-app-deployment-error-0x80070643) 2. [Issue – Error 0x80070643](#issue-error-0x80070643) 3. [Understanding Error 0x80070643: What Causes the Fatal Installation Failure](#understanding-error-0x80070643-what-causes-the-fatal-installation-failure) 4. [Troubleshooting Steps](#troubleshooting-steps) 5. [Verbose Logging with MSIExec for Intune Troubleshooting](#verbose-logging-with-msiexec-for-intune-troubleshooting) 6. [Real-World Example](#real-world-example) 7. [Best Practices](#best-practices) 8. [Related Posts](#related-posts) 9. [Explore More Intune Guides](#explore-more-intune-guides) ## **Issue** – Error **0x80070643** The Win32 App deployment failed with the following error in Microsoft Intune. **Error code: 0x80070643** : Fatal error during installation **Suggested remediation**: A Microsoft Windows Installer failure occurred. Enable Windows Installer verbose logging. Then retry the installation to capture the error details. The deployment error can be checked from **Microsoft Intune Admin Center > Apps > Windows Apps** blade. ![Intune error code 0x80070643 | Intune Win32 app error 0x80070643](https://techuisitive.com/wp-content/uploads/2023/03/image-11.png)## **Understanding Error 0x80070643: What Causes the Fatal Installation Failure** The **Intune error 0x80070643** is a **generic installation failure code** that does not point to a single root cause, making troubleshooting more complex. This error can appear in multiple scenarios where **MSI‑based applications** or **Microsoft Intune Win32 app deployments** encounter issues. You are likely to see this error under conditions such as: ### **Common Causes** #### Cause 1: Encrypted Folder Installation - Symptoms: MSI fails silently - Fix: install to a non-encrypted folder. #### Cause 2: SYSTEM Account Permission - Symptom: Access denied errors. - Fix: Grant SYSTEM full control. #### **Cause 3: CD/DVD Drive Target** - Symptom: MSI fails with 1603. - Fix: Install to a valid HDD partition. #### **Cause 4: App Already Installed** - Symptom: Duplicate install attempt. - Fix: Uninstall, then redeploy. #### **Cause 5: Unknown/Generic Failure** - Symptom: Fatal error without a clear cause. - Fix: Enable verbose logging. ## Troubleshooting Steps To resolve this issue, you may need to take one or more of the following actions, depending on the root cause: - Install the package to a drive that is not a CD/DVD drive or not accessed as a [substitute drive](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/). - Install the package in a folder that is not encrypted. - Check if the app is already installed on the PC. If so, uninstall and reinstall the app. - Grant full control permission to the SYSTEM account on the target folder where you are trying to install the application**.** - Generate a verbose log to identify the possible issues. Continue below to learn about verbose logging. ## **Verbose Logging with MSIExec for Intune Troubleshooting** The **Microsoft Installer (MSIExec.exe)** handles application installations. By enabling **verbose logging**, you can capture detailed information about the installation process in a log file. This is especially useful when diagnosing **Intune Win32 app deployment failures**. The most commonly used logging option is `/L*V`, which records all events with verbose detail. Here’s a complete MSI command line example: *`msiexec /i App1.msi /L*V `*App1.log - /i App1.msi → Installs the MSI package. - */L*\*V “C:\\Temp\\App1.log” → Creates a detailed log file named *App1.log* in the specified path. You can analyze the log file using **Notepad** or a log viewer such as **CMTrace** to quickly identify **error codes**, **failure points**, or **permission conflicts**. This level of detail helps pinpoint the exact cause of installation issues, whether related to **silent install switches**, **detection rules**, or **missing prerequisites**. ## **Real-World Example** We have documented insights from multiple scenarios where fatal errors occurred during application installation. ### **The target folder was a CD/ DVD Drive** The WinZip installation failed with error 0x80070643. The command line below was used. `msiexec /i winzip260-64.msi /qn INSTALLDIR="D:\Program Files\WinZip26" ALLUSERS=1` Upon reviewing the **[IntuneManagementExtension.log](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/#intune-management-extension "IntuneManagementExtension.log")**, we discovered that the installation command was attempting to deploy the application to the **D: drive**, which triggered a **1603 fatal error**. Further investigation of the affected computer revealed that the hard disk contained only a single partition, and the **D: drive letter** was mapped to a **CD/DVD drive**. This misconfiguration was the root cause of the installation failure. By correcting the **installation path** or ensuring the **drive mapping** is valid, administrators can prevent this error and ensure successful **Microsoft Intune Win32 app deployments**. ![IntuneManagementExtension.log](https://techuisitive.com/wp-content/uploads/2023/03/image-12.png)## **Best Practices** - Always test MSI installs manually before packaging. - Use pilot groups for Win32 deployments. - Automate log collection with PowerShell/Graph API. - Document fixes for recurring issues ## **Related Posts** - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune App Troubleshooting, Win32 Apps --- ### [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) **Published:** February 11, 2022 **Author:** Equebal Ahmad **Content:** Deploying **Win32 applications with Microsoft Intune** can sometimes fail with the error code **0x87D1041C**, which translates to *“The application was not detected after installation completed successfully.”* This issue typically occurs when **Intune detection rules** (MSI, File, Registry, or custom script) are misconfigured or fail to validate the app’s presence after installation. In this guide, we’ll explain the **common causes of Intune error 0x87D1041C**, how detection rules work, and provide a step‑by‑step checklist to troubleshoot and fix the problem. Whether you’re deploying apps on **Windows 10 or Windows 11 devices**, this article will help IT administrators resolve **Intune Win32 app deployment failures** and ensure smooth application delivery across managed endpoints. For a deeper understanding of how **[Intune Win32 app detection rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune")** work, you can follow our detailed guide: Understanding Win32 App Detection Rules in Microsoft Intune (techuisitive.com in Bing). That article explains how Intune evaluates application presence using **MSI, File, Registry, and custom script detection rules**, and what entries are logged in the **IntuneManagementExtension.log** file during the detection process. ## **Issue:** **Microsoft Intune Win32 application deployment** may fail with the error code **0x87D1041C**. You can view detailed information about this failure in the **Application installation status** section of the **Intune admin center**, which provides insights into why the **Win32 app deployment** was not detected after installation. Reviewing these details is the first step in troubleshooting **Intune Win32 app deployment errors** and validating detection rules. **Error code: 0x87D1041C** *The application was not detected after installation completed successfully (0x87d1041c)* **Suggested remediation** *Couldn’t detect app because it was manually updated after installation or uninstalled by the user.* The deployment error can be checked from the **Intune Admin Center / Apps / Windows Apps** / **** ![Intune 0x87D1041C the application was not detected after installation completed successfully (0x87d1041c)](https://techuisitive.com/wp-content/uploads/2023/03/image-13.png)## **Understanding the Cause of Intune Win32 Deployment Error 0x87D1041C** The **Intune error 0x87D1041C** indicates that the application was successfully installed on the device; however, Intune could not detect its presence after installation. This detection failure can occur due to several reasons: - **User‑initiated uninstall**: The application may have been explicitly uninstalled by the user after installation. This scenario typically applies only to **required applications** where Intune expects the app to remain present. - **Incorrect detection method**: The detection rules configured for the application may not be valid. This often happens when using **Registry, File, or custom script detection rules** with incorrect paths, values, or parameters. If the detection logic does not match the actual installation footprint, Intune will report the app as *not detected* even though it was installed successfully. By reviewing and correcting the **Intune Win32 app detection rules**, administrators can resolve error **0x87D1041C** and ensure reliable application deployment across **Windows 10 and Windows 11 devices**. ### Detection Rule Types and Common Pitfalls Detection RuleCommon PitfallQuick FixMSIWrong product codeUse PowerShell/Registry to confirmFileIncorrect path/versionDouble-check folder/file existenceRegistryWrong key/valueValidate with `regedit`ScriptLogic errorsTest script locally before upload## How to Fix Win32 App Deployment Error **0x87D1041C** No action is required when a **required application** has been uninstalled by the user. Since the app is assigned as **mandatory in Microsoft Intune**, it will automatically reinstall during the next **policy update cycle**. However, if you encounter this **error code immediately after installation**, the issue is likely related to the **Win32 app detection rules**. In such cases, the detection logic must be reviewed, identified, and corrected to ensure Intune can properly validate the application’s presence after deployment. ### Checklist for Detection Rule 1. Verify detection rule type (MSI/File/Registry/Script). 2. Confirm the correct path/product code. 3. Check Intune logs ([`IntuneManagementExtension.log`](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/#intune-management-extension)). 4. Validate app presence manually. ### **Verify Intune Win32 App Detection Rule Type** You can validate the **Intune Win32 app detection rules** (such as **application product code**, **registry key**, **file or folder path**, or **custom PowerShell script**) from the **Detection Rules tab** when editing the application in **Microsoft Intune**. Always ensure that the details provided are accurate so Intune can correctly detect the application after installation. For example, if you are using a **file or folder detection rule**, confirm that the **path**, **file name**, and **version information** are correct. Any mismatch in these values can cause Intune to fail detection, even if the application installs successfully. Please check “[Understanding win32 app detection rule](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune")” to learn more about Win32 app detection rules. ![Intune win32 app detection rules 0x87D1041C ](https://techuisitive.com/wp-content/uploads/2023/03/image-14.png)### Confirm the Product Code If you are using the **MSI product code** as the detection method in **Microsoft Intune Win32 app deployments**, you can validate the correct product code directly from the machine where the application is installed. Run the following **PowerShell command** to retrieve the MSI product code: ``` Get-WmiObject -Class win32_product -Filter "Name LiKE '%VISIO%'" ``` ![win32_product 0x87d1041c](https://techuisitive.com/wp-content/uploads/2023/03/image-15.png)**Name** → Displays the installed application name. **IdentifyingNumber** → Shows the MSI product code (GUID) required for Intune detection rules. By confirming the correct **MSI product code**, you ensure that Intune can properly detect the application after installation, preventing common errors such as **0x87D1041C** (app not detected post‑install) or [**0x87D30006** ](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/ "How to Fix Intune Win32 App Error 0x87D30006")(invalid detection rule parsing). ### **Find MSI Product Code in Windows Registry for Intune Detection** You can also locate the **MSI product code** from the **Windows Registry** on a device where the application is installed. 1. Open the **Registry Editor** (`regedit`). 2. Navigate to: `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall` 3. Browse through the **GUID entries** under this path to find the application you are looking for. 4. The **GUID** corresponds to the MSI product code, which can be used in **Intune Win32 app detection rules**. Validating the correct **MSI product code** ensures that **Microsoft Intune** can properly detect the application after installation, preventing errors such as **0x87D1041C** (app not detected post‑install) or **0x87D30006** (invalid detection rule parsing). ![Windows registry product MSI GUID](https://techuisitive.com/wp-content/uploads/2023/03/image-16.png)## **Related Posts** - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune App Troubleshooting, Win32 Apps --- ### [Fix Intune Win32 App Deployment Error 0x87d300c9 (Step‑by‑Step Guide)](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) **Published:** February 4, 2022 **Author:** Equebal Ahmad **Content:** Deploying Win32 apps through Intune can sometimes throw unexpected errors that leave administrators puzzled. One common issue is **error 0x87D300C9**, which typically indicates that the installer failed to run silently or timed out during execution. In this guide, we’ll break down the root causes of this error, show you how to analyze logs, and walk through practical fixes—so you can get your apps deployed smoothly without wasted cycles. ## **Issue:** Intune Win32 app deployment failed with error code 0x87D300C9. **Error Code:** 0x87D300C9 **Error Description:** The unmonitored process is in progress; it may timeout. ![Error Code: 0x87D300C9](https://techuisitive.com/wp-content/uploads/2023/10/image-54.png)Intune – Win32 App – Error 0x87D300C9 ## **Cause of Intune Error 0x87D300C9 – Process Still Running** The **Intune error 0x87D300C9** occurs when **Microsoft Intune** detects that a process is still running after it has stopped monitoring the installation. This typically happens when the **installer** or **deployment script** becomes stuck during execution, preventing Intune from completing the **Win32 app installation**. **PowerShell scripts**: The issue often arises when an unexpected **message box** or prompt appears, causing the script to hang indefinitely until manually closed. **Applications**: Common causes include a **corrupt installer**, incorrect **command‑line arguments**, or missing **silent install switches** that prevent the installer from running unattended. Properly configuring **Intune Win32 app deployment scripts** and ensuring installers support **silent installation** are key steps to avoiding this error. ## Step-by-Step Guide to Investigate Intune 0x87D300C9 Error ### **Validate command-line switches** To resolve **Intune error 0x87D300C9**, first validate that the **command‑line switches** used in the installer are correct. Next, perform a **manual installation** using the same switches to confirm that the application runs in **silent mode** without generating any **pop‑up messages** or prompts. This ensures the installer supports unattended execution and prevents Intune from hanging during **Win32 app deployment**. ### ****Manual Installation to Verify Intune Error 0x87D300C9**** To troubleshoot **Intune error 0x87D300C9**, try installing the application manually using the same **source file**. This helps verify whether the installation process completes without hanging. - If the issue occurs only on certain devices, perform the manual installation on one of the **affected machines** to isolate the problem. - Failures may stem from a **corrupt source file** or missing **prerequisites** such as the **.NET Framework** or other required **dependencies**. By confirming the installer runs correctly outside of Intune, you can determine whether the problem lies with the **application package** itself or with the **Intune deployment process**. ### Check for Message Boxes in PowerShell Scripts – Intune Error 0x87D300C9 A **PowerShell script** may hang indefinitely if it displays a **message box** or interactive prompt during execution. This prevents the script from completing silently and can trigger **Intune error 0x87D300C9** during **Win32 app deployment**. **Fix**: Remove or suppress any interactive elements, so the script runs in **unattended mode**. **Why it happens**: Message boxes require user interaction, which blocks the script from finishing and stops Intune from detecting completion. **How to verify**: Run the script manually and confirm that no **message boxes** or prompts appear while it executes. Ensuring scripts are designed for **silent execution** is critical for successful **Microsoft Intune Win32 app installation**. ### Check IntuneManagementExtension.log for Win32 App Deployment Errors The **[IntuneManagementExtension.log](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/#intune-management-extension "IntuneManagementExtension.log")** is the primary log file for troubleshooting **Microsoft Intune Win32 app deployments**. **Tip**: Use a log viewer such as **CMTrace** to make entries easier to read and quickly identify **error codes** or **failure points**. **Purpose**: This log records every step Intune takes during deployment—actions attempted, successes, and points of failure. **Why it matters**: Reviewing the log helps pinpoint the exact cause of deployment issues, whether it’s a **timeout**, **detection rule mismatch**, or **installer error**. By analyzing the **IntuneManagementExtension.log**, administrators can efficiently diagnose and resolve **Intune Win32 app installation problems**, ensuring smoother **application deployment** across devices. ## Real World Example To better understand why the deployment failed in this case, we analyzed the **IntuneManagementExtension.log** file. **Outcome:** As shown in the second screenshot, the Win32 installation was aborted once the timeout was reached. **Root cause:** The command‑line switch used was incorrect. **What happened:** The Microsoft installer responded by displaying a usage prompt. Because the installation was running under the **system account**, the prompt was invisible to the user and required manual interaction to close. **Result:** With no way to dismiss the prompt, the installer process remained stuck until Intune’s monitoring timed out after **60 minutes**. ![IntuneManagementExtension.log intune 0x87d300c9](https://techuisitive.com/wp-content/uploads/2023/10/image-55.png)Figure: IntuneManagementExtension.log ![IntuneManagementExtension.log 0x87d300c9 intune ](https://techuisitive.com/wp-content/uploads/2023/10/image-56.png)We attempted to install **Microsoft Visio Viewer 2016** using the same command, but the **/qs switch** was incorrect. As a result, the **Microsoft Installer (MSI)** displayed a **message box** that required user interaction to close. Because the deployment was running under the **system context**, the prompt was invisible to the user. With no way to dismiss it, the installation process became stuck and eventually failed with **Intune error 0x87D300C9**. This error highlights the importance of validating **command‑line switches** and ensuring installers run in **silent mode** during **Microsoft Intune Win32 app deployments**. ![Microsoft Visio Error 0x87D300C9 Intune](https://techuisitive.com/wp-content/uploads/2023/10/image-57.png)## **Related Posts** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Win32 Apps vs LOB Apps](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Tags: [Intune App Troubleshooting](https://techuisitive.com/tag/intune-app-troubleshooting/), [Win32 Apps](https://techuisitive.com/tag/win32-app/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune App Troubleshooting, Win32 Apps --- ### [Intune Win32 App Deployment failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) **Published:** January 27, 2022 **Author:** Equebal Ahmad **Content:** Deploying Win32 applications through Microsoft Intune can sometimes throw unexpected errors that leave administrators puzzled. One common issue is the failure with error code **0x80070653**, which typically points to problems with the MSI installer package or detection rules. In this guide, we’ll break down what this error means, explore the most frequent causes, and walk through practical troubleshooting steps to help you resolve it quickly and keep your Intune deployments running smoothly. ## **Issue:** Microsoft Intune Win32 application deployment failed with error code 0x80070653 Error Code: **0x80070653** Error Description: This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package. You can check for the error by following the steps below. - Open Intune Admin Console - Navigate to **Apps > Windows > Windows Apps > < App Name>** ![Intune - Win32 App error - 0x80070653](https://techuisitive.com/wp-content/uploads/2023/03/image-60.png)- Click on App status ![Intune - Win32 App error - 0x80070653](https://techuisitive.com/wp-content/uploads/2023/03/image-61.png)## **Causes for the Win32 App Deployment Error** 0x80070653 **Error code 0x80070653 (decimal 1619)** is a Windows Installer return code that maps to **ERROR\_INSTALL\_PACKAGE\_OPEN\_FAILED**. In practical terms, this indicates that the installer was unable to access or open the specified installation package. Common reasons include a missing or corrupted MSI file, incorrect file path, insufficient permissions, or issues with how the package was delivered through Intune. When this error occurs, Windows essentially reports: *“This installation package could not be opened.”* ## Troubleshooting Steps for Error 0x80070653 StepWhat to ValidateWhy It MattersHow to Check1Package existenceIf the installer file is missing, Windows Installer cannot proceed.Confirm the MSI/EXE file exists at the specified path.2File name & pathIncorrect paths prevent the installer from being located.Double-check the command line path and filename syntax.3Command line parametersInvalid arguments can cause the installer to fail.Review and correct command line switches/parameters.4File integrityA corrupted installer cannot be opened.Verify file hash or re-download the package. 5Manual installationHelps isolate silent install vs. package issues.Run the installer manually without silent switches to see if errors occur.6Verbose loggingProvides detailed insight into failure points.Use `msiexec /i package.msi /L*v install.log` and analyze the log file. Check out [verbose logging](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/#verbose-logging "verbose logging") for more details.## **Related Posts** - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune App Troubleshooting, Win32 Apps --- ### [Assign Microsoft Store Apps Using Intune Filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/) **Published:** May 29, 2021 **Author:** Equebal Ahmad **Content:** Microsoft recently introduced Filters in Microsoft Endpoint Manager / Intune, which allow more granular targeting of applications and policies to specific devices. In this blog post, we will see how we can deploy a Microsoft Store app to a group of devices using Azure AD groups and MEM Filters. We will deploy Microsoft Whiteboard to all Windows 10 Devices whose Device Category is ‘Training Devices’. For this example, we already approved the Microsoft Whiteboard application in Microsoft Store for Business (MSfB), and it’s synced with Microsoft Endpoint Manager. ![Intune Filters](https://techuisitive.com/wp-content/uploads/2023/04/image-235.jpeg) Table Of Contents 1. [Create AD Group for Windows 10 Devices](#create-ad-group-for-windows-10-devices) 2. [Create Filter for Training Devices](#create-filter-for-training-devices) 3. [Deploy Microsoft Whiteboard on Devices using AAD group & Intune Filters](#deploy-microsoft-whiteboard-on-devices-using-aad-group-intune-filters) 4. [Deployment Status & Filters Evaluation](#deployment-status-filters-evaluation) 5. [Related Posts](#related-posts) 6. [Explore More Intune Guides](#explore-more-intune-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Create AD Group for Windows 10 Devices** The next step is to create a dynamic AAD group for all Windows 10 devices. If you already have a group for Windows 10 devices then you can skip this step. From Azure Active Directory > Group, create a dynamic group. Use the below query expression to include all Windows 10 devices. ![Dynamic membership rule](https://techuisitive.com/wp-content/uploads/2023/04/image-236.jpeg)Azure AD Group – Dynamic Rule ``` (device.deviceOSVersion -startsWith "10.0") -and (device.DeviceOSType -startsWith "Windows") -and (device.managementType -eq "MDM") ``` ## **Create Filter for Training Devices** In Microsoft Endpoint Manager admin center, Select Devices | Filters (preview) and click on Create. ![Create Intune Filter](https://techuisitive.com/wp-content/uploads/2023/04/image-237.jpeg)Enter Filter Name, Description, and Platform, and then clock on Next. Add the expression to include devices whose Device Category is ‘Training Devices’. Click on Next. ![Create intune filter](https://techuisitive.com/wp-content/uploads/2023/04/image-238.jpeg)Review the details and then click on Create. ![Intune filter Review + create](https://techuisitive.com/wp-content/uploads/2023/04/image-239.jpeg)You can now see the newly created filter in Devices | Filters (preview) ![Devices | Check existing filters](https://techuisitive.com/wp-content/uploads/2023/04/image-240.jpeg)## **Deploy Microsoft Whiteboard on Devices using AAD group & Intune Filters** Now we have both AAD group and MEM Filter in place for the granular deployment of applications on Windows 10 devices whose device category is ‘Training Devices’. To deploy the application, Go to Apps, click on Microsoft Whiteboard, and select Properties. Click on the Edit link under the Assignments section. ![App properties](https://techuisitive.com/wp-content/uploads/2023/04/image-241.jpeg)In the Edit application page, click on Add group under Required and select Windows 10 devices group. Click on Select. ![Intune Apps assign group](https://techuisitive.com/wp-content/uploads/2023/04/image-242.jpeg)Now you can see the Windows 10 Devices group added under Required. The Filter option is now available. ![Intune Apps assign group](https://techuisitive.com/wp-content/uploads/2023/04/image-243.jpeg)Click on the None link below Filter mode. Select the “Include filtered devices in assignment” radio button. From available filters, select the filter which you want to use and click on Select. ![Intune Apps assign group](https://techuisitive.com/wp-content/uploads/2023/04/image-244.jpeg)You can now see that Filter mode and Filter is now visible under Required. Filter mode is set to Include and Filter set to ‘Training Devices’. Click on Review & Save. ![Intune Apps assign group](https://techuisitive.com/wp-content/uploads/2023/04/image-245.jpeg)Review the details and click on Save to complete the deployment setup. ![Intune Apps assign group](https://techuisitive.com/wp-content/uploads/2023/04/image-246.jpeg)## **Deployment Status & Filters Evaluation** We will now check the deployment on one of our test Windows 10 laptops. The device category has not yet been set on this laptop. Before proceeding further, let’s understand how the include and exclude filters are evaluated. Here is the excerpt from Microsoft documentation. ![Intune Filters | filter mode](https://techuisitive.com/wp-content/uploads/2023/04/image-247.jpeg)Microsoft Endpoint Manager Filters – Include and Exclude evaluation rule To check the application deployment status, Go to Apps > Microsoft Whiteboard > Device install status. The following details are shown. Status: Not applicable Status Details: Filters criteria are not met Filters (Preview): Filters evaluated ![Apps](https://techuisitive.com/wp-content/uploads/2023/04/image-248.jpeg)Application install status Click on the Filters evaluated link. You can see that the Evaluation result is “Not match” hence the application was not offered to the device. You can also see that the Device Category property was empty hence Filter criteria were not matched. ![Filters evaluation status](https://techuisitive.com/wp-content/uploads/2023/04/image-249.jpeg)We will now set the Device category for this device, force client policy sync, and check the filter evaluation and deployment status again. To change the Device category, go to Devices > Select Device and select Properties. Update the Device category. We changed this to “Training Devices”. ![Device properties](https://techuisitive.com/wp-content/uploads/2023/04/image-250.jpeg)Device category Force sync on Windows 10 devices to quickly update the policy. Windows Settings > Accounts > Access Work or School > Select Account and then click on Sync. ![School or work account | Device sync status](https://techuisitive.com/wp-content/uploads/2023/04/image-251.jpeg)Wait for some time for Filter re-evaluation. I have waited for an hour and the application was installed after the filter evaluation succeeded. ![Intune filter evaluation](https://techuisitive.com/wp-content/uploads/2023/04/image-253.jpeg)See the Filter evaluation now. The included criteria were matched and the application was offered to the device. ![Intune filter evaluation](https://techuisitive.com/wp-content/uploads/2023/04/image-252.jpeg)Filter evaluation You can also find the application added in the Start menu on Windows 10 devices. ![Windows 10 Start menu](https://techuisitive.com/wp-content/uploads/2023/11/image-3.jpeg)## **Related Posts** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Win32 Apps vs LOB Apps](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Tags: [M365 and Store Apps](https://techuisitive.com/tag/m365-and-store-apps/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** M365 and Store Apps --- ### [Win32 App Deployment with Dependencies | Microsoft Intune](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) **Published:** February 8, 2022 **Author:** Equebal Ahmad **Content:** Windows Apps (Win32) in Microsoft Intune / Endpoint Manager provide us with greater control over the deployment of applications. The Win32 apps allow us to configure additional parameters similar to Configuration Manager application model features such as [Detection methods](https://techuisitive.com/intune-understanding-win32-app-detection-rules/), [Dependencies ](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/)& [Supersedence](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/). In this blog post, we will understand what application dependencies are and how we can install a dependent application during the deployment. Table Of Contents 1. [What are Win32 App Dependencies](#what-are-win32-app-dependencies) 2. [How to Add Win32 App Dependencies](#how-to-add-win32-app-dependencies) 3. [End User Experience](#end-user-experience) 4. [Related Posts](#related-posts) 5. [Explore More Intune Guides](#explore-more-intune-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **What are Win32 App Dependencies** App dependencies are applications that must be installed before your Win32 app can be installed. You can require that other apps are installed as dependencies. The app dependency must be a Win32app. You can’t add other application types such as a LOB app or a Windows Store app as a dependency for a Win32 application. A dependency can have sub-dependencies, and each sub-dependency will be installed before the main dependency is installed. We have created the following Win32 application in Intune for this demonstration. **Notepad++** is the main application that we will deploy on the test device. The application has been created with default settings without any dependency. Check[ ](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/)[**How to Deploy Google Chrome for Enterprise with Intune Win32 App**](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) if you need any help on Win32 app creation. **Visual C++ Redist** is another Win32app which we will use as a dependency for Notepad++. Though this is not a real dependency for Notepad++, we will use this as a dependency for this demonostration. We have captured the information below by installing the Visual C++ redistributable on a Windows 10 device to use it for detection methods in the Visual C++ redist win32 app. DisplayName : Microsoft Visual C++ 2022 X64 Minimum Runtime – 14.30.30708 Key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AE043016-3897-41D4-870B-1DAEE62CF152} ![Intune - Win32 apps](https://techuisitive.com/wp-content/uploads/2023/04/image-21.png)It’s not required to assign an app dependency to users or devices. Hence, we have not assigned Visual C++ Redistributable to any user or device. ![Intune - Win32 app dependency](https://techuisitive.com/wp-content/uploads/2023/04/image-22.png)## **How to Add Win32 App Dependencies** Now we will edit the Notepad++ application and add an app dependency. To edit the app, navigate to **Apps >** Windows, select , and click on **Properties**. Scroll down to the Dependencies section and click on Edit. Click on Add in the **Dependencies** tab. ![Intune - Win32 app - Add dependencies](https://techuisitive.com/wp-content/uploads/2023/04/image-23.png)Type the app dependency application name in the search box to quickly find the application and select the same. Click on **Select**. ![Intune - Win32 app - Add dependencies](https://techuisitive.com/wp-content/uploads/2023/04/image-24.png)In the next screen, ensure that **Automatically Install** is set to **Yes**. Click on Review + save. ![Intune - Win32 app - Add dependencies](https://techuisitive.com/wp-content/uploads/2023/04/image-25.png)**Note:** When the Automatically install option is set to Yes for a dependency, Intune will install the app on the device automatically even if the dependent app is not targeted to the user or device.In the **Review + save** tab, review the details and click on the **Save** button. ![Intune - Win32 app - Add dependencies](https://techuisitive.com/wp-content/uploads/2023/04/image-26.png)Click on **Dependency Viewer** to see the graphical view of all dependencies for the application. ![Intune - Win32 app - Dependencies graphical view](https://techuisitive.com/wp-content/uploads/2023/04/image-27.png)Now, we will assign the application to a test device. To edit the app, navigate again to Apps > Windows, select , and click on Properties. Scroll down to the **Assignments** section and click on **Edit**. In the **Assignment** page, click on **Add group** in the **Required** section and add the Azure AD (AAD) group where you want to target this application. We have added “IT Department Devices” in our case. Click on **Review + save**. ![Intune - Win32 app - Assignments](https://techuisitive.com/wp-content/uploads/2023/04/image-28.png)In the **Review + save** page, validate the setting and click on **Save**. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-29.png)The Win32 app will now deploy to all targeted users or devices. We will now see the end user experience for this deployment. ## **End User Experience** Once the policy is updated on the client machine, the dependency applications will be downloaded and installed. As you can see in the screenshot, the app dependency ( Visual C++ Redistributable ) was downloaded and installed. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-30.png)Once the app dependency installation was completed, the Intune client downloaded and installed the application, which was targeted to the device. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-31.png)## **Related Posts** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Win32 Apps vs LOB Apps](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Tags: [Intune win32 App Guides](https://techuisitive.com/tag/intune-win32-app-guides/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune win32 App Guides --- ### [Understanding Win32 App Requirements Rule in Microsoft Intune](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) **Published:** April 28, 2022 **Author:** Equebal Ahmad **Content:** Deploying Win32 apps in Microsoft Intune isn’t just about packaging and pushing software—it’s about ensuring the right conditions are met before installation. Intune’s **Requirements Rules** give admins precise control, from verifying OS architecture to checking disk space, registry keys, or custom PowerShell scripts. In this guide, we’ll break down each requirement type, show real‑world examples, and explain how to troubleshoot using Intune logs. For step‑by‑step instructions on creating a **[Win32 application in Microsoft Intune](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/ "Win32 application in Microsoft Intune")**, please refer to the dedicated blog post. ## **Table of contents** Table Of Contents 1. [Table of contents](#table-of-contents) 2. [Win32 App Requirements Checklist](#win32-app-requirements-checklist) 3. [Win32 App – Mandatory Requirement](#win32-app-mandatory-requirement) 4. [Win32 App – Optional Requirement](#win32-app-optional-requirement) 5. [Win32 App – Additional Requirement Rules](#win32-app-additional-requirement-rules) - [Requirement Types: File](#requirement-types-file) - - [Requirement Type: Registry](#requirement-type-registry) - - [Requirement Type: Script](#requirement-type-script) 6. [Win32 App – Monitoring Requirement Rule Behavior](#win32-app-monitoring-requirement-rule-behavior) - [Monitoring Mandatory / Optional Requirements Rules Evaluation](#monitoring-mandatory-optional-requirements-rules-evaluation) - - [Monitoring File Requirement Rules Evaluation](#monitoring-file-requirement-rules-evaluation) - - [Monitoring Registry requirement rules Evaluation](#monitoring-registry-requirement-rules-evaluation) - - [Monitoring Script Requirement Rules Evaluation](#monitoring-script-requirement-rules-evaluation) 7. [Conclusion](#conclusion) 8. [Related Posts](#related-posts) 9. [Explore More Intune Guides](#explore-more-intune-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Win32 App Requirements Checklist** Before deploying Win32 applications with Microsoft Intune, it’s essential to confirm that all **requirement rules** are properly configured. These rules determine whether an app is applicable to a device, based on factors like **OS architecture, minimum version, hardware resources, registry keys, or custom scripts**. A quick checklist helps administrators validate settings, avoid deployment errors, and streamline troubleshooting. - ✅ Configure mandatory OS architecture & minimum OS version - ✅ Set optional rules (disk space, RAM, CPU speed, processors) - ✅ Add extended rules (File, Registry, Script) as needed - ✅ Verify applicability in **IntuneManagementExtension.log** - ✅ Troubleshoot failures with log excerpts ## **Win32 App – Mandatory Requirement** When creating a **Win32 app in Microsoft Intune**, you must configure the following **mandatory requirement rules**: **Operating System Architecture**: Select the architecture(s) required for installation. **Options:** 32‑bit or 64‑bit **Minimum Operating System Version**: Define the lowest supported Windows version for the app. **Options:** Windows 10, version 1607 and above ![Intune | Wind32 App Requirements rule](https://techuisitive.com/wp-content/uploads/2023/04/image-11.png)## **Win32 App – Optional Requirement** In addition to mandatory rules, you can configure **optional requirement rules** in Microsoft Intune to control app installation based on device resources: **Minimum CPU Speed (MHz):** Specify the minimum processor speed required. **Disk Space Required (MB):** Specify the minimum free disk space needed on the system drive. *Example:* 1000 MB **Physical Memory Required (MB):** Define the minimum RAM required for installation. *Example:* 4096 MB **Minimum Number of Logical Processors:** Set the minimum number of logical processors required to run the app. ## **Win32 App – Additional Requirement Rules** **Additional requirement rules** provide extended options to configure **Win32 app deployment in Microsoft Intune**. These rules allow administrators to validate app installation conditions beyond the mandatory and optional checks. ### **Requirement Types:** **File** The File requirement rule Validates based on file or folder existence, date, version, or size. *Example:* Ensure a specific `.exe` file exists before installation. **How to Add a File‑Based Requirement Rule:** Configure the file path and condition (existence, version, size, or date). Navigate to the **Requirements** page while creating or editing the Win32 app. Click **+ Add** at the bottom of the page. Select **File** from the **Requirement type** options. ![Intune - File Based Requirements Rule](https://techuisitive.com/wp-content/uploads/2023/04/image-12.png)You have to provide the following details when using this Requirement Rule. - **Path**: Enter the full path of the folder that contains the file or folder to detect. - **File or folder**: Enter the file or folder to detect. - **Property**: Select the type of rule used to validate the presence of the app. - File or folder exists - Date modified - Date created - String (version) - Size in MB ### Requirement Type: Registry The **Registry requirement rule** allows administrators to validate **Win32 app installation conditions in Microsoft Intune** based on registry settings. This can include: - **Key existence** – Verify if a specific registry key is present. - **String comparison** – Match or compare registry string values. - **Version checks** – Validate application or system versions stored in the registry. **How to Add a Registry‑Based Requirement Rule:** Configure the registry path, value, and condition (existence, comparison, or version). Navigate to the **Requirements** page while configuring the Win32 app. Click **+ Add** at the bottom of the page. Select **Registry** from the **Requirement type** options. ![Intune - Registry based Win32 apps Requirements Rule](https://techuisitive.com/wp-content/uploads/2023/04/image-13.png)You have to provide the following details when using this detection rule. - **Key path**: The full path of the registry key that contains the value to detect. - **Value name**: The name of the registry value to detect. If this value is empty, the detection will happen on the key. The (default) value of a key will be used as the detection value if the detection method is other than file or folder existence. - **Registry key requirement**: Select the type of registry key comparison that’s used to validate the presence of the app. The following comparison types are available. - Key exists - The key does not exist - String comparison - Version comparison - Integer comparison ### Requirement Type: Script The **Script requirement rule** provides advanced options to evaluate **Win32 app installation conditions in Microsoft Intune** that cannot be validated using file or registry checks. With this rule, administrators can use a **PowerShell script** to determine whether an application should install, based on custom logic. **Common Use Cases:** - Validate complex conditions (e.g., device type, custom configurations). - Check for specific values or states not available via file/registry rules. - Implement organization‑specific compliance checks before deployment. **How to Add a Script‑Based Requirement Rule:** Upload or paste the PowerShell script and define the evaluation logic. Navigate to the **Requirements** page while configuring the Win32 app. Click **+ Add** at the bottom of the page. Select **Script** from the **Requirement type** options. ![Intune - Script Based win32 apps Requirements Rule](https://techuisitive.com/wp-content/uploads/2023/04/image-14.png)We have to provide the following mandatory details when using script requirement rules. - **Script Name**: Enter the name of the Script. For example, check Disk Space - **Script File**: Click on the Browse button and select the script file. - **Select Output Data Type**: Select the output data type. The following output data types are currently available. - String - Date and Time - Integer - Floating Point - Version - Boolean ## **Win32 App – Monitoring Requirement Rule Behavior** Now that we understand how **requirement rules** are evaluated on the client side, it’s important to know how to monitor their behavior during **Win32 app deployment in Microsoft Intune**. All details related to Win32 app installation and requirement evaluation are logged in the **IntuneManagementExtension.log** file. By analyzing this log, administrators can decode the exact steps Intune takes when validating requirements. While you typically don’t need to review logs during a successful deployment, this information becomes invaluable when troubleshooting **deployment failures, requirement mismatches, or applicability issues**. **Key Takeaway:** Reviewing logs helps identify why an app failed to install or was marked as not applicable. Requirement rules are always evaluated at the client end. The **IntuneManagementExtension.log** provides step‑by‑step visibility into requirement checks. ### Monitoring **Mandatory / Optional Requirements** Rules Evaluation We have configured both mandatory and optional requirements here. Operating System architecture: 64-bit Minimum operating system: Windows 10 1607 Disk space required: 5000 MB ![Intune Win32 App Files based requirements rule](https://techuisitive.com/wp-content/uploads/2023/04/image-15.png)When the application installation is initiated through the **Company Portal**, the configured **requirement rules** are quickly logged in the **Intune Management Extension** under the **Check Applicability** section. ![IntuneManagementExtension.log file showing win32 app requirement rules evaluation](https://techuisitive.com/wp-content/uploads/2023/04/image-16.png)Below are complete excerpts from the **IntuneManagementExtension.log** that capture the **Check Applicability** section during a Win32 app deployment. These entries show how **requirement rules** are evaluated on the client device, including whether the app meets the configured **mandatory, optional, file, registry, or script‑based conditions**. **Reviewing these logs helps administrators:** Troubleshoot deployment failures linked to requirement rules. Understand the step‑by‑step evaluation process. Identify why an app was marked as *applicable* or *not applicable*. ``` ``` ===Step=== Check applicability]LOG]!>RequiredOSArchitecture: 2, client Is64BitOperatingSystem: True, nativeMachine IsArm64: False, applicability: Applicable.]LOG]!>expected version: 10.0.14393, client version: 10.0.19042, applicability: Applicable.]LOG]!>RequiredFreespace: 5,000.00, availableFreeSpaceInMB: 156,379.00 on Drive C:\, applicability: Applicable.]LOG]!> ``` ``` ### Monitoring **File** Requirement Rules Evaluation We configured the following requirement rule: the application will install only if the **D:\\Program Files** folder exists. ![File requirement rules in win32 app](https://techuisitive.com/wp-content/uploads/2023/04/image-17.png)The **IntuneManagementExtension.log** confirms that the requirement rule was evaluated and the specified folder exists. As a result, the requirement was successfully met, allowing the application installation to proceed. ![intunemanagementextension.log showing win32 app file requirement rules](https://techuisitive.com/wp-content/uploads/2023/04/image-18.png)Below are complete excerpts from the **IntuneManagementExtension.log** that capture the **Check Extended Requirement** section during a Win32 app deployment. These entries illustrate how Intune evaluates extended requirement rules such as **File, Registry, and Script‑based checks** on the client device. ``` Checked under Path: D:\, filePath:D:\Program Files, agent was checking under expanded: D:\Program Files, applicationDetected: True]LOG]!> ``` ### Monitoring **Registry** requirement rules Evaluation The behavior of **registry‑based requirement rules** is almost identical to **file or folder‑based rules**, as both validate the existence or properties of specific system resources before allowing application installation. ### Monitoring **Script** Requirement Rules Evaluation For this deployment scenario, we considered the following requirement: The application must be installed on the **D: drive**, but the requirement rule is configured to ensure that the **D: drive is not a CD/DVD or removable storage device**. This validation is achieved using a **PowerShell script**, which checks the drive type before allowing installation. **Key Points:** If the script fails or returns false, the app is marked as ***not applicable*.** Script rules extend Intune’s flexibility beyond file or registry checks. PowerShell can validate custom conditions such as drive type, device configuration, or organizational policies. If the script returns a positive result (e.g., confirming D: is a fixed drive), the **requirement is met** and installation proceeds. ![Intune Win32 App - Requirement rule - Script](https://techuisitive.com/wp-content/uploads/2023/04/image-19.png)Here is the **PowerShell script** we used to validate custom **Intune Win32 app requirements**. The script checks whether the **D: drive** is a local disk. It writes the output to **STDOUT**, and the requirement rule is configured to confirm that the returned value equals `"LocalDisk"`. ``` foreach ($drive in $ldisk) { if ($drive.DeviceID -eq "D:") { if ($drive.DriveType -eq 3) {Write-Host "LocalDisk" Exit} else { Write-Host "NotLocalDisk" Exit} } } Write-Host "DriveNotFound" ``` The **IntuneManagementExtension.log** confirms that the requirement rule was evaluated, the PowerShell script executed successfully, and the value `"LocalDisk"` was returned. Therefore, the requirement was met, and the application installation proceeded as expected. ![IntuneManagementExtension.log showing win32 app script requirement rules evaluation](https://techuisitive.com/wp-content/uploads/2023/04/image-20.png)Here are the excerpts from IntuneManagementExtension log for Check Extended requirements. ``` Checked Powershell script result: LocalDisk ``` ## Conclusion By mastering **Win32 app requirements rules in Microsoft Intune**, administrators can ensure that applications install only under the right conditions—whether based on **OS architecture, minimum version checks, disk space, registry keys, or custom PowerShell scripts**. Proper configuration of **mandatory and optional rules** reduces deployment errors, improves compliance, and streamlines **endpoint management**. Combined with effective use of **IntuneManagementExtension logs** for troubleshooting, these rules give IT teams precise control over **application deployment, device targeting, and user experience**. Leveraging Intune’s flexibility helps organizations achieve more reliable **modern management** and secure **Windows app delivery**. ## **Related Posts** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Win32 Apps vs LOB Apps](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Tags: [Intune Guides](https://techuisitive.com/tag/intune-guides/), [Intune win32 App Guides](https://techuisitive.com/tag/intune-win32-app-guides/), [Win32 Apps](https://techuisitive.com/tag/win32-app/), [Win32 Apps Featured](https://techuisitive.com/tag/win32-apps-featured/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune Guides, Intune win32 App Guides, Win32 Apps, Win32 Apps Featured --- ### [SCCM Device Collection Equivalents in Microsoft Intune](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) **Published:** May 19, 2022 **Author:** Equebal Ahmad **Content:** In SCCM, collections have always been the go‑to mechanism for targeting deployments. For example, if you needed to apply a patch to all Dell computers, the quickest way was to build a collection of Dell devices and deploy the fix directly to that group. The same approach worked for application upgrades in the legacy package and program model—create a collection of machines running a specific version of an app, then target the deployment accordingly. With Intune, the concept of collections doesn’t exist in the same form. Instead, administrators achieve the same outcomes by combining **Azure AD groups**, **[Intune assignment filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/ "Intune Filters – Assign Microsoft Store App policy using Filters")**, and **Win32 app features** such as requirement rules, [detection rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive"), and [supersedence](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/ "How to Upgrade / Replace App with Win32 App Supersedence relationship | Intune"). Filters provide granular, reusable targeting, while requirement rules ensure apps are only installed when certain conditions are met. This means you don’t need to maintain tightly scoped AD groups; you can target broadly and let filters and rules narrow down the actual installation. In this post, we’ll explore how to replicate common SCCM collection scenarios in Intune, using practical examples to show how filters, dynamic groups, and app rules can be combined to meet real‑world deployment needs. ## **Requirements: Deploy a utility on all Dell computers** **SCCM Approach:** Create a dynamic collection for all computers where the manufacturer is Dell, then deploy the package to that collection. **Intune Approach:** There are multiple ways to achieve the same targeting. Below are three practical options: **Option 1: Dynamic Azure AD Group** - Create an Azure AD group with dynamic membership. - Assign the application to this group. **Dynamic membership query:** ``` (device.deviceManufacturer -eq "Dell") ``` **Option 2: Broad Group + Intune Filter** - Use an Azure AD group with a wider scope (e.g., *All Windows 10 Devices*). - Apply an Intune assignment filter to narrow targeting to Dell computers. **Assignment Filter query:** ``` (device.manufacturer -contains "Dell") ``` **Option 3: Requirement Rule in Win32 App** - Use a broad Azure AD group (e.g., *All Windows 10 Devices*). - Configure a [Win32 app requirement ](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/ "Understanding Win32 App Requirements Rule in Microsoft Intune")rule to check if the device manufacturer is Dell. - The app will only install if the requirement condition is met. ## **Requirements: Deploy a driver** package to the **Lenovo Thinkpad T490** **SCCM Approach:** Create a dynamic collection where the device model is *ThinkPad T490*. Deploy the driver package to that collection. **Intune Approach:** There are several ways to achieve the same targeting in Intune: **Option 1: Dynamic Azure AD Group** - Create an Azure AD group with dynamic membership for devices where the model is *ThinkPad T490*. - Assign the driver package to this group. **Dynamic membership query:** ``` (device.deviceModel -contains "ThinkPad T490") ``` **Option 2: Broad Group + Intune Assignment Filter** - Use an Azure AD group with a wider scope (e.g., *All Windows 10 Devices*). - Apply an Intune assignment filter to narrow targeting to *ThinkPad T490* devices. **Assignment Filter query:** ``` (device.model -contains "ThinkPad T490") ``` **Option 3: Requirement Rule in Win32 App** The driver package will only install if the requirement condition is met. Use a broad Azure AD group (e.g., *All Windows 10 Devices*). Configure a Win32 app requirement rule to check if the device model is *ThinkPad T490*. ## **Requirements: Deploy an application to All Computers for a specific OS Version** **SCCM Approach:** Create a collection to include all computers with a specific OS version. Deploy the package to that collection. **Intune Approach:** You can achieve the same targeting in Intune using different methods: **Option 1: Dynamic Azure AD Group** - Create an Azure AD group with dynamic membership for devices running the required OS version. - Assign the package to this group. **Dynamic membership query example:** ``` (device.deviceOSVersion -startsWith "10.0.0") ``` **Option 2: Broad Group + Intune Assignment Filter** - Use an Azure AD group with a wider scope (e.g., *All Windows 10 Devices*). - Apply an Intune assignment filter to narrow targeting to the specific OS version. **Filter query example:** ``` (device.deviceOSVersion -eq "10.0.1") ``` **Option 3: Requirement Rule in Win32 App** The package will only install if the requirement condition is met. Use a broad Azure AD group (e.g., *All Windows 10 Devices*). Configure a Win32 app requirement rule to check the OS version. ## SCCM vs Intune Equivalents (Examples) **SCCM Collection Example****Intune Equivalent****Notes**All Dell computersIntune filter: (deviceManufacturer -eq “Dell”)Direct manufacturer targetingWindows 11 devicesIntune filter: (osVersion -startsWith “10.0.22”)Useful for OS-specific deploymentsAll laptopsIntune filter: (deviceModel -contains “Laptop”)Replace SCCM chassis type logicBYOD devicesDynamic group: (deviceOwnership -eq “Personal”)Helps separate corporate vs personalDevices with versionIntune filter with app inventory attributesSimilar to SCCM app version targetingCompliant devices onlyDynamic group: (isCompliant -eq true)Ensures deployment only to compliant endpoints## **Related Posts:** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Win32 Apps vs LOB Apps](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Tags: [Intune win32 App Guides](https://techuisitive.com/tag/intune-win32-app-guides/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune win32 App Guides --- ### [How to Prepare Win32 App Installation Source for Intune Using Intune WinAppUtil](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) **Published:** August 9, 2022 **Author:** Equebal Ahmad **Excerpt:** Win32 apps provide us greater control over the deployment of application. We can deploy 32 bit and 64 bit application through Microsoft Intune Win32 apps. The Win32 apps support deployment of multiple files via IntuneWin wrapper / Intune WinAppUtil (intuneWinAppUtil.exe). The IntuneWin Wrapper can be used to deploy multiple files such as MSI with transform (MST). The Win32 app also support the deployment of .EXE file by converting them to .intunewin format. IntuneWinAppUtil help you to prepare win32 app installation source for Microsoft Intune deployment. **Content:** Microsoft Intune Win32 apps give IT administrators greater control over application deployment across Windows devices. With Intune, you can package and deploy both 32‑bit and 64‑bit applications using the **Win32 app model**. Before adding a Win32 app to Microsoft Intune, the installation source must be prepared with the **Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe)**. The **Intune Win32 content prep tool** allows you to wrap multiple files into a single `.intunewin` package, including MSI installers with MST transforms, configuration files, or dependencies. It also supports converting traditional `.EXE` installers into the Intune‑ready `.intunewin` format, ensuring smooth deployment through Intune. By using the **IntuneWin wrapper (IntuneWinAppUtil)**, administrators can streamline packaging, simplify app distribution, and enforce consistent installation across managed devices. In short, the **Intune Win32 Content Prep Tool** is essential for preparing Win32 app installation sources and creating reliable deployment packages for Microsoft Intune. Table Of Contents 1. [Prerequisites](#prerequisites) 2. [Step 1: Download the Intune Win32 Content Prep Tool](#step-1-download-the-intune-win32-content-prep-tool) 3. [Step 2: Prepare Source File](#step-2-prepare-source-file) 4. [Step 3: Wrap Into .Intunewin](#step-3-wrap-into-intunewin) 5. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) - [What is IntuneWinAppUtil?](#what-is-intunewinapputil) - - [Why must IntuneWinAppUtil.exe be kept outside the source folder?](#why-must-intunewinapputilexe-be-kept-outside-the-source-folder) - - [Can I package multiple files together?](#can-i-package-multiple-files-together) - - [What if my app exceeds 30 GB?](#what-if-my-app-exceeds-30-gb) 6. [Related Posts](#related-posts) 7. [Explore More Intune Guides](#explore-more-intune-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## Prerequisites - Microsoft Intune allows the deployment of up to 30 GB-sized apps. If your package size is more than 30 GB, then perform the cleanup to reduce the size, and then create an Intune wrapper. - Windows 10 1607+ versions are supported for Intune Win32 app deployment. ## Step 1: **Download the Intune Win32 Content Prep Tool** Get the official `IntuneWinAppUtil.exe` utility to package your Win32 applications for Microsoft Intune deployment. **👉 Download before you proceed:** Grab the [IntuneWinAppUtil.exe](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool "IntuneWinAppUtil.exe") tool now to follow along with this guide. ## Step 2: Prepare Source File 1. Create a folder structure to copy installation files in a folder. The `intuneWinAppUtil.exe` must be located **outside** the app folder to avoid package contamination. See the example below - D:\\Source\\Notepad++ 7.9.1\\ - D:\\Source\\intuneWinAppUtil.exe 2. Copy all the installation files and other supported files (if any) inside the single source folder (Notepad++ 7.9.1 in this case) 3. Copy the intuneWinAppUtil.exe outside of the installation source folder (D:\\Source, in this case). The Intune Win32 prep tool zips all files and folders when it creates the .intunewin file. Hence, it’s important not to keep the tool in the application installation source folder. Otherwise, the tool will also be included in the application installation package. ## Step 3: Wrap Into **.Intunewin** Let’s understand how to use the Intune Prep Tool intuneWinAppUtil to create an Intunewin package for Win32 app deployment. Follow the steps below to create a wrapper using IntuneWinAppUtil. - Open the command prompt and change the directory to the root of the folder you created. - Run IntuneWinAppUtil.exe and provide the following details. - **Source folder:** Provide the complete path for the application source - **Setup file:** Provide the name of the main setup file that needs to be executed to start the installation of the application. - **Output folder:** Provide the name of the output folder where the resulting intunewim file will be created - **Catalog folder:** Yes or No, based on whether you want to use the catalog or not. ![Prepare win32 app installation source using Intune Win32 Content preparation tool | Intune WinAppUtil | intunewinapputil](https://techuisitive.com/wp-content/uploads/2023/03/image-62.png)You can also use the command below to skip the prompts. ``` IntuneWinAppUtil.exe -c "D:\source\Notepad++7_9_1" -s setup.exe -o "d:\Source" -q ``` Syntax: ``` IntuneWinAppUtil.exe -c C:\Source -s setup.msi -o C:\Output ``` *Here, `-c` specifies source folder, `-s` is the setup file, and `-o` defines output location.* As you see in the folder below, the intunewin file is created in the root folder with the .intunewin extension. You need to upload the Intune.win file to Intune when creating the Win32 app for the respective application. ![Microsoft Win32 Content Prep Tool / Intune WinAppUtil / Intune Content Prep Tool | intunewinapputil.exe](https://techuisitive.com/wp-content/uploads/2023/03/image-63.png)Please check out this post if you would like to know the steps to deploy a Win32 app in Intune: [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) The Win32 app can also be deployed directly from the Microsoft Store: [Deploy Win32 App using Microsoft Store app (new) | Intune](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) The recent addition is the Enterprise App Catalog, which streamlines the deployment using an app catalog maintained by app vendors: [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) For full details, see Microsoft’s official guide on preparing Win32 app content for Intune. [https://learn.microsoft.com/en-us/intune/intune-service/apps/apps-win32-prepare?utm\_source=chatgpt.com](https://learn.microsoft.com/en-us/intune/intune-service/apps/apps-win32-prepare?utm_source=chatgpt.com) ## Frequently Asked Questions (FAQs) ### **What is IntuneWinAppUtil?** A Microsoft tool that converts MSI/EXE installers and dependencies into `.intunewin` format for Intune deployment. ### **Why must IntuneWinAppUtil.exe be kept outside the source folder?** To avoid the tool itself being included in the `.intunewin` package. ### **Can I package multiple files together?** Yes, you can include MSI with MST transforms, config files, and dependencies in one `.intunewin`. ### **What if my app exceeds 30 GB?** Perform cleanup to reduce size or split components before packaging. ## **Related Posts** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Win32 Apps vs LOB Apps](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Tags: [intune apps](https://techuisitive.com/tag/intune-apps/), [Intune Guides](https://techuisitive.com/tag/intune-guides/), [Intune win32 App Guides](https://techuisitive.com/tag/intune-win32-app-guides/), [Win32 Apps](https://techuisitive.com/tag/win32-app/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** intune apps, Intune Guides, Intune win32 App Guides, Win32 Apps --- ### [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) **Published:** May 22, 2023 **Author:** Equebal Ahmad **Content:** **Deploy Microsoft SQL Server Management Studio (SSMS) 20.x through Intune** Microsoft SQL Server Management Studio (SSMS) continues to evolve, with **SSMS 20.x** now available as the latest release. If you are still using SSMS 19.0.2, it is recommended to upgrade to the current version for enhanced stability, performance, and feature updates. In this guide, we walk through the step‑by‑step process of deploying SSMS as a **Win32 app in Microsoft Intune**, covering silent installation commands, packaging, detection rules, and assignment strategies. - Release number: 19.0.2 - Build number: 19.0.20209.0 - Release date: March 13, 2023 You can download Microsoft SQL Server Management Studio from https://aka.ms/ssmsfullsetup. In this blog post, we will look at the steps to install SQL Server Management Studio version 19.0.2 through Microsoft Intune. Table Of Contents 1. [SSMS Silent Install & Uninstall Commands](#ssms-silent-install-uninstall-commands) 2. [Prepare SSMS Installation Source for Intune](#prepare-ssms-installation-source-for-intune) 3. [Create a Win32 App for Microsoft SQL Server Management Studio](#create-a-win32-app-for-microsoft-sql-server-management-studio) - [Conclusion](#conclusion) 4. [Related Posts](#related-posts) 5. [Explore More Intune Guides](#explore-more-intune-guides) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## SSMS Silent Install & Uninstall Commands **Install (Silent):** SSMS-Setup-ENU.exe /install /quiet /norestart **Uninstall (silent):** SSMS-Setup-ENU.exe /uninstall /quiet /norestart ## Prepare SSMS Installation Source for Intune Before deploying **SQL Server Management Studio (SSMS)** through **Microsoft Intune**, you must first prepare the installation source as a **Win32 app package**. This ensures Intune can properly upload, distribute, and manage the application. 👉 Follow this guide: **[How to Prepare Win32 App Installation Source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/ "How to Prepare Win32 App Installation Source for Microsoft Intune")** ## Create a Win32 App for Microsoft SQL Server Management Studio Follow the steps below to deploy **SQL Server Management Studio (SSMS)** using **Microsoft Intune Win32 app deployment**: Click **Select** to proceed with configuration. In the **Microsoft Intune console**, go to **Apps > Windows Apps**. Click **Add**. Select **Windows app (Win32)** as the app type. ![install sql server management studio](https://techuisitive.com/wp-content/uploads/2023/05/SSMS02-1024x468.jpg)On the **Add App** page: Click **OK** to upload the package. Click **Select app package file**. Click **Browse** and choose the **.intunewin** file you created in the previous step. ![deploy sql server management studio](https://techuisitive.com/wp-content/uploads/2023/05/SSMS04.jpg)On the **App information** page: Click **Next** to continue with the deployment configuration. Provide the required details such as **Name, Description, Publisher, and Category**. Optionally, upload an **icon/logo** for better visibility in the Company Portal. ![Deploy ssms intune](https://techuisitive.com/wp-content/uploads/2023/05/SSMS05.jpg)On the **Program** page: Enter the **silent install command**: `SSMS-Setup-ENU.exe /install /quiet /norestart` Enter the **silent uninstall command**: `SSMS-Setup-ENU.exe /uninstall /quiet /norestart` Adjust other options (e.g., restart behavior, install context) as per your requirements. Click **Next** to continue. ![Install ssms intune](https://techuisitive.com/wp-content/uploads/2023/05/SSMS06-1024x608.jpg)On the **Requirements** page: Select the **conditions that must be met** before installation begins (e.g., OS architecture, minimum OS version, disk space, or custom script checks). Configure additional requirement rules if needed (file, registry, or PowerShell script). Click **Next** ![Intune | Create win32 app | Requirements](https://techuisitive.com/wp-content/uploads/2023/05/SSMS07-1024x608.jpg)On the **Detection rules** page, perform the following steps: - In **Rule format**, select **Manually configure detection rules**. - Click **Add**. - In the **Detection rule flyout window**: - **Rule type:** File - **Path:**`C:\Program Files (x86)\Microsoft SQL Server Management Studio 19\Common7\IDE` - **File:**`Ssms.exe` - **Detection method:** File or folder exists - Click **Next** to continue. ![Intune install SQL server management studio | win32 Detection rule](https://techuisitive.com/wp-content/uploads/2023/05/SSMS08-1-1024x545.jpg)After configuring detection rules: - Click **Next** three times to skip **Dependencies** and **Supersedence** (not required for this installation). - On the **Assignments** page, choose how to deploy the app: - **All Devices** - **All Users** - Specific **Azure Active Directory (AAD) groups** - Optionally, apply **Filters** for more granular targeting. - Select the assignment type: - **Required** → App installs automatically on targeted devices. - **Available** → App is published to the **Company Portal**, and users can initiate installation themselves. - Click on **Next**. ![Intune | Win32 App | Assignments](https://techuisitive.com/wp-content/uploads/2023/05/SSMS11-1024x540.jpg)On the **Review + create** page: Carefully review all configured settings (App information, Program, Requirements, Detection rules, and Assignments). Confirm that the details are correct. Click **Create** to finalize the deployment. ![Intune | Win32 App | Review + Create](https://techuisitive.com/wp-content/uploads/2023/05/SSMS12-1024x598.jpg)Intune will now create the application and upload .intunewin file to the Intune portal. You can monitor the progress from the Notification area. ![Intune | Create Win32 App | Notification](https://techuisitive.com/wp-content/uploads/2023/05/SSMS13-1024x343.jpg)### Conclusion Deploying **SQL Server Management Studio (SSMS)** through **Microsoft Intune Win32 app deployment** streamlines application management across your organization. By preparing the installation source, configuring program commands, setting requirements, and defining detection rules, you ensure a reliable and automated deployment process. Assignments ## **Related Posts** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Win32 Apps vs LOB Apps](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Tags: [Intune Guides](https://techuisitive.com/tag/intune-guides/), [Intune win32 App Guides](https://techuisitive.com/tag/intune-win32-app-guides/), [Win32 Apps](https://techuisitive.com/tag/win32-app/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune Guides, Intune win32 App Guides, Win32 Apps --- ### [Deploy Win32 App using Microsoft Store app (new) | Intune](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) **Published:** August 1, 2023 **Author:** Equebal Ahmad **Content:** The **new Microsoft Store app integration in Intune** makes it easier than ever to deploy and manage **Win32 applications** across Windows 10 and Windows 11 devices. Instead of manually packaging installers, IT admins can leverage the **Microsoft Store (new)** and **Winget** to distribute apps directly through Intune, ensuring simplified deployment, automatic updates, and streamlined lifecycle management. This guide walks through the process step‑by‑step, highlighting both the benefits and limitations of using the new Store app for Win32 deployments. [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") admins can browse, deploy, and monitor Microsoft Store Win32 applications inside Intune. Upon deployment, Intune automatically keeps the apps up to date when a new version becomes available. While we are discussing the deployment of the Win32 App using the new Microsoft Store, the same process can be followed to install Universal Windows Platform (UWP) apps as well. ## Intune management of Microsoft Store apps (Win32 Apps) Before we proceed with the deployment, let’s understand the management of Win32 apps once Microsoft Store Win32 apps are deployed. Microsoft Intune takes over the management of the Win32 application when you install it through the Microsoft Store app. This means when a new version of an application is available, Intune automatically upgrades the application on devices where it’s already installed. When a Microsoft Store Win32 app is published to a device as **Required**, but it is already installed (either manually or via the Microsoft Store for Business), Intune takes over the management of the application. For available Microsoft Store Win32 apps, the end user must click install in the Company Portal before Intune takes over management and automatic updates for the app. Intune will not attempt to reinstall the app. ## Deploy Microsoft Store Win32 Apps using Intune Deploying the Microsoft Store Win32 app through Intune is a straightforward process. In this example, we will publish an application to the Microsoft Intune company portal as an available application. Users can go to the Company portal and install the application from there. Follow the process below to deploy the application as an available deployment. - Navigate to **Apps > Windows Apps** - Click on **+Add** - From the **App type**, select **Microsoft Store app (new)** - Click on **Select** ![Intune | Microsoft Store app](https://techuisitive.com/wp-content/uploads/2023/07/image-45-1024x362.png)In the **App information** page, click on **Search the Microsoft Store app (new)** ![Intune | Microsoft Store Win32 apps](https://techuisitive.com/wp-content/uploads/2023/07/image-46.png)In the Search **the Microsoft Store app (new)** page, type the name of the application that you want to search. Ensure you have selected the Win32 application type. Select the application and click on Select. In this example, we will deploy Adobe Acrobat Reader DC, Type: Win32 ![Intune | Microsoft Store app | Win32 apps Intune](https://techuisitive.com/wp-content/uploads/2023/07/image-47-1024x605.png)You can now see app details on the App information page. You can notice that there are no customization options to provide command line, Requirements, Detection, or Supersedence options. When you are using the Microsoft Store to deploy the Win32 app, it will be completely managed by Intune & application vendor and no customization is possible. If you need customization, then you have to fall back to a non-Microsoft Store Win32 app. Check out here to understand how you can prepare and deploy a Win32 app whose installation source is available to you. Click on **Next** to move to the **Assignments** page. ![Intune Microsoft store win32 apps](https://techuisitive.com/wp-content/uploads/2023/07/image-48-1024x795.png)On the Assignment page, assign the application to the Device, user, or group as per your requirements. In this example, we will assign the application to All devices as Available. User can install the application on their device from the Company portal. Click on **Next** to move to the Review + Create page. ![Intune Microsoft Store app ](https://techuisitive.com/wp-content/uploads/2023/07/image-49.png)Review the details on the **Review + Create** page and click **Create** to start the policy creation process. ![Intune Microsoft Store win32 ](https://techuisitive.com/wp-content/uploads/2023/07/image-50.png)## Install Application from Company Portal ( Microsoft Store App Win32 App) We have published the Microsoft Store Win32 app to the Company Portal in the previous steps. Now, we need to install the app on a Windows 10 / 11 device from the Company portal. On a Windows 10 / 11 Device, launch the Company portal and navigate to Apps. Click on the Application (Adobe Acrobat Reader DC in this case) that you want to install. ![Intune Company Portal Microsoft store app](https://techuisitive.com/wp-content/uploads/2023/07/Inune-Company-Portal-1024x541.jpg)Click on **Install** on the App Overview page to install the application. ![Intune Microsoft store app | Company portal](https://techuisitive.com/wp-content/uploads/2023/07/Intune-Company-portal-Store-App-1024x531.jpg)## Related Posts - [Intune Filters – Assign Microsoft Store App policy using Filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/) - [Deploy Win32 App using Microsoft Store app (new) | Intune](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) Tags: [App Management Getting Started](https://techuisitive.com/tag/app-management-getting-started/), [intune apps](https://techuisitive.com/tag/intune-apps/), [Intune Guides](https://techuisitive.com/tag/intune-guides/), [Intune win32 App Guides](https://techuisitive.com/tag/intune-win32-app-guides/), [M365 and Store Apps](https://techuisitive.com/tag/m365-and-store-apps/), [Microsoft Store Apps](https://techuisitive.com/tag/microsoft-store-apps/), [Win32 Apps](https://techuisitive.com/tag/win32-app/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** App Management Getting Started, intune apps, Intune Guides, Intune win32 App Guides, M365 and Store Apps, Microsoft Store Apps, Win32 Apps --- ### [Understanding Win32 App Detection Rules in Microsoft Intune - Deep Dive](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) **Published:** March 2, 2022 **Author:** Equebal Ahmad **Content:** Win32 app detection rules in **Microsoft Intune** are critical for ensuring accurate application deployment and compliance. These rules determine whether an app is already installed, when it should be offered, and how uninstall actions are triggered. In this guide, we’ll break down the different detection methods—MSI, file, registry, and custom PowerShell scripts—along with practical examples and log snippets to help administrators configure and troubleshoot Intune deployments effectively. **Win32 app detection rules in Intune are methods used to verify whether an application is installed and compliant on a managed device.** They prevent duplicate installations, ensure accurate deployment status, and support troubleshooting through MSI, file, registry, or PowerShell checks. ![Intune Windows App (Win32)](https://techuisitive.com/wp-content/uploads/2024/02/image-4.png) Table Of Contents 1. [Explore Intune Win32 App Detection Rules](#explore-intune-win32-app-detection-rules) 2. [Manually Configure Intune App Detection Rule](#manually-configure-intune-app-detection-rule) 3. [Use a custom detection Rule](#use-a-custom-detection-rule) 4. [Conclusion](#conclusion) 5. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) 6. [Related Posts](#related-posts) 7. [Explore More Intune Guides](#explore-more-intune-guides) ## Explore Intune Win32 App **Detection Rules** To explore the **Win32 app detection rules in Microsoft Intune**, open the **Intune admin center** and navigate to: **Apps > Windows > Windows apps**. Select any Win32 application, then go to **Properties > Detection rules** to access the Detection Rules blade. Note: You have to create a Win32 app if you don’t have one. Check [Deploy Microsoft SQL Management Studio through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/ "this article") for steps by steps guide for Win32 app deployment. ![Intune detection rule](https://techuisitive.com/wp-content/uploads/2023/03/image.png)The following **Win32 app detection rule formats are available in Microsoft Intune**: **Use custom detection rules**: This option enables administrators to create detection logic using a **custom PowerShell script**, providing flexibility for complex scenarios that cannot be handled by built‑in methods. **Manually configure detection rules**: This option allows Intune administrators to define detection logic based on **MSI product codes**, **file or folder existence**, **file version**, or **registry keys and values**. ## **Manually Configure Intune App Detection Rule** Let’s take a closer look at how to **manually configure Intune detection rules**. This detection rule format supports three options: **MSI‑based detection**, **file‑based detection**, and **registry‑based detection**. Each method allows administrators to define how Intune verifies whether a **Win32 application** is installed or meets specific conditions. ### 1. MSI Product-Based Win32 App Detection Rules This detection rule detects application installation based on the MSI product key or version check. When you choose this rule type, you have two settings: - **MSI product code**: This property allows the administrator to configure the MSI product code to detect the installation of the App. When you use this rule type with an MSI, the MSI product key is populated automatically. - **MSI product version check**: This property allows the administrator to configure an additional check that is a specific version of the MSI product code to detect the application. Example of MSI product detection: #### **Check for app existence based on MSI product code** To add a **Win32 app detection rule based on an MSI product code** in **Microsoft Intune**, configure the detection settings by selecting the following options: - Rule type: MSI - MSI product code: Enter MSI product code - MSI product version check: No ![Check for app existence based on MSI product code | win32 app detection rules](https://techuisitive.com/wp-content/uploads/2023/03/image-1.png)#### **Check for app existence based on product code and version** To add a **Win32 app detection rule based on an MSI product code** **and version** in **Microsoft Intune**, configure the detection settings by selecting the following options: - Rule type: MSI - MSI product code: Enter MSI product code - MSI product version check: Yes - Operator / Value: Select operator and enter product version ![MSI Detection Rule](https://techuisitive.com/wp-content/uploads/2023/03/image-2.png)#### **Client-side activities:** Every step of the **Win32 app installation process in Microsoft Intune** is recorded in the **Intune Management Extension log file**, located at: ``` `C:\ProgramData\Microsoft\IntuneManagementExtension\Logs` ``` This includes activities such as downloading policies for detection and installation. In this article, we’ll focus specifically on **policy processing and detection rules**. The following snippets from **IntuneManagementExtension.log** illustrate the details of the policies received by a client, including the associated Intune **Win32 app detection rules**. **Client Received Policy:** *`Get policies = [{"Id":"4c153c53-913e-4a75-92b1-27e53ca03876","Name":"WinZip 26.0","Version":1,"Intent":3,"TargetType":2,"AppApplicabilityStateDueToAssginmentFilters":null,"AssignmentFilterIds":null,"DetectionRule":"[{\"DetectionType\":1,\"DetectionText\":\"{\\\"ProductCode\\\":\\\"{CD95F661-A5C4-44F5-A6AA-ECDD91C2413B}\\\",\\\"ProductVersion\\\":\\\"26.0.14610\\\",\\\"ProductVersionOperator\\\":1}\"}]","InstallCommandLine":"msiexec /i winzip260-64.msi /qn INSTALLDIR=\"D:\\Program Files\\WinZip26\"","UninstallCommandLine":"msiexec /x \"`* **Detection Phase:** During the **Win32 app detection rules phase in Microsoft Intune**, each detection rule is evaluated and logged. In the example above, **DetectionType 1** represents an **MSI‑based detection rule**. The log entries show that the application detection failed because the app was not installed on the client device. *` `* **Post Application Installation Phase:** Since the application was not detected during the **Win32 app detection phase in Microsoft Intune**, it will be offered to the client for installation. After the installation completes, the same **detection rules** are evaluated again to verify the application’s presence on the device and confirm a successful deployment. *` `* ### 2. File-Based Win32 App Detection Rules **Win32 app detection rules in Microsoft Intune** can verify application presence based on **file or folder existence, file version, date, or size**. When configuring a **file‑based detection rule**, administrators need to provide specific details such as the **file path, file or folder name, and the detection criteria** (e.g., version, date, or size). These parameters allow Intune to accurately determine whether the targeted application is installed on the device. You need to provide the following details when configuring a file-based detection rule. - **Path**: Enter the full path of the folder that contains the file or folder to detect. - **File or folder**: Enter the file or folder to detect. - **Detection method**: Select the type of detection method used to validate the app’s presence. - File or folder exists - Date modified - Date created - String (version) - Size in MB A **Win32 app detection rule in Microsoft Intune** can include multiple **file‑based detection checks**. When more than one detection rule is configured for an application, **all rule evaluations must return true** for the app to be successfully detected on the client device. **Example of File-based detection:** Check for file existence: You need to provide the following details. - Rule type: File - Path: File path - File or folder: Name of file or folder - Detection method: Select the type of detection method used to validate the app’s presence. ![Fiel detection rule](https://techuisitive.com/wp-content/uploads/2023/03/image-3.png)Check for the file version: ![Win32 App Detection Rules | File](https://techuisitive.co.in/wp-content/uploads/2023/03/image-4.png)#### **Client-side activities:** This section demonstrates how to view **client‑side activities in the Intune Management Extension log**. In the log snippets below, you can see that the client downloaded the latest policy from **Microsoft Intune**, which contains all the application details, including the **detection rules** configured in the Intune portal. In this example, **DetectionType 2** represents a **File/Folder‑based detection rule**. *`Get policies = [{"Id":"4c153c53-913e-4a75-92b1-27e53ca03876","Name":"WinZip 26.0","Version":1,"Intent":3,"TargetType":2,"AppApplicabilityStateDueToAssginmentFilters":null,"AssignmentFilterIds":null,"DetectionRule":"[{\"DetectionType\":2,\"DetectionText\":\"{\\\"Path\\\":\\\"D:\\\\\\\\Program Files\\\\\\\\WinZip26\\\",\\\"FileOrFolderName\\\":\\\"Winzip64.exe\\\",\\\"Check32BitOn64System\\\":false,\\\"DetectionType\\\":1,\\\"Operator\\\":0,\\\"DetectionValue\\\":null}\"},`* *`{\"DetectionType\":2,\"DetectionText\":\"{\\\"Path\\\":\\\"D:\\\\\\\\Program Files\\\\\\\\Winzip26\\\",\\\"FileOrFolderName\\\":\\\"Winzip64.exe\\\",\\\"Check32BitOn64System\\\":false,\\\"DetectionType\\\":4,\\\"Operator\\\":1,\\\"DetectionValue\\\":\\\"50.260.14610.0\\\"}\"}]","InstallCommandLine":"msiexec /i winzip260-64.msi /qn INSTALLDIR=\"D:\\Program Files\\WinZip26\"","UninstallCommandLine":"msiexec /x \"{CD95F661-A5C4-44F5-A6AA-ECDD91C2413B}\" /q","RequirementRules":" ........`* ![Intune win32 app detection rules](https://techuisitive.com/wp-content/uploads/2023/03/image-6.png)The **Win32 app detection rules process in Microsoft Intune** begins by evaluating each defined rule. In the example below, we configured two **file‑based detection rules**: 1. **File existence check** – verifies whether the specified file or folder is present. 2. **File version check** – validates the version of the file against the defined criteria. For the application to be detected as installed, **both rules must evaluate to true**. As shown in the **IntuneManagementExtension.log**, the system first checks the file or folder existence rule before proceeding to the file version rule. *`[Win32App] Checked filePath: D:\Program Files\WinZip26\Winzip64.exe, Exists: True, applicationDetected: True [Win32App] Checked under Path: D:\Program Files\WinZip26, filePath:D:\Program Files\WinZip26\Winzip64.exe, agent was checking under expanded: D:\Program Files\WinZip26\Winzip64.exe, applicationDetected: True`* ![IntuneManagementExtension.log showing win32 app detection rules](https://techuisitive.com/wp-content/uploads/2023/03/image-7.png)Next, the system validated the second **file‑based detection rule** by comparing the version installed on the client device with the version specified in the detection rule. Since both conditions were evaluated to true, the application was successfully detected on the computer and will not be re‑offered for installation. *`[Win32App] Checked filePath: D:\Program Files\Winzip26\Winzip64.exe, Got versionStr:50.260.14610.0, compareValue 50.260.14610.0 [Win32App] Equal: actualValue: 50.260.14610.0, compareValue: 50.260.14610.0, applicationDetected: True [Win32App] Checked under Path: D:\Program Files\Winzip26, filePath:D:\Program Files\Winzip26\Winzip64.exe, agent was checking under expanded: D:\Program Files\Winzip26\Winzip64.exe, applicationDetected: True`* ![IntuneManagementExtension.log showing win32 app file based detection rule](https://techuisitive.com/wp-content/uploads/2023/03/image-5.png)### 3. Registry-Based Win32 App Detection Rules **Intune Win32 app detection rule registry** verifies an application’s presence by checking specific **Windows registry keys and values**. Administrators can configure detection based on **key existence**, **string or integer values**, or **version comparisons**, making this method useful for applications that store installation details in the registry. - **Key path**: The full path of the registry key that contains the value to detect. - **Value name**: The name of the registry value to detect. If this value is empty, the detection will happen on the key. If the detection method is other than file or folder existence,the (default) value of a key will be used as the detection value - **Detection method**: Select the type of detection method that’s used to validate the presence of the app. The following detection methods are available in registry-based detection rules. - Key exists - The key does not exist - String comparison - Version comparison - Integer comparison **Example of Registry-based detection:** Please see the Intune registry detection rule example in the screenshot below. ![intune registry detection rule example | Registry detection rule](https://techuisitive.com/wp-content/uploads/2023/03/image-8.png)Check for string comparison: ![Registry detection rule](https://techuisitive.com/wp-content/uploads/2023/03/image-9.png)**Client-side activities:** Similar to **MSI‑based** and **file‑based detection rules**, the details of a **registry‑based detection rule** are included in the policy downloaded by the client. In the log entries, **DetectionType 0** represents a **registry‑based detection rule**, which verifies application presence through registry keys and values. *`Get policies = [{"Id":"c9b949c9-6e56-4e3a-a9d5-7f174fd5681c","Name":"visioviewer_4339-1001_x64_en-us.exe","Version":1,"Intent":3,"TargetType":2,"AppApplicabilityStateDueToAssginmentFilters":0,"AssignmentFilterIds":["40a00a67-5909-47bd-8948-54dc237881e6"],"DetectionRule":"[{\"DetectionType\":0,\"DetectionText\":\"{\\\"Check32BitOn64System\\\":0,\\\"Path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Uninstall\\\\\\\\{95160000-0052-0409-1000-0000000FF1CE}\\\",\\\"KeyName\\\":\\\"DisplayName\\\",\\\"DetectionType\\\":3,\\\"Operator\\\":1,\\\"DetectionValue\\\":\\\"Microsoft Visio Viewer 2016\\\"}\"}]","InstallCommandLine":"visioviewer_4339-1001_x64_en-us.exe /quiet","UninstallCommandLine":"visioviewer_4339-1001_x64_en-us /uninstall /quiet","RequirementRules":"`* Once the client receives the deployment policy, it begins processing the application installation workflow. All activities related to **Win32 app detection** are captured in the **Intune Management Extension log**. The log snippets below illustrate how the client evaluates detection rules during this phase. *` `* ## **Use a custom detection Rule** **PowerShell‑based detection rules** are supported in **Microsoft Intune** to verify the presence of a Win32 application. This method allows administrators to run a custom script that defines the detection logic. To configure this option, the following details are required: When configuring a **PowerShell‑based detection rule in Microsoft Intune**, the following options must be defined: 1. **Script file** – Select a PowerShell Win32 App Detection Script that will detect the presence of the application on the client. The app is considered detected when the script returns an **exit code of 0** and writes a **string value to STDOUT**. 2. **Run the script as a 32‑bit process on 64‑bit clients** – Choose **Yes** to run the script in a 32‑bit process on 64‑bit devices. Select **No** (default) to run the script in a 64‑bit process. On 32‑bit clients, the script always runs in a 32‑bit process. 3. **Enforce script signature check** – Select **Yes** to verify that the script is signed by a trusted publisher. This allows the script to run without warnings or prompts. Select **No** (default) to run the script without signature verification, which may require user confirmation. ![Intune win32 app detection rules custom detection script](https://techuisitive.com/wp-content/uploads/2023/03/image-10.png)The **Intune agent** evaluates the results returned by the Intune Win32 app detection script. It reads the values written to the **STDOUT stream**, the **standard error (STDERR) stream**, and the **exit code**. - If the script exits with a **non‑zero value**, the detection fails and the application status is reported as **not installed**. - If the script exits with a **zero value** and **STDOUT contains data**, the detection succeeds, and the application status is reported as **installed** ### **Exit Code and STDOUT stream** **Exit Code****STDOUT Stream****Detection State**0Not EmptyDetected, Application installed0EmptyNot detected, Application not installedNon zero​EmptyNot detected, Application not installed​Non zero​Not EmptyNot detected, Application not installedSource: ### **Sample Intune Win32 app detection script:** Below is a sample **PowerShell Intune Win32 app detection script** that can be used with the **Custom Detection Rule for Win32 apps in Microsoft Intune**. This script validates both **file existence** and **file version**, making it suitable for scenarios where precise **Intune detection rules** are required to ensure accurate application deployment and compliance. - If the conditions match, the script returns an **exit code of 0** and writes a **string value to STDOUT**. - If the conditions do not match, the script still returns an **exit code of 0**, but without writing any value to STDOUT. The **Intune Management Extension** captures the output written to STDOUT (via `Write-Host`) and records it in the log file. ``` $AppName = "Winzip ver 26.0" $File = "D:\Program Files\WinZip26\winzip64.exe" $FileVersion = "50.260.14610 (64-bit)" Write-Host "Custom script based detection : $AppName" if (Test-path $File) { $ActualVersion = (Get-ItemProperty -Path $File).VersionInfo.FileVersion If ($ActualVersion -eq $FileVersion) { Write-host "Actual version: $Actualversion, Compared version: $FileVersion" Write-host "Same version of application installed" Exit 0} else { Write-host "Actual version: $Actualversion, Compared version: $FileVersion" Write-host "Different Version of application installed" Exit 0} } else { Write-Host "File $file not found. Application not installed" Exit 1 } ``` ### **Client-side activities:** Below are excerpts from the **Intune Management Extension log**. In these entries, the client downloaded the deployment policy, which contains all configuration details for Intune **Win32 app detection rules**. The policy also includes the **PowerShell detection script**, stored in encrypted form. (For readability, some lines have been removed.) In this example, **DetectionType 3** represents a **custom script‑based detection rule**. *` `* If any of the above **Win32 app detection rules** are misconfigured, the application may be offered to the client even if it is already installed. In such cases, the **Intune agent** cannot properly detect the application after installation, and the deployment will fail with the error code **0x87D1041C**. ## Conclusion Understanding how **Win32 app detection rules in Microsoft Intune** work is critical for ensuring reliable application deployments. Whether detection is based on **MSI**, **file/folder checks**, **registry keys**, or **custom PowerShell scripts**, each rule must be configured correctly to avoid false negatives and deployment failures. The **Intune Management Extension log** provides detailed visibility into the detection process, helping administrators troubleshoot issues and validate rule behavior. Misconfigured rules can lead to errors such as **[0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/ "Win32 App Deployment Failed with Error 0x87D1041C")**, so careful planning and testing are essential. By leveraging the right detection method and monitoring logs effectively, IT admins can ensure that applications are accurately identified, properly installed, and consistently managed across client devices. ## Frequently Asked Questions (FAQs) ### **What are Win32 app detection rules in Intune?** Win32 app detection rules are methods used by Intune to verify whether an application is installed and compliant on a managed device. They ensure that deployment status is accurate and help avoid reinstallation of already present apps. ### **Which types of detection rules does Intune support?** Intune supports multiple detection methods, including MSI product codes, file existence checks, registry key/value checks, and custom PowerShell scripts. ### **When should I use MSI detection rules?** MSI detection rules are best used when deploying applications packaged as MSI installers. Intune checks the MSI product code to confirm installation. ### **How do file and registry detection rules work?** File detection rules verify the presence of a specific file or folder path, while registry detection rules check for a particular registry key or value to confirm app installation. ### **Can I use PowerShell scripts for detection?** Yes. PowerShell detection rules provide flexibility to define custom logic, making them useful for complex scenarios where MSI, file, or registry checks are insufficient. ### **Where can I find logs for troubleshooting detection rules?** Detection rule results are logged in the **Intune Management Extension (IME) logs**, located at: `C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log`. ### **What happens if detection rules are misconfigured?** If detection rules are incorrect, Intune may repeatedly attempt to install the app or mark it as failed. Proper configuration ensures accurate compliance reporting and smooth deployments. ## **Related Posts** - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** App Deployment Featured, Application Deployment, intune featured, Intune Guides, Intune win32 App Guides, Software Deployment, Win32 Apps, Win32 Apps Featured --- ### [Windows Administrator Basics: Windows Registry](https://techuisitive.com/windows-administrator-basics-windows-registry/) **Published:** October 3, 0202 **Author:** Equebal Ahmad **Content:** The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. ## **Windows Registry Root Keys** The Windows Registry consists of the following Root Keys. -HKEY\_CLASSES\_ROOT -HKEY\_CURRENT\_USER -HKEY\_LOCAL\_MACHINE -HKEY\_USER -HEKY\_CURRENT\_CONFIG ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-254.jpeg)Root Keys contain SubKeys. Subkeys may contain subkeys of their own too and contain at least one value, called as its Default Value. ## **Windows Registry Hives** A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in. For Example, HKEY\_CURRENT\_USER with its subkeys and Value called a hive. When a user log on to Windows, the information from ntuser.dat file is loaded into HKEY\_CURRENT\_USER hive. When a user logs off, any changes in the registry are saved back to ntuser.dat ## **Windows Registry Data Type** The values stored in the registry are classified by a data type. A data type represents the specific kind of data that the value can store. There are 5 widely used data types which we will explain here. ### REG\_BINARY The raw binary data is stored in this data type. Most hardware component information is stored as binary data, and can be displayed in an editor in hexadecimal format. ### REG\_DWORD This type represents the data as a four-byte number and is commonly used for boolean values, such as “0” is disabled and “1” is enabled. ### REG\_EXPAND\_SZ This type is an expandable data string that is string containing a variable to be replaced when called by an application. For example, for the following value, the string “%SystemRoot%” will be replaced by the actual location of the directory containing the Windows NT system files. (This type is only available using an advanced registry editor such as REGEDT32) ### REG\_MULTI\_SZ This type is a multiple string used to represent values that contain lists or multiple values; each entry is separated by a NULL character. (This type is only available using an advanced registry editor such as REGEDT32) ### REG\_SZ This type is a standard string, used to represent human-readable text values. ## **Backing up (Exporting) Windows Registry** You should always backup your registry before you attempt to change, create, or remove registry settings. This will give you an option to revert to a known good version if something goes wrong. You can follow the steps below to backup windows registry. - Press the Windows button and the R button simultaneously to open the Run window. - Type “regedit” to open the registry editor and press Enter. ![regedit](https://techuisitive.co.in/wp-content/uploads/2023/04/image-255.jpeg)- Select the Key which you want to back up, right-click, and select Export. If you want to backup entire Windows registry, then select ‘Computer’ at the top and then select Export from the menu or Context menu. ![regedit](https://techuisitive.co.in/wp-content/uploads/2023/04/image-256.jpeg)- In the dialog box, enter a name for the backup file, select the location where you want to export the registry file, and click Save to create and save the backup. ![regedit](https://techuisitive.co.in/wp-content/uploads/2023/04/image-257.jpeg)## **Importing Windows Registry from Registry Editor** - Open Registry Editor, Select File > Import ![registry import](https://techuisitive.co.in/wp-content/uploads/2023/04/image-258.jpeg)- Browse to the location where you have saved the registry backup, select the file, and click on Open. ![registry import](https://techuisitive.co.in/wp-content/uploads/2023/04/image-259.jpeg)- You can see the import progress if you have taken the backup of the entire registry or complete hives. Otherwise, the action will be quick, and you may not see any progress window at all. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-260.jpeg)- You will see a dialog box showing success/failure of registry import. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-261.jpeg)## Related Posts - [Windows 10 – Remote administration through PowerShell – Part 1](https://techuisitive.com/windows-10-remote-administration-through-powershell-part-1/) - [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) - [Windows Administrator Basics: Windows Services](https://techuisitive.com/windows-administrator-basics-windows-services/) - [Windows Administrator Basics: Managing Windows Services from Powershell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) ## Explore More Windows Guides Continue building your Windows administration skills with practical, step-by-step guides covering Windows configuration, troubleshooting, device management, PowerShell, and automation. - **[Windows 10/11 Guides](https://techuisitive.com/microsoft-windows/)** – Explore practical guides for Windows configuration, administration, troubleshooting, updates, PowerShell, and everyday Windows management. - **[Microsoft Intune Learning](https://techuisitive.com/microsoft-intune/)** – Learn how to manage Windows devices with Intune, including device enrollment, configuration, compliance, application deployment, and updates. - **[Automation](https://techuisitive.com/automation/)** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive administration tasks and manage Windows devices more efficiently. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Windows 10 / 11 **Tags:** Windows Administration --- ### [Automating Intune Reports Using PowerShell and Microsoft Graph API](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/) **Published:** June 30, 2026 **Author:** Equebal Ahmad **Content:** Managing Microsoft Intune environments often requires administrators to export reports regularly for compliance checks, device auditing, and operational monitoring. While Intune provides built-in reporting in the admin center, manually exporting reports and emailing them repeatedly can quickly become time-consuming. In this guide, we’ll build a PowerShell-based Intune reporting automation framework that: - Authenticates using a Service Principal - Reads report configuration from JSON - Exports Intune reports using the Microsoft Graph API - Generates CSV reports automatically - Email reports using Microsoft Graph Mail API - Supports multiple reports dynamically - Includes logging and report enable/disable controls By the end, you’ll have a reusable and scalable reporting solution for Intune. ## Solution Overview The automation works using the following flow: ``` PowerShell Script ↓ Authenticate to Microsoft Graph ↓ Read Report Configuration from JSON ↓ Export Intune Report Data ↓ Format Report Data ↓ Generate CSV File ↓ Send Email via Graph API ``` ## Features Included - Service Principal authentication - JSON-driven report configuration - Multiple report support - Enable/Disable reports individually - Dynamic report formatting - Graph API email delivery - Automatic log generation - Automatic log cleanup - CSV report exports - Modular report functions ## Prerequisites Before using the script, ensure the following requirements are completed: - An active Microsoft Intune tenant - A licensed Microsoft 365 mailbox - An App Registration in Microsoft Entra ID - Microsoft Graph API application permissions configured - PowerShell 5.1 or later ## Required Microsoft Graph Permissions Add the following **Application Permissions** to the App Registration: PermissionTypeDeviceManagementManagedDevices.Read.AllApplicationDeviceManagementConfiguration.Read.AllApplicationMail.SendApplication![](https://techuisitive.com/wp-content/uploads/2026/05/image-2.png)After adding permissions: 1. Grant Admin Consent 2. Generate a Client Secret 3. Note down: - Tenant ID - Client ID - Client Secret Microsoft Graph permissions documentation: [Microsoft Graph Permissions Reference](https://learn.microsoft.com/en-us/graph/permissions-reference?utm_source=chatgpt.com) ## Project Structure ``` Intune_Report_Automailer │ ├── Intune_Report_Automailer.ps1 ├── config.json │ ├── Reports │ └── *.csv │ └── Logs └── *.log ``` ## JSON Configuration File The script reads all report settings dynamically from a JSON configuration file. Example: ``` { "EmailSettings": { "SenderEmail": "intunereports@contoso.com" }, "Reports": [ { "Enabled": true, "ReportName": "Device Inventory Report", "ReportType": "ManagedDevices", "FileName": "DeviceInventory", "ReportUri": "https://graph.microsoft.com/beta/deviceManagement/managedDevices", "Recipients": [ "admin@contoso.com" ] }, { "Enabled": true, "ReportName": "Device Compliance Report", "ReportType": "Compliance", "FileName": "DeviceCompliance", "ReportUri": "https://graph.microsoft.com/beta/deviceManagement/managedDevices", "Recipients": [ "security@contoso.com" ] } ] } ``` ## Understanding the Report Configuration Each report entry supports: PropertyPurposeEnabledEnables or disables the reportReportNameFriendly report nameReportTypeUsed for custom formattingFileNameExported CSV filenameReportUriGraph API endpointRecipientsEmail recipients## Supported Reports Currently, the script supports: ReportGraph EndpointDevice Inventory`/deviceManagement/managedDevices`Device Compliance`/deviceManagement/managedDevices`The same Graph endpoint can be reused with different formatting functions to create multiple report types. ## Service Principal Authentication The script authenticates to Microsoft Graph using OAuth 2.0 Client Credentials flow. ``` $TokenBody = @{ Grant_Type = "client_credentials" Scope = "https://graph.microsoft.com/.default" Client_Id = $ClientId Client_Secret = $ClientSecret } ``` This avoids interactive sign-ins and makes the automation suitable for scheduled execution. ## Report Formatting Functions One of the biggest challenges with Microsoft Graph responses is nested JSON properties. For example: ``` hardwareInformation contains multiple embedded objects and arrays. ``` To generate clean CSV exports, the script uses custom formatting functions. ## Device Inventory Report The `Format-ManagedDevicesReport` function: - Flattens nested hardware information - Converts storage values to GB - Selects only required properties - Removes nested array issues Example exported columns: - Device Name - OS Version - Compliance State - Manufacturer - Serial Number - TPM Version - Storage Information ## Device Compliance Report The compliance report focuses on: - Device Name - Compliance state - Management state - Last sync time - Device ownership This provides a simplified operational compliance report for administrators. ## Exporting Reports The script dynamically exports CSV files to the .\\Reports folder using the Export-Csv cmdlet. The generated files include timestamps for easier tracking. Example: ``` DeviceInventory_20260525_101500.csv ``` ## Sending Reports via Microsoft Graph API The script uses Microsoft Graph Mail API **/users/{sender}/sendMail** to send the report. Its provide cloud native email delivery, modern authentication, and better security. Microsoft Graph sendMail documentation: [Microsoft Graph SendMail API Documentation](https://learn.microsoft.com/en-us/graph/api/user-sendmail?utm_source=chatgpt.com) ## Logging The script includes centralized logging with automatic log cleanup. Example log entries: ``` 2026-05-25 09:00:01 [INFO] Getting Graph access token... 2026-05-25 09:00:05 [INFO] Processing Report: Device Inventory Report 2026-05-25 09:00:12 [INFO] Report exported successfully. 2026-05-25 09:00:15 [INFO] Email sent successfully. ``` Logs are stored in: ``` .\Logs ``` Older logs are automatically removed after 30 days. ## Enabling or Disabling Reports Reports can easily be enabled or disabled directly from the JSON file. Example: ``` "Enabled": false ``` The script automatically skips disabled reports. ## Running the Script Execute the script using: ``` .\Intune_Report_Automailer.ps1 ``` You can also schedule it using: Windows Task Scheduler for daily or weekly report delivery. ## Common Use Cases This framework can be extended for: - Non-compliant device reporting - Stale device detection - Autopilot device exports - BitLocker reporting - App inventory exports - Windows 11 readiness reporting ## Future Enhancements Potential future improvements include: - HTML report templates - ZIP compression - Teams notifications - Advanced filtering - Graph Export Jobs integration - Dashboard reporting - Azure Automation support - Azure Key Vault integration ## Final Thoughts Using Microsoft Graph with PowerShell provides a powerful way to automate Intune reporting workflows. This approach offers: - Better scalability - Modern authentication - Reusable automation - Flexible reporting - Simplified administration If you regularly export Intune reports manually, this framework can significantly reduce repetitive administrative work while improving operational visibility. ## Script Download Download the latest version of the **Intune Report Auto mailer** automation script from GitHub. ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Automation, Automation Featured, Automation Graph API, Intune Automation --- ### [How to Create Intune Detection and Remediation Scripts (Step‑by‑Step Guide)](https://techuisitive.com/how-to-create-intune-detection-and-remediation-scripts-step-by-step-guide/) **Published:** July 28, 2026 **Author:** Equebal Ahmad **Content:** Microsoft Intune provides powerful capabilities to keep devices compliant and secure. One of the most useful features is **detection and remediation scripts** that allow us to use small PowerShell scripts to check for issues and automatically fix them. If you’re new to Intune automation, start here. Once you understand how to create scripts manually, you can move on to my [automation guide using the Microsoft Graph API](https://techuisitive.com/automation/#PowerShell-and-Graph-API "automation guide using the Microsoft Graph API") to streamline deployments across environments. ## What Are Detection and Remediation Scripts? - **Detection Script** checks for a condition (e.g., outdated software, missing registry key). - **Remediation Script** fixes the issue if detected (e.g., installs an update, adds a registry key). Together, they help admins enforce compliance and reduce manual troubleshooting. ## Prerequisites - Access to **Microsoft Intune Admin Center** - Basic knowledge of **PowerShell** - A test group of devices (recommended before production rollout) ## Prepare the Detection and Remediation Scripts ### Create a Detection Script Before creating the remediation package, you need a **PowerShell detection script**. This script determines whether a device is compliant by evaluating a specific condition and returning an appropriate exit code. - **Exit code 0** – The device is **compliant**. Intune does not run the remediation script. - **Exit code 1** – The device is **non-compliant**. Intune automatically runs the associated remediation script (if one is configured). In the following example, the detection script checks whether the installed **Google Chrome** version is earlier than **125.0.0.0**. If Chrome is running version **125.0.0.0** or later, the script returns **exit code 0**. Otherwise, it returns **exit code 1**, allowing Intune to trigger the remediation script and perform the required corrective action. ``` # Detection Script: Check Chrome version with logging $logFolder = "C:\ProgramData\IntuneRemediation" $logFile = Join-Path $logFolder "DetectionLog.txt" # Ensure log folder exists if (!(Test-Path $logFolder)) { New-Item -ItemType Directory -Path $logFolder -Force | Out-Null } function Write-Log { param([string]$Message) $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" Add-Content -Path $logFile -Value "$timestamp - $Message" } $chromePath = "C:\Program Files\Google\Chrome\Application\chrome.exe" if (Test-Path $chromePath) { $version = (Get-Item $chromePath).VersionInfo.ProductVersion Write-Log "Chrome detected. Version: $version" if ($version -lt "125.0.0.0") { Write-Output "NonCompliant" Write-Log "Result: NonCompliant (Version below 125.0.0.0)" exit 1 } else { Write-Output "Compliant" Write-Log "Result: Compliant" exit 0 } } else { Write-Output "NotInstalled" Write-Log "Result: NotInstalled (Chrome not found)" exit 1 } ``` ### Create a Remediation Script After creating the detection script, the next step is to create the **PowerShell remediation script**. This script runs **only when the detection script returns exit code 1**, indicating that the device is non-compliant. The remediation script should contain the actions required to bring the device back into the desired state. Depending on your scenario, it might install or update an application, modify a registry value, restart a service, or change a configuration setting. In the following example, the remediation script upgrades **Google Chrome** to the required version if the installed version is earlier than **125.0.0.0**. After the remediation completes, the detection script runs again during the next scheduled execution to verify that the device is now compliant. ``` # Remediation Script: Install latest Chrome with logging $logFolder = "C:\ProgramData\IntuneRemediation" $logFile = Join-Path $logFolder "RemediationLog.txt" # Ensure log folder exists if (!(Test-Path $logFolder)) { New-Item -ItemType Directory -Path $logFolder -Force | Out-Null } function Write-Log { param([string]$Message) $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" Add-Content -Path $logFile -Value "$timestamp - $Message" } try { $installer = "$env:TEMP\ChromeSetup.exe" $url = "https://dl.google.com/chrome/install/latest/chrome_installer.exe" Write-Log "Starting remediation. Downloading Chrome installer from $url" Invoke-WebRequest -Uri $url -OutFile $installer -ErrorAction Stop Write-Log "Download complete: $installer" Write-Log "Starting silent installation..." Start-Process -FilePath $installer -Args "/silent /install" -Wait Write-Log "Installation completed successfully." Remove-Item $installer -Force Write-Log "Installer removed from $installer" } catch { Write-Log "Error occurred: $($_.Exception.Message)" exit 1 } ``` ## Deploy the Remediation Script in Microsoft Intune - Sign in to [Microsoft Intune Admin Center](https://endpoint.microsoft.com/?utm_source=copilot.com). - Navigate to: **Devices > Windows > Script and Remediation** - Select +Create ![Intune remediation script](https://techuisitive.com/wp-content/uploads/2026/07/image-6-1024x501.png)On the **Settings** page, complete the following steps: - Click **Browse** under **Detection script file** and select the PowerShell detection script. - Click **Browse** under **Remediation script file** and select the PowerShell remediation script. - Configure the following options based on your organization’s requirements: - **Run this script using the logged-on credentials** – Choose whether the script should run in the context of the signed-in user or the SYSTEM account. - **Enforce script signature check** – Enable this option to run only digitally signed PowerShell scripts. - **Run script in 64-bit PowerShell** – Enable this option if your script requires a 64-bit PowerShell environment (recommended for most Windows devices). After configuring the required settings, click **Next** to proceed to the **Assignments** page. ![Intune remediation script](https://techuisitive.com/wp-content/uploads/2026/07/image-8.png)- On the **Assignments** page, select the Microsoft Entra user or device groups that should receive the remediation package. You can assign the package to one or more groups depending on your deployment requirements. Next, configure the **Schedule** by choosing whether the scripts should run **Once**, **Hourly**, or **Daily**, and specify the execution time or interval. After reviewing the assignment and schedule settings, click **Next**. - On the **Review + create** page, verify that all the configured settings are correct, including the remediation package name, uploaded detection and remediation scripts, assignments, and schedule. If any changes are required, click **Previous** to return to the relevant page and update the configuration. Once you have confirmed the settings, click **Create** to deploy the remediation package. Intune will begin distributing the scripts to the targeted devices based on the configured schedule. ## Validate the Remediation Results After the remediation package has been deployed, verify that it is working as expected by reviewing the execution results in the Microsoft Intune admin center. Navigate to **Devices** > **Scripts and remediations**, select your remediation package, and review the available reports to confirm whether the detection and remediation scripts executed successfully on the targeted devices. ![Intune remediation script overview](https://techuisitive.com/wp-content/uploads/2026/07/image-14-1024x518.png)Check the **detection status**, **remediation status**, and any **error messages** reported for individual devices. If remediation was triggered, verify that the issue has been resolved by confirming that the device is now reported as **compliant** during the next detection cycle. ![Intune remediation script Device status](https://techuisitive.com/wp-content/uploads/2026/07/image-16-1024x232.png)If the scripts do not produce the expected results, review the execution logs and PowerShell output to identify the root cause. Common issues include incorrect file paths, registry locations, missing permissions, or script logic errors. Update the detection or remediation script as required, redeploy the package, and validate the results again until the remediation works reliably across all targeted devices. ## Best Practices for Intune Remediation Scripts To ensure your remediation scripts are reliable, secure, and easy to maintain, follow these best practices: **Keep scripts lightweight and efficient** – Detection and remediation scripts should perform only the tasks necessary to evaluate or correct the issue. Avoid complex logic or long-running operations that can increase execution time and consume device resources. **Implement logging and error handling** – Use PowerShell logging (such as `Write-Output` or transcript logging where appropriate) and proper error handling to capture execution details. Well-written logs make it easier to troubleshoot failures and verify that the remediation completed successfully. **Test in a pilot group first** – Before deploying scripts to production, assign them to a small pilot group of devices. Validate that the detection logic correctly identifies non-compliant devices and that the remediation script resolves the issue without introducing unintended side effects. **Avoid hard-coded values** – Use variables, parameters, or configurable values instead of hard-coding file paths, registry keys, URLs, or application versions. This makes your scripts easier to update, reuse, and maintain across different environments. **Make scripts idempotent** – Design remediation scripts so they can run multiple times without causing errors or making unnecessary changes. A well-written remediation script should safely verify the current state before applying any modifications. **Follow the principle of least privilege** – Run scripts with the minimum permissions required to perform the task. If SYSTEM context is not necessary, consider using the logged-on user context where appropriate to reduce security risks. By following these best practices, you can create remediation scripts that are easier to troubleshoot, safer to deploy, and more reliable across your Microsoft Intune-managed Windows devices. ## Next Steps: Automate with Graph API Once you’re comfortable creating scripts manually, you can automate the process using **Microsoft Graph API**. This allows bulk deployment, version control, and integration with CI/CD pipelines. 👉 Read my full guide: [Automate Intune Remediation Script Creation with PowerShell and Graph API](https://techuisitive.com/automation/#PowerShell-and-Graph-API). ## ✅ Conclusion Detection and remediation scripts are a simple but powerful way to enforce compliance in Intune. By following this step‑by‑step guide, you can start small, test safely, and then scale with automation. 💡 Have a favorite detection/remediation use case? Share it in the comments—I’d love to feature real‑world scenarios in future posts. ## Related Posts - [Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) - [Automating Intune Reports Using PowerShell and Microsoft Graph API](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/) - [The Remediation Playbook: How Intune Admins Can Automate Fixes in 2026](https://techuisitive.com/the-remediation-playbook-how-intune-admins-can-automate-fixes-in-2026/ "The Remediation Playbook: How Intune Admins Can Automate Fixes in 2026") ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune Remediation --- ### [Bulk Upload Win32 Apps to Intune With PowerShell and Microsoft Graph API](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) **Published:** May 18, 2026 **Author:** Equebal Ahmad **Content:** Bulk uploading Win32 applications to Microsoft Intune can become time-consuming when you need to package applications, create Entra ID groups, configure detection rules, assign applications, and repeat the same process for dozens of applications. This guide demonstrates how to automate the complete deployment process using PowerShell and the Microsoft Graph API. Instead of uploading every application manually, the automation reads configuration files, packages applications, uploads them to Intune, creates assignment groups, and assigns applications automatically. By the end of this guide, you’ll understand how the solution works, what it supports, and how to customize it for your environment. Table Of Contents 1. [Win32 App Bulk Upload Workflow](#win32-app-bulk-upload-workflow) 2. [How the Automation Works](#how-the-automation-works) 3. [Intune Automation Script Components](#intune-automation-script-components) 4. [Prepare the Environment](#prepare-the-environment) 5. [Download the Script](#download-the-script) 6. [Run the Script](#run-the-script) 7. [Verify the Deployment](#verify-the-deployment) 8. [Recommended Security Practice](#recommended-security-practice) 9. [Benefits of This Intune Automation](#benefits-of-this-intune-automation) 10. [Future Enhancements](#future-enhancements) 11. [Related Posts](#related-posts) 12. [Explore More Intune Guides](#explore-more-intune-guides) ## **Win32 App Bulk Upload Workflow** The following workflow illustrates how the PowerShell automation deploys Win32 applications to Microsoft Intune. From reading the application folder to creating Microsoft Entra groups and assigning applications, each step is performed automatically to minimize manual effort and ensure consistent deployments. ![](https://techuisitive.com/wp-content/uploads/2026/05/1000347728-683x1024.jpg "1000347728") The sections below explain each stage of the workflow in detail. ## How the Automation Works ### Read Application Folder The script begins by scanning the specified application root folder and identifies each subfolder as a separate application. It verifies that the required installation files and configuration file are present before proceeding with the deployment. ### Read Config.json For each application, the script reads the **Config.json** file to retrieve deployment settings such as the application name, publisher, installation command, uninstall command, detection rule, assignment group, and other metadata. This allows every application to be deployed using its own configuration without modifying the PowerShell script. ### Validate Configuration Before packaging the application, the script validates the configuration to ensure all required properties are present and correctly formatted. If mandatory values are missing or invalid, the deployment for that application is skipped and the error is recorded in the log. ### Create .intunewin Package If the application package has not already been created, the script automatically packages the installer using the **Microsoft Win32 Content Prep Tool**. The resulting **.intunewin** file is then prepared for upload to Microsoft Intune. ### Authenticate to Microsoft Graph The script authenticates to Microsoft Graph using the configured Azure App Registration and required application permissions. Once authentication succeeds, all subsequent operations—including application creation, group management, and assignments—are performed through Microsoft Graph APIs. ### Upload Win32 App The script uploads the generated **.intunewin** package to Microsoft Intune and creates the Win32 application using the settings defined in the configuration file. It also configures application metadata, installation commands, detection rules, return codes, and other deployment properties automatically. ### Create Microsoft Entra Group If specified in the configuration, the script creates a Microsoft Entra security group for the application. This eliminates the need to manually create assignment groups for every application and ensures a consistent naming convention. ### Assign Application After the application and security group have been created, the script automatically assigns the Win32 application to the configured Microsoft Entra group. Assignment intent, such as **Required** or **Available**, is applied based on the values defined in the configuration. ### Write Logs & Transcript Throughout the deployment process, the script records detailed log entries and generates a PowerShell transcript. These logs help administrators verify successful deployments and quickly troubleshoot failures by identifying the exact step where an error occurred. ## Intune Automation Script Components ### 1. Configuration Validation The script validates: - Required JSON properties - Empty values - Installer file existence - Folder name vs DisplayName mismatch - Detection rule structure Example validation logic: ``` if ($folderName -ne $Config.DisplayName) { Write-Log @" Folder name does not match DisplayName. Folder Name : $folderName DisplayName : $($Config.DisplayName) "@ "ERROR" $validationFailed = $true } ``` This helps avoid deployment issues caused by copied configuration files. This helps in cleaner transcript logs and easier troubleshooting. ### 2. Centralized Logging Instead of scattered `Write-Host` calls, the script uses a centralized logging function. Example: ``` function Write-Log { param( [string]$Message, [ValidateSet("INFO","WARN","ERROR","SUCCESS")] [string]$Level = "INFO" ) $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" switch ($Level) { "INFO" { $color = "White" } "WARN" { $color = "Yellow" } "ERROR" { $color = "Red" } "SUCCESS" { $color = "Green" } } Write-Host "[$timestamp] [$Level] $Message" ` -ForegroundColor $color } ``` ### 3. Automated Packaging The script automatically creates `.intunewin` packages using `IntuneWinAppUtil.exe`. Example: ``` Start-Process ` -FilePath $intuneUtilPath ` -ArgumentList $arguments ` -Wait ` -WindowStyle Hidden ``` ### 4. Entra Group Creation The script checks whether a group already exists before creating it. Benefits: - Prevents duplicate groups - Safe re-execution - Better bulk deployment experience ### 5. Assignment Handling The script: - Assigns apps automatically - Prevents duplicate assignments - Supports Available intent ## Prepare the Environment Before you begin, prepare your environment by installing the required tools, configuring Microsoft Graph permissions, organizing the application folder structure, and updating the **Config.json** file. Completing these steps ensures the automation script can successfully package, upload, and assign Win32 applications in Microsoft Intune. ### Prerequisites #### Microsoft Intune and Microsoft Entra Access An active **Microsoft Intune environment** and appropriate administrator access to Microsoft Intune and Microsoft Entra ID are required to configure the application deployment and assignment resources. #### Required PowerShell Modules Install the following PowerShell modules before running the script: - **MSAL.PS** – Used for Microsoft Entra authentication. - **IntuneWin32App** – Used to package and upload Win32 applications to Intune. The script has been tested with **version 1.5.0**. #### Microsoft Win32 Content Prep Tool Download `IntuneWinAppUtil.exe` from the **Microsoft Win32 Content Prep Tool** GitHub repository. The tool is used by the script to package application source files into the `.intunewin` format required by Intune. #### Application Source Files Store each application’s source files and its corresponding `Config.json` file in an individual folder under the `Apps` directory. The folder structure is described in the **Application Folder Structure** section below. #### PowerShell Execution Policy Ensure your PowerShell execution policy allows the script and required modules to run. If your environment restricts script execution, configure the appropriate execution policy according to your organization’s security requirements. #### Microsoft Entra App Registration The script uses a **service principal** for unattended authentication, allowing it to connect to Microsoft Intune and Microsoft Graph without requiring an administrator to sign in interactively each time the script runs. To enable this, create a **Microsoft Entra App Registration** and use its **Tenant ID, Client ID, and Client Secret** in the script. Grant the application the following **Microsoft Graph application permissions** and provide **admin consent**: ``` DeviceManagementApps.ReadWrite.All DeviceManagementConfiguration.ReadWrite.All Group.ReadWrite.All ``` These permissions allow the script to create and manage Intune applications and configurations, as well as create and manage Microsoft Entra groups used for application assignments. ![Microsoft Graph API Permission](https://techuisitive.com/wp-content/uploads/2026/05/image-1-1024x197.png)### Current Limitations #### Currently Supported - MSI Detection Rules #### Planned for Future Release - File, Registry, and Script Detection Rules - Icon Upload Support - Supersedence Support - Requirement Rules Expansion ### Folder Structure The application installation source and configuration files need to be aligned as per the folder structure below. ``` Intune_Win32App_AutoDeploy/ │ ├── Apps/ │ ├── Notepad++ 8.9.1 x64/ │ │ ├── npp.8.9.1.Installer.x64.msi │ │ └── config.json │ │ │ └── 7Zip 24.09/ │ ├── 7z2409-x64.msi │ └── config.json │ ├── IntuneWinAppUtil.exe ├── Intune_Win32App_AutoDeploy.ps1 └── Logs/ ``` ![Two Windows Explorer views: top shows folder path Intune_Win32App_AutoDeploy containing Apps and Logs folders and files Intune_Win32App_AutoDeploy.ps1, IntuneWinAppUtil.exe, Set_Env_Variable.ps1; bottom shows Apps folder path Notepad++ 8.9.1 x64 containing config.json and npp.8.9.1.Installer.x64.msi.](https://techuisitive.com/wp-content/uploads/2026/05/image-4-1024x634.png) ### Config.json Parameters The **Config.json** file controls how each Win32 application is packaged, uploaded, and assigned. Update the following properties to match your application’s deployment requirements. ParameterDescriptionRequired**DisplayName**Name displayed for the application in the Microsoft Intune admin center.Yes**Description**Brief description of the application shown to administrators and users.No**Publisher**Software publisher displayed in the application properties.No**AppVersion**Version number of the application. Used for identification and reporting.Yes**InstallerName**Name of the installer file located in the application folder.Yes**InstallCmd**Silent installation command executed during deployment.Yes**UninstallCmd**Silent uninstall command executed when removing the application.Yes**CreateGroup**Specifies whether the script should automatically create a Microsoft Entra security group (**Yes** or **No**).Yes**GroupName**Name of the Microsoft Entra security group created or used for application assignment.Required if `CreateGroup` is `Yes`**AssignApp**Specifies whether the application should be automatically assigned after upload (**Yes** or **No**).Yes**DetectionRules**Defines the detection method used by Intune to determine whether the application is installed.Yes### Detection Rule Parameters ParameterDescription**Type**Detection rule type. Currently, the script supports **MSI** detection.**Enabled**Enables or disables the detection rule.**ProductCode**MSI Product Code used to detect the installed application.**ProductVersionOperator**Comparison operator for the product version, such as **equal**, **greaterThanOrEqual**, or **lessThan** (depending on what your script supports).**ProductVersion**Version number compared against the installed MSI version.**Note:** The current version of the script supports MSI-based detection rules. Support for File, Registry, and PowerShell Script detection rules may be added in a future release. #### Sample Config.json File ``` { "DisplayName": "Notepad++ 8.9.1 x64", "Description": "Notepad++", "Publisher": "Notepad++", "AppVersion": "8.9.1", "InstallerName": "npp.8.9.1.Installer.x64.msi", "InstallCmd": "msiexec /i npp.8.9.1.Installer.x64.msi /qn /norestart", "UninstallCmd": "msiexec /x npp.8.9.1.Installer.x64.msi /qn /norestart", "CreateGroup": "Yes", "GroupName": "APP - Notepad++", "AssignApp": "Yes", "DetectionRules": [ { "Type": "MSI", "Enabled": true, "ProductCode": "{7349B4F3-02E1-4234-A67A-FA85B33B67AF}", "ProductVersionOperator": "equal", "ProductVersion": "8.9.1" } ] } ``` ``` ``` ## Download the Script Download the latest version of the **Bulk Win32 App Deployment** automation script from GitHub. The repository includes the PowerShell script, sample **Config.json** file, folder structure, and supporting files required to automate Win32 application deployment to Microsoft Intune using Microsoft Graph API. Download the complete Intune automation script from [Techuisitive GitHub repository](https://github.com/techuisitive/Intune_Win32App_AutoDeploy). ## Run the Script ### Configuration Validation Mode The script supports a validation-only mode. This is useful before large bulk deployments, as you can validate the configurations before bulk upload. Any issues identified with the configuration can be fixed before the bulk upload. Example: ``` .\Intune_Win32App_AutoDeploy.ps1 -ValidateConfig ``` This mode: - Validates JSON files - Checks the installer’s existence - Verifies folder naming - Skips upload and assignment The Validate Config mode is useful before large bulk deployments. You can identify the fix the configuration issues before running the script in deployment mode. ![Intune win32 app deploy validation mode](https://techuisitive.com/wp-content/uploads/2026/05/image-5-1024x524.png)### Deployment Mode The script will run in deployment mode when executed without any parameters. ``` .\Intune_Win32App_AutoDeploy.ps1 ``` ![Intune Win32 app deploy deployment mode](https://techuisitive.com/wp-content/uploads/2026/05/image-6-1024x628.png)The script provides application deployment summary at the end. ![Intune Win32 App Deployment Summary](https://techuisitive.com/wp-content/uploads/2026/05/image-7-1024x152.png)## Verify the Deployment After running the script, verify the deployment in the **Microsoft Intune admin center**. Under **Apps > Windows apps**, confirm that the Win32 applications have been created with the expected application name, version, and assignment status, as shown below. ![App creation and assignment validation](https://techuisitive.com/wp-content/uploads/2026/05/image-8-1024x424.png)In this example, both **Notepad++ 8.9.1 x64** and **Notepad++ 8.9.4 x64** were successfully created as Windows app (Win32) applications and show **Assigned: Yes**. This confirms that the application upload and assignment steps completed successfully. ## Recommended Security Practice Avoid storing secrets directly in the script. Instead, use environment variables: ``` $clientSecret = $env:INTUNE_CLIENT_SECRET ``` Set the user environment variable using the PowerShell command below. You need to run this with elevated PowerShell. ``` [System.Environment]::SetEnvironmentVariable( "INTUNE_CLIENT_SECRET", "YOUR_SECRET", [System.EnvironmentVariableTarget]::User) ``` ## Benefits of This Intune Automation This automation framework streamlines Win32 application deployment by reducing repetitive administrative tasks and ensuring a consistent deployment process across your Microsoft Intune environment. **Key benefits include:** - Reduces repetitive Intune administration - Standardizes application onboarding - Improves deployment consistency - Minimizes manual configuration errors - Accelerates bulk Win32 application deployments - Simplifies application assignment using Microsoft Entra groups - Generates detailed logs for easier troubleshooting **Ideal for:** - Managed Service Provider (MSP) environments - Enterprise IT administrators managing large application portfolios - Application packaging teams - Test and lab environments - Organizations onboarding multiple Win32 applications ## Future Enhancements Planned improvements include: - File and Registry detection rules - Script detection support - Icon uploads - Supersedence support - Requirement rule expansion - Dependency support - Retry logic improvements ## Related Posts - [Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) - [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) - [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/) - [Bulk Add Devices to Entra ID Group from CSV File](https://techuisitive.com/powershell-script-add-device-to-entra-id-group-from-csv-file/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning ")– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Intune Automation](https://techuisitive.com/automation/ "Intune Automation")** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive Intune administration tasks. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Automation, Automation Featured, Automation Graph API, Intune Automation, intune featured --- ### [PowerShell Remote - WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) **Published:** June 15, 2023 **Author:** Equebal Ahmad **Excerpt:** Enter-PSSession : Connecting to remote server failed with the following error message : WinRM cannot complete the operation. verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. **Content:** PowerShell remoting may fail with the **“WinRM cannot complete the operation”** error when connecting to a remote Windows computer using `Enter-PSSession`, `Invoke-Command`, or other PowerShell remoting commands. The error indicates that the remote computer cannot be reached through Windows Remote Management (WinRM), often because the WinRM service is stopped or the required firewall configuration is not available. In this guide, you’ll learn how to troubleshoot the **WinRM cannot complete the operation** error and start the WinRM service on the remote computer using PowerShell or the `SC` command. ## Issue You may get the error below when trying to connect with PowerShell remotely. *Enter-PSSession : Connecting to remote server failed with the following error message : WinRM cannot complete the operation. verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer.* ![Powershell remote | Winrm Error | WinRM cannot complete the operation](https://techuisitive.com/wp-content/uploads/2023/05/image-10-1024x312.png)You already have a firewall exception is in place for WinRM, and the service startup type is also set to Automatic. ## Cause This issue may happen if the WinRM service is stopped on the remote computer. If this is happening on a high number of client computers, then re-validate if firewall exceptions are in place and the Windows service type for WinRM is also set to Automatic. ## Solution ### **Check the status of the WinRM service** ``` Get-Service -ComputerName ComputerName -ServiceName WinRm ``` ![Get-Service PowerShell](https://techuisitive.com/wp-content/uploads/2023/05/image-11.png)### **Start WinRM service on Remote computer using PowerShell** ``` Get-Service -ComputerName ComputerName -ServiceName Winrm | Start-Service ``` ### **Start WinRM service on remote computer using SC command** You can also use [SC (Service Control)](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) command to manage services on the local and remote computers. Open the command prompt on your computer and run the command below. `SC \\ComputerName START WINRM` ## **Related Posts** - [Powershell – Get System up time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) ## Explore More Windows Guides Continue building your Windows administration skills with practical, step-by-step guides covering Windows configuration, troubleshooting, device management, PowerShell, and automation. - **[Windows 10/11 Guides](https://techuisitive.com/microsoft-windows/)** – Explore practical guides for Windows configuration, administration, troubleshooting, updates, PowerShell, and everyday Windows management. - **[Microsoft Intune Learning](https://techuisitive.com/microsoft-intune/)** – Learn how to manage Windows devices with Intune, including device enrollment, configuration, compliance, application deployment, and updates. - **[Automation](https://techuisitive.com/automation/)** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive administration tasks and manage Windows devices more efficiently. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell **Tags:** PowerShell, Windows 10/11 troubleshooting --- ### [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) **Published:** September 25, 2022 **Author:** Sabir Ali **Content:** If your computer is on a corporate network behind a proxy server, by default you won’t be able to access external web resources from your PowerShell CLI. For example, you won’t be able to get the content of an external web page using the *Invoke-WebRequest* cmdlet, update help using the *Update-Help*, connect to Azure/Microsoft 365 tenant (Exchange Online PowerShell module), install modules from PSGallery, or RSAT capabilities, download an application package or System Drivers from an external software repository ( external FTP share). This is very annoying but don’t worry, I am happy to offer the solution for you!!! ## **PowerShell Script** By default, the [PowerShell Script Execution Policy](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.2) doesn’t allow PS scripts to run, even from PowerShell profile files. To allow PS1 scripts to run, you need to change your PowerShell Execution Policy settings. Download the script file and add it to your actual script which requires access to external data through a proxy server. [Proxy\_Auto-Config](http://techuisitive.co.in/wp-content/uploads/2023/04/Proxy_Auto-Config.zip)[Download](http://techuisitive.co.in/wp-content/uploads/2023/04/Proxy_Auto-Config.zip) Important **Please ensure you perform adequate testing before using the script in your environment.** \* Please feel free to reach out with any comments or questions! [LinkedIn](https://www.linkedin.com/in/sabir-ali-54594a37/) [Twitter](https://twitter.com/sabiralicwi1324) ## Related Posts - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell **Tags:** Device Configuration, Windows Guides --- ### [Windows 10 - Remote administration through PowerShell - Part 1](https://techuisitive.com/windows-10-remote-administration-through-powershell-part-1/) **Published:** November 16, 2020 **Author:** Equebal Ahmad **Content:** This post is collection of useful PowerShell commands which will simplify your day to day desktop support administration tasks. The tasks can be performed remotely without taking remote control of the machine and without impacting user productivity. Please ensure you change the computer name used in below examples. ## **Check, Start and Stop Windows Services** **Check status of Windows service** ``` Get-Service -ComputerName DESKTOP-VND43IR -Name BITS ``` ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-262.jpeg)**Start a Windows service** ``` Get-Service -ComputerName DESKTOP-VND43IR -Name BITS | Start-Service ``` ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-263.jpeg)**Stop a Windows service** ``` Get-Service -ComputerName DESKTOP-VND43IR -Name BITS | Stop-Service ``` ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-264.jpeg)## **Get Computer Details** The WMI class win32\_ComputerSystem hold information about computer system. These information can be retrieved using Get-WMIObject cmdlet. **Get all details stored in win32\_computersystem WMI class** ``` Get-WmiObject -class win32_computersystem -ComputerName DESKTOP-VND43IR | select * ``` **Get logged on user name** ``` Get-WmiObject -class win32_computersystem -ComputerName DESKTOP-VND43IR | select username ``` ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-265.jpeg)**Get computer make and model details** ``` Get-WmiObject -class win32_computersystem -ComputerName DESKTOP-VND43IR | select Manufacturer,model ``` ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-266.jpeg)**Get physical memory size in GB** ``` Get-WMIObject -class Win32_PhysicalMemory -ComputerName DESKTOP-VND43IR | Measure-Object -Property capacity -Sum | % {[Math]::Round(($_.sum / 1GB),2)} ``` ## Related Posts - [Windows 10 – Remote administration through PowerShell – Part 1](https://techuisitive.com/windows-10-remote-administration-through-powershell-part-1/) - [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) - [Windows Administrator Basics: Windows Services](https://techuisitive.com/windows-administrator-basics-windows-services/) - [Windows Administrator Basics: Managing Windows Services from Powershell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) - [Windows Administrator Basics: Windows Registry](https://techuisitive.com/windows-administrator-basics-windows-registry/) - [Basic Knowledge for Windows Desktop Support Engineer](https://techuisitive.com/basic-knowledge-for-windows-desktop-support-engineer/) - [Windows 10 /11 : Create a virtual drive with SUBST command](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell, Windows 10 / 11 **Tags:** Windows Admin Basics --- ### [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) **Published:** March 27, 2010 **Author:** Equebal Ahmad **Content:** Consider the following scenario - The WSUS is installed on SCCM central site server. - The correct port is configured in Software Update Point setting. - No proxy server is in used. I was getting following error in WSysncmgr.log file when initiating synchronization from Configuration Manager console. *Sync failed: WSUS server not configured. Source: CWSyncMgr::DoSync* *STATMSG: ID=6703 SEV=E LEV=M SOURCE=”SMS Server” COMP=”SMS\_WSUS\_SYNC\_MANAGER” SYS=SERVER1 SITE=BNG PID=1728 TID=3408 GMTDATE=Sat Apr 03 18:28:48.292 2010 ISTR0=”CWSyncMgr::DoSync” ISTR1=”WSUS server not configured” ISTR2=”” ISTR3=”” ISTR4=”” ISTR5=”” ISTR6=”” ISTR7=”” ISTR8=”” ISTR9=”” NUMATTRS=0* I have gone through lots of articles but nothing worked for me. I have also verified the configurations as described in the TechNet article. Everything was fine. [http://technet.microsoft.com/en-us/library/bb735874.aspx](https://www.blogger.com/blog/post/edit/342669710247136852/7028469465777778728#) Later I noticed the following error in wcm.log. *System.Net.WebException: The request failed with HTTP status 401: Unauthorized.~~ at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object\[\] args)~~ at Microsoft.UpdateServices.Administration.AdminProxy.GetUpdateServer(String serverName, Boolean useSecureConnection, Int32 portNumber)~~ at Microsoft.SystemsManagementServer.WSUS.WSUSServer.ConnectToWSUSServer(String ServerName, Boolean UseSSL, Int32 PortNumber)* The same time following error was appearing in the IIS log. *2010-04-03 19:06:44 W3SVC1 192.168.1.101 POST /ApiRemoting30/WebService.asmx – 80 – 192.168.1.101 Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.42)* ***401*** *1 0* I searched for the error which was in IIS log and come to know about below article on MyITForum.com. [http://www.myitforum.com/forums/tm.aspx?high=&m=172010&mpage=1#172010](https://www.blogger.com/blog/post/edit/342669710247136852/7028469465777778728#) The method 1 described in the [http://support.microsoft.com/kb/896861](https://www.blogger.com/blog/post/edit/342669710247136852/7028469465777778728#) worked like a charm. **Method 1** To set the **DisableLoopbackCheck** registry key yourself, follow these steps: 1. Click **Start**, click **Run**, type regedit, and then click **OK**. 2. In Registry Editor, locate and then click the following registry key: **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa** 1. Right-click **Lsa**, point to **New**, and then click **DWORD Value**. 2. Type DisableLoopbackCheck, and then press ENTER. 3. Right-click **DisableLoopbackCheck**, and then click **Modify**. 4. In the **Value data** box, type 1, and then click **OK**. 5. Quit Registry Editor, and then restart your computer. ## Related Posts - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting --- ### [How to deploy Android .APK Apps in Microsoft Intune](https://techuisitive.com/how-to-deploy-android-apk-apps-in-microsoft-intune/) **Published:** July 7, 2023 **Author:** Asif Khan **Content:** Use the Manage Google Play App option in Intune to deploy custom Android APK files. This allows you to add LOB apps by submitting just the app APK and a title, directly within Intune. This method does not require you to have a Google developer account and does not require you to pay the fee to register with Google as a developer. This method is simpler and has a significantly reduced number of steps and makes LOB apps available for management. ![Intune | Adnroid .APK Deploy](https://techuisitive.com/wp-content/uploads/2023/07/image-30.png)Do not use a line-of-business app in Intune. While this option allows you to select .apk files and configure the app successfully in Intune, when deployed to devices, it won’t get installed and won’t report any status to Intune. You must use **Store App > Managed Google Play App** to deploy a custom .apk application to Android devices. ## Managed Google Play private (LOB) app publishing directly in the Microsoft Intune admin center - Sign in to the [Microsoft Intune admin center](https://endpoint.microsoft.com/#home). - Select **Apps > All apps > Add**. - In the Select app type pane, under the available Store app types, select **Managed Google Play app**. ![Intune | Adnroid APK Deploy](https://techuisitive.com/wp-content/uploads/2023/07/image-31.png)- Select Private apps (next to the lock icon) in the Google Play window. ![Intune | Managed Google Play App | Android APK](https://techuisitive.com/wp-content/uploads/2023/07/image-32.png)- Click the “+” button at the lower right to add a new app. ![Intune | Upload private android apk](https://techuisitive.com/wp-content/uploads/2023/07/image-33.png)- Add an app Title and click Upload APK add the APK app package. - Click Create. - Close the Managed Google Play pane if you are done adding apps. - Click Sync on the App app pane to sync with the Managed Google Play service. Once the sync completes app will be available in all Apps , you are now ready to deploy these .apk files to android devices More details at ## Related Posts - [How to deploy Android APK apps in Microsoft Intune](https://techuisitive.com/how-to-deploy-android-apk-apps-in-microsoft-intune/ "How to deploy Android .APK Apps in Microsoft Intune") - [How to Enroll Android Mobile Device to Microsoft Intune](https://techuisitive.com/how-to-enroll-android-mobile-device-to-microsoft-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Android, iOS and Android Apps --- ### [How to Block Built-in Apps on iOS Using Intune](https://techuisitive.com/how-to-block-built-in-apps-on-ios-using-intune/) **Published:** July 15, 2024 **Author:** Equebal Ahmad **Content:** [Microsoft Intune](https://techuisitive.com/microsoft-intune/) includes built-in settings to configure different Apple features on iOS and iPadOS devices. One such configuration is to block built-in apps on iPhone & iPad. You can configure the policy to block built-in apps through the Microsoft Intune device restriction policy. This feature applies to iOS/iPadOS versions below. - iOS 9.3 and newer - iPadOS 13.0 and newer Most of these settings are available for Automated Device Enrollment (Supervised) devices. ## How to Block Built-In Apps on iOS Devices The built-in apps on iOS devices can be blocked using Microsoft Intune device restriction profiles. Follow the steps below to create a device restriction policy to block apps on iOS ( iPhone & iPad ) devices. - On the Intune admin center, navigate to **Devices > iOS/iPadOS > Configuration Profiles** - Click on **Create** and select **New policy**. - On the **Create a Profile** window, select **Template** under Profile type, select **Device restrictions** template, and click on **Create**. - Provide Policy Name and Description on the **Basic** page. - Click on **Next** to go to the Configuration Settings page. Expand **Built-in Apps**. ![Block Built-in Apps on iOS](https://techuisitive.com/wp-content/uploads/2024/03/image.png)- You can now see the list of built-in apps that can be blocked. The default settings are not configured. You can simply set the toggle switch to Yes to block an app. There are different settings available for different types of enrollment profiles. However, most of the settings are available for Automated Device Enrollment profiles. - We have turned on the following settings for Automated device enrollment. - Block Apple News - Block Podcasts - Block iTunes Store ![Block built-in apps on iOS](https://techuisitive.com/wp-content/uploads/2024/01/image-42-1024x633.png)- Once you have added all iOS apps that you want to block on iPhone or iPad, click **Next** to go Assignment page. - On the Assignment page, assign the policy to the Entra ID group. You can also use [Intune assignment filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/ "Intune Filters – Assign Microsoft Store App policy using Filters") to narrow down policy assignment scope. - On the Scope tag page, add the Scope tags if required, else click on Next to move to the Review + Create page. - On the **Review + create** page, review the details and click on the Create button to complete policy creation. - Check the notification in the Notification area to ensure the policy was successfully created. ## End User Experience Once blocked, the app will no longer be visible on the home screen and settings app. ## Related Posts - [Deny M365 Apps access from Untrusted Locations](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/ "Deny M365 Apps access from Untrusted Locations") - [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/ "How to Restrict Website Access Using Web Content Filter | Intune") - [Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/ "Fix Something went wrong – 2002 error on iOS | Intune") - [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/ "Configure Home Screen Layout on iOS using Intune") - [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) - [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) - [Create ADE Enrollment Profile in Microsoft Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune Guides, Intune iOS, Windows Experience --- ### [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) **Published:** May 24, 2024 **Author:** Equebal Ahmad **Content:** [Microsoft Intune](https://techuisitive.com/microsoft-intune/) includes some built-in settings to configure different Apple features on iOS/iPadOS devices. One such setting is to configure lock screen messages on iPhones & iPads. You can configure the lock screen message through Device feature profiles. This feature applies to below iOS/iPadOS versions. - iOS 9.3 and newer - iPadOS 13.0 and newer These settings are available for [**Automated Device Enrollmen**t](https://techuisitive.com/create-ade-enrollment-profile-in-intune/ "Create ADE Enrollment Profile in Intune") (Supervised) devices. ![IOS Lock screen message / iPhone lock screen message / iPad lock screen message](https://techuisitive.com/wp-content/uploads/2024/01/image-38.png)*Figure: Lock Screen message on iPad* ## Create a Lock Screen Policy for IOS/iPadOS Follow the below steps to create a device feature profile to apply the lock screen policy on iOS devices (iPhone / iPad). - On the Intune Admin Center, navigate to **Devices > iOS/iPadOS > Configuration Profiles** - Click on **Create > New Policy** and select the following - **Profile type:** Template - **Profile name:** Device features - Click on **Create** - On the profile **Basics** page, enter the policy name, and description and click on **Next** - On the Configuration settings page, expand the **Lock Screen Message** and provide the following details. - “If lost, Return to…” Message: The message entered here is displayed on the lock screen. You can enter the information that may help identify the owner if the device is lost. - **Asset tag information:** Enter asset details such as User name or device serial number. You can use the supported variables as well. For example, the variable `{{UserId}}` shows the Intune user ID. You can find all supported variables on Microsoft documentation [here](https://learn.microsoft.com/en-us/mem/intune/configuration/ios-device-features-settings#lock-screen-message "here"). - Once you configured the settings, click on **Next and assign the policy to the** appropriate Entra ID group. - Review & create the policy. ![Device features - iOS Lock screen message](https://techuisitive.com/wp-content/uploads/2024/01/image-33-1024x596.png) ## Related Posts - [Deny M365 Apps access from Untrusted Locations](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/ "Deny M365 Apps access from Untrusted Locations") - [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/ "How to Restrict Website Access Using Web Content Filter | Intune") - [Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/ "Fix Something went wrong – 2002 error on iOS | Intune") - [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/ "Configure Home Screen Layout on iOS using Intune") - [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) - [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) - [Create ADE Enrollment Profile in Microsoft Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Mac OS / iOS, Microsoft Intune **Tags:** Intune iOS, User Experience --- ### [Create ADE Enrollment Profile in Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) **Published:** March 26, 2024 **Author:** Equebal Ahmad **Content:** The corporate-owned devices purchased through Apple Business Manager or Apple School Manager can be enrolled in [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") via Apple automated device enrollment. An ADE enrollment profile is required to enroll the device. A device enrollment profile defines the settings applied to a group of devices during enrollment. This article will demonstrate how to create an Apple ADE profile. This article assumes that you already have ADE prerequisites configured in your Intune tenants. These prerequisites include: - Apple Automated Device Enrollment Token configured and active - Apple MDM Push Notification Certificates (APNs) configured. ## Create iOS / iPadOS ADE Enrollment Profile Follow the below steps to create an Automated device enrollment profile for iOS and iPadOS devices. - Open **the** Intune admin center and navigate to **Devices > iOS/iPadOS > iOS/iPadOS enrollment** blade. - Click on **Enrollment Program tokens** ![ADE Enrollment Profile](https://techuisitive.com/wp-content/uploads/2023/12/image-11-1024x472.png)- On the **Enrollment program tokens** page, click on **Token name**. ![Intune | Apple enrollment program token](https://techuisitive.com/wp-content/uploads/2023/12/image-13-1024x322.png)- Click on the **Profiles > Create profile** and select **iOS/iPadOS** ![Intune Apple MDM profile](https://techuisitive.com/wp-content/uploads/2023/12/image-15-1024x229.png)- On the **Create profile > Basics page**, provide the following details. - **Name:** Enter a suitable name for the enrolment profile - **Description:** Enter the brief description to describe the purpose of the profile ![Intune MDM iOS ADE profile](https://techuisitive.com/wp-content/uploads/2023/12/image-16.png)On the **Management Settings** page, provide the following details. - **User affinity**: Enroll with User Affinity - **Authentication Method**: Setup Assistant with modern authentication - **Install Company portal with VPP:** Select the VPP token that you want to use if it’s not selected automatically. - **Supervised**: Yes - **Locked Enrollment:** Yes - **Sync with computers**: Allow All ![Apple MDM Intune ADE | Management Settings](https://techuisitive.com/wp-content/uploads/2023/12/image-20.png) Scroll down to update the remaining settings. - **Await final configuration**: No - **Apply device name template (supervised only)** : Yes - **Device Name Template**: Update as per your organization’s naming convention. The {{DEVICETYPE}} and {{SERIAL}} variable inserts the device type (e.g. iPad or iPhone) and serial number of the device. ![ADE device name template](https://techuisitive.com/wp-content/uploads/2023/12/image-19-1024x533.png)On the **Setup Assistant** page, show or hide the settings as per your requirements. This will only show/hide the setting during device enrollment. If you want to hide specific settings on a device then you need to use a device restriction policy. ![ADE | Setup Assistant](https://techuisitive.com/wp-content/uploads/2023/12/image-21.png)On the **Review + create** page, review the details and click on the **Create** button to create the enrollment profile. ![Intune ADE enrollment profile | Review + create.](https://techuisitive.com/wp-content/uploads/2023/12/image-22.png)You can now see the enrollment profile under the profile blade. ![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABmkAAAEhCAYAAACUS0TMAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAHbcSURBVHhe7d0LfFXVnff/L8WKpcVWDRbGVDTRjqBto/gIRXqQaqQz4KVAW4z0kQwtF/2rtQNSh8RbYBThaUWrgC2NPsVIpyT1gjPF2GKOSKGPSOwoMMVEsaHQErVqRVGR/157r33OPvdzcjtJ+Lx5bXL2/bb29bfXWn0OOQQAAAAAAAAAAIAu9TH7FwAAAAAAAAAAAF2IIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAIA8I0gAAAAAAAAAAAOQBQRoAAAAAAAAAAIA8IEgDAAAAAAAAAACQBwRpAAAAAAAAAAAA8oAgDQAAAAAAAAAAQB4QpAEAAAAAAAAAAMgDgjQAAAAAAAAAAAB50OeQw/7O2Ssvv6zfPPmEXn/9ddsFQHdz7LHH6vwLLtRJJ59suwAAAAAAAAAAuoN2BWlW/mSFxpz3VZ1y6qm2C4Du5qWdO9Xw1G81/bszbRcAAAAAAAAAQHfQruLOTA4aAjRA92aOUXK7AQAAAAAAAED3Q500AAAAAAAAAAAAeUCQBgAy+PUf/+42QEc7ePCgmpqa9MQTT+j3v/+97Spt3rzZ7dbc3OwOAwAAAAAAgN6JIA0AZECQBp3hww8/1EMPPaRt27bpxBNP1K5du7Rv3z799a9/1auvvup2e/HFF7V69Wp98MEHdiwAAAAAAAD0JgRpAADIgyOOOEKf/OQnVVpaqtNOO00jRozQb3/7W61fv979bbpdcMEFOvLII/Xxj3/cjgUAAAAAAIDepEuDNOGX9+vrP39VI+5t1pl3NemqR/bo1b/xdTAA4PDx97//XYcOHXJ/f/azn3Vzzhgm58x5552nsWPHur8N02/gwIHubzOOGRcAAAAAAAC9R5cFaa5+dI9ub9ineWMGavOVRfr9VUW68NRP6WvVu1T34lt2qGzs0eOV39V3vxttbly7x/brOnvW3qjvVj7uLA0AtM1rj16t4WedGWiu1sN/sT0PM39YarfB1Q/rJXe7+NviNT189Zm65tHX3OF6uo8++khr1651izBraGjQ3r173WLPfCZoc/zxx9s2r0i01tZWd1gzzuOPP+5OI1sHDhzQo48+qvvvvz/SBOu+6Qz19fU5zePPf/6zVq1a5S7bH//4R9u1bcz4v/jFL/T222/bLvkVXDezTcxvf9t0t2UFAAAAAAD50SVBmqea39ELfzmgx/73iRp54ifcbh/v20eXDBug33znJH3vsb06cND7qji957Tsuzdq84hb9ZOf/MQ2szV4N6ESAD2JF3i4sP58PfHcVm3xm5+drJc763TW+EM3ANIdQx0mWFX+0k3etrj7Up1y8d3O9rhbl37WDtCL/OlPf3KLL/v617+uoqIiDR8+3P3re+utt/S3v/3NtknFxcU6++yz3WHMOKbYs5aWFts3PfPy/+GHH9agQYM0bdo0t5k0aVLW9duYIIIJ8JhAT2cxy/j000/rnHPOcZfv85//vO3TMbpiHVKJXzfzd+rUqe5fAAAAAAAAX5cEaR56/k19f/Rx6vuxPrZL1OABR2j8aQP0yuvv2y5pbN2s53SWLp0w2HYwztLsmWfZ3wC6yv533tGv6upsm/Tmm29q7WOP2Tak84elF6jqlAfcgMRxtpur5Pu6rsT+PtycUhS7LXqpnTt3unXNHHXUUfrc5z6nIUOGuN3N8fPLX/7SzYVi6qUxv00346STTnKHNeOYIEa2uU327PEifkOHDnX/GgMGDNC5555r27oHUzfPpz71KdvWu/TmdQMAAAAAAB2jS4I0f2x9X6OG9Ldtic753Cf02v6Dti2NwSdqsPZoz17bnszex3VjqqLQ4vp9d8Vztodj6zKn2zI95/4N9jO5dwLjxBdx5g+frB/QS7333nuqqJivc0Z4X4SbejJuuvFGp32E2440/vKwfvrAaFVO+aLtkMwf9KOzztSPGr2/w8/6odPF9vGLBYvrbsT2ixad5nb/l59Lz9yiC02/pdGx0k0vhsmJY/o7y39NknkYbvFtVz+sP9hi3CJFlMWM4zSBHD1m/hfevEF64IroOP687DAJ4qbXk4pCM0ESE6gxRZj5TJFmJjgzatQoN6fLxIkTNXr0aP3mN7/RwYPRa6Opn6apqUlHH3207ZKeCQ6YemzSFacVLI4rWBSaWZ6NGzfq9ddf10MPPeS2p2L6+eMnGy7VPEz3Rx55xF2+J554IlL0lwlC+cMGhzfM9OPnYfonm6/plmkd/OLg/Gn48wwOa5bJLNvWrVvdv8EiyoLjmMYPoCVbN1O0nfmbLsgWnF5wPgAAAAAAoPfqkiBN/4/30b53omXux3tt/4du8WcZDRqvS8/eo4crv6tlW223IBOEqdysEVWBotAeuTEy7J5nX43pd9azy+Km85yW/X6E19/NnWMCNMu055Jo8Wqzg++g9z6sG/3hzfSc9mV5qB8H6Ervv/++c5xV6F/nzNEJJxRq//79uvmmm/Rv8+fH1KXRk2x69V3d/ORfUzabXt3vNsn6+Y2ZRlb2NOuZc8/XV7IoymvVvzyp892i0L4vE9IxAY1yPRApHu2Jm19WeSTg8Qf9JqafVLXA6/fFa01Rat+WzrVFil3rBYjSTy+Zn6t8gXSTHd4Uz1b1T3H16Dxzi36qm93+d118nBdw+aff6Kv/ZcdxmupTbtGFdj5m2Z64ebR0hbcc7jjpmABNzPQe0Mk3X6AfNdr+Gdx7z91qbm6ybemZAMdP7luunVnmXMnGiBEj3ObJJ5/Uvn373G4m+GKCNyeccILbbgwePNjt5g/zl7/8xc1hM3LkyKyLy/qHf/gHHXfccW6QIFlgwAQSwuGwvvrVr0aKQnv55ZfdYUtLS92g0bHHHqvLLrvMbU/GBBXeffdddxgzDZMzaPfu3bZv+nmY5bvkkkvc9bzwwgv1rW99K7LOZjgzvOne3NzsTidX2a6DsW3bNnfZzTzNsGadgoEawyzzP//zP7vLaYqsM8Edw4zjL6sJ9qRat09+8pPu8Kn48/Ond/LJJ2v9+vV5KaoNAAAAAAB0nS4J0lw89Gj94g9v2bZEq59/S6ccd6RtS++smT/RT648S8/da3Kv3KjHA7lqnnvkYemS2Ro/yHYwRaNdMljP/d7LFTN4Qmy/EWdLe2LqsxnsDB8tOm3P2of13NmzdWugeLWzJox3hvIFi1rz5rVn83PkpkGvZQI0t9x8k6793vciAZpbb7lF18+b12MDNF3ttVdfzrpor3NvvsINzrj+YnLgfFvVNsBiHHfxdzX1md/oaTdI8kVdF+w34nyd+0yzoq/L42ScXjKjVVkRKKKt5ApVnrtBv90cDOt8W9+JBFpe08Mrf+6sx80x9ct88doHMswntT+svkWKmd4X9b9vHq1VDSnz3cT46vkX6Ef/Z4lefrnZdknOVM6/Yvm9euONN3TSySfbrh2jT58+bmOCQIb/NxmzHD5z/JlgTbBbJn6gwuQoMblZgsGOF1980a3rxgQUDBNQMIGBXbt2ue2ZmGm99tprbp05/fr1c7uZ4tiCwaa2zMMUx2aGM0yQqX///m5uvc5kltmvD8esiymSzuTACeZkMcvtL5dZfhPIMUEzn1lHM41st1+Q2ZamPqLg9Ewxdab+ILONAQAAAABA79UlQZrysz+jnz37hhY1tOrAh9GXUa3vHNTkB/+kr33+UzrmE31t1yycOdvNvXLrJXJz1XhFmu3Rnhbn/0dujBY/5jQ3PuL0a3H6eWPquRXRfsuetR0jBmtwJIizR89t3qPBJwTrv4kzyBS/Bhw+Hrj/fn3tn/7JDdAY9957j6Z+e2qPD9CMPPETuvmC41M2I0/s7zbJ+vmNmUbWXmpOk1sl6uQTA6EckwPH5GQJFPM1/KwrtEob9LJ/gjO5TPx+/3SLM3wa2UwvwckqiskBdJyKTrE/fecWKfqKfrdedhYiZj1cJ+jkc9PNJ5XX1PyS9MzNFwSW2RaX5mzTbJx22lBddfU1+uGSxXpp507bNZYJgtz747vdl+bXfX+OW1l/R9m0aZPbnH/++ZHj5rOf/aw7L5OjxmeKQzOBCdPPMH/HjRvnFne2bt06t1u2TODA5Mwwf02uGpPbw+TOMEEGk4MkWFyXaTfds8m9YZbPBJv8wEW8ts7DdDe5VMywppgyEyzpbJ/+9KftL48pKs7UJxP0mc98xv6S/va3v+kTn/iEm6MmyAyT7fYLMtvSBIRqa2sj28n8Nt06O0AFAAAAAADyq9ODNAc/OqRv/0eLzh3SX7//07satPB/NKPuz5rwwKv60l0v6fTP9lNVadte8A6ecKubq2bPIw/Lr0FmcKBoskhTZXK/eHXLLJMX4DHN7LPtSGmkDdIAh5krpk3T2sce05/+9Ce3/corr9ID9z/gft2P7Bx34slSuhwuaX1b1bbIsGBzXYmtDyZYDNh/3aTM1cOnnl7HGa2TO/g0eu7NTyYs85a7L7V9M/MDNT/64RLt2LHddvX4AZr97+7v8ACNYV66n3rqqSooKLBdvMrlTZFYGzZs0K9//Wu38YsI69s3+gGDCdSYQEu2ddLEM8WkmVw1prgxP4fIsGHDIsVr+c3FF18cyRmTSbJARbxc5mFylPzyl7/UoEGD3OFM0WOmuLLuyKx7ttspG2Z6fjFvwcbP4QMAAAAAAHqnTg3SmADNZatbZEpy+fk3T1Dt1M9p55xTVVbyaf344sHafcM/6pYLjlefLKqjSWmwn5tlsAYXKq74soCtm/XcoEt1a6R4sky86flFpQGQ+zL2llur9OO773IDNaYYoptuvllLFi8mUJMtt4iwn+unuVZ2P7hI5+plNSfdzK/p6foNmvqzu2OKFUsr7fSy5eVsScwp4/NyzMQWh2aYHDZtCd54OXeeebltIa4gE6i5+trv6a47f6QXX3jB7fbRwYOdGqAxzAv3HTt26L333tOrr76qV155xe1ucnJMnDjRDaKYIq/Mbz93hxnGHG9mnP/5n/9p10t7P4eICS6YoMCbb75p++TOTMsUeRgsjsvPPWO0ZR4tLS1uMCpVvTvxOV6M9qxDKib3itn/qQJQJsdMfHFohp/DJtfgjdmWpti7+OkBAAAAAIDer9OCNCZAM+WhFrd4s4emFKrvx7xITMEn++q8ok/qpGPa8PJr6zJbtFmUqYdmz9kjZEIvZ11yqQY/u0zLtnr9XM44brsJ5uzdrOf8OmxM94TizmIlm95zax+nzhkc1o466ig3UHPnj37ovjg2LxdNoOb2224jUJOV43RpxU2SKbJraVw9Ko0/TF0B/mcv1Xeu2KCqBcGK/V/Tw0tNuxe8iNbL4nRfkKS4s2AOnrTTS+XnKg8s82uP3qwq3aT/nTLnjbOu07+tZ5z08XAgafxh6RVadcV3sw8oBXxxyk0694ErYrdTuu2WhgnUXPO963T33Uv1hz88r7uW3tmpARrjc5/7nFu3zK9+9Ss3R8vWrVvdIsx8JpdMsFitl156Sc8++6x7rD355JPucg0cOND2Tc9UYG+KNgsydcSYeZgiyk4//XT3mDXD+czvYLsJuJjlTcavL8ZM0/f888/HFE+WzTyC4oMf8dMz/c30/Lp1zHR2704ftEu3Dj4zHX+aZt5mv5h6aVIFW4YMGeIGY0zRdT4zfnNzs7vOuTL12Zjtafa1X1Sa+fvMM8/kXHQaAAAAAADoWTolSOMHaP7+/kdu7hk/QNNug0+U4uqccYsv83PHDBqvW688S8/dG+3/3boTdemZXr/Ztg4bt/vvR2Qu7sxMr+pS7QlMb9nuwdRDg8OeH6jZsmWL224CNTfedJP7ghFZ+Oyluuu5J1X50hUxdasMX1mUJuBhKtx3xtEtujAyzgV6eYxXkb9bGf8D/vRulqbHFXdmc/C4ddDYQEu66SX3bVWPedIOa+qCOVnVd6cb3lHyfW352cmq+id/HmeqXA9oy7VftAPkyGy7n31bq/4lOr1M2y0dE6j53nXf191L79T7H7zfqQEa42Mf+5gmTJigKVOmaMyYMW6ukeD8TAAiGOw0/UxxXyaHjRnvoosusn0yM8elCT74dZyYxigtLXX/msCAybGycePGSH+Ty8cEIAw/EGHqRqmvr3e7BZkAhqknxwRBgtM3lfD7Ms0jnsklZNbXr5vFVJwfLO7M9DfbzNStY/qbSvpNcWqpZFoH38knn+yev8w0zbCmPV2OpWTr/tvf/lahUMhd57Yw4xqmHh4zPfPXBORyzZUDAAAAAAB6lj6HTPkabbR40W2aO+8G2xblB2jqpn5OR/btoAANgDZLdawiO99b62XBu3PCIPfvYanxhxr+L1L1c99XG8Mr3VpzU5MKP+dcszLUr9LR6urqNH78ePdFvCn+7He/+53b3QRlTK4bk4vikUce0Te/+U23OzqW2b7r1q1z68BJVcQaAAAAAABAZ+qUnDRXjzpWj3ybAA0AoGcoKi7u8gCNySVi6nQxuUJMjhcToPnqV7+qsWPHusVomfpnTD8z3MGDB+1YAAAAAAAA6E06JUhz7pD+HVfEGQDk2dc+/ym3ATqSKcrssssuc4vreuWVV1RUVOQWb3X88cfrxBNPdIvyMvWbmKLR+vbta8cCAAAAAABAb9IpxZ0B6F44VgEAAAAAAACg++mUnDQAAAAAAAAAAABIjyANAAAAAAAAAABAHrQrSHPsscfqpZ07bRuA7sgco+ZYBQAAAAAAAAB0L+2qk+aVl1/Wb558Qq+//rrtAqC7MQGa8y+4UCedfLLtAgAAAAAAAADoDtoVpAEAAAAAAAAAAEDbUCcNAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkQZ9DDvsbAHqd7du3218AAAAAAAAAkF9Dhw61vzwEaQAAAAAAAAAAAPKA4s4AAAAAAAAAAADygCANAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAe9DnksL87xIcfSc1/O6iX3jio/h+XvjDwCB33CWJBAAAAAAAAAAAAQR0WpDHBmf9sOqA1Ow7o3Q9jJ3nacX016oQjdf5JH9eRffvYrgAAAAAAAAAAAIevDgnS/Pntj3TrM+9o3/6DTpsJwhxy/u/j/B/795Rj+urfRn1SR/cjUAMAAAAAAAAAAA5v7S6H7G/vfaSKhrf057c+0PsffqQPPjzo/j3644f06SPl/Pbazd8X972vf33yTf31nY/s2G3VqtqZp2nY0EAzc43TNT9a62Y6yzBTtXttBwAAAAAAAAAAgAzalZPm3Q8O6bon39Suv33oTKmPzKRMjhmTU+ahrx9rOmnaI2/oryaHTaD/iBM+rptDR9up5GjvGs0aW6Hw9NXaNqfEdpQal5ymspXlqtk+T9GuAAAAAAAAAAAA3VO7ctL8V9O72vna+3r/oJdT5gPz9+BB/e29D7V+13tq2HVA+/Z/mND/6Vff00uvf2inkotW1d5UIS3cEBOgMUrm7FDN9GqVLWm0XQAAAAAAAAAAALqvdgVpnv/L+/rg4CE3+BL8++4HH+nnf3hHDzz/tv7+vukW29/8/cnWv9up5GDvU6oPl2vWxALbIVbJ1AUKrVym2r1ecWiz6mILQHOLJYsUixZXZFqwuLQti5xui9To/nX63fIjzUooziwwD39428cwOXsi047088ZZvMVt8bjjBqedZBgAAAAAAAAAANDrtCtIs33f+zF1zgT/rpxwnFZeVKAPDybvv+XP79qp5GB3k8KhYhXa1gSDzlNpqEHNuws0ZtwYhdc9FQ28OL8a1jWofMZkFbiBkNGqH7dB27bvcJuaUysUismFU62y9eO8/jd9251u/cZA0CdNwMgtek2rI9MOL2xWmRsE8paren10Pq27mp3/zTJ77VKLmsNjVHSCbQUAAAAAAAAAAL1Su4I0fXRIH37kNAcP6aD796NIe19nyh/rIx08lLx/W2bsBjROPUXJ89HEKhhVqlC4Xg1+DhUbVCkd7vzeslKVWqAFgQCLlwtnXSA3zBhVTfWLVEsM+rRurFd4+rjE+m/2rtFyUzdOoDi2gomzVW6XpWBIkRSZjwkcSeXTA4GbLetUHSrVmEFeKwAAAAAAAAAA6J3aFaTpf4S8wMtBr74Z77fX7kvV/xPOuG2y86VIoCQtm6vGz/0SDKq4wZ5whUKR4sicZmyFwmpWU6TYsSIVBwIlsUEfmytnbEKIxsvtY3LhBKc9dIrTxeaWGT5O5f58TOBIpSqf6kzbrpdZttC487IKRAEAAAAAAAAAgJ6rnUGaPjK5YkzumIP2r9/uS9X/y4VH2SGy5wVKmtRi2xMEc8v4uV+azdBJgiqhBQrb4siizQpNSpWDJVKUmvM7Zj7JlKsmYdo7NNcdvkSl073gkQkcyQRkBp2iYjcA5C1n8RBCNAAAAAAAAAAA9HbtCtKMOekTbq4YkzvmA/vXb/f5uWfi+59f9Ak7RA7cQEm1lpvK+pNoXFURUwSZG9QxRYu5OVYWqNwGVdwix9IFe5KK1ifjBlcWTk8s6sw4oVihmBw5iQqLvOBRS7NUOsoEZLzATfNuUx9NuuAPAAAAAAAAAADoLdoVpJl8+gAVHfNx+bljgn998d3N368M+YT+1wm556QxgZJJtyyQ5o/WrLhATaOprD+uLhgNmqxZ06u1/CabY8V21vDpqgpVq2xJtAYaZwpaHNOeyK1bZuUyVazzgytJuPNsUOVNawLFsrWqdkm03QseTXGWN1qkWsnYclVPnaLqZPXcAAAAAAAAAACAXqddQZqP9ZFu+WqB+vbxizP7yPnrNM7fb/5it77lNO9/cNBt9/uf9OkjdOc/H2+n0AaDJmv59g0qXTc6UOfLaSrTam3bPi8hwGGCH+FwfFClQJNWrFb5yimBaSxT0dRM4REvx0tY6Sv2L5mzQVUK1nkzWs1jJ0eDRG6OIOdvMCDj5sBR8npuAAAAAAAAAABAr9PnkMP+brPGPe9pWt0evfHuQdsluWP791XdZYU6+ZiP2y4AAAAAAAAAAACHpw4J0hi7/vaByv5jt/tXMpPsE/l71BF99N3/dYyuGnGMPnVkuzLvAAAAAAAAAAAA9AodFjEZ8pmPK/ydIXqy/ETdc9Fg3fTVAv2ffxqk/7ric3rxmmLN+8pxBGgA9B5bFgWKS4w28fVltV2jFptpZqgrqzdrrZupYTOD9Xuh7bz0tHiLbXXT7yKn6+HL1GXnHrdOGnvK/e1vj7htlU9712hWh55X2qJVtTPTbI8OSkvB/ZG3teW46OYypEV0qtyO0djzaI+7nsecC7x0l9152BvWvyf0mpmq3Wt7t4u9L3SaWXVPxd0jdt11y6SDnK5J9jpmlntxfddf03rHvWQPP546SM5pDz2MPccdLs++ye7x83y+RA9j7lU64FrgXlM67F4lT9xjp3c8w3Vo1KTvx/rotIH9dMnQAfru2cfoW184Wl/47FHqd4TJVQMAvUxogcLbd2hbpFmt4vmjO+jBqURzzTTn9NZ6qsyNeA+/GUA75Pdlq7kZLdtpj98Vk3XeHHP8JtZrl3duPXw7tHxisF693id+f3TN2vLCH9ngWmXk5xjtucpXmWuKbVYVqXJse9OQOV9NUdPCDe40l088r4fcIzrHz9gKFdvtMbe0s69pHK9dg+3cO3Xifk32MjmhW29/9o2TcI/fgefLDnp5j47jBkK6aQCyYOIKJ82t0KQ09a6j65C1BQA6jLm53KAqVaiCr16A7u3UU3jR2J2wP4DujWO0bYbPU830BtVvbP99YfGQnrgHxqjoBPsTAJAG50vgcEeQBgA6VIEmzShXeN1T0a9XAlmXvWIqvD5u0SHxX1REithIVryG+cIpOp2YL2Tc8aL9Yr4OT9cvwP3Cw5lmo/lrh/XmH5xv4Asrd73iv7iK+wor2bzdblNUrQZVjjXdM2RNDU4j7qugSPErbhOdb/pt64kdN/0ypJqP/zW+2U7BYTJmTU+5TzJPL34/RfrFpbP4bZWaP89G9683vl3HNNs+Vbo2/GVsTTa+O95oVYal6qmmX3wasvz9FTOfZNveX+5oP3f+kXFil81s19D8BmnllEi/yPLaYRKk3F9JxO+HmHToLXOkX2Seqbp7x17q49nZPqY9bjpmndKmx7TrE7sss+pabPcMUu4nT+wxFHscxu8PV/x2jNk//nbxz005HteZ0mDMvOOnkWJfueMkX++E7W/FLmt2aTur9XP52yh+f8YtS5rtnLDsdthgeokZJm5a0XFTr0/Hp0U/TfhNcBv5y5Hl+dpdthTXqjTbLZnYc5K//kmOb7uMMd3i5xU4p8Sf66LjxW672OVL3S/ZcpptldU5M+ZclEp0H8RIO26adXH3kbNfYrZRcJ9ne66I3w8dL9xs0m/q5Ynfl9FtZIaNP1+l2I5BaY6t5OkxuZjtlPQr4BT7x90n8cePv/7uiFnsPyPN/g9yp5Xm3jK4PeKnEXeMpd2uRspt669f7DLHH5dJz4Xxx3nK4yFefJoyjbfuMfs5ft+lXOdo2kp6nsy0nSPi9lvMcJm2kydz2gtqy3Zo5zLG77O029jZ11tMe+z2ij0PJZt/LuvjSJk2O2i/ppy+I0U/d35Tq52TYIVCpp+zzMm6BZfR5U7PWY6Y7Ri/XLH7xz+2ossV3H5OE7+9IuLSQuT4S54OIsvoS7ddHPHnd6+/P23np7uOGc6XRqY050i+bT3xy5GwHhFx+8Jn1jNwbopNv7HL6vaLWz53/n43f//62y7lvomfT/CaFbd/Y9KHvw7B8210vWKmmWo7BqYdXDd3PZztEPssHpeGIsvidU/6rBM/Tqbzfkw6iz8WPLHLbYdx0038tT66LSL7wvZxpUlrSefhymF9YtYluE2cqdjtm/Q9gi9m+Zx122279waHAAC5e/b2Q0Nn/PLQPtsaY88vD8087fZDWyO/Zxxas8ft49h66I7T/vHQHc86P800/OGsrYv/8dDMWjPVfYfWzPB/G9540XanS62df/x0gvOMn7/TvsbMO4l9tTOc6QTm4U73H50mOr5Zvsh6J6ybYZYzm3kHhkvBX56hi/01i98GTnuknx3eX7a029b7HZ1u3LgJ0szH+d/sJ7Oc7j413HmnWbd0+yuL6SXsJyPJPGP2ld12sdP0l8GfZ3R8d1xn+PjxI/NM2Pex08+877x5RpYnGXcZg8vgiFnPxOU2YtfbiJ+3Xb6U+zTdtnIkTfdR+2pvT7ld4tOdfwyn6h4/fuJ+9vpHlz2L9Jh2fez48dsmOL147vSCy+CIm2f8+sVub9se6J+4nnYacfso2TGebj6xkqTBhHWJ3x5eezAtReeZ2M9bztj1iHL6pVxWO99k2yDr9fO3UXAaXrfIMmbazqZ/cPp2+yQ9jtOeE5Kvjze9DkyL7vix/b1x4s91gWGSbINYSfZhpu0WL349n3Wuhe64wW3kC2xTI2GdnP61dm1i1s3hDOtdY71pJE+nsb+NlPcSkeW088qU9sz4kW6x6xYcPtm4Zplijx1f+nXxljm47e0+jiyrtxwx65UwjCN+O8dsi8RlSM0bNtk+9cZPtjx2nWK2iTdcdJ7x041fpri0FL8vg8dWmv0cL2G57PaOX67gtolNX2a5gsdKsuUMzsObXnT8TNOPFz8/ZwrucRK/TIFpBreNK24Z46Xbtnbc4PnBm39sWkp+LoztFrvtY5cp9hjy5xk/D6fx1zk+fadd5+j4sfspfvi4dYjnzOOOtOnCzCM6jdjtZIdPm/bitW07tGcZ093vJcwrsjxx6xiZn51+e/Zr2rTZAfs1Znpee+S5Lu28HaZ/cH8aCd28ZYzsY3eazjJHhrHrENlm8e1OF3cf+esYNz3Tbq+f8eL3Rfx9eOJ2il/O1Osen26i2y0uzbjtifOJ9HenGxw+9fok294Jx5SdfqpjKjY9esw0vOETt3388sVvU8Odpt/N379xw8RLWG7/mpWwPeK3tV3GmG3qd4vbjjHrknnd/HQWs+2cYVKfT+w4MevqzSc4jWTbLMLdXonpI7htks7T7Z84L2+d7LZKmoaTp7XU80jsFz2OEm1dnOmYCU4rLq0mWz53vwam2YORkwYAOkWzmswXqKsqpIULA2V8lqh84RhVr2+Uho9TuapVH/kyo1H1K8eodFRicRatdctUPX11TLm0JRNNufCtqr2vWuWrAvVpDJqsWTFFaxSp2J+/02/ScPs7mdACLfDnMXy6qkJOp8Dyl0xdoFC4SVl+W+/IYd5JlasmUjaxt+2iuZRKNDdQbnHBqNLosqXbtnvXaPnK4HRNWayzVR6uV0PSr0nTzMfn7Ju5/rq5261BzUm/6MhmfzkyTq9csyJpwZtmcD8ZJXNWp1mnRAn7WWNUdYtf94Dd9u6XwBnSdUSSfWfHz15wGRx2W8Ruq9nR5XD3bdw4Zv+tisvdlrUs91dAwcR5MduldLrUtCs6bKio0P5y+rrHsCdV96hk+9lbtwQp00+G9dmyUpXh+GNjoXseSC/Nfsr5eMs+PYcWTo+uR87zSSW4Ll7OSK1c530lZraPAudIh3usuP0LNGZc8Pzk2LJO1aFSjQmsR1Q255X4tJ37+sWnl+g5NIvtfEKxs0zR6Teud9LO9MCxtPcp1TvppdRJa1mdE4LrY+ffkWnRLEM4mPYd3jjBa4Ej6/N1MtmnzxihYkWO8OHOtTAwbjredt0QWCcnTU4026RR1fOlqvWx28+9xqZNp56U55s2LmcuvLQe3Fap732yWZekx+zOl7w0asWcK5KkLbPtFiRcwzpGa918d37Ra3bc8uTjupXNfk62XG7Rbfa3kdX+ySTN/uuQ6RvB/R08D2Z57orIYts6gucH9zxtnwkikpwLcz6nxIkuk92GwXV2lzF6L5Ld+bo950mHM8+5wf02NtlxmWI7ZZP2UshlO7RrGd321Pd7idcjZ3lucdKubcv2mp79+mSXNtu9X5M+12U57zbJcH7I4j4hWkykM757/Uwu3X147PGZeC+Vet3TXKtzlPp+IAttuM6kvVZ32HXUWaapadbBP06CdeHZa1biMebv//h7vuD51oo/Nk268q8rWa9b7HXdDJPpfBIjp+tbsutE3DNg2nNK4jNK68Z6Z/uNi6bLgJRpLYvzVubnWU/JnOAxcZ5KE85FwfnYYy7wHiLt+bWHI0gDAJ3C3MS2qmmnFJ4/OppV02nc7K7uRdu7oY9c8FO+0GtVw7qGmIteVIuaI0VgRJuylbZoDfeiV60yp1swG2ku2lwGegfMO+ZFQjLOzUIkq+tY54JtO5uLecptu7vJGc5brug287KYp3xQSTkfT7J9E3wxH5Vhf1kZpxezXbxpJu6nQhXl/PAVFHgQi5EpXVvJ9l26m9Wk4pehQMWn2p9WzLZy922S5XZfNucSXPRlt7/iNQaygZthfeaG3dtusVnKU3WPlWo/J0qdftKvT+uu5uT7LaM0+ynn4y379BwzTFuO66RSpXsn5Zvt4xcf4Tfu+cB7aRP7QGsf3GekfkDJ6bzSxvWL344FQ4rsryy2c8xDk3k4L1fpnHHOw5g9lswyuQ942Z0TYtNlR6dFbxkS076XFoPnz9THRzayT58R5qMBm25iii3JyGzzZPNymGtairSaKZ2mPN+0eTlzZNOV//LO+wglyUsUR6Z18STZDnHn++A2TJW23GMj52tUcsF0HVpXqvD2wMsIR8w+7errVrb7OdVyBWS3fzJJvf86ZvqOlOeSLO9nIjJsWyvxmI09NyQ7F+Z0TslGO9e5fedJK1hUjSl+KU7K7ZRF2staputIW5fRSn6/l+p6FNDGa3rq9ckubbZrv6Z8rstu3m2T4fyQdv96L6bd5cpQjFSm+/D4dBB/L5Vy3dNcq3OT5n4gG225zqS5VnfcdTT9tnEDCUn3cfvu+RK6me1gf2a9bsmWK8P5JCi361uq60RAhnNK/DOKebdUPjZ4Z+JLk9YyzCO751mf85wUKRrNK9I1RrLt627/LM6vPRxBGgDoYPE3FKGFG7Rt+47Yxn4RYi5m/gXffKUcGndeyhd66S7M5avipm8a9+uDAk1aYdpXq9i9aMaXR9qZOnfebnmlY+tVut6u7/rYLyjSb9ty1cRvL6cJfo3jyzSftki9v9qq6yuaTJeu8yrpzXz7ZL+/vLKRy7Q6MlzMl5/D57ndwgubvRtcv3zfVN0TdMx+Trs+nVI5ePbHm6et65nrfNogtEDhhHms8F4w268n3RcsgVwmybTtvNLR65dpO9sXHCbYbV40uAEZ8+LQ+0rRPa8GHpLack7o6LTY5hcYOck1fZZorlkvZx83uS9ysnl49aWZV7pzXbp0mvJ8057lzIX31ar38i7diwIr3bq0Vaec56Ji0nU218UuvW7lsJ+zWa7O2D9BnT19R67nruzvCbLVMdf2XHT2PZwbvJiq6DUrWa7fdDrhmIjXvmXMcL/nyHw96vh7lo5Pm0Hpn+s6d94pZDiXF0xc4S5Hzaney/CUHw1mfR+eXNp177C03M7zRM7LkeFa3cnX0Yg08+m0e742rFubzic5Xd+y2f9pzinBD68yPKOkn1eaeWR7HLkfqY1W/Tj/OrQhIQdcJl1zv58fBGkAoEOZbM3OTYz79bT3NUfar4jcLxrNVw3eV8ox2WYjvOkkzz5sXphl8xWU91AeXihVruqg1y6DTlGx/Rmx9yU12Z9RnTBv/2ZxVZoH9VTb1v1aJtuvMLOYT06y3V+5MNNMVqSA+eqmMx78s0jXncb7eibljZn7RVg0y3WE+fKnTQ9JOe4vN8eWc8Od4aHUe2hcrfKVy2IecFN19yTfz63mS6yspV8f9yuxhGz23tdbuQnsp5yON6ON6Tnn+eTO3T4Zvmw3wWFzrk5XjECbzisdtH5uenEfPrPbzv6Xg43OeN7DuRe4adrV6Oxjv4iqtpwTOjotprpOZjhn5KyN6dMYNFnLnWthzfRqLXdfFHnbIFZwHVPNy5HqXOfIJp0aKc83CcuZyJ1HnJzOReb6bPZvhhcF2a5LLpKnreCx0cXydd3KtJ+TLpd3PPk6Y/8Edfb0nTnkeO7KctvmpB3nlDbpins4c989JraIp1xkkfbar53LmPZ+L8X1yP0K3eqga3pUZ6TNVOKf67py3lHJz+XJ7xNK5uxwA9OavzLh3B+U/j48Knq9yLDuaa7VuUl1nshSW68zKa7V2VxHC4vGeB0DWpob7K/spJpPymOsrfd8ge2Qzbolyv18ktv1Lfn+d5fJl/GcEv3wyjyjKFjsaow0aS3L81am48h7Rootxj97WZxfeziCNADQUdyvAqaoaWG0DE+vbNEpsUVKbFkUaDdlbEr1N5ksxKle6CWfTmOdybptv3KZPz/mIthat8hrj5lX7jdH6XkX8WjgpVW1N5lsulbGeWfI0p9W/AU6bt6uFNvWfu1eeVMw67sz/pJkWeGzmU8uMuyvNkk+zcYlU1IWIdNemdN1djI/0FWrLPAVjlu2vxaoPNWXP0n3baMWT81Q7FRKOe6v+IcgZ5sEi7+ISWORgGaq7vFsecLBB0znnFNhiijJWob1MQ9jzjYPvrBz05H9nVqa/ZTT8Wa0MT3nPB9PTi8V3PLbY9fVTV/BdveBdpkq0uYOaMN5pY3rVz018JW8m15ky//Ocjub9QlXqMwZLxK4GVUqzZ/i7ONo8Zy5nxM6Pi0mW4aM54ysBK9VuafP2PNF8EWjTQf3Rfdh7Domm5ezz+ucPZosPTj7t9ase9p0GpdmAueb1MuZhHuuq1C1v61zPheZIkmd/XtTumCmI5tjLlfJphlzbKTn5oLLUHROTrr4upX1frZf3QY/rvHq17EtRmfsn6A2TT+3e8vczl0Zzlttkvs5pb065h4u3XYujHvJ56XnrGWT9tqtncuY9n7P2cYmN3/MC8q46bfxmp5aR6XNNPs1Lo1En+uynHeyF9LtCcJmvE+IO1ekfImb+rroy/VeKrLu6a7VOUk2H3s/kEpw27b5OpPiWp3FddQLdgSOgbhjJCvJ5rPF2X7ONNtzzxe7HeO2Q5vuEbI8nwSLS8vp+pbFM2AW5xS3/hj3GUXJ6wF0pUlraeeR+TjyxQfCcj2/Zzy/9nAEaQCgrRLKEW3SrO07Yr8KcC5my1c5t5DBsmrvK465eXBfeIXTvdBzmOlEiqbwmrJm+zXH8Hne10xjo/1CzeO8BzvnISJmHJMtvyOzvZtK2pwbJG/6zt3LLaudG2Yr7bxtJaWZitpIw61UNTjvGc6y2H6+VNu2ZM4GVSm4/0areWzym9Rs5pOTdPurrUz24lVFMdPs2H0dJ4t0nZ5/A5ipGLxy1YxdF5lHaH5RbOWRSZiv5fxiDbzxpkir2lF8RC77y9kuC4LDrh8XKP6iQMXBNOcWdWVyUqTqbkcLMF8mRbKQm+YmaUGuRYikXR/zdaRfjIXXr35sNlnQ0++nXI43VxvTc27zyTYNBjnjrAieD0yzTEUxD23mgbZB4QwPiW05r+S8HR3lq8ap3h9+bIWKg7l3strOZn2cP8H60mwuypgiJNtyTujotJjkOunWB9KuInySXKtyTJ8FQ4Lr6BXv4N8neJWDR/dpwjomzMsZX943rwnnOufcITeQli6dpj7fpFvOBO65zt8uTtOGc5F5yA47D+XpAyPZHHO5MtN0tvPOwDTTnHe7Qldet7Lfz4nbqUIL44p06oz9E5Tr9Ntwb5nruSvteauNcjyntFtbztcxMm1nZ785zweKnL/XqTSn80M2aa+92rmM7jkwkA5i7vccCfvUmb5zfQqe3ttyTU+r3Wkzw35N91yXad7+C2nTz38JnaxbTjLdJxSqKHied4uiSpbTIfN9eKZ7qXTrnvpanaOENBW9H0iQZNu29TqT/FqdeIwmbDdneWvMC31/eZ1jJOykr9wkmc/UJq8em3bc84UWzpZu8seL/cA2q3VLkPl84lWw721/r9g9M5/sr2/ZPANmPqf4zyjJ6kAOSJPWUs8j++dZL23Y9Ok0FZode++bScLyJZ5fe7I+hxz2NwAAQPewZVGaByr4zFfdoebZnfcyBzkz5VIvL0rzgrtLNGpxe1/0Ap3JnOPvK25nEA0AegjOeV3A3PssU1GHBd25l+pd6bZVtTMzfIQC5Bk5aQAAAHoim9U9bS48dC23OAe/rhYAyXlFU8TkxgKAXotzXldwizsL5vxFO5Fuga5GkAYAAKAHcOtC8LORm8bNSk5OiW5hr6mTzNknU5tV1WFfcAK9jfmK1Zy/vOJF+JIVQK9kch8E79dsbgzOeR3J5HIJbmNbBBs5lToA12ogXyjuDAAAAAAAAAAAIA/ISQMAAAAAAAAAAJAHBGkAAAAAAAAAAADygCANAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAOkSrameepll1rbY9V41aPPQ0DVvSaNs7RmvdTA2bucZZunbYu0azzLI5zeItthsAAAAAAACAdiNIAwBtYoIqM1W717a2W4nmbt+hbXNKbHs+JFsnp9vYChWvcpbNWb65w21nAAAAAAAAAO1GkAYAkMEYFZ1gfwIAAAAAAADoMARpACBXWxZp2NApqlaDKseaYsAWKVhIWeMSr2gw0yQUf+aOG+0fLT4srrg0dzhnuv7wSYtB84pIW7zFG9efZtoi1+LmHzu/uHVyizlLvp7BdTRNsBg0v4i1RvPXn0f8+pjGXafYZac4NQAAAAAAABxOCNIAQK6Gz9O27atVrjGqWm+KAZsnv5Cy8PzRqh/rFQ22bVW50z4/WnyYCVBMlWpMP9OsX6CmqemKTKtW2fpx3rBpikGrnjpfusVO01muYmcZUgVqGtfHzl/+8iVbp0GTtTxhPb2gSplWe9Ow02maGhdgCVdouRa6/ZdPLLAdA+vjjBNaOUXDho5W8wxvOuGFY5x1iQ14AQAAAAAAAL0ZQRoA6EjTV0frbRk+XVWhBtVvNAGTVtXeV63yVdGAjgZN1qzpfv9kxqhqauY6akILF2rSINviTL184RiF1z3lzDFRyZzg/M9TqbN8zbtteza2rFRluFw1waCRsx4LTIBlfTC8Uq5ZkeCMLzCeu+7O38D2Kpg42xmiWU0dVs8PAAAAAAAA0L0RpAGADhQqKrS/4rWoOWxyvUSL9jJN2Uop3Nxih4lXpOJI8CW14iGxwZCCIUX2VzLB4sVGq9JZply07mp2VrJY8WvpznPnS9HAUJJhkkm9vQAAAAAAAIDejyANAHSh8lW2iLBgk6Yosw7l1jEzWvXjNth5b1BVyPbLxamnKD6PDAAAAAAAAIDcEaQBgC5RqKKQ1LQrVdFmHcfN7ZIkkNK6sV7h6asDdcTkzs0xs3JdQr0xqeYJAAAAAAAAIDWCNADQZrnU51KgSTPKFfYr6rda6xbFtLdFTGX7e9eoYr6S1mUTH2BprZufpLizDOvk1rNTrbIlgTBNmnm2XaMWDz1Ni7fYVgAAAAAAAKAXIkgDAG3iVdDv1TETCJKkM3yewgulyrHROmlCzeMClf63Tfmqcaq30xs2tkLFq1Ykn6Yz/5rp1Sqzw1ZodlxxZ9msU4Emrdigqp1TIuswbGy9StenmCcAAAAAAACAlPocctjfAIAexeQ2mSKt2qG5w20nAAAAAAAAAD1GO3PStKp2pv2SesqDarFdY7yxVtfar60ptgYAAAAAAAAAAMDTccWdPV+rcLP9HdC6/jHV9++nfrYdAAAAAAAAAAAAHRWkGTFGof7bdP+6bbaDr0VP/EeDhoZCKrJdAAAdpURzt1PUGQAAAAAAANBTdUyQpl+pSi/rp5basLYftN2MF9bq/udLNOmcQm23nVxvNKp63jRNGOUVgzZiSpVqdx6wPU0dC073JQ1qrqtSmRlm+GjNWrlN/hDpx3ccbNHaW6coNNwfd62q3WLZAhVhH2zV5mUzvWGGnqMJVy/X5lbbDwAAAAAAAAAAoJN1WHFnI742W4W7l6l2czRYsv3pNWoJTdaFn7cdfM2bFB44QZWrNij8+BJd9PaDqpxdHRvg+fUdWtpypq5dskIVX/u0wksu0+KNdtppxz+gzYun6fqHmlX8nSWqvnuhQs3LtDjsjmm1au3V56t87UDNuu9JZxqLVfrGMpVfsTx2GQAAAAAAAAAAADpJhwVpjjpjgqZ96YBq12/1crwc2KTan7ao9OILVeAOETB8lqrnTNaIogIVFDnjTRsp7d6qbftsf6OgTHOvmaARo8ao7OpyhZyphl9o8vqlG7+1XtUPtKjwmvtVPduOf+tdmnuGN6rrhTW6a/1AXbtogcqGFzrTGKNrry6TmtcovNMOAwAAAAAAAAAA0Ik6LEgjFSp0SYkOrHpQ9W9IBzbXq2b/5Zp0wdG2f8DBVjXWVWvB1RM16eujddGNm2yPgLNPd6ZoDTpFxc6flrfe99rTjb/rRZlMM6VnDfPajb7FOnOE/e1o/eNWtTj/ln7DKy7NbaZVO31a9NY73jAAAAAAAAAAAACdqQODNFLh16aqVPWq39ik+l89qH5TSzWin+0Z8Zbq552vsoXrNOBr12vB0v9UzfyRtl82shz/CPvXdUBv7bc/I0aq4le/1+aNsc01JbY3AAAAAAAAAABAJ+rQII2OCWnCeKn+5/NV8+tCzbpkpBJiNG9vVv3jB6TLfqBrx4/U0BOPdrq12J5ZyDT+MYUa6vzZ5BeNZhxs0vZAnTQFQ4qc5dqkzc4gA445Oqbp19cOBADpvNikPj/cpb22FQAAAAAAAABy1bFBGh2t0MTL1e/5RjWeMFkhEy2J13+gBvZ3/q5/TLVbnOHqqlTx02BlNBlkGr9onMpC0vbbr1HlQw3avHGtVsyYoeVv2P5GyUWaVSTV3zjNHWb7C9u0ef0aLV6yVq12EAAAAAAAAAAAgM7UwUEaqd+Ii1TWXxo6rVRDk+VK6Vuiax6Yp9D+NaqcOkN3vDBS1/8gh+LOMo5foElLVmvu2De19taZmjX/MWnGj1VxttPrjEK5NeT0HaaZq1er4oIj1bBkpiZ9Y6KuWbJWBz4/VANMfwAAAAAAAAAAgE7W55DD/u699m/S4ounqTq0QltvHJNYBBsA5MoUd7buCO35/hANsp2Cflfzokb9t23RUdp4W7G+bNvccVe9Z1ukiaWFqv3qp51fb6rmhy2qLTlOkxpf0+X7+urB75+mr/73Dg1u/IT2jPtQg/3xBn4q5by96Usbp0qj/OG/cJwOlX3Cnf7lNvPhgqmna/7p3m9j72+d+dQftG3B5XLET9Odnpm7t8z+NNMuFwAAAAAAAIAYHZ6TJv9atfbGOVpaZ4o626TN6x9U5eUzVb27WNd+kwANgM7nBmh0nA7ddrrb7Cn9QKMC9df87nlpo+136Pufkur3qCZQamNd/d+kb5v+p6lsoO247+8a/Pwn7TSP0wKn/arfvml7JvOeRvnDO/OY+N+vqc8NLXp5nDffPaV9VbGqSb+zQ5tldgNB/nI58zirvkWTYuYRmGYgQFNbUmjHOV0bBznLWUNNPQAAAAAAAEA2emGQ5kgVFh5Q+O5rVD59msqvXKqthWW641cPaeZpdhAA6Cz7dmnJfx+ljW4QwzPoq5/Rgn3v6rc2EPPlskCumoGf0aSBB/XyX2278YXPRIMzEcFpDtL00r6q2/uubU8mMPzAIZrzBefvF46L5Jxxl0kf6GWzTO4y99WD3w7mgBmk+VOPUl3j3yLBJckZpjQ6hF5s1eX6lO7xc9s4vlxqAkLvRII/AAAAAAAAAFLrhUGao1Uy427Vrn9e27bvcJrfa+3d8zThNLc2GgDoXH/9UHUmx8kNL6pPpHlNFQoGYkwOFL9foKgwa+KgT9hfAQOP0Mn2Z8TeA4EASmZJp2u4y/xxnRwfGDr+CE3c96Fetq2KG2bvXz7wcvgE1/WHf3emZYM/AAAAAAAAANLqhUEaAMg3UweNX2xYtHFzsezbpUk3BIsIK9SDCblm8iBZECgbpg6auPWMKaYNAAAAAAAAQEoEaQCgI5ncJ2lykuz973dV94XjohXydwdujplocWwRJodNmuDNoM9+XIrJaQMAAAAAAAAgFwRpAKAjufW/HNTlP98VKIrsTdXUeO1uYCNQZ8ve3+5JKO6syyVd5r1auOo9LRgXrKcmzukFenDgexpVEyx0zRnPtv+u5kX1iekHAAAAAAAAIIggDQC0VXx9LDfsUM0+6ctlhXpQwX4tevlLNthxerE2fiFaZ81V+ky3KO7sy2Wna+Og4DK/Jk21RbSl9GmVff84Lfjv1+w4pvmbTi5NGdYBAAAAAAAAENDnkMP+BgAAAAAAAAAAQBchJw0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAedCuOmm2bNlifwE4HAwfPtz+AgAAAAAAAAC0V7uCNAAAAAAAAAAAAGgbijsDAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAIA8I0gAAAAAAAAAAAOQBQRoAAAAAAAAAAIA8IEgDAAAAAAAAAACQBwRpAAAAAAAAAAAA8oAgDQAAAAAAAAAAQB4QpAEAAAAAAAAAAMgDgjQAAAAAAAAAAAB5QJAGAAAAAAAAAAAgDwjSAAAAAAAAAAAA5EEPC9K0qnbmaRo2NL5ZpEY7RLvtXaNZzjRn1bXaDgAAAAAAAAAAAB2vzyGH/d0DmCDNaDXP2KG5w20nR2vdTIXmN6h8VWx3AAAAAAAAAACA7qpXFHdWMHGFtq0qV/XUDsxRAwAAAAAAAAAA0Il6T500w6erKlSt+i223dG4JFmRaF6RafHFmZncOMNmrnH6NmqxM/ziwHT8ItAi01oSDQUln4cRVzSbO20AAAAAAAAAAABP7wnSqEDFp0pNu7xQiAmelGm1tm3f4Tbhhc0qcwMlBRozbozC654KBE1a1bCuQeUzJjt945gAzdgKFa/yprNt+wZVFXm9Us/D9ButylOj/WrGeeMAAAAAAAAAAAAYvShI4wk3t7iBleUry1Uzp8R2NUWizVZ5uF4Ne53fo0oVsr9de59SfbhcpUnqs2lcVSEt3BCo66ZAkyY6080wDyNUVOj9cJRMTBIAAgAAAAAAAAAAh61eF6RxAyO7mxRWtcoixZCZZorTpUHNu52BBp2n0lCD6jd6eWlaN9YrPH2couEWX6PqV0rFQ5KEVzLMo2RsucLzRzvdqCcHAAAAAAAAAAAk6kVBmviASrlqbFFjwcbLEWOLPDO5bvyizsYmhmg8Y1R0gv2ZIM08hs9zf7tFoJkATqAeGwAAAAAAAAAAgF4TpGmtW6bq0AKVmwDJCcUKqVlNfnFmSbhFnq1cp0ZT1JnseAkKVRTIcRMji3kYBRNXaNv21SpfuUy1GYYFAAAAAAAAAACHj14RpDEV+IfmF6lmha33ZdBkzZreoMqbvEr8Pa2qXRJod4ep1vKb6qVx56WoL6ZAk2aYYsvmBwIsznTqGjPMI25ee19Sk/0JAAAAAAAAAABg9MggTfXUYD0wp2l50QZt2z4vpk6ZkjkbVKUKhSLDjVbz2NjK+916Y8JS6ajkIRqXKbZsVZEqx0anU69Ct1fqeRSoONh9bL1K16/QpEHuaAAAAAAAAAAAAOpzyGF/AwAAAAAAAAAAoIsQpAHQqz2x8++65rE9+p9979suAAAAAAAAANB1/nHgkbrrosG68NRP2S5RvaJOGgBIxQRohh1/lG0DAAAAAAAAgK5TMvgofb6gn/ueMhly0gDo1frc8KL79+mZJ6vw00e4vwEAAAAAAACgK7S8+aG+suJl9/eh2053/wYRpAHQq/lBmpevP1UnHXOk+xsAAAAAAAAAusIrb7yvk+/Y6f5OFqShuDMAAAAAAAAAAIA8IEgDAEn86U9/0s9W/lTz5v6rZn53um65+UY99ugjeuedd+wQAAAAAAAAANA+BGkAIM4T636txYtuU//+/fWdGTN11933aPyEi7Tnz3/W/BvmqaXlT3ZIAAAAAAAAAGg7gjQAEPCnV1/VY489qlsXLNSUy8p06qmfV7+jjtLZZ/8vzZg1W9+acpnu+fHdduhEtTNP07ChyZvFW+xAHa41+XyXNNr+ncGb56y6VtveqMWduo4AAAAAAABA70OQBgACfvkfv9DEiZP1mc8cY7vE+vKoczVgwADblmjSih3att00G1QVkspX+e07NHe4HShHrXUzswq4BOflNnNKbJ/DQ7bbCQAAAAAAAOguCNIAgHXo0CH9cecfde7o0bZLcmPOG2t/AQAAAAAAAEDbEaQBAOvdd9/Vx484QkceeaTtktyxxxxrf+WucUmwSLJFCub7cHOCRPrNVO1er0ix0PwGaeUUt3u0eLHsudOduUatWxZFp2/abX+53Z1l8ftHcqN4RZhFxolb3nT8eTYG1slb9uA0zTp6w3viim1Ltox712hWZHx/eTpmOwEAAAAAAABdrc9r+/5yyP4GgLw4tuB4+6vj9bnhRffvy9efqpOOSR98+eijj3TlrBm668f3pg3UbHzmGY0691zblooJHIxW84xoMWcmQFOm1ZFiyEwgI7SuVOEVk1VgghBTpZrt8+T23bJGtSdM1qRBdrjm2WmKL0ucV5A7vglgTPfnbQIlU9S0cIOWTyzwAiBTqwP9HSYYMrZCxaui0/SmU2SX0Ztn/Tg7DTtN2eH9eYbi56Exqlq/wl0vd3vsXOCtf8L04raXP34odvjKU+O2Z9rtBAAAAAAAAHStV954XyffsdP9fei2092/QeSkAQDrYx/7mIaffbY2PB22XZJ76qnf2l852LtGy1eWqyYQQCiYOFvl4Xo1+LlJQsUqtD813AvQ5KJ6aiAXitPEVuIfnHeJyheOUbi5xbYbY1Q1NbpsjasqFJ6+OiboUzBxoapC1aqPmW4aoQVaYAMuGj7draMntHBhZL1Kpi5QKNwkdym2rFSlAsM73P4r1wVy7zjLeIsJ0BgFmjSjXNr5ksgzAwAAAAAAgJ6KIA0ABEy57HI9+sjDevGFF2yXKFNnzX/8YrU++OAD2yUHu5sUVrXKAkGUYUOnOF0a1Lzb6T98nMrDFQolBFeyV75qh7ZtjzYxuWqCASBfTICjSMWRoFCrmnY6oxTFj1Gg4lOlpl1tD4sUD4kGYYJadzVLdv0j22dshbPNmtUUKRItuIyWH+QBAAAAAAAAeiCCNAAQsPaxRzVgwNF64P5qrfzpfXrhhf/Wjh3bteXZZ3XbwgXa9uIL+tc519uhc1WumkAQJTaYUqK5pn39AjW5OWKyr/+ls6QKqHQaU5RZ3LbZtt0rGg0AAAAAAADojQjSAIC16uf/V//9hz/o+h/coAX/fpsGDRqs/3x8rR7+VZ2erH9CX/jiF/WDf6vQpz71KTtGDk4oVigmV0gKgyZr+fYdqplereV5q/zeyzFTvT4+TOTlsOmM4E3BkCJyxQAAAAAAAOCwQ5AGwGHPFGN2f/XP9IfnG90AzYABA3TkkUdq/ISLdP28G/SDG+Zr3g3/posuvkRHHXWUHStHgyZr1vQGVd60JlDEWKtql3jtrXWLVBsJ4HjBkBhdXPeKVx/MlJii11rr5rv1xpQHi1HrKG6dNdUqWxIMDDVqcUx7FqijBgAAAAAAAD0IQRoAhzUToFn5k/vcHDQ/+Lf5+sxnPmP7dLySORtUpWC9K6PVPNarCL9giFQ5Ntq9ftwGLbeV6BdMnB2pr2ZWmtw11W4xaYFmZjAglCOToydS9JrXhNaVKrzCr7i/oxVo0orVKl85JbAOy1Q0tcT2zyzb7QQAAAAAAAB0F31e2/eXQ/Y3AOTFsQXH218dr88NL7p/X77+VJ10zJHub58J0KxYfq/+Z8cO/VvFjRo4cKDtAwAAAAAAAADt98ob7+vkO7xicw7ddrr7N4icNAAOWz9b+RNte/FFt4gzAjQAAAAAAAAAuhpBGgCHrenfmaG7fnyvBg/+B9sFAAAAAAAAALoOQRoAAAAAAAAAAIA8IEgDAAAAAAAAAACQBwRpAAAAAAAAAAAA8qDPa/v+csj+7gFe19q5l+r2TbbV9WX9oHaRJhxvW9vsRd3zldl6yPn15Rse1hW7LtWsmm9p+dNX6QzbT/eEddUXvaEBdJxjC9p9AKfU54YX3b9PzzxZhZ8+wv0NAAAAAAAAAF2h5c0P9ZUVL7u/D912uvs3qEcGaXZ9OxAs+cM9Gn3Vq+0M1HjTbRj7sBb/87G2WxBBGqAzdWaQ5rQf7tTnC/rpse1v2y4AAAAAAAAA0HW+WvxJ7X7rA+34/qm2S1TPL+7si1dpednv1PDs67ZD251UmCxAA6Anu+uiwfpj6wHbBgAAAAAAAABdywRozHvKZHp+ThrHC8tCmqVl2jB7sM0Rs0xj1s/W7ZuiRaG9/p/zdPFtv7NjeEWaeblmosWcebxxRj3rDL8+pEcXj9exyXLSuDl4fmFbpMuy7QcgQWfmpAEAAAAAAACA7qrn56TR63qlWfrykGgU6ne3/V9pblgbnvYCNCaI4wZcnjbdTLNMJ912qeb+p8l9c7quevph/WCkF0zxx0nLDcJIy/3p1c7TK1fN09q/Ov3++rjmusWvRfsN8cYCAAAAAAAAAACI6PFBmtf/c5Fu3/QtXRGsS6bsf0cDLX99XA/UfFk/mGtyxPhO11X3fEu/W/875V5I2uta+/Nf6LJ7rtIZtouOH68rYopcO1En+fN3+k0gFw0AAAAAAAAAAIjTI4M0D10V0uiveI2XQyYQMHEEc9Vo7yv6XTBo4ht0kr686RX92bZmb492bYpdBtPMqpF+t2uPdPyXNWbkLzTL6ebl1AEAAAAAAAAAAEjUI4M0XrFktnHrjMlg5En6B/uzo8Qsg9/MPt3pc6wmLDbtXpFqo79ii0EDAAAAAAAAAAAI6AV10mTg5pgJa2N8oMTksGlT8GawhoyUXmnJlEvG1HUT1qM3SLfXvmi7AQAAAAAAAAAAeHp/kMbWF3P74scD9c+8qHuu+oUu+3YWuXASHKsJ3/6WfnfbopgcMq//5z1e+x/u0T1/8LoZf971O/sLAAAAAAAAAAAgqvcHaRxnzA5redEiXRypQ2a2dE9YV7W1Qv8vXuXlkJkUrZPm4l3naYKp92bQSXolUF/NLC2zxaABAAAAAAAAAABE9Xlt318O2d8AkBfHFpgIJwAAAAAAAAAcXg6LnDQAAAAAAAAAAADdDUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAB6vQ0bNuiSSy7Re++9Z7sA3R/pFgAAAOj9CNIAQEDjktM0bOhpmnBXow7Ybr7Wupluv8VbbAcAQI8QDoc1depUbd68WZdeeqn2799v++SXf82JNKPGa9LVi1S7pdUO0cUONGrF18/RpGWJ18CcdNR0DnPdNd1690MzVbvXdoho1GKTjpc02vYu8sZaXeseQ1NU86rtFnSwVZuXzVRouBlmpta6h9cBNddVqWyU6fYlLX2+VWuvO0cjrlurbI++1sev1ohRV2ttwnZAt/b2Nq1dcrUmuPveNOdowsIGvW17d1edmd68a9Ei5whGt7VlkU2vgXT7jau1uK5RrQftMEC31KramcG0e5pGjL9aKzZGr7ap7ytyEX9dt52BHoQgDQAk0bxsvu7fYVsAAD2WyYkwY8YMLV26VKNGjdKZZ56pr3/9690oZ0Kp5q68X9X3LtDcKSM18IUaVU4drQlL8hDgeP9NtfzlLR34wLZn4+1GVc+botBdgdd7bZkOYnT/dNt9vL1xnerVT/36N6o23GS7Rr1df7vK79qkwiuWOMfZZBWajjuqNWv+g3prbKWWr6zUyP5vat8rB/R+DgfdW627neHft23OfLZU63rn2F3Kxzzd18FtWjFloq5/aLeGTVng7Pv7dceNkzTs4NvdPqAcn95weCr9gXO/sHKFquaUaeTAraqZ71x/L16kxrzH8FtUf+vVmnDdmqwD3Z2Fc3E3dUa57rD3u5MHbdbS6efr+l+/ZXvmIkVaS7iu2+5AD0KQBgASFKuoqElLb35QzXyZBAA91vr16/Wd73xHdXV1GjZsmNvttttu01lnneUWIfXOO++43YLmz5+vP//5z7atKxTqzFEjNWLsZJVf4zxYPvm0qqcXq3nlFaps08NrOwwYo6qNO7T2mhL1s50yeuclbX60Ua3Bd4dtmQ4ieka67S5a9cSj9dL46zV3rLT9/nptt318B/abPBIjNembE5zjrFQlBU7rO2+qxfkzZuLlCo2arBGnFqv8V89r670TZHpno+iKOm3dskITBnntB3Zt0totreI1ejf2whNa3ixNWvKQ7rhmsrPvR2rCZfN0x43Z7/d8iU9vODwVnuHcL4wao0nTv6eKezcofH+5ipqrVX5jfZ5zg7Wq8aF6NXeDDJ+ci7upY4s10t7vzr3vfl17wgGt/dUTbQjqpUhrCdd1rzPQkxCkAYAEIV1/Y7kKn6/SHXXmUp/CG+br4WmR4hJGTKlS7U7/Ozy/yI+GaLbbUVO04NfO9PZvU/WVo3Wm0//MsXNUExnHEVMkxzmacPVybc7350gA0EM98MADkRfdhw4dUp8+fdzu5oX38OHD3dwK8V544YWkL8G7TN+jNeK6hSrv7zy8Prk58tLl7R1rtGDKOe715syxzvWkrin65ffbjaoxuVki14417oOqq3WTl9PF7fclhaY+qGbT2RYtUf14tWaN/ZKGzTRfJMYVV2WLV1m82Xy1OEUjTD9zLfPnbfqPrVDY/F45xRvW/XI1SbFXezdpxdXjvWm4y7hI4UDRVJGiLp53hrPXSHNdrd9tBziM9Mh0m8zBFoUjxUqZtHenNvsJOt39jp/ufllv03yaYpheXadaJwFOuOAiXXTBBGn3GoUjOaG9IlZC8xuc3w2qHOvMy0nnT5minaZWu0NUTzXzN9O3xbG4x4GR5D5u+GjNWrktctwFi2cxxUV58wlMc8dyXehM48L7trndPW+pfo7T/4Ll2s6HQHmzr3Wf/RVn7xrNcvbZrLrAzXdct8h+3xm8n5+pFcEb9oNvaXug2J3Q1CTPCLeviZxXF2/ZphUXON2+4Z2ffS0PmfOqV4xffHFAbz//oJtbwMzfFJV5beCZJe31wj0u7bFn03QXfw6ADjRgxDwtmN5PBx5fp03++dVcb23adNPGsk3RItEyXdcdbk6U6dHrddmtawIvxJOk33pzjEyRe1YNVyjkdPOOlyTn0fY+D/vLv75JtXb+5virfsEbP+m52G1Dt9J3mEoucP6Gm6L3qwEp06B7Pk5Ma26RjQnXdYd/Ljb3uW5amaLrH2rU25Hrb7LzcfR+oHHzcu8e2b/+O+fP4HGzOBw47wMdgCANACRx9IjvqeKyfgrffqfq37Ad4zVvUnjgBFWu2qDw40t00dsPqnJ2dexD90NzVdVypq5dWKlJxzSq5rqZmnR5hZq/slDLl8zS0LfWakGl/zKtVWuvPl/lawdq1n1POtNcrNI3lqn8Ch7kAaAt7r///khOBOOjjz6yv6R///d/17hx42xbN9N3qEZc4vxd/6JM4U0Hnr9Tl329SttGLdba9U+qesYp2jR/os1p06Ka707RghdO17UPeNeOi/a3ei+a9zsPn1dM0+Knj9JF81eoeuVdmlX0fuCFXIMWPypd++jz2rZicsovyRturVD41Nm6a+USXTu0WTXOvBdvPCAVTVb1knINNQN9bZ4z/fs1qcgdJdbetZo1fpqWm+vhvaaoi2t1ZnO1Zn19Ttw1tkkrFq/VgG8sca+RxTsf1LX/+mDSB/jerMem2xgHtPn28Zr10Pu6aMnjCq97wEl7rdrnxpGyu9+pXrFJI+78vbZtn6cS2y1eyzOPqVFjNKLkaA0oGamQk1pq1/tBkQEaceX9uuMKsy2HqXyJk/auHKkzLnH+/qDUHcIrOmiyit22JH59h5aadLtkhSq+9mmFl1zmpf04xc40vfkEpnnaBE37krOM9VujL94PbNXmx6Wh00o1tK/thq5zxmRVjHXu728cr0k3PqjGNtd/0KTq6+/QW+Odc9W9lZrwmU1aOu3/s3UiHVDjPZdp0sIXNWKhTftDNqlyyvzY890Dy7V51I+1efsOzR0+TKFvFkovhLU1skyt2vxUo/SlixQ60XbyvfqgZk5xrglDv6eadRu0duFFeusv3svC9NcL57hcPE2zVm5V8XeWqPruhQo1V+jah9xR0UMNPWey83+9tpkTjb3ePnbMbFW7aaNU+346TdNWBoPFaa7rjqbfN2jg+Eo9tN4Zf4mTth6q0KwHYsePSb+hkU6amif3rGqLtJo1YoA7mKsTnofrl9ypluHf013m+Ovv3MtccYc2O4uf9FzstqF7aVGL+aBiRHHSe8+UafCY5GnN7PfE67o9F89/TP2+udC9R636upN2bp2iy+KOh9jzse32bJWqHh2gsoULNXPo2+71v2zyNar+zFQ33Zm0XH3dMjfdAR2FIA0AJNVPoauXaILW6vq7GyJfFsUYPkvVcyZrRFGBCoqcB/FpI6XdW7Ut+HHeqdeq6hpTvMblqph3udOhSW9fuEBVl43RiPHf07XfcDo9H1ajea56YY3uWj9Q1y5aoLLhhc40x+jaq8uk5jUK7zQTAwAcHvrpaFOW9n5z9XlL9fcvV/PXFmrFNWNUNKhQJZfNUvkIP6dNq3abylFLQppwhnftmHnfLPel9vZVc1TdXKKKVfdr7kTnujNqjMpuLQ+88O6n8hnlGhp4l5LM0ZdVetetURM08967VNb/gGqe3KQDxxRrxPBiDTQDnXCm03+kio5xR4mx/Vd3Kry/VFU/c65vY01RF5er6u5Klexfq+WPB+sQ2afQlZXeMM418vrL+jnXyK3ant8yXNAmb6vlVSf9Fo1UqXkJc2KJk/YWaIJJLFne74SunK3StEU7NSlc1+gMWKoxZrhB56k0JLXUhu3LvH4q/NJIjfy8melAFQ130tWXnPmd6vx1jhXDKzqoWCkPgYIyzTX3cebYubpcIeeOMPxCYr03A5xpevMJTrNQF35zjLO+j2mTzTV2YHNYNc4ROCnEa8O86FuoSXf/RsunD1XLL83X1eeoPJjLIGv7NPK6Fbp2vLOvzfls6fXOXrV1Ir1Rr+plTSq99T5dO9am/SvLNcI539VvDuRZCc3SrAuiryeHXmAC3g2q9yvT3vuU6sNS6bcv8upRCtrX4n4lfuaoizT0xAIVjXWeSWaYM3uG68Xex1T9QIsKr7lf1bNtur51sa5JFlxHj9Hvk0c6/x/Q+x/a6+0x39PiWy9XiZs2vOfN5v9wzove4K6U13WnX8lsc8/gXM8HOeOPL3fSj3NebdzmffzhC6bffk46G3Wml05tkVYlJwQKO+2E5+GCqfMix9+1053z7P4GNb6c6lyMbuXgATU/eqdWbHbS2riRiec3R8o0mCKtmf2ecF235+Lo+W6kJlzzgJY695bNP6pVOPiCJ+587Jms6280RadN0LW3Xu+cnw9o+0n/4pxbvbQ807z72b9Gm6jHGB3oY8cWHC8aGhqafDbd1jGluv4m56bvoSrdlewTiYOtaqyr1oKrJ2rS10frohs32R4BZ58eufHwbqCde4DTow/mxZ93pu844NxUt/5xq/mmREu/YbLo2maaybbbore6WQkmAIDO9Jb2ma+pnQfOo9Ws7b92fv96ji32wTQXqNJ5uNXbbzqPjENVOtu5rtTN1MixM7W4zhTcZLRq25YWacRkhVK+gHMegE+wP9M4c2jghXK/UzT0bOfv7n1Zln/vLEejsxyhMRoZDOAUna4znT/b9wanMlJDi6IvdgqLnAdgZy5cA3uiAo0ZP0b9XlikCV+ZoutXNqjZ7Oq+2d/vFA9JlbfL2lGv+1+Qhn7lTPslboHO/MowJ20u09qOKt8mcB+nQae4X2S3vJV9TQcFYy9SqRoVftYclQfU+PQa51iYrAvjc0ag6/QtUGjOam3eWKeqbxSq8a5pKp2Xa30ezrnq84GX0CcGzmfNL6re+V0/xytuzG0uqJA5Zb+1P5B2Tj0l9gty53w36QwpvHGruyxvb2lQ2Ek9paOO9voHnTFOM53zeu2V5yh05SLVbnHSl5szK8P1YneTWzxl6VnRnHrqW6wzR9jf6JHe3me+EBymE46x19vddzppyd//p6n8Aaf3bnO/EJX2ur63UbUrq3TtN5xn3LHjvfQTLz79ptMJz8Nnfj5yZlbBEHOTw/Nyt2eLJxt2xpc0Yd5aHTnxbt1hchAmk00azMSei0vPCZzv1M+Zv7m3bNG+YM7GZOn57KEq9k/z/fu5HyQNHT40EvQrLDL5yL3gKNBRyEkDAGkUjK9URahF1bcu06aYyuneUv2881W2cJ0GfO16LVj6n6qZby74mfX7ZOChLsFIVfzq986DY2xzTapyPgAAvc/+rQo/7lwvRpyuSHxl6oqEa8PmJRc5D5X9VHLN49r8yyWaNnyfcy2aotLJy9Xov41xLjlH2Z8d4z3zTIrDWL/+5hVFg5p3ee0RrS0yeUyGDvJeYRRcvEKbnrxfFV87Sg1LZmrCuKu1NlKUU/vvd7av94rH2b5wfORl3oSFpgiTA6r5tfdFeN4dE9KE8VL46U16++B2hesOqPTiC7N/uYnOc8wwTbq1TrU/GKYDjz+oJ9pT/9VB57wYp+zexPS9eHy6PV+s0ETnAHDrFnlLm9bXS+Mv1pgkuRPVr0TXPvp71S4p18g9Naqcer4mLWuMpvmU1wvrCPvXMi/H0VMd0Nan10r9R2jYENtpRKVq4/f/xu+lLDYy5rr+Rr2uHz9FC9YPUOl1C7S07iFVdEIQj+fhw5AtnswUO1b75PNuUXyFyYr97KI02BYD+3/a/gI6B0EaAEjHFIswr1IlzctVs/ZN29Hx9mbVP+7czV72Azer9dATj3a6eSXptpX5CqifNmlzkzTgmKNjmn6UWw4AneK//uu/VFlZads8H/uYd4v84osvavr06e7vLnOwRWtvrFJt/zGqmmreSBSqKOT8Wb9dLUfHXhsGDLAvOQ46140zJujaJXXadO9kHdhxp+pfKFDxqU7/cL0a2lzvgqdlb6CInjcaFd4s9cv6K1p/ORq0KfjVYvOL2ur8KTmB19Vtkc90O+DzZ7r1ENWsiy0OtmX9Ywo7dzJnFtkvY5102e+EkSq78X5tfnSehr5Rr7UbWzvmfufgNoVrnfuuEy5XlX3p4zVLVH6GdKCuPhqozKujFZp4ufr9+ik11K9Tzf4JmhBKkjMCeXNkf7M/3tKBQHrZtz96z39gu3POs7+jmtQaLPvJGcZ8sR0yaf+EYplTdnhHS0L69k/ZqRSee5FKtFab659wnjOksotDyYtqMsWz9T1aQ8d/T3f86vdaPvGAtt+1TtszXS+OKXSP3U3BIvucY6nxSfsbPU7Lo/O1oK6fQjdNV0lfe73dvMlJoXH7/5jYxJfqut5v8zqt3e+kveu+pwmjhqmw/Y+4OeF5uBezxZOZYseGBovDi/N2R6VBey6u/32w/pkD2vbCJql/oQqTBcCBPCNIAwCZFF2uyuuK1fh8oOyM/gM10NQXsP4x1W5pVGNdlSp+GqyMpg1KLtKsIudG4sZpqnyoQdtf2KbN69do8ZK1sWUAAwBy1r9/f51xxhm2LSoUCumZZ57RDTfcYLt4FbVv27ZNkyZNUnl5ue3aWVq0deMmbd64VjV3Van8Kxfo+vVHa+Z9d2mCWx9HgS78+gT1232nps1YrrVbtmn7lk1au3KOqk1dNGrUCtP9hRa9/eo2rd1oQh9j3GLMSi6rVKh/gyqnX63qx808GlRzY7Vbl0Euwguv0VJ3/LVaevV81atEc80X38bAU1TsXw83rtHmJHWoectRr8p/qVDNemc66x9U5dVVaiwq1/WXpCjqAq5umW6LnPuV8f104KGZCk2v0tK77tTSW6dp0o0N6je2UtNGmJcvrVp7i7O/NzapdW+Ts883qVmFKh4yoGPudxof0/LdUuE3J2mSfenjNRN0mUmb+x9UfRfX5uu9XJQafu0cB3VmfT39hpdqUv+1umtJvQ5cdpFCSd+6o0s8v1xl8xapuq7BPR/W3jVH196+SfrSJI00uRAGnakRTtrc/qP53jnv8eWaddemaJF3Efu0vDJwPpt3p1r6X66yrxU407hQk5zjo+WuaSpftlaNTvpudM6d1XOyOPeeOEYTviTVLqzSWmd6pe6xlETjcnfa2199Sy0vPKawmXCo2FnODNeLonEqCznrd/s17rFnzukrZszQ8mAAHd1aywvmWuzs04fu1ILp5+jCefUaMPsBLb3Y++ChZMJsFTlXae966+x/Z/hw3SItfjz27Jrquj5g4MDIeazRecatvb0iy/RhA4TP1qt2fYPqn2/j02sHXB9SnYvRM2ROg1mmtUFOWppeHDkXu8fNXVfo2oec0+X8cqU6vQL5RJAGALIw9IqFbtnPEX1LdM0D8xTav0aVU2fojhdG6vofZFfcWUp9h2nm6tWquOBIt1iQSd+YqGucG9IDn4+WfQoAaJvCwkJVVVXZtqhPfvKTeuyxx/Tcc8/plltuUZ8+fbR9+3ZNnDhRP/3pTzV69Gg7ZGep1+LpzgPk9Dla/KutOnriAtU8Xqdrh0efHgd8bYkeu7dcI/f+TNdPnahJM+aouvEUnenWa1Gggv6PqeobF2jEuMu0dPtQVaxerEkmwHPCZC1dvUTlQ7bqrjnOPK6er7UHBmaZAyaqbOH1OvrxOc7D7hzVvBHS3NX3qcy/JjrXw8sWXq6SN0zg5U41xhQNatnlKBv8lBZf6SzHnGVqOqNSNavnqcQEeJBS90y3R6t00W9UfU2pBm5/UCuWLdeKX+/TyOlLVLtksi2+5EgNPOYlLb96vEJjx+uaR45U2b33a65J1+2+3zmgzb+ucf4fpmkXBMua93i5EaSaR8M51jPSTiWX647LSrRvVYVm3d2oyHfq/UZq0ncK1bJ7n8ouGOm+fEKeHFOowtbNql440znnztSCXzWr8LIlWvuzy1Xkpttild1ZqQmDmrVizkzNfVyadfOsaLGTESNV8YMxal5xjcqvvEMNxzj7/lcmGG36mePjcS2fPkL7fj5HZU76Lp//MzUWn+nWaZReoS785hgd2H9A/S67KPVLxIEFOnrtrZo07hxdeMWd2mbOp86xZ87tma4Xk5as1tyxb2rtrTM1a/5j0owfq8LUR4Ieof52c78wTdcvWaOt/SepatVvVHtNSfS8ctosPbS6UqWfNNdbZ/9/4xrd8fj7Gjo09uya8ro+/HuqmTNGb9VVqOzq27V9+PVZpo8CTbjaeTY+epOWXjlX9Xts51x1xPNwqnMxeoaMaTDbtNZPJdc9oOo5IR1wzsXmuKlaN9C5F3HOzxP5QAjdU59DDvsbAAAAOCzt37/ffcHd2Niofv36qaamRueee67te5jaskjDplarfNUOzR1uu6FbId32BAcUvvUczXqkTDW/n6cSiuzp0VrrZio0X6pav8ILhgM9Cdd1AOi2yEkDAACAw54pVqqurs59wf3QQw/xohs9Aum2G9tbr5q6YPEqlxOgAQAAQFIEaQAAAACHeeFdW1urUaNG2S5A90e67aaOOKDw/Gm6frU0aWGdllK8CgAAAFKguDMAAAAAAAAAAIA8ICcNAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIgz6HHPY3APQ6r7f+1f4CAAAAAAAAgPw5tuB4+yuKIA0AAAAAAAAAAEAeUNwZAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAIA8I0gCA1bjkNA0bmryZVddqh+p4Sec7c406b45Sa93MwDxaVTuzc9exIyTbTou32J7tFJm2s02ecn8vUqPXR4s7cD4AAPR4WxbFXIu9ZqZq99r+ncGdp39t7rj7Fu/67083mVzvA9Is2941mpV2Xp3BW/5hS1LN1fZ3Gn+Z3XtEt9siNbi/s9+3mbdnfpl9k3RbxKQvoJtJes61TSc/M7qSzJ9nI2TNvfYluS5mm64ShktxrjbDmeMhfn7Jjp+U18Qs+POxrb7EdxXJlzNhuPYsC3odgjQAYJXM2aFt272mZroUWrgh0r58YoEdKkcpLuLxgvNymxWT1cY59kxt2U7rF6hpavsfEszLiLKdCxS22/08Nx3MU4ntDwAA4oTsdTPSrNCkQbZfD+Ld+0Wv+W6Aoje9MNmyTtWhMQqtXJfkZZEJKE1Rk723cu91nfux0Pwi1bj7dJ7GTFyR076N357Z3t91lUkzyqWEbeFsh/uqVb6Kez90U8Pnuceo26xy0nDw/NvmZ0YToM0cgHVfKE9tVtV6Oz/T2GewjgiU4zAwaLKWO+km+D4l23TlXpOnyl6TvCa8UGpKSLf2PD7DOR6SzC/2nmWDqnZO6cBrvfexQ+R9gm3CC5tVFnOMeR9xlGl1ZBh3WfRSt7lGHs7eeP11bd60SVufe852ifXqq7vcJhkzjhnXTKO9CNIAAHom5wZswcIxql7fATdYp55yeAXFAABAr9e43ry0WqjSULXqU3zUUjwk7g4oVKxC+7PXGT5dVc62WB58ubxlpSq1QOXDbTsAz5ZFKltZrpr4QK15Cb5+gTR/fufmoETvlHW6alXDugaFFk6PCaAXTJyX+OHA3qdUHy5XaVbn8QJNumVBio8Xcte4ZIqqp69OCJgWTFzhBpQqb7IfKrjLOEZVU2PWRpPmHGYf53ZD77//vlat+r9avuwe/fjupXr++diU8fjax3RTZYXbmN9BZlgzjhnXTKO9CNIAQLbM14CBrKkxOTiS9PO+EKmWwhUKme5t+VrDne4iNdpsu970g1ln/WI4/OIqov3is9JmnePEn2dwndxl977+SDW92PklW8bk47d7O+00X594055V12jnEfhqJWbbOU3gi04z79D8BmnlFLef+XIntii4JOKmx1dkAAD40l/z/XuJZNfraDFb7bm+etOPuUdx72cSv2Y1w0Sv+V63+HuCqFTr0w5J7h0jUvZLvf0SNap+pXlpVaAx48ao+r7gvY3ZT6NVGZaqp3rTeaDafLEcdz/m3xO64/jzbo255wtup+A9VOL93VOR8WOYeXRZbpsCNzdNeP7K6Dr5X1+b1rT3eP69tm067CtsoJ1yPZe43aaoWg2qHGu6B5/bokyQN/4FecSgyZo13Rl/lT2S7LHfaM/jkWMnZv72+bLLjnd0D/59gW3LOl0VqPhU5xLS3OL1S6N1Y73C08fZacbOL7VmL0dO/LuC+HN7fBq2nT3mOhsfeIkqmDhb5c41sNosy6BTVOwcc827vX7oPvbu2aPntngJ5qOPPkrITfPs//t/9lfsb8MMa8Yx/Gm0B0EaAMiGuTgHs9q62XHtg7G5sAez6zr9ipzObpEPwSzpc5JfvDOrVtlN0gI/S2zIaY+7eaieuk6lbn9TVIP3EB2TldZmH858s+Jz5rF+XGTckPvCYrSaZ3jTC5scLFOjNynmQTw4Pzd7b9wNePXU+dItieO3Zzu1NDfE5IIJz19m52G/zDH7bWy9SgNZqWtOrVDILpuZt1kWma9fnH4Zi7Uz+zpmeqtVPH90DtsVAIDeL9U13xd/vXY/mlhXGigqxLu+JrzQz8gGJAK5bFt3NTv/B1+MtKg5PEZFJ9hWV4EmrUh9T5BpfXKW4t7Rle6e00q430mitW6Zqu1Lq4JRpQqF69UQmUaJ5rr3lFL5Km86V5SvyOp+LOzsl/qxdtmc4cMpvqZPvL87z9034XVPxdwfNpoXduPOi9zLdTqbm8bNWRTMRZP2Hs/cW0eLhnPvxyM7DMijNjyjesWnrVa5xth+yYr6a1XTziQ57QJKxjrHt/uxnBWu0HItdOflF58YW6TVONWbwC0OY7mlq5Kp9j1E2sBeo6qdS3SqQElSu5sUdo6GYuf62bqxKea8X+7ML/JsnykN731JTXY6yZWodLrUtMtdG5W79w9JPlZAXn38yCM1YuRI9/dnPztIJ510kvvbd/oZZ9hfsb8NM6wZxxgxwptGexCkAYCM7Fd2wbKq7Vce9Rv9C2zg4uz0m5RjkQnmgTf6hUb8hdu5gb7FzwbrfQEYc0PsiPkaxTxwhstVE3y4dpYpt6LBAuO76+r8nb5ac+16uV+FBL4+WW6yLAfm5301EnwZYJZxYeRFQsz4beXcNJXFf7kyfXbgZYW334LzNUrmODdfccuWrcZVFVLM9OzNVkcUuQYAQE/h547wm7gXKBmv+cHrtXsfEbzXMUo01wQA4l7oZ6NgSFGg3hFTXIpzVzM9cK1262kp1ZjAvUEmieuTuviw7CW7d8zmntMRc7+TjFdMTPlY/17uPJWG4qbRVoH7QS/gkf2XwYnBIu8r5NJRqV/YdTzvXrr6vkVaHMhFk809XvTFojONiYH7TyAvOvMZNVkwO5NyzYoEt5M9h3nndRzOckxXTppd7tbbkqbEjZyv6Y1aPDWamye2+LRgUCWLNGyCPTkUEWqKQDPBUtl3P3zo2T0MHjxYM2ddqRmzZutbU6bovLFftX08k7/xTV33/TluY34HmWHNOGbcmbOvtF3bjiANAGRkbibMV5SBlxFOU7ZSXvZb98G3WmVOt7Z+FRFTIb7TxOboSPJ1RrjJWaqo4NcoreaL0SQ3C+5Li7jgTi5CRSluP9wvUbz1j24fLwt98KE98YuZ3LP7xgSz3K/GYr8gjV1Gb78lzrdQRTm8UIjyvvyJD6i5RaO0Y7sCANDjxFTC6zRxZbFnuubHXK8DX7TGOKFYobj7nawMHxf4kOQp1atU5VNLFbLXanOflGvOjcT1aaeU944Z7jmtlPdkvoTy+b0cRm0JesVLNm/vhVYW4oJFXm6fTAGnTmCCS86danWkLppM93g2h5bZLxTVhG6js59Rc3xeinn+TPUcBuT6HO7ldPVzucQXOZZVbsyYD0umSKti37eY3LzB48eTZRrO9T7FDTw567Oq3Dt2KTqzW+jTp4++/OVROvOs5JHsL37pS26TjBnHjGum0V4EaQAgS15xEHGNm3skeuNgikVIXz54F+nyivBN5X9x28ZpIl9adpDYYFayrPnxcv0CLLP4gJrbxL2cAgAAOejQyurNl7BeIMCUUy/z8saUBe/m4PBymHTei0OvDP3M0t87pr7nzI5bPn/cBzRuwKGNOYk7jpeLxQs4xeX26VJ2P8XdL6e7x3O/gHba3WJzne1JcTXoLjrnGTWYoyC5zC/HO/45DD1de9KVX0xntZZHzr9e3WvRHFwpxH1YEn1H4dVfEyy2vcaUIBKRIQ0HPwpJKk1uUVPs4HpTnNuy/L87QrdBkAYAMjI5L7L5StDcOJiyyhWpRDEfYov5iDJfjnZK8MZ86dreoss6hZdjJrFoD/NVTFseGrKvvBAAAGTJzTGTJHiQYzEiQYVFY9zrdYtz6+O9HPECN827zT1AMIdJx3PnnSzHStL1ib93zPaeMx0b/Ejy4rbG2Qb5vEd1mZda5j41IbdPPmV/j+fWteMWV7My4V4b6Fqd+4xq6gYJp0rntpjK1EUVJn8Oa3XrCMPhrH3pKvZDiGDda23iFpW2QOGkH0Fkk4a9e4tUx5W7fOmKYjMfkNifgEGQBgAysl/9xVWM2lq3yGvfsiimPFG3MvugthTV0R62QtSyYNZZ54anItcK9bJlyz6uvClY/EOrapfkWBxEh2+n5PutccmUNhet4VdeGFN+bNz+BwAAOUh6H+GVGe/XF5Irt+4T53pdtjJajJp5MVQ91dwDZHih084iTL16VypUEcxp4dyHzQquT8p7xwz3nNmwdRMmC364FTIn+ZCnUyXc35mXWtVaflO9wu15udbB0t/jOekxeF/tFtEH5Fs7n1EzFTs1fJ5qnGO1LK54Kfd8Nja+Dqd4tojF4Mt493k0fhlw2Mk6XbWqdmbiMNEgTgfkxoz/SMQ5ZqLFnWWXht36bk0xbHHFlrXWzVTIvH/x69sz65cwTIYgDg47BGkAIBvOzYT79dHYQLERzeO8Gwjn4t4UKAvYzS7rf43hB0xMvzTljcaXgR1f1mpuTNb2DaraacpstdMbW6/S9bH1t3SkkjmBCv3cZrSax+bwYiXL7ZQzk414VVHMfovZP7kyZcj65cf663pfsS3PHACAw0RM+e5e054PFkzuBL8YKW96XpnxbS421a2LwfkbDAK4OX+V9oVOwcTZKrfr1ubirNzy5v3ihez6jK1QcXB90t47prnnzIIpKiZmvYPcolmqVd+OfZWTFPd37pfU4U76eKit0t7jFaooeF/t1ouYTbG7QCdr6zOqk3rLF9p6ltI8d7o5x1bJO4b9xn2ujK9DNZEpIjC8sDk67k3SgmCl6zhsZZeuTK4Ze/2IGca+03DrnPPrFWsj57y/IHj8rB8XU9xZdmnYy6lWo8A1wmlC60oVDtafa3LNuHXqxA1DsekI6HPIYX8DAAAAAAB0ni2L3AAIL6eAw4ubu6B5dts/mAMsU9n/8qINGYOFQE9CThoAAAAAANAFvKLs0lc4DqDXsUVFtat4KsCVpkJ+oAcjJw0AAAAAAOhEpn6B0aoMS6GFfP0M9HZenRzB+jvGqKoTi98GgJ6OIA0AAAAAAAAAAEAeUNwZAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAd9DjnsbwDodbZs2WJ/AQAAAAAAAED+DB8+3P6KIkgDAAAAAAAAAACQBxR3BgAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAIA8I0gAAAAAAAAAAAOQBQRoAAAAAAAAAAIA8IEgDAAAAAAAAAACQBwRpAAAAAAAAAAAA8oAgDQAAAAAAAAAAQB4QpAEAAAAAAAAAAMgDgjQAAAAAAAAAAAB5QJAGAAAAAAAAAAAgDwjSAAAAAAAAAAAA5AFBGgAAAAAAAAAAgDwgSAMAAAAAAAAAAJAHBGkAAAAAAAAAAADygCANAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAoMtJ/z+utyHC73KTgAAAAABJRU5ErkJggg==) ## Assign a Device to Enrollment Profile A device needs to be assigned to an enrollment profile before a user can enroll the device. A device can be enrolled to only one profile and the last assignment removes previous profile assignments. Follow the below steps to assign a device to an enrollment profile. - Open **Intune admin center** and navigate to **Devices > iOS/iPadOS > iOS/iPadOS enrollment** - Click on **Enrollment Program tokens** - Click on the **Token name** - Click on the **Profiles** blade and then select the enrollment profile ![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABmkAAAEhCAYAAACUS0TMAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAHbcSURBVHhe7d0LfFXVnff/L8WKpcVWDRbGVDTRjqBto/gIRXqQaqQz4KVAW4z0kQwtF/2rtQNSh8RbYBThaUWrgC2NPsVIpyT1gjPF2GKOSKGPSOwoMMVEsaHQErVqRVGR/157r33OPvdzcjtJ+Lx5bXL2/bb29bfXWn0OOQQAAAAAAAAAAIAu9TH7FwAAAAAAAAAAAF2IIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAIA8I0gAAAAAAAAAAAOQBQRoAAAAAAAAAAIA8IEgDAAAAAAAAAACQBwRpAAAAAAAAAAAA8oAgDQAAAAAAAAAAQB4QpAEAAAAAAAAAAMgDgjQAAAAAAAAAAAB50OeQw/7O2Ssvv6zfPPmEXn/9ddsFQHdz7LHH6vwLLtRJJ59suwAAAAAAAAAAuoN2BWlW/mSFxpz3VZ1y6qm2C4Du5qWdO9Xw1G81/bszbRcAAAAAAAAAQHfQruLOTA4aAjRA92aOUXK7AQAAAAAAAED3Q500AAAAAAAAAAAAeUCQBgAy+PUf/+42QEc7ePCgmpqa9MQTT+j3v/+97Spt3rzZ7dbc3OwOAwAAAAAAgN6JIA0AZECQBp3hww8/1EMPPaRt27bpxBNP1K5du7Rv3z799a9/1auvvup2e/HFF7V69Wp98MEHdiwAAAAAAAD0JgRpAADIgyOOOEKf/OQnVVpaqtNOO00jRozQb3/7W61fv979bbpdcMEFOvLII/Xxj3/cjgUAAAAAAIDepEuDNOGX9+vrP39VI+5t1pl3NemqR/bo1b/xdTAA4PDx97//XYcOHXJ/f/azn3Vzzhgm58x5552nsWPHur8N02/gwIHubzOOGRcAAAAAAAC9R5cFaa5+dI9ub9ineWMGavOVRfr9VUW68NRP6WvVu1T34lt2qGzs0eOV39V3vxttbly7x/brOnvW3qjvVj7uLA0AtM1rj16t4WedGWiu1sN/sT0PM39YarfB1Q/rJXe7+NviNT189Zm65tHX3OF6uo8++khr1651izBraGjQ3r173WLPfCZoc/zxx9s2r0i01tZWd1gzzuOPP+5OI1sHDhzQo48+qvvvvz/SBOu+6Qz19fU5zePPf/6zVq1a5S7bH//4R9u1bcz4v/jFL/T222/bLvkVXDezTcxvf9t0t2UFAAAAAAD50SVBmqea39ELfzmgx/73iRp54ifcbh/v20eXDBug33znJH3vsb06cND7qji957Tsuzdq84hb9ZOf/MQ2szV4N6ESAD2JF3i4sP58PfHcVm3xm5+drJc763TW+EM3ANIdQx0mWFX+0k3etrj7Up1y8d3O9rhbl37WDtCL/OlPf3KLL/v617+uoqIiDR8+3P3re+utt/S3v/3NtknFxcU6++yz3WHMOKbYs5aWFts3PfPy/+GHH9agQYM0bdo0t5k0aVLW9duYIIIJ8JhAT2cxy/j000/rnHPOcZfv85//vO3TMbpiHVKJXzfzd+rUqe5fAAAAAAAAX5cEaR56/k19f/Rx6vuxPrZL1OABR2j8aQP0yuvv2y5pbN2s53SWLp0w2HYwztLsmWfZ3wC6yv533tGv6upsm/Tmm29q7WOP2Tak84elF6jqlAfcgMRxtpur5Pu6rsT+PtycUhS7LXqpnTt3unXNHHXUUfrc5z6nIUOGuN3N8fPLX/7SzYVi6qUxv00346STTnKHNeOYIEa2uU327PEifkOHDnX/GgMGDNC5555r27oHUzfPpz71KdvWu/TmdQMAAAAAAB2jS4I0f2x9X6OG9Ldtic753Cf02v6Dti2NwSdqsPZoz17bnszex3VjqqLQ4vp9d8Vztodj6zKn2zI95/4N9jO5dwLjxBdx5g+frB/QS7333nuqqJivc0Z4X4SbejJuuvFGp32E2440/vKwfvrAaFVO+aLtkMwf9KOzztSPGr2/w8/6odPF9vGLBYvrbsT2ixad5nb/l59Lz9yiC02/pdGx0k0vhsmJY/o7y39NknkYbvFtVz+sP9hi3CJFlMWM4zSBHD1m/hfevEF64IroOP687DAJ4qbXk4pCM0ESE6gxRZj5TJFmJjgzatQoN6fLxIkTNXr0aP3mN7/RwYPRa6Opn6apqUlHH3207ZKeCQ6YemzSFacVLI4rWBSaWZ6NGzfq9ddf10MPPeS2p2L6+eMnGy7VPEz3Rx55xF2+J554IlL0lwlC+cMGhzfM9OPnYfonm6/plmkd/OLg/Gn48wwOa5bJLNvWrVvdv8EiyoLjmMYPoCVbN1O0nfmbLsgWnF5wPgAAAAAAoPfqkiBN/4/30b53omXux3tt/4du8WcZDRqvS8/eo4crv6tlW223IBOEqdysEVWBotAeuTEy7J5nX43pd9azy+Km85yW/X6E19/NnWMCNMu055Jo8Wqzg++g9z6sG/3hzfSc9mV5qB8H6Ervv/++c5xV6F/nzNEJJxRq//79uvmmm/Rv8+fH1KXRk2x69V3d/ORfUzabXt3vNsn6+Y2ZRlb2NOuZc8/XV7IoymvVvzyp892i0L4vE9IxAY1yPRApHu2Jm19WeSTg8Qf9JqafVLXA6/fFa01Rat+WzrVFil3rBYjSTy+Zn6t8gXSTHd4Uz1b1T3H16Dxzi36qm93+d118nBdw+aff6Kv/ZcdxmupTbtGFdj5m2Z64ebR0hbcc7jjpmABNzPQe0Mk3X6AfNdr+Gdx7z91qbm6ybemZAMdP7luunVnmXMnGiBEj3ObJJ5/Uvn373G4m+GKCNyeccILbbgwePNjt5g/zl7/8xc1hM3LkyKyLy/qHf/gHHXfccW6QIFlgwAQSwuGwvvrVr0aKQnv55ZfdYUtLS92g0bHHHqvLLrvMbU/GBBXeffdddxgzDZMzaPfu3bZv+nmY5bvkkkvc9bzwwgv1rW99K7LOZjgzvOne3NzsTidX2a6DsW3bNnfZzTzNsGadgoEawyzzP//zP7vLaYqsM8Edw4zjL6sJ9qRat09+8pPu8Kn48/Ond/LJJ2v9+vV5KaoNAAAAAAB0nS4J0lw89Gj94g9v2bZEq59/S6ccd6RtS++smT/RT648S8/da3Kv3KjHA7lqnnvkYemS2Ro/yHYwRaNdMljP/d7LFTN4Qmy/EWdLe2LqsxnsDB8tOm3P2of13NmzdWugeLWzJox3hvIFi1rz5rVn83PkpkGvZQI0t9x8k6793vciAZpbb7lF18+b12MDNF3ttVdfzrpor3NvvsINzrj+YnLgfFvVNsBiHHfxdzX1md/oaTdI8kVdF+w34nyd+0yzoq/L42ScXjKjVVkRKKKt5ApVnrtBv90cDOt8W9+JBFpe08Mrf+6sx80x9ct88doHMswntT+svkWKmd4X9b9vHq1VDSnz3cT46vkX6Ef/Z4lefrnZdknOVM6/Yvm9euONN3TSySfbrh2jT58+bmOCQIb/NxmzHD5z/JlgTbBbJn6gwuQoMblZgsGOF1980a3rxgQUDBNQMIGBXbt2ue2ZmGm99tprbp05/fr1c7uZ4tiCwaa2zMMUx2aGM0yQqX///m5uvc5kltmvD8esiymSzuTACeZkMcvtL5dZfhPIMUEzn1lHM41st1+Q2ZamPqLg9Ewxdab+ILONAQAAAABA79UlQZrysz+jnz37hhY1tOrAh9GXUa3vHNTkB/+kr33+UzrmE31t1yycOdvNvXLrJXJz1XhFmu3Rnhbn/0dujBY/5jQ3PuL0a3H6eWPquRXRfsuetR0jBmtwJIizR89t3qPBJwTrv4kzyBS/Bhw+Hrj/fn3tn/7JDdAY9957j6Z+e2qPD9CMPPETuvmC41M2I0/s7zbJ+vmNmUbWXmpOk1sl6uQTA6EckwPH5GQJFPM1/KwrtEob9LJ/gjO5TPx+/3SLM3wa2UwvwckqiskBdJyKTrE/fecWKfqKfrdedhYiZj1cJ+jkc9PNJ5XX1PyS9MzNFwSW2RaX5mzTbJx22lBddfU1+uGSxXpp507bNZYJgtz747vdl+bXfX+OW1l/R9m0aZPbnH/++ZHj5rOf/aw7L5OjxmeKQzOBCdPPMH/HjRvnFne2bt06t1u2TODA5Mwwf02uGpPbw+TOMEEGk4MkWFyXaTfds8m9YZbPBJv8wEW8ts7DdDe5VMywppgyEyzpbJ/+9KftL48pKs7UJxP0mc98xv6S/va3v+kTn/iEm6MmyAyT7fYLMtvSBIRqa2sj28n8Nt06O0AFAAAAAADyq9ODNAc/OqRv/0eLzh3SX7//07satPB/NKPuz5rwwKv60l0v6fTP9lNVadte8A6ecKubq2bPIw/Lr0FmcKBoskhTZXK/eHXLLJMX4DHN7LPtSGmkDdIAh5krpk3T2sce05/+9Ce3/corr9ID9z/gft2P7Bx34slSuhwuaX1b1bbIsGBzXYmtDyZYDNh/3aTM1cOnnl7HGa2TO/g0eu7NTyYs85a7L7V9M/MDNT/64RLt2LHddvX4AZr97+7v8ACNYV66n3rqqSooKLBdvMrlTZFYGzZs0K9//Wu38YsI69s3+gGDCdSYQEu2ddLEM8WkmVw1prgxP4fIsGHDIsVr+c3FF18cyRmTSbJARbxc5mFylPzyl7/UoEGD3OFM0WOmuLLuyKx7ttspG2Z6fjFvwcbP4QMAAAAAAHqnTg3SmADNZatbZEpy+fk3T1Dt1M9p55xTVVbyaf344sHafcM/6pYLjlefLKqjSWmwn5tlsAYXKq74soCtm/XcoEt1a6R4sky86flFpQGQ+zL2llur9OO773IDNaYYoptuvllLFi8mUJMtt4iwn+unuVZ2P7hI5+plNSfdzK/p6foNmvqzu2OKFUsr7fSy5eVsScwp4/NyzMQWh2aYHDZtCd54OXeeebltIa4gE6i5+trv6a47f6QXX3jB7fbRwYOdGqAxzAv3HTt26L333tOrr76qV155xe1ucnJMnDjRDaKYIq/Mbz93hxnGHG9mnP/5n/9p10t7P4eICS6YoMCbb75p++TOTMsUeRgsjsvPPWO0ZR4tLS1uMCpVvTvxOV6M9qxDKib3itn/qQJQJsdMfHFohp/DJtfgjdmWpti7+OkBAAAAAIDer9OCNCZAM+WhFrd4s4emFKrvx7xITMEn++q8ok/qpGPa8PJr6zJbtFmUqYdmz9kjZEIvZ11yqQY/u0zLtnr9XM44brsJ5uzdrOf8OmxM94TizmIlm95zax+nzhkc1o466ig3UHPnj37ovjg2LxdNoOb2224jUJOV43RpxU2SKbJraVw9Ko0/TF0B/mcv1Xeu2KCqBcGK/V/Tw0tNuxe8iNbL4nRfkKS4s2AOnrTTS+XnKg8s82uP3qwq3aT/nTLnjbOu07+tZ5z08XAgafxh6RVadcV3sw8oBXxxyk0694ErYrdTuu2WhgnUXPO963T33Uv1hz88r7uW3tmpARrjc5/7nFu3zK9+9Ss3R8vWrVvdIsx8JpdMsFitl156Sc8++6x7rD355JPucg0cOND2Tc9UYG+KNgsydcSYeZgiyk4//XT3mDXD+czvYLsJuJjlTcavL8ZM0/f888/HFE+WzTyC4oMf8dMz/c30/Lp1zHR2704ftEu3Dj4zHX+aZt5mv5h6aVIFW4YMGeIGY0zRdT4zfnNzs7vOuTL12Zjtafa1X1Sa+fvMM8/kXHQaAAAAAADoWTolSOMHaP7+/kdu7hk/QNNug0+U4uqccYsv83PHDBqvW688S8/dG+3/3boTdemZXr/Ztg4bt/vvR2Qu7sxMr+pS7QlMb9nuwdRDg8OeH6jZsmWL224CNTfedJP7ghFZ+Oyluuu5J1X50hUxdasMX1mUJuBhKtx3xtEtujAyzgV6eYxXkb9bGf8D/vRulqbHFXdmc/C4ddDYQEu66SX3bVWPedIOa+qCOVnVd6cb3lHyfW352cmq+id/HmeqXA9oy7VftAPkyGy7n31bq/4lOr1M2y0dE6j53nXf191L79T7H7zfqQEa42Mf+5gmTJigKVOmaMyYMW6ukeD8TAAiGOw0/UxxXyaHjRnvoosusn0yM8elCT74dZyYxigtLXX/msCAybGycePGSH+Ty8cEIAw/EGHqRqmvr3e7BZkAhqknxwRBgtM3lfD7Ms0jnsklZNbXr5vFVJwfLO7M9DfbzNStY/qbSvpNcWqpZFoH38knn+yev8w0zbCmPV2OpWTr/tvf/lahUMhd57Yw4xqmHh4zPfPXBORyzZUDAAAAAAB6lj6HTPkabbR40W2aO+8G2xblB2jqpn5OR/btoAANgDZLdawiO99b62XBu3PCIPfvYanxhxr+L1L1c99XG8Mr3VpzU5MKP+dcszLUr9LR6urqNH78ePdFvCn+7He/+53b3QRlTK4bk4vikUce0Te/+U23OzqW2b7r1q1z68BJVcQaAAAAAABAZ+qUnDRXjzpWj3ybAA0AoGcoKi7u8gCNySVi6nQxuUJMjhcToPnqV7+qsWPHusVomfpnTD8z3MGDB+1YAAAAAAAA6E06JUhz7pD+HVfEGQDk2dc+/ym3ATqSKcrssssuc4vreuWVV1RUVOQWb3X88cfrxBNPdIvyMvWbmKLR+vbta8cCAAAAAABAb9IpxZ0B6F44VgEAAAAAAACg++mUnDQAAAAAAAAAAABIjyANAAAAAAAAAABAHrQrSHPsscfqpZ07bRuA7sgco+ZYBQAAAAAAAAB0L+2qk+aVl1/Wb558Qq+//rrtAqC7MQGa8y+4UCedfLLtAgAAAAAAAADoDtoVpAEAAAAAAAAAAEDbUCcNAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkQZ9DDvsbAHqd7du3218AAAAAAAAAkF9Dhw61vzwEaQAAAAAAAAAAAPKA4s4AAAAAAAAAAADygCANAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAe9DnksL87xIcfSc1/O6iX3jio/h+XvjDwCB33CWJBAAAAAAAAAAAAQR0WpDHBmf9sOqA1Ow7o3Q9jJ3nacX016oQjdf5JH9eRffvYrgAAAAAAAAAAAIevDgnS/Pntj3TrM+9o3/6DTpsJwhxy/u/j/B/795Rj+urfRn1SR/cjUAMAAAAAAAAAAA5v7S6H7G/vfaSKhrf057c+0PsffqQPPjzo/j3644f06SPl/Pbazd8X972vf33yTf31nY/s2G3VqtqZp2nY0EAzc43TNT9a62Y6yzBTtXttBwAAAAAAAAAAgAzalZPm3Q8O6bon39Suv33oTKmPzKRMjhmTU+ahrx9rOmnaI2/oryaHTaD/iBM+rptDR9up5GjvGs0aW6Hw9NXaNqfEdpQal5ymspXlqtk+T9GuAAAAAAAAAAAA3VO7ctL8V9O72vna+3r/oJdT5gPz9+BB/e29D7V+13tq2HVA+/Z/mND/6Vff00uvf2inkotW1d5UIS3cEBOgMUrm7FDN9GqVLWm0XQAAAAAAAAAAALqvdgVpnv/L+/rg4CE3+BL8++4HH+nnf3hHDzz/tv7+vukW29/8/cnWv9up5GDvU6oPl2vWxALbIVbJ1AUKrVym2r1ecWiz6mILQHOLJYsUixZXZFqwuLQti5xui9To/nX63fIjzUooziwwD39428cwOXsi047088ZZvMVt8bjjBqedZBgAAAAAAAAAANDrtCtIs33f+zF1zgT/rpxwnFZeVKAPDybvv+XP79qp5GB3k8KhYhXa1gSDzlNpqEHNuws0ZtwYhdc9FQ28OL8a1jWofMZkFbiBkNGqH7dB27bvcJuaUysUismFU62y9eO8/jd9251u/cZA0CdNwMgtek2rI9MOL2xWmRsE8paren10Pq27mp3/zTJ77VKLmsNjVHSCbQUAAAAAAAAAAL1Su4I0fXRIH37kNAcP6aD796NIe19nyh/rIx08lLx/W2bsBjROPUXJ89HEKhhVqlC4Xg1+DhUbVCkd7vzeslKVWqAFgQCLlwtnXSA3zBhVTfWLVEsM+rRurFd4+rjE+m/2rtFyUzdOoDi2gomzVW6XpWBIkRSZjwkcSeXTA4GbLetUHSrVmEFeKwAAAAAAAAAA6J3aFaTpf4S8wMtBr74Z77fX7kvV/xPOuG2y86VIoCQtm6vGz/0SDKq4wZ5whUKR4sicZmyFwmpWU6TYsSIVBwIlsUEfmytnbEKIxsvtY3LhBKc9dIrTxeaWGT5O5f58TOBIpSqf6kzbrpdZttC487IKRAEAAAAAAAAAgJ6rnUGaPjK5YkzumIP2r9/uS9X/y4VH2SGy5wVKmtRi2xMEc8v4uV+azdBJgiqhBQrb4siizQpNSpWDJVKUmvM7Zj7JlKsmYdo7NNcdvkSl073gkQkcyQRkBp2iYjcA5C1n8RBCNAAAAAAAAAAA9HbtCtKMOekTbq4YkzvmA/vXb/f5uWfi+59f9Ak7RA7cQEm1lpvK+pNoXFURUwSZG9QxRYu5OVYWqNwGVdwix9IFe5KK1ifjBlcWTk8s6sw4oVihmBw5iQqLvOBRS7NUOsoEZLzATfNuUx9NuuAPAAAAAAAAAADoLdoVpJl8+gAVHfNx+bljgn998d3N368M+YT+1wm556QxgZJJtyyQ5o/WrLhATaOprD+uLhgNmqxZ06u1/CabY8V21vDpqgpVq2xJtAYaZwpaHNOeyK1bZuUyVazzgytJuPNsUOVNawLFsrWqdkm03QseTXGWN1qkWsnYclVPnaLqZPXcAAAAAAAAAACAXqddQZqP9ZFu+WqB+vbxizP7yPnrNM7fb/5it77lNO9/cNBt9/uf9OkjdOc/H2+n0AaDJmv59g0qXTc6UOfLaSrTam3bPi8hwGGCH+FwfFClQJNWrFb5yimBaSxT0dRM4REvx0tY6Sv2L5mzQVUK1nkzWs1jJ0eDRG6OIOdvMCDj5sBR8npuAAAAAAAAAABAr9PnkMP+brPGPe9pWt0evfHuQdsluWP791XdZYU6+ZiP2y4AAAAAAAAAAACHpw4J0hi7/vaByv5jt/tXMpPsE/l71BF99N3/dYyuGnGMPnVkuzLvAAAAAAAAAAAA9AodFjEZ8pmPK/ydIXqy/ETdc9Fg3fTVAv2ffxqk/7ric3rxmmLN+8pxBGgA9B5bFgWKS4w28fVltV2jFptpZqgrqzdrrZupYTOD9Xuh7bz0tHiLbXXT7yKn6+HL1GXnHrdOGnvK/e1vj7htlU9712hWh55X2qJVtTPTbI8OSkvB/ZG3teW46OYypEV0qtyO0djzaI+7nsecC7x0l9152BvWvyf0mpmq3Wt7t4u9L3SaWXVPxd0jdt11y6SDnK5J9jpmlntxfddf03rHvWQPP546SM5pDz2MPccdLs++ye7x83y+RA9j7lU64FrgXlM67F4lT9xjp3c8w3Vo1KTvx/rotIH9dMnQAfru2cfoW184Wl/47FHqd4TJVQMAvUxogcLbd2hbpFmt4vmjO+jBqURzzTTn9NZ6qsyNeA+/GUA75Pdlq7kZLdtpj98Vk3XeHHP8JtZrl3duPXw7tHxisF693id+f3TN2vLCH9ngWmXk5xjtucpXmWuKbVYVqXJse9OQOV9NUdPCDe40l088r4fcIzrHz9gKFdvtMbe0s69pHK9dg+3cO3Xifk32MjmhW29/9o2TcI/fgefLDnp5j47jBkK6aQCyYOIKJ82t0KQ09a6j65C1BQA6jLm53KAqVaiCr16A7u3UU3jR2J2wP4DujWO0bYbPU830BtVvbP99YfGQnrgHxqjoBPsTAJAG50vgcEeQBgA6VIEmzShXeN1T0a9XAlmXvWIqvD5u0SHxX1REithIVryG+cIpOp2YL2Tc8aL9Yr4OT9cvwP3Cw5lmo/lrh/XmH5xv4Asrd73iv7iK+wor2bzdblNUrQZVjjXdM2RNDU4j7qugSPErbhOdb/pt64kdN/0ypJqP/zW+2U7BYTJmTU+5TzJPL34/RfrFpbP4bZWaP89G9683vl3HNNs+Vbo2/GVsTTa+O95oVYal6qmmX3wasvz9FTOfZNveX+5oP3f+kXFil81s19D8BmnllEi/yPLaYRKk3F9JxO+HmHToLXOkX2Seqbp7x17q49nZPqY9bjpmndKmx7TrE7sss+pabPcMUu4nT+wxFHscxu8PV/x2jNk//nbxz005HteZ0mDMvOOnkWJfueMkX++E7W/FLmt2aTur9XP52yh+f8YtS5rtnLDsdthgeokZJm5a0XFTr0/Hp0U/TfhNcBv5y5Hl+dpdthTXqjTbLZnYc5K//kmOb7uMMd3i5xU4p8Sf66LjxW672OVL3S/ZcpptldU5M+ZclEp0H8RIO26adXH3kbNfYrZRcJ9ne66I3w8dL9xs0m/q5Ynfl9FtZIaNP1+l2I5BaY6t5OkxuZjtlPQr4BT7x90n8cePv/7uiFnsPyPN/g9yp5Xm3jK4PeKnEXeMpd2uRspt669f7DLHH5dJz4Xxx3nK4yFefJoyjbfuMfs5ft+lXOdo2kp6nsy0nSPi9lvMcJm2kydz2gtqy3Zo5zLG77O029jZ11tMe+z2ij0PJZt/LuvjSJk2O2i/ppy+I0U/d35Tq52TYIVCpp+zzMm6BZfR5U7PWY6Y7Ri/XLH7xz+2ossV3H5OE7+9IuLSQuT4S54OIsvoS7ddHPHnd6+/P23np7uOGc6XRqY050i+bT3xy5GwHhFx+8Jn1jNwbopNv7HL6vaLWz53/n43f//62y7lvomfT/CaFbd/Y9KHvw7B8210vWKmmWo7BqYdXDd3PZztEPssHpeGIsvidU/6rBM/Tqbzfkw6iz8WPLHLbYdx0038tT66LSL7wvZxpUlrSefhymF9YtYluE2cqdjtm/Q9gi9m+Zx122279waHAAC5e/b2Q0Nn/PLQPtsaY88vD8087fZDWyO/Zxxas8ft49h66I7T/vHQHc86P800/OGsrYv/8dDMWjPVfYfWzPB/G9540XanS62df/x0gvOMn7/TvsbMO4l9tTOc6QTm4U73H50mOr5Zvsh6J6ybYZYzm3kHhkvBX56hi/01i98GTnuknx3eX7a029b7HZ1u3LgJ0szH+d/sJ7Oc7j413HmnWbd0+yuL6SXsJyPJPGP2ld12sdP0l8GfZ3R8d1xn+PjxI/NM2Pex08+877x5RpYnGXcZg8vgiFnPxOU2YtfbiJ+3Xb6U+zTdtnIkTfdR+2pvT7ld4tOdfwyn6h4/fuJ+9vpHlz2L9Jh2fez48dsmOL147vSCy+CIm2f8+sVub9se6J+4nnYacfso2TGebj6xkqTBhHWJ3x5eezAtReeZ2M9bztj1iHL6pVxWO99k2yDr9fO3UXAaXrfIMmbazqZ/cPp2+yQ9jtOeE5Kvjze9DkyL7vix/b1x4s91gWGSbINYSfZhpu0WL349n3Wuhe64wW3kC2xTI2GdnP61dm1i1s3hDOtdY71pJE+nsb+NlPcSkeW088qU9sz4kW6x6xYcPtm4Zplijx1f+nXxljm47e0+jiyrtxwx65UwjCN+O8dsi8RlSM0bNtk+9cZPtjx2nWK2iTdcdJ7x041fpri0FL8vg8dWmv0cL2G57PaOX67gtolNX2a5gsdKsuUMzsObXnT8TNOPFz8/ZwrucRK/TIFpBreNK24Z46Xbtnbc4PnBm39sWkp+LoztFrvtY5cp9hjy5xk/D6fx1zk+fadd5+j4sfspfvi4dYjnzOOOtOnCzCM6jdjtZIdPm/bitW07tGcZ093vJcwrsjxx6xiZn51+e/Zr2rTZAfs1Znpee+S5Lu28HaZ/cH8aCd28ZYzsY3eazjJHhrHrENlm8e1OF3cf+esYNz3Tbq+f8eL3Rfx9eOJ2il/O1Osen26i2y0uzbjtifOJ9HenGxw+9fok294Jx5SdfqpjKjY9esw0vOETt3388sVvU8Odpt/N379xw8RLWG7/mpWwPeK3tV3GmG3qd4vbjjHrknnd/HQWs+2cYVKfT+w4MevqzSc4jWTbLMLdXonpI7htks7T7Z84L2+d7LZKmoaTp7XU80jsFz2OEm1dnOmYCU4rLq0mWz53vwam2YORkwYAOkWzmswXqKsqpIULA2V8lqh84RhVr2+Uho9TuapVH/kyo1H1K8eodFRicRatdctUPX11TLm0JRNNufCtqr2vWuWrAvVpDJqsWTFFaxSp2J+/02/ScPs7mdACLfDnMXy6qkJOp8Dyl0xdoFC4SVl+W+/IYd5JlasmUjaxt+2iuZRKNDdQbnHBqNLosqXbtnvXaPnK4HRNWayzVR6uV0PSr0nTzMfn7Ju5/rq5261BzUm/6MhmfzkyTq9csyJpwZtmcD8ZJXNWp1mnRAn7WWNUdYtf94Dd9u6XwBnSdUSSfWfHz15wGRx2W8Ruq9nR5XD3bdw4Zv+tisvdlrUs91dAwcR5MduldLrUtCs6bKio0P5y+rrHsCdV96hk+9lbtwQp00+G9dmyUpXh+GNjoXseSC/Nfsr5eMs+PYcWTo+uR87zSSW4Ll7OSK1c530lZraPAudIh3usuP0LNGZc8Pzk2LJO1aFSjQmsR1Q255X4tJ37+sWnl+g5NIvtfEKxs0zR6Teud9LO9MCxtPcp1TvppdRJa1mdE4LrY+ffkWnRLEM4mPYd3jjBa4Ej6/N1MtmnzxihYkWO8OHOtTAwbjredt0QWCcnTU4026RR1fOlqvWx28+9xqZNp56U55s2LmcuvLQe3Fap732yWZekx+zOl7w0asWcK5KkLbPtFiRcwzpGa918d37Ra3bc8uTjupXNfk62XG7Rbfa3kdX+ySTN/uuQ6RvB/R08D2Z57orIYts6gucH9zxtnwkikpwLcz6nxIkuk92GwXV2lzF6L5Ld+bo950mHM8+5wf02NtlxmWI7ZZP2UshlO7RrGd321Pd7idcjZ3lucdKubcv2mp79+mSXNtu9X5M+12U57zbJcH7I4j4hWkykM757/Uwu3X147PGZeC+Vet3TXKtzlPp+IAttuM6kvVZ32HXUWaapadbBP06CdeHZa1biMebv//h7vuD51oo/Nk268q8rWa9b7HXdDJPpfBIjp+tbsutE3DNg2nNK4jNK68Z6Z/uNi6bLgJRpLYvzVubnWU/JnOAxcZ5KE85FwfnYYy7wHiLt+bWHI0gDAJ3C3MS2qmmnFJ4/OppV02nc7K7uRdu7oY9c8FO+0GtVw7qGmIteVIuaI0VgRJuylbZoDfeiV60yp1swG2ku2lwGegfMO+ZFQjLOzUIkq+tY54JtO5uLecptu7vJGc5brug287KYp3xQSTkfT7J9E3wxH5Vhf1kZpxezXbxpJu6nQhXl/PAVFHgQi5EpXVvJ9l26m9Wk4pehQMWn2p9WzLZy922S5XZfNucSXPRlt7/iNQaygZthfeaG3dtusVnKU3WPlWo/J0qdftKvT+uu5uT7LaM0+ynn4y379BwzTFuO66RSpXsn5Zvt4xcf4Tfu+cB7aRP7QGsf3GekfkDJ6bzSxvWL344FQ4rsryy2c8xDk3k4L1fpnHHOw5g9lswyuQ942Z0TYtNlR6dFbxkS076XFoPnz9THRzayT58R5qMBm25iii3JyGzzZPNymGtairSaKZ2mPN+0eTlzZNOV//LO+wglyUsUR6Z18STZDnHn++A2TJW23GMj52tUcsF0HVpXqvD2wMsIR8w+7errVrb7OdVyBWS3fzJJvf86ZvqOlOeSLO9nIjJsWyvxmI09NyQ7F+Z0TslGO9e5fedJK1hUjSl+KU7K7ZRF2staputIW5fRSn6/l+p6FNDGa3rq9ckubbZrv6Z8rstu3m2T4fyQdv96L6bd5cpQjFSm+/D4dBB/L5Vy3dNcq3OT5n4gG225zqS5VnfcdTT9tnEDCUn3cfvu+RK6me1gf2a9bsmWK8P5JCi361uq60RAhnNK/DOKebdUPjZ4Z+JLk9YyzCO751mf85wUKRrNK9I1RrLt627/LM6vPRxBGgDoYPE3FKGFG7Rt+47Yxn4RYi5m/gXffKUcGndeyhd66S7M5avipm8a9+uDAk1aYdpXq9i9aMaXR9qZOnfebnmlY+tVut6u7/rYLyjSb9ty1cRvL6cJfo3jyzSftki9v9qq6yuaTJeu8yrpzXz7ZL+/vLKRy7Q6MlzMl5/D57ndwgubvRtcv3zfVN0TdMx+Trs+nVI5ePbHm6et65nrfNogtEDhhHms8F4w268n3RcsgVwmybTtvNLR65dpO9sXHCbYbV40uAEZ8+LQ+0rRPa8GHpLack7o6LTY5hcYOck1fZZorlkvZx83uS9ysnl49aWZV7pzXbp0mvJ8057lzIX31ar38i7diwIr3bq0Vaec56Ji0nU218UuvW7lsJ+zWa7O2D9BnT19R67nruzvCbLVMdf2XHT2PZwbvJiq6DUrWa7fdDrhmIjXvmXMcL/nyHw96vh7lo5Pm0Hpn+s6d94pZDiXF0xc4S5Hzaney/CUHw1mfR+eXNp177C03M7zRM7LkeFa3cnX0Yg08+m0e742rFubzic5Xd+y2f9pzinBD68yPKOkn1eaeWR7HLkfqY1W/Tj/OrQhIQdcJl1zv58fBGkAoEOZbM3OTYz79bT3NUfar4jcLxrNVw3eV8ox2WYjvOkkzz5sXphl8xWU91AeXihVruqg1y6DTlGx/Rmx9yU12Z9RnTBv/2ZxVZoH9VTb1v1aJtuvMLOYT06y3V+5MNNMVqSA+eqmMx78s0jXncb7eibljZn7RVg0y3WE+fKnTQ9JOe4vN8eWc8Od4aHUe2hcrfKVy2IecFN19yTfz63mS6yspV8f9yuxhGz23tdbuQnsp5yON6ON6Tnn+eTO3T4Zvmw3wWFzrk5XjECbzisdtH5uenEfPrPbzv6Xg43OeN7DuRe4adrV6Oxjv4iqtpwTOjotprpOZjhn5KyN6dMYNFnLnWthzfRqLXdfFHnbIFZwHVPNy5HqXOfIJp0aKc83CcuZyJ1HnJzOReb6bPZvhhcF2a5LLpKnreCx0cXydd3KtJ+TLpd3PPk6Y/8Edfb0nTnkeO7KctvmpB3nlDbpins4c989JraIp1xkkfbar53LmPZ+L8X1yP0K3eqga3pUZ6TNVOKf67py3lHJz+XJ7xNK5uxwA9OavzLh3B+U/j48Knq9yLDuaa7VuUl1nshSW68zKa7V2VxHC4vGeB0DWpob7K/spJpPymOsrfd8ge2Qzbolyv18ktv1Lfn+d5fJl/GcEv3wyjyjKFjsaow0aS3L81am48h7Rootxj97WZxfeziCNADQUdyvAqaoaWG0DE+vbNEpsUVKbFkUaDdlbEr1N5ksxKle6CWfTmOdybptv3KZPz/mIthat8hrj5lX7jdH6XkX8WjgpVW1N5lsulbGeWfI0p9W/AU6bt6uFNvWfu1eeVMw67sz/pJkWeGzmU8uMuyvNkk+zcYlU1IWIdNemdN1djI/0FWrLPAVjlu2vxaoPNWXP0n3baMWT81Q7FRKOe6v+IcgZ5sEi7+ISWORgGaq7vFsecLBB0znnFNhiijJWob1MQ9jzjYPvrBz05H9nVqa/ZTT8Wa0MT3nPB9PTi8V3PLbY9fVTV/BdveBdpkq0uYOaMN5pY3rVz018JW8m15ky//Ocjub9QlXqMwZLxK4GVUqzZ/i7ONo8Zy5nxM6Pi0mW4aM54ysBK9VuafP2PNF8EWjTQf3Rfdh7Domm5ezz+ucPZosPTj7t9ase9p0GpdmAueb1MuZhHuuq1C1v61zPheZIkmd/XtTumCmI5tjLlfJphlzbKTn5oLLUHROTrr4upX1frZf3QY/rvHq17EtRmfsn6A2TT+3e8vczl0Zzlttkvs5pb065h4u3XYujHvJ56XnrGWT9tqtncuY9n7P2cYmN3/MC8q46bfxmp5aR6XNNPs1Lo1En+uynHeyF9LtCcJmvE+IO1ekfImb+rroy/VeKrLu6a7VOUk2H3s/kEpw27b5OpPiWp3FddQLdgSOgbhjJCvJ5rPF2X7ONNtzzxe7HeO2Q5vuEbI8nwSLS8vp+pbFM2AW5xS3/hj3GUXJ6wF0pUlraeeR+TjyxQfCcj2/Zzy/9nAEaQCgrRLKEW3SrO07Yr8KcC5my1c5t5DBsmrvK465eXBfeIXTvdBzmOlEiqbwmrJm+zXH8Hne10xjo/1CzeO8BzvnISJmHJMtvyOzvZtK2pwbJG/6zt3LLaudG2Yr7bxtJaWZitpIw61UNTjvGc6y2H6+VNu2ZM4GVSm4/0areWzym9Rs5pOTdPurrUz24lVFMdPs2H0dJ4t0nZ5/A5ipGLxy1YxdF5lHaH5RbOWRSZiv5fxiDbzxpkir2lF8RC77y9kuC4LDrh8XKP6iQMXBNOcWdWVyUqTqbkcLMF8mRbKQm+YmaUGuRYikXR/zdaRfjIXXr35sNlnQ0++nXI43VxvTc27zyTYNBjnjrAieD0yzTEUxD23mgbZB4QwPiW05r+S8HR3lq8ap3h9+bIWKg7l3strOZn2cP8H60mwuypgiJNtyTujotJjkOunWB9KuInySXKtyTJ8FQ4Lr6BXv4N8neJWDR/dpwjomzMsZX943rwnnOufcITeQli6dpj7fpFvOBO65zt8uTtOGc5F5yA47D+XpAyPZHHO5MtN0tvPOwDTTnHe7Qldet7Lfz4nbqUIL44p06oz9E5Tr9Ntwb5nruSvteauNcjyntFtbztcxMm1nZ785zweKnL/XqTSn80M2aa+92rmM7jkwkA5i7vccCfvUmb5zfQqe3ttyTU+r3Wkzw35N91yXad7+C2nTz38JnaxbTjLdJxSqKHied4uiSpbTIfN9eKZ7qXTrnvpanaOENBW9H0iQZNu29TqT/FqdeIwmbDdneWvMC31/eZ1jJOykr9wkmc/UJq8em3bc84UWzpZu8seL/cA2q3VLkPl84lWw721/r9g9M5/sr2/ZPANmPqf4zyjJ6kAOSJPWUs8j++dZL23Y9Ok0FZode++bScLyJZ5fe7I+hxz2NwAAQPewZVGaByr4zFfdoebZnfcyBzkz5VIvL0rzgrtLNGpxe1/0Ap3JnOPvK25nEA0AegjOeV3A3PssU1GHBd25l+pd6bZVtTMzfIQC5Bk5aQAAAHoim9U9bS48dC23OAe/rhYAyXlFU8TkxgKAXotzXldwizsL5vxFO5Fuga5GkAYAAKAHcOtC8LORm8bNSk5OiW5hr6mTzNknU5tV1WFfcAK9jfmK1Zy/vOJF+JIVQK9kch8E79dsbgzOeR3J5HIJbmNbBBs5lToA12ogXyjuDAAAAAAAAAAAIA/ISQMAAAAAAAAAAJAHBGkAAAAAAAAAAADygCANAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAOkSrameepll1rbY9V41aPPQ0DVvSaNs7RmvdTA2bucZZunbYu0azzLI5zeItthsAAAAAAACAdiNIAwBtYoIqM1W717a2W4nmbt+hbXNKbHs+JFsnp9vYChWvcpbNWb65w21nAAAAAAAAAO1GkAYAkMEYFZ1gfwIAAAAAAADoMARpACBXWxZp2NApqlaDKseaYsAWKVhIWeMSr2gw0yQUf+aOG+0fLT4srrg0dzhnuv7wSYtB84pIW7zFG9efZtoi1+LmHzu/uHVyizlLvp7BdTRNsBg0v4i1RvPXn0f8+pjGXafYZac4NQAAAAAAABxOCNIAQK6Gz9O27atVrjGqWm+KAZsnv5Cy8PzRqh/rFQ22bVW50z4/WnyYCVBMlWpMP9OsX6CmqemKTKtW2fpx3rBpikGrnjpfusVO01muYmcZUgVqGtfHzl/+8iVbp0GTtTxhPb2gSplWe9Ow02maGhdgCVdouRa6/ZdPLLAdA+vjjBNaOUXDho5W8wxvOuGFY5x1iQ14AQAAAAAAAL0ZQRoA6EjTV0frbRk+XVWhBtVvNAGTVtXeV63yVdGAjgZN1qzpfv9kxqhqauY6akILF2rSINviTL184RiF1z3lzDFRyZzg/M9TqbN8zbtteza2rFRluFw1waCRsx4LTIBlfTC8Uq5ZkeCMLzCeu+7O38D2Kpg42xmiWU0dVs8PAAAAAAAA0L0RpAGADhQqKrS/4rWoOWxyvUSL9jJN2Uop3Nxih4lXpOJI8CW14iGxwZCCIUX2VzLB4sVGq9JZply07mp2VrJY8WvpznPnS9HAUJJhkkm9vQAAAAAAAIDejyANAHSh8lW2iLBgk6Yosw7l1jEzWvXjNth5b1BVyPbLxamnKD6PDAAAAAAAAIDcEaQBgC5RqKKQ1LQrVdFmHcfN7ZIkkNK6sV7h6asDdcTkzs0xs3JdQr0xqeYJAAAAAAAAIDWCNADQZrnU51KgSTPKFfYr6rda6xbFtLdFTGX7e9eoYr6S1mUTH2BprZufpLizDOvk1rNTrbIlgTBNmnm2XaMWDz1Ni7fYVgAAAAAAAKAXIkgDAG3iVdDv1TETCJKkM3yewgulyrHROmlCzeMClf63Tfmqcaq30xs2tkLFq1Ykn6Yz/5rp1Sqzw1ZodlxxZ9msU4Emrdigqp1TIuswbGy9StenmCcAAAAAAACAlPocctjfAIAexeQ2mSKt2qG5w20nAAAAAAAAAD1GO3PStKp2pv2SesqDarFdY7yxVtfar60ptgYAAAAAAAAAAMDTccWdPV+rcLP9HdC6/jHV9++nfrYdAAAAAAAAAAAAHRWkGTFGof7bdP+6bbaDr0VP/EeDhoZCKrJdAAAdpURzt1PUGQAAAAAAANBTdUyQpl+pSi/rp5basLYftN2MF9bq/udLNOmcQm23nVxvNKp63jRNGOUVgzZiSpVqdx6wPU0dC073JQ1qrqtSmRlm+GjNWrlN/hDpx3ccbNHaW6coNNwfd62q3WLZAhVhH2zV5mUzvWGGnqMJVy/X5lbbDwAAAAAAAAAAoJN1WHFnI742W4W7l6l2czRYsv3pNWoJTdaFn7cdfM2bFB44QZWrNij8+BJd9PaDqpxdHRvg+fUdWtpypq5dskIVX/u0wksu0+KNdtppxz+gzYun6fqHmlX8nSWqvnuhQs3LtDjsjmm1au3V56t87UDNuu9JZxqLVfrGMpVfsTx2GQAAAAAAAAAAADpJhwVpjjpjgqZ96YBq12/1crwc2KTan7ao9OILVeAOETB8lqrnTNaIogIVFDnjTRsp7d6qbftsf6OgTHOvmaARo8ao7OpyhZyphl9o8vqlG7+1XtUPtKjwmvtVPduOf+tdmnuGN6rrhTW6a/1AXbtogcqGFzrTGKNrry6TmtcovNMOAwAAAAAAAAAA0Ik6LEgjFSp0SYkOrHpQ9W9IBzbXq2b/5Zp0wdG2f8DBVjXWVWvB1RM16eujddGNm2yPgLNPd6ZoDTpFxc6flrfe99rTjb/rRZlMM6VnDfPajb7FOnOE/e1o/eNWtTj/ln7DKy7NbaZVO31a9NY73jAAAAAAAAAAAACdqQODNFLh16aqVPWq39ik+l89qH5TSzWin+0Z8Zbq552vsoXrNOBr12vB0v9UzfyRtl82shz/CPvXdUBv7bc/I0aq4le/1+aNsc01JbY3AAAAAAAAAABAJ+rQII2OCWnCeKn+5/NV8+tCzbpkpBJiNG9vVv3jB6TLfqBrx4/U0BOPdrq12J5ZyDT+MYUa6vzZ5BeNZhxs0vZAnTQFQ4qc5dqkzc4gA445Oqbp19cOBADpvNikPj/cpb22FQAAAAAAAABy1bFBGh2t0MTL1e/5RjWeMFkhEy2J13+gBvZ3/q5/TLVbnOHqqlTx02BlNBlkGr9onMpC0vbbr1HlQw3avHGtVsyYoeVv2P5GyUWaVSTV3zjNHWb7C9u0ef0aLV6yVq12EAAAAAAAAAAAgM7UwUEaqd+Ii1TWXxo6rVRDk+VK6Vuiax6Yp9D+NaqcOkN3vDBS1/8gh+LOMo5foElLVmvu2De19taZmjX/MWnGj1VxttPrjEK5NeT0HaaZq1er4oIj1bBkpiZ9Y6KuWbJWBz4/VANMfwAAAAAAAAAAgE7W55DD/u699m/S4ounqTq0QltvHJNYBBsA5MoUd7buCO35/hANsp2Cflfzokb9t23RUdp4W7G+bNvccVe9Z1ukiaWFqv3qp51fb6rmhy2qLTlOkxpf0+X7+urB75+mr/73Dg1u/IT2jPtQg/3xBn4q5by96Usbp0qj/OG/cJwOlX3Cnf7lNvPhgqmna/7p3m9j72+d+dQftG3B5XLET9Odnpm7t8z+NNMuFwAAAAAAAIAYHZ6TJv9atfbGOVpaZ4o626TN6x9U5eUzVb27WNd+kwANgM7nBmh0nA7ddrrb7Cn9QKMC9df87nlpo+136Pufkur3qCZQamNd/d+kb5v+p6lsoO247+8a/Pwn7TSP0wKn/arfvml7JvOeRvnDO/OY+N+vqc8NLXp5nDffPaV9VbGqSb+zQ5tldgNB/nI58zirvkWTYuYRmGYgQFNbUmjHOV0bBznLWUNNPQAAAAAAAEA2emGQ5kgVFh5Q+O5rVD59msqvXKqthWW641cPaeZpdhAA6Cz7dmnJfx+ljW4QwzPoq5/Rgn3v6rc2EPPlskCumoGf0aSBB/XyX2278YXPRIMzEcFpDtL00r6q2/uubU8mMPzAIZrzBefvF46L5Jxxl0kf6GWzTO4y99WD3w7mgBmk+VOPUl3j3yLBJckZpjQ6hF5s1eX6lO7xc9s4vlxqAkLvRII/AAAAAAAAAFLrhUGao1Uy427Vrn9e27bvcJrfa+3d8zThNLc2GgDoXH/9UHUmx8kNL6pPpHlNFQoGYkwOFL9foKgwa+KgT9hfAQOP0Mn2Z8TeA4EASmZJp2u4y/xxnRwfGDr+CE3c96Fetq2KG2bvXz7wcvgE1/WHf3emZYM/AAAAAAAAANLqhUEaAMg3UweNX2xYtHFzsezbpUk3BIsIK9SDCblm8iBZECgbpg6auPWMKaYNAAAAAAAAQEoEaQCgI5ncJ2lykuz973dV94XjohXydwdujplocWwRJodNmuDNoM9+XIrJaQMAAAAAAAAgFwRpAKAjufW/HNTlP98VKIrsTdXUeO1uYCNQZ8ve3+5JKO6syyVd5r1auOo9LRgXrKcmzukFenDgexpVEyx0zRnPtv+u5kX1iekHAAAAAAAAIIggDQC0VXx9LDfsUM0+6ctlhXpQwX4tevlLNthxerE2fiFaZ81V+ky3KO7sy2Wna+Og4DK/Jk21RbSl9GmVff84Lfjv1+w4pvmbTi5NGdYBAAAAAAAAENDnkMP+BgAAAAAAAAAAQBchJw0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAedCuOmm2bNlifwE4HAwfPtz+AgAAAAAAAAC0V7uCNAAAAAAAAAAAAGgbijsDAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAIA8I0gAAAAAAAAAAAOQBQRoAAAAAAAAAAIA8IEgDAAAAAAAAAACQBwRpAAAAAAAAAAAA8oAgDQAAAAAAAAAAQB4QpAEAAAAAAAAAAMgDgjQAAAAAAAAAAAB5QJAGAAAAAAAAAAAgDwjSAAAAAAAAAAAA5EEPC9K0qnbmaRo2NL5ZpEY7RLvtXaNZzjRn1bXaDgAAAAAAAAAAAB2vzyGH/d0DmCDNaDXP2KG5w20nR2vdTIXmN6h8VWx3AAAAAAAAAACA7qpXFHdWMHGFtq0qV/XUDsxRAwAAAAAAAAAA0Il6T500w6erKlSt+i223dG4JFmRaF6RafHFmZncOMNmrnH6NmqxM/ziwHT8ItAi01oSDQUln4cRVzSbO20AAAAAAAAAAABP7wnSqEDFp0pNu7xQiAmelGm1tm3f4Tbhhc0qcwMlBRozbozC654KBE1a1bCuQeUzJjt945gAzdgKFa/yprNt+wZVFXm9Us/D9ButylOj/WrGeeMAAAAAAAAAAAAYvShI4wk3t7iBleUry1Uzp8R2NUWizVZ5uF4Ne53fo0oVsr9de59SfbhcpUnqs2lcVSEt3BCo66ZAkyY6080wDyNUVOj9cJRMTBIAAgAAAAAAAAAAh61eF6RxAyO7mxRWtcoixZCZZorTpUHNu52BBp2n0lCD6jd6eWlaN9YrPH2couEWX6PqV0rFQ5KEVzLMo2RsucLzRzvdqCcHAAAAAAAAAAAk6kVBmviASrlqbFFjwcbLEWOLPDO5bvyizsYmhmg8Y1R0gv2ZIM08hs9zf7tFoJkATqAeGwAAAAAAAAAAgF4TpGmtW6bq0AKVmwDJCcUKqVlNfnFmSbhFnq1cp0ZT1JnseAkKVRTIcRMji3kYBRNXaNv21SpfuUy1GYYFAAAAAAAAAACHj14RpDEV+IfmF6lmha33ZdBkzZreoMqbvEr8Pa2qXRJod4ep1vKb6qVx56WoL6ZAk2aYYsvmBwIsznTqGjPMI25ee19Sk/0JAAAAAAAAAABg9MggTfXUYD0wp2l50QZt2z4vpk6ZkjkbVKUKhSLDjVbz2NjK+916Y8JS6ajkIRqXKbZsVZEqx0anU69Ct1fqeRSoONh9bL1K16/QpEHuaAAAAAAAAAAAAOpzyGF/AwAAAAAAAAAAoIsQpAHQqz2x8++65rE9+p9979suAAAAAAAAANB1/nHgkbrrosG68NRP2S5RvaJOGgBIxQRohh1/lG0DAAAAAAAAgK5TMvgofb6gn/ueMhly0gDo1frc8KL79+mZJ6vw00e4vwEAAAAAAACgK7S8+aG+suJl9/eh2053/wYRpAHQq/lBmpevP1UnHXOk+xsAAAAAAAAAusIrb7yvk+/Y6f5OFqShuDMAAAAAAAAAAIA8IEgDAEn86U9/0s9W/lTz5v6rZn53um65+UY99ugjeuedd+wQAAAAAAAAANA+BGkAIM4T636txYtuU//+/fWdGTN11933aPyEi7Tnz3/W/BvmqaXlT3ZIAAAAAAAAAGg7gjQAEPCnV1/VY489qlsXLNSUy8p06qmfV7+jjtLZZ/8vzZg1W9+acpnu+fHdduhEtTNP07ChyZvFW+xAHa41+XyXNNr+ncGb56y6VtveqMWduo4AAAAAAABA70OQBgACfvkfv9DEiZP1mc8cY7vE+vKoczVgwADblmjSih3att00G1QVkspX+e07NHe4HShHrXUzswq4BOflNnNKbJ/DQ7bbCQAAAAAAAOguCNIAgHXo0CH9cecfde7o0bZLcmPOG2t/AQAAAAAAAEDbEaQBAOvdd9/Vx484QkceeaTtktyxxxxrf+WucUmwSLJFCub7cHOCRPrNVO1er0ix0PwGaeUUt3u0eLHsudOduUatWxZFp2/abX+53Z1l8ftHcqN4RZhFxolb3nT8eTYG1slb9uA0zTp6w3viim1Ltox712hWZHx/eTpmOwEAAAAAAABdrc9r+/5yyP4GgLw4tuB4+6vj9bnhRffvy9efqpOOSR98+eijj3TlrBm668f3pg3UbHzmGY0691zblooJHIxW84xoMWcmQFOm1ZFiyEwgI7SuVOEVk1VgghBTpZrt8+T23bJGtSdM1qRBdrjm2WmKL0ucV5A7vglgTPfnbQIlU9S0cIOWTyzwAiBTqwP9HSYYMrZCxaui0/SmU2SX0Ztn/Tg7DTtN2eH9eYbi56Exqlq/wl0vd3vsXOCtf8L04raXP34odvjKU+O2Z9rtBAAAAAAAAHStV954XyffsdP9fei2092/QeSkAQDrYx/7mIaffbY2PB22XZJ76qnf2l852LtGy1eWqyYQQCiYOFvl4Xo1+LlJQsUqtD813AvQ5KJ6aiAXitPEVuIfnHeJyheOUbi5xbYbY1Q1NbpsjasqFJ6+OiboUzBxoapC1aqPmW4aoQVaYAMuGj7draMntHBhZL1Kpi5QKNwkdym2rFSlAsM73P4r1wVy7zjLeIsJ0BgFmjSjXNr5ksgzAwAAAAAAgJ6KIA0ABEy57HI9+sjDevGFF2yXKFNnzX/8YrU++OAD2yUHu5sUVrXKAkGUYUOnOF0a1Lzb6T98nMrDFQolBFeyV75qh7ZtjzYxuWqCASBfTICjSMWRoFCrmnY6oxTFj1Gg4lOlpl1tD4sUD4kGYYJadzVLdv0j22dshbPNmtUUKRItuIyWH+QBAAAAAAAAeiCCNAAQsPaxRzVgwNF64P5qrfzpfXrhhf/Wjh3bteXZZ3XbwgXa9uIL+tc519uhc1WumkAQJTaYUqK5pn39AjW5OWKyr/+ls6QKqHQaU5RZ3LbZtt0rGg0AAAAAAADojQjSAIC16uf/V//9hz/o+h/coAX/fpsGDRqs/3x8rR7+VZ2erH9CX/jiF/WDf6vQpz71KTtGDk4oVigmV0gKgyZr+fYdqplereV5q/zeyzFTvT4+TOTlsOmM4E3BkCJyxQAAAAAAAOCwQ5AGwGHPFGN2f/XP9IfnG90AzYABA3TkkUdq/ISLdP28G/SDG+Zr3g3/posuvkRHHXWUHStHgyZr1vQGVd60JlDEWKtql3jtrXWLVBsJ4HjBkBhdXPeKVx/MlJii11rr5rv1xpQHi1HrKG6dNdUqWxIMDDVqcUx7FqijBgAAAAAAAD0IQRoAhzUToFn5k/vcHDQ/+Lf5+sxnPmP7dLySORtUpWC9K6PVPNarCL9giFQ5Ntq9ftwGLbeV6BdMnB2pr2ZWmtw11W4xaYFmZjAglCOToydS9JrXhNaVKrzCr7i/oxVo0orVKl85JbAOy1Q0tcT2zyzb7QQAAAAAAAB0F31e2/eXQ/Y3AOTFsQXH218dr88NL7p/X77+VJ10zJHub58J0KxYfq/+Z8cO/VvFjRo4cKDtAwAAAAAAAADt98ob7+vkO7xicw7ddrr7N4icNAAOWz9b+RNte/FFt4gzAjQAAAAAAAAAuhpBGgCHrenfmaG7fnyvBg/+B9sFAAAAAAAAALoOQRoAAAAAAAAAAIA8IEgDAAAAAAAAAACQBwRpAAAAAAAAAAAA8qDPa/v+csj+7gFe19q5l+r2TbbV9WX9oHaRJhxvW9vsRd3zldl6yPn15Rse1hW7LtWsmm9p+dNX6QzbT/eEddUXvaEBdJxjC9p9AKfU54YX3b9PzzxZhZ8+wv0NAAAAAAAAAF2h5c0P9ZUVL7u/D912uvs3qEcGaXZ9OxAs+cM9Gn3Vq+0M1HjTbRj7sBb/87G2WxBBGqAzdWaQ5rQf7tTnC/rpse1v2y4AAAAAAAAA0HW+WvxJ7X7rA+34/qm2S1TPL+7si1dpednv1PDs67ZD251UmCxAA6Anu+uiwfpj6wHbBgAAAAAAAABdywRozHvKZHp+ThrHC8tCmqVl2jB7sM0Rs0xj1s/W7ZuiRaG9/p/zdPFtv7NjeEWaeblmosWcebxxRj3rDL8+pEcXj9exyXLSuDl4fmFbpMuy7QcgQWfmpAEAAAAAAACA7qrn56TR63qlWfrykGgU6ne3/V9pblgbnvYCNCaI4wZcnjbdTLNMJ912qeb+p8l9c7quevph/WCkF0zxx0nLDcJIy/3p1c7TK1fN09q/Ov3++rjmusWvRfsN8cYCAAAAAAAAAACI6PFBmtf/c5Fu3/QtXRGsS6bsf0cDLX99XA/UfFk/mGtyxPhO11X3fEu/W/875V5I2uta+/Nf6LJ7rtIZtouOH68rYopcO1En+fN3+k0gFw0AAAAAAAAAAIjTI4M0D10V0uiveI2XQyYQMHEEc9Vo7yv6XTBo4ht0kr686RX92bZmb492bYpdBtPMqpF+t2uPdPyXNWbkLzTL6ebl1AEAAAAAAAAAAEjUI4M0XrFktnHrjMlg5En6B/uzo8Qsg9/MPt3pc6wmLDbtXpFqo79ii0EDAAAAAAAAAAAI6AV10mTg5pgJa2N8oMTksGlT8GawhoyUXmnJlEvG1HUT1qM3SLfXvmi7AQAAAAAAAAAAeHp/kMbWF3P74scD9c+8qHuu+oUu+3YWuXASHKsJ3/6WfnfbopgcMq//5z1e+x/u0T1/8LoZf971O/sLAAAAAAAAAAAgqvcHaRxnzA5redEiXRypQ2a2dE9YV7W1Qv8vXuXlkJkUrZPm4l3naYKp92bQSXolUF/NLC2zxaABAAAAAAAAAABE9Xlt318O2d8AkBfHFpgIJwAAAAAAAAAcXg6LnDQAAAAAAAAAAADdDUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAB6vQ0bNuiSSy7Re++9Z7sA3R/pFgAAAOj9CNIAQEDjktM0bOhpmnBXow7Ybr7Wupluv8VbbAcAQI8QDoc1depUbd68WZdeeqn2799v++SXf82JNKPGa9LVi1S7pdUO0cUONGrF18/RpGWJ18CcdNR0DnPdNd1690MzVbvXdoho1GKTjpc02vYu8sZaXeseQ1NU86rtFnSwVZuXzVRouBlmpta6h9cBNddVqWyU6fYlLX2+VWuvO0cjrlurbI++1sev1ohRV2ttwnZAt/b2Nq1dcrUmuPveNOdowsIGvW17d1edmd68a9Ei5whGt7VlkU2vgXT7jau1uK5RrQftMEC31KramcG0e5pGjL9aKzZGr7ap7ytyEX9dt52BHoQgDQAk0bxsvu7fYVsAAD2WyYkwY8YMLV26VKNGjdKZZ56pr3/9690oZ0Kp5q68X9X3LtDcKSM18IUaVU4drQlL8hDgeP9NtfzlLR34wLZn4+1GVc+botBdgdd7bZkOYnT/dNt9vL1xnerVT/36N6o23GS7Rr1df7vK79qkwiuWOMfZZBWajjuqNWv+g3prbKWWr6zUyP5vat8rB/R+DgfdW627neHft23OfLZU63rn2F3Kxzzd18FtWjFloq5/aLeGTVng7Pv7dceNkzTs4NvdPqAcn95weCr9gXO/sHKFquaUaeTAraqZ71x/L16kxrzH8FtUf+vVmnDdmqwD3Z2Fc3E3dUa57rD3u5MHbdbS6efr+l+/ZXvmIkVaS7iu2+5AD0KQBgASFKuoqElLb35QzXyZBAA91vr16/Wd73xHdXV1GjZsmNvttttu01lnneUWIfXOO++43YLmz5+vP//5z7atKxTqzFEjNWLsZJVf4zxYPvm0qqcXq3nlFaps08NrOwwYo6qNO7T2mhL1s50yeuclbX60Ua3Bd4dtmQ4ieka67S5a9cSj9dL46zV3rLT9/nptt318B/abPBIjNembE5zjrFQlBU7rO2+qxfkzZuLlCo2arBGnFqv8V89r670TZHpno+iKOm3dskITBnntB3Zt0totreI1ejf2whNa3ixNWvKQ7rhmsrPvR2rCZfN0x43Z7/d8iU9vODwVnuHcL4wao0nTv6eKezcofH+5ipqrVX5jfZ5zg7Wq8aF6NXeDDJ+ci7upY4s10t7vzr3vfl17wgGt/dUTbQjqpUhrCdd1rzPQkxCkAYAEIV1/Y7kKn6/SHXXmUp/CG+br4WmR4hJGTKlS7U7/Ozy/yI+GaLbbUVO04NfO9PZvU/WVo3Wm0//MsXNUExnHEVMkxzmacPVybc7350gA0EM98MADkRfdhw4dUp8+fdzu5oX38OHD3dwK8V544YWkL8G7TN+jNeK6hSrv7zy8Prk58tLl7R1rtGDKOe715syxzvWkrin65ffbjaoxuVki14417oOqq3WTl9PF7fclhaY+qGbT2RYtUf14tWaN/ZKGzTRfJMYVV2WLV1m82Xy1OEUjTD9zLfPnbfqPrVDY/F45xRvW/XI1SbFXezdpxdXjvWm4y7hI4UDRVJGiLp53hrPXSHNdrd9tBziM9Mh0m8zBFoUjxUqZtHenNvsJOt39jp/ufllv03yaYpheXadaJwFOuOAiXXTBBGn3GoUjOaG9IlZC8xuc3w2qHOvMy0nnT5minaZWu0NUTzXzN9O3xbG4x4GR5D5u+GjNWrktctwFi2cxxUV58wlMc8dyXehM48L7trndPW+pfo7T/4Ll2s6HQHmzr3Wf/RVn7xrNcvbZrLrAzXdct8h+3xm8n5+pFcEb9oNvaXug2J3Q1CTPCLeviZxXF2/ZphUXON2+4Z2ffS0PmfOqV4xffHFAbz//oJtbwMzfFJV5beCZJe31wj0u7bFn03QXfw6ADjRgxDwtmN5PBx5fp03++dVcb23adNPGsk3RItEyXdcdbk6U6dHrddmtawIvxJOk33pzjEyRe1YNVyjkdPOOlyTn0fY+D/vLv75JtXb+5virfsEbP+m52G1Dt9J3mEoucP6Gm6L3qwEp06B7Pk5Ma26RjQnXdYd/Ljb3uW5amaLrH2rU25Hrb7LzcfR+oHHzcu8e2b/+O+fP4HGzOBw47wMdgCANACRx9IjvqeKyfgrffqfq37Ad4zVvUnjgBFWu2qDw40t00dsPqnJ2dexD90NzVdVypq5dWKlJxzSq5rqZmnR5hZq/slDLl8zS0LfWakGl/zKtVWuvPl/lawdq1n1POtNcrNI3lqn8Ch7kAaAt7r///khOBOOjjz6yv6R///d/17hx42xbN9N3qEZc4vxd/6JM4U0Hnr9Tl329SttGLdba9U+qesYp2jR/os1p06Ka707RghdO17UPeNeOi/a3ei+a9zsPn1dM0+Knj9JF81eoeuVdmlX0fuCFXIMWPypd++jz2rZicsovyRturVD41Nm6a+USXTu0WTXOvBdvPCAVTVb1knINNQN9bZ4z/fs1qcgdJdbetZo1fpqWm+vhvaaoi2t1ZnO1Zn19Ttw1tkkrFq/VgG8sca+RxTsf1LX/+mDSB/jerMem2xgHtPn28Zr10Pu6aMnjCq97wEl7rdrnxpGyu9+pXrFJI+78vbZtn6cS2y1eyzOPqVFjNKLkaA0oGamQk1pq1/tBkQEaceX9uuMKsy2HqXyJk/auHKkzLnH+/qDUHcIrOmiyit22JH59h5aadLtkhSq+9mmFl1zmpf04xc40vfkEpnnaBE37krOM9VujL94PbNXmx6Wh00o1tK/thq5zxmRVjHXu728cr0k3PqjGNtd/0KTq6+/QW+Odc9W9lZrwmU1aOu3/s3UiHVDjPZdp0sIXNWKhTftDNqlyyvzY890Dy7V51I+1efsOzR0+TKFvFkovhLU1skyt2vxUo/SlixQ60XbyvfqgZk5xrglDv6eadRu0duFFeusv3svC9NcL57hcPE2zVm5V8XeWqPruhQo1V+jah9xR0UMNPWey83+9tpkTjb3ePnbMbFW7aaNU+346TdNWBoPFaa7rjqbfN2jg+Eo9tN4Zf4mTth6q0KwHYsePSb+hkU6amif3rGqLtJo1YoA7mKsTnofrl9ypluHf013m+Ovv3MtccYc2O4uf9FzstqF7aVGL+aBiRHHSe8+UafCY5GnN7PfE67o9F89/TP2+udC9R636upN2bp2iy+KOh9jzse32bJWqHh2gsoULNXPo2+71v2zyNar+zFQ33Zm0XH3dMjfdAR2FIA0AJNVPoauXaILW6vq7GyJfFsUYPkvVcyZrRFGBCoqcB/FpI6XdW7Ut+HHeqdeq6hpTvMblqph3udOhSW9fuEBVl43RiPHf07XfcDo9H1ajea56YY3uWj9Q1y5aoLLhhc40x+jaq8uk5jUK7zQTAwAcHvrpaFOW9n5z9XlL9fcvV/PXFmrFNWNUNKhQJZfNUvkIP6dNq3abylFLQppwhnftmHnfLPel9vZVc1TdXKKKVfdr7kTnujNqjMpuLQ+88O6n8hnlGhp4l5LM0ZdVetetURM08967VNb/gGqe3KQDxxRrxPBiDTQDnXCm03+kio5xR4mx/Vd3Kry/VFU/c65vY01RF5er6u5Klexfq+WPB+sQ2afQlZXeMM418vrL+jnXyK3ant8yXNAmb6vlVSf9Fo1UqXkJc2KJk/YWaIJJLFne74SunK3StEU7NSlc1+gMWKoxZrhB56k0JLXUhu3LvH4q/NJIjfy8melAFQ130tWXnPmd6vx1jhXDKzqoWCkPgYIyzTX3cebYubpcIeeOMPxCYr03A5xpevMJTrNQF35zjLO+j2mTzTV2YHNYNc4ROCnEa8O86FuoSXf/RsunD1XLL83X1eeoPJjLIGv7NPK6Fbp2vLOvzfls6fXOXrV1Ir1Rr+plTSq99T5dO9am/SvLNcI539VvDuRZCc3SrAuiryeHXmAC3g2q9yvT3vuU6sNS6bcv8upRCtrX4n4lfuaoizT0xAIVjXWeSWaYM3uG68Xex1T9QIsKr7lf1bNtur51sa5JFlxHj9Hvk0c6/x/Q+x/a6+0x39PiWy9XiZs2vOfN5v9wzove4K6U13WnX8lsc8/gXM8HOeOPL3fSj3NebdzmffzhC6bffk46G3Wml05tkVYlJwQKO+2E5+GCqfMix9+1053z7P4GNb6c6lyMbuXgATU/eqdWbHbS2riRiec3R8o0mCKtmf2ecF235+Lo+W6kJlzzgJY695bNP6pVOPiCJ+587Jms6280RadN0LW3Xu+cnw9o+0n/4pxbvbQ807z72b9Gm6jHGB3oY8cWHC8aGhqafDbd1jGluv4m56bvoSrdlewTiYOtaqyr1oKrJ2rS10frohs32R4BZ58eufHwbqCde4DTow/mxZ93pu844NxUt/5xq/mmREu/YbLo2maaybbbore6WQkmAIDO9Jb2ma+pnQfOo9Ws7b92fv96ji32wTQXqNJ5uNXbbzqPjENVOtu5rtTN1MixM7W4zhTcZLRq25YWacRkhVK+gHMegE+wP9M4c2jghXK/UzT0bOfv7n1Zln/vLEejsxyhMRoZDOAUna4znT/b9wanMlJDi6IvdgqLnAdgZy5cA3uiAo0ZP0b9XlikCV+ZoutXNqjZ7Oq+2d/vFA9JlbfL2lGv+1+Qhn7lTPslboHO/MowJ20u09qOKt8mcB+nQae4X2S3vJV9TQcFYy9SqRoVftYclQfU+PQa51iYrAvjc0ag6/QtUGjOam3eWKeqbxSq8a5pKp2Xa30ezrnq84GX0CcGzmfNL6re+V0/xytuzG0uqJA5Zb+1P5B2Tj0l9gty53w36QwpvHGruyxvb2lQ2Ek9paOO9voHnTFOM53zeu2V5yh05SLVbnHSl5szK8P1YneTWzxl6VnRnHrqW6wzR9jf6JHe3me+EBymE46x19vddzppyd//p6n8Aaf3bnO/EJX2ur63UbUrq3TtN5xn3LHjvfQTLz79ptMJz8Nnfj5yZlbBEHOTw/Nyt2eLJxt2xpc0Yd5aHTnxbt1hchAmk00azMSei0vPCZzv1M+Zv7m3bNG+YM7GZOn57KEq9k/z/fu5HyQNHT40EvQrLDL5yL3gKNBRyEkDAGkUjK9URahF1bcu06aYyuneUv2881W2cJ0GfO16LVj6n6qZby74mfX7ZOChLsFIVfzq986DY2xzTapyPgAAvc/+rQo/7lwvRpyuSHxl6oqEa8PmJRc5D5X9VHLN49r8yyWaNnyfcy2aotLJy9Xov41xLjlH2Z8d4z3zTIrDWL/+5hVFg5p3ee0RrS0yeUyGDvJeYRRcvEKbnrxfFV87Sg1LZmrCuKu1NlKUU/vvd7av94rH2b5wfORl3oSFpgiTA6r5tfdFeN4dE9KE8VL46U16++B2hesOqPTiC7N/uYnOc8wwTbq1TrU/GKYDjz+oJ9pT/9VB57wYp+zexPS9eHy6PV+s0ETnAHDrFnlLm9bXS+Mv1pgkuRPVr0TXPvp71S4p18g9Naqcer4mLWuMpvmU1wvrCPvXMi/H0VMd0Nan10r9R2jYENtpRKVq4/f/xu+lLDYy5rr+Rr2uHz9FC9YPUOl1C7S07iFVdEIQj+fhw5AtnswUO1b75PNuUXyFyYr97KI02BYD+3/a/gI6B0EaAEjHFIswr1IlzctVs/ZN29Hx9mbVP+7czV72Azer9dATj3a6eSXptpX5CqifNmlzkzTgmKNjmn6UWw4AneK//uu/VFlZads8H/uYd4v84osvavr06e7vLnOwRWtvrFJt/zGqmmreSBSqKOT8Wb9dLUfHXhsGDLAvOQ46140zJujaJXXadO9kHdhxp+pfKFDxqU7/cL0a2lzvgqdlb6CInjcaFd4s9cv6K1p/ORq0KfjVYvOL2ur8KTmB19Vtkc90O+DzZ7r1ENWsiy0OtmX9Ywo7dzJnFtkvY5102e+EkSq78X5tfnSehr5Rr7UbWzvmfufgNoVrnfuuEy5XlX3p4zVLVH6GdKCuPhqozKujFZp4ufr9+ik11K9Tzf4JmhBKkjMCeXNkf7M/3tKBQHrZtz96z39gu3POs7+jmtQaLPvJGcZ8sR0yaf+EYplTdnhHS0L69k/ZqRSee5FKtFab659wnjOksotDyYtqMsWz9T1aQ8d/T3f86vdaPvGAtt+1TtszXS+OKXSP3U3BIvucY6nxSfsbPU7Lo/O1oK6fQjdNV0lfe73dvMlJoXH7/5jYxJfqut5v8zqt3e+kveu+pwmjhqmw/Y+4OeF5uBezxZOZYseGBovDi/N2R6VBey6u/32w/pkD2vbCJql/oQqTBcCBPCNIAwCZFF2uyuuK1fh8oOyM/gM10NQXsP4x1W5pVGNdlSp+GqyMpg1KLtKsIudG4sZpqnyoQdtf2KbN69do8ZK1sWUAAwBy1r9/f51xxhm2LSoUCumZZ57RDTfcYLt4FbVv27ZNkyZNUnl5ue3aWVq0deMmbd64VjV3Van8Kxfo+vVHa+Z9d2mCWx9HgS78+gT1232nps1YrrVbtmn7lk1au3KOqk1dNGrUCtP9hRa9/eo2rd1oQh9j3GLMSi6rVKh/gyqnX63qx808GlRzY7Vbl0Euwguv0VJ3/LVaevV81atEc80X38bAU1TsXw83rtHmJHWoectRr8p/qVDNemc66x9U5dVVaiwq1/WXpCjqAq5umW6LnPuV8f104KGZCk2v0tK77tTSW6dp0o0N6je2UtNGmJcvrVp7i7O/NzapdW+Ts883qVmFKh4yoGPudxof0/LdUuE3J2mSfenjNRN0mUmb+x9UfRfX5uu9XJQafu0cB3VmfT39hpdqUv+1umtJvQ5cdpFCSd+6o0s8v1xl8xapuq7BPR/W3jVH196+SfrSJI00uRAGnakRTtrc/qP53jnv8eWaddemaJF3Efu0vDJwPpt3p1r6X66yrxU407hQk5zjo+WuaSpftlaNTvpudM6d1XOyOPeeOEYTviTVLqzSWmd6pe6xlETjcnfa2199Sy0vPKawmXCo2FnODNeLonEqCznrd/s17rFnzukrZszQ8mAAHd1aywvmWuzs04fu1ILp5+jCefUaMPsBLb3Y++ChZMJsFTlXae966+x/Z/hw3SItfjz27Jrquj5g4MDIeazRecatvb0iy/RhA4TP1qt2fYPqn2/j02sHXB9SnYvRM2ROg1mmtUFOWppeHDkXu8fNXVfo2oec0+X8cqU6vQL5RJAGALIw9IqFbtnPEX1LdM0D8xTav0aVU2fojhdG6vofZFfcWUp9h2nm6tWquOBIt1iQSd+YqGucG9IDn4+WfQoAaJvCwkJVVVXZtqhPfvKTeuyxx/Tcc8/plltuUZ8+fbR9+3ZNnDhRP/3pTzV69Gg7ZGep1+LpzgPk9Dla/KutOnriAtU8Xqdrh0efHgd8bYkeu7dcI/f+TNdPnahJM+aouvEUnenWa1Gggv6PqeobF2jEuMu0dPtQVaxerEkmwHPCZC1dvUTlQ7bqrjnOPK6er7UHBmaZAyaqbOH1OvrxOc7D7hzVvBHS3NX3qcy/JjrXw8sWXq6SN0zg5U41xhQNatnlKBv8lBZf6SzHnGVqOqNSNavnqcQEeJBS90y3R6t00W9UfU2pBm5/UCuWLdeKX+/TyOlLVLtksi2+5EgNPOYlLb96vEJjx+uaR45U2b33a65J1+2+3zmgzb+ucf4fpmkXBMua93i5EaSaR8M51jPSTiWX647LSrRvVYVm3d2oyHfq/UZq0ncK1bJ7n8ouGOm+fEKeHFOowtbNql440znnztSCXzWr8LIlWvuzy1Xkpttild1ZqQmDmrVizkzNfVyadfOsaLGTESNV8YMxal5xjcqvvEMNxzj7/lcmGG36mePjcS2fPkL7fj5HZU76Lp//MzUWn+nWaZReoS785hgd2H9A/S67KPVLxIEFOnrtrZo07hxdeMWd2mbOp86xZ87tma4Xk5as1tyxb2rtrTM1a/5j0owfq8LUR4Ieof52c78wTdcvWaOt/SepatVvVHtNSfS8ctosPbS6UqWfNNdbZ/9/4xrd8fj7Gjo09uya8ro+/HuqmTNGb9VVqOzq27V9+PVZpo8CTbjaeTY+epOWXjlX9Xts51x1xPNwqnMxeoaMaTDbtNZPJdc9oOo5IR1wzsXmuKlaN9C5F3HOzxP5QAjdU59DDvsbAAAAOCzt37/ffcHd2Niofv36qaamRueee67te5jaskjDplarfNUOzR1uu6FbId32BAcUvvUczXqkTDW/n6cSiuzp0VrrZio0X6pav8ILhgM9Cdd1AOi2yEkDAACAw54pVqqurs59wf3QQw/xohs9Aum2G9tbr5q6YPEqlxOgAQAAQFIEaQAAAACHeeFdW1urUaNG2S5A90e67aaOOKDw/Gm6frU0aWGdllK8CgAAAFKguDMAAAAAAAAAAIA8ICcNAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIgz6HHPY3APQ6r7f+1f4CAAAAAAAAgPw5tuB4+yuKIA0AAAAAAAAAAEAeUNwZAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAIA8I0gCA1bjkNA0bmryZVddqh+p4Sec7c406b45Sa93MwDxaVTuzc9exIyTbTou32J7tFJm2s02ecn8vUqPXR4s7cD4AAPR4WxbFXIu9ZqZq99r+ncGdp39t7rj7Fu/67083mVzvA9Is2941mpV2Xp3BW/5hS1LN1fZ3Gn+Z3XtEt9siNbi/s9+3mbdnfpl9k3RbxKQvoJtJes61TSc/M7qSzJ9nI2TNvfYluS5mm64ShktxrjbDmeMhfn7Jjp+U18Qs+POxrb7EdxXJlzNhuPYsC3odgjQAYJXM2aFt272mZroUWrgh0r58YoEdKkcpLuLxgvNymxWT1cY59kxt2U7rF6hpavsfEszLiLKdCxS22/08Nx3MU4ntDwAA4oTsdTPSrNCkQbZfD+Ld+0Wv+W6Aoje9MNmyTtWhMQqtXJfkZZEJKE1Rk723cu91nfux0Pwi1bj7dJ7GTFyR076N357Z3t91lUkzyqWEbeFsh/uqVb6Kez90U8Pnuceo26xy0nDw/NvmZ0YToM0cgHVfKE9tVtV6Oz/T2GewjgiU4zAwaLKWO+km+D4l23TlXpOnyl6TvCa8UGpKSLf2PD7DOR6SzC/2nmWDqnZO6cBrvfexQ+R9gm3CC5tVFnOMeR9xlGl1ZBh3WfRSt7lGHs7eeP11bd60SVufe852ifXqq7vcJhkzjhnXTKO9CNIAAHom5wZswcIxql7fATdYp55yeAXFAABAr9e43ry0WqjSULXqU3zUUjwk7g4oVKxC+7PXGT5dVc62WB58ubxlpSq1QOXDbTsAz5ZFKltZrpr4QK15Cb5+gTR/fufmoETvlHW6alXDugaFFk6PCaAXTJyX+OHA3qdUHy5XaVbn8QJNumVBio8Xcte4ZIqqp69OCJgWTFzhBpQqb7IfKrjLOEZVU2PWRpPmHGYf53ZD77//vlat+r9avuwe/fjupXr++diU8fjax3RTZYXbmN9BZlgzjhnXTKO9CNIAQLbM14CBrKkxOTiS9PO+EKmWwhUKme5t+VrDne4iNdpsu970g1ln/WI4/OIqov3is9JmnePEn2dwndxl977+SDW92PklW8bk47d7O+00X594055V12jnEfhqJWbbOU3gi04z79D8BmnlFLef+XIntii4JOKmx1dkAAD40l/z/XuJZNfraDFb7bm+etOPuUdx72cSv2Y1w0Sv+V63+HuCqFTr0w5J7h0jUvZLvf0SNap+pXlpVaAx48ao+r7gvY3ZT6NVGZaqp3rTeaDafLEcdz/m3xO64/jzbo255wtup+A9VOL93VOR8WOYeXRZbpsCNzdNeP7K6Dr5X1+b1rT3eP69tm067CtsoJ1yPZe43aaoWg2qHGu6B5/bokyQN/4FecSgyZo13Rl/lT2S7LHfaM/jkWMnZv72+bLLjnd0D/59gW3LOl0VqPhU5xLS3OL1S6N1Y73C08fZacbOL7VmL0dO/LuC+HN7fBq2nT3mOhsfeIkqmDhb5c41sNosy6BTVOwcc827vX7oPvbu2aPntngJ5qOPPkrITfPs//t/9lfsb8MMa8Yx/Gm0B0EaAMiGuTgHs9q62XHtg7G5sAez6zr9ipzObpEPwSzpc5JfvDOrVtlN0gI/S2zIaY+7eaieuk6lbn9TVIP3EB2TldZmH858s+Jz5rF+XGTckPvCYrSaZ3jTC5scLFOjNynmQTw4Pzd7b9wNePXU+dItieO3Zzu1NDfE5IIJz19m52G/zDH7bWy9SgNZqWtOrVDILpuZt1kWma9fnH4Zi7Uz+zpmeqtVPH90DtsVAIDeL9U13xd/vXY/mlhXGigqxLu+JrzQz8gGJAK5bFt3NTv/B1+MtKg5PEZFJ9hWV4EmrUh9T5BpfXKW4t7Rle6e00q430mitW6Zqu1Lq4JRpQqF69UQmUaJ5rr3lFL5Km86V5SvyOp+LOzsl/qxdtmc4cMpvqZPvL87z9034XVPxdwfNpoXduPOi9zLdTqbm8bNWRTMRZP2Hs/cW0eLhnPvxyM7DMijNjyjesWnrVa5xth+yYr6a1XTziQ57QJKxjrHt/uxnBWu0HItdOflF58YW6TVONWbwC0OY7mlq5Kp9j1E2sBeo6qdS3SqQElSu5sUdo6GYuf62bqxKea8X+7ML/JsnykN731JTXY6yZWodLrUtMtdG5W79w9JPlZAXn38yCM1YuRI9/dnPztIJ510kvvbd/oZZ9hfsb8NM6wZxxgxwptGexCkAYCM7Fd2wbKq7Vce9Rv9C2zg4uz0m5RjkQnmgTf6hUb8hdu5gb7FzwbrfQEYc0PsiPkaxTxwhstVE3y4dpYpt6LBAuO76+r8nb5ac+16uV+FBL4+WW6yLAfm5301EnwZYJZxYeRFQsz4beXcNJXFf7kyfXbgZYW334LzNUrmODdfccuWrcZVFVLM9OzNVkcUuQYAQE/h547wm7gXKBmv+cHrtXsfEbzXMUo01wQA4l7oZ6NgSFGg3hFTXIpzVzM9cK1262kp1ZjAvUEmieuTuviw7CW7d8zmntMRc7+TjFdMTPlY/17uPJWG4qbRVoH7QS/gkf2XwYnBIu8r5NJRqV/YdTzvXrr6vkVaHMhFk809XvTFojONiYH7TyAvOvMZNVkwO5NyzYoEt5M9h3nndRzOckxXTppd7tbbkqbEjZyv6Y1aPDWamye2+LRgUCWLNGyCPTkUEWqKQDPBUtl3P3zo2T0MHjxYM2ddqRmzZutbU6bovLFftX08k7/xTV33/TluY34HmWHNOGbcmbOvtF3bjiANAGRkbibMV5SBlxFOU7ZSXvZb98G3WmVOt7Z+FRFTIb7TxOboSPJ1RrjJWaqo4NcoreaL0SQ3C+5Li7jgTi5CRSluP9wvUbz1j24fLwt98KE98YuZ3LP7xgSz3K/GYr8gjV1Gb78lzrdQRTm8UIjyvvyJD6i5RaO0Y7sCANDjxFTC6zRxZbFnuubHXK8DX7TGOKFYobj7nawMHxf4kOQp1atU5VNLFbLXanOflGvOjcT1aaeU944Z7jmtlPdkvoTy+b0cRm0JesVLNm/vhVYW4oJFXm6fTAGnTmCCS86danWkLppM93g2h5bZLxTVhG6js59Rc3xeinn+TPUcBuT6HO7ldPVzucQXOZZVbsyYD0umSKti37eY3LzB48eTZRrO9T7FDTw567Oq3Dt2KTqzW+jTp4++/OVROvOs5JHsL37pS26TjBnHjGum0V4EaQAgS15xEHGNm3skeuNgikVIXz54F+nyivBN5X9x28ZpIl9adpDYYFayrPnxcv0CLLP4gJrbxL2cAgAAOejQyurNl7BeIMCUUy/z8saUBe/m4PBymHTei0OvDP3M0t87pr7nzI5bPn/cBzRuwKGNOYk7jpeLxQs4xeX26VJ2P8XdL6e7x3O/gHba3WJzne1JcTXoLjrnGTWYoyC5zC/HO/45DD1de9KVX0xntZZHzr9e3WvRHFwpxH1YEn1H4dVfEyy2vcaUIBKRIQ0HPwpJKk1uUVPs4HpTnNuy/L87QrdBkAYAMjI5L7L5StDcOJiyyhWpRDEfYov5iDJfjnZK8MZ86dreoss6hZdjJrFoD/NVTFseGrKvvBAAAGTJzTGTJHiQYzEiQYVFY9zrdYtz6+O9HPECN827zT1AMIdJx3PnnSzHStL1ib93zPaeMx0b/Ejy4rbG2Qb5vEd1mZda5j41IbdPPmV/j+fWteMWV7My4V4b6Fqd+4xq6gYJp0rntpjK1EUVJn8Oa3XrCMPhrH3pKvZDiGDda23iFpW2QOGkH0Fkk4a9e4tUx5W7fOmKYjMfkNifgEGQBgAysl/9xVWM2lq3yGvfsiimPFG3MvugthTV0R62QtSyYNZZ54anItcK9bJlyz6uvClY/EOrapfkWBxEh2+n5PutccmUNhet4VdeGFN+bNz+BwAAOUh6H+GVGe/XF5Irt+4T53pdtjJajJp5MVQ91dwDZHih084iTL16VypUEcxp4dyHzQquT8p7xwz3nNmwdRMmC364FTIn+ZCnUyXc35mXWtVaflO9wu15udbB0t/jOekxeF/tFtEH5Fs7n1EzFTs1fJ5qnGO1LK54Kfd8Nja+Dqd4tojF4Mt493k0fhlw2Mk6XbWqdmbiMNEgTgfkxoz/SMQ5ZqLFnWWXht36bk0xbHHFlrXWzVTIvH/x69sz65cwTIYgDg47BGkAIBvOzYT79dHYQLERzeO8Gwjn4t4UKAvYzS7rf43hB0xMvzTljcaXgR1f1mpuTNb2DaraacpstdMbW6/S9bH1t3SkkjmBCv3cZrSax+bwYiXL7ZQzk414VVHMfovZP7kyZcj65cf663pfsS3PHACAw0RM+e5e054PFkzuBL8YKW96XpnxbS421a2LwfkbDAK4OX+V9oVOwcTZKrfr1ubirNzy5v3ihez6jK1QcXB90t47prnnzIIpKiZmvYPcolmqVd+OfZWTFPd37pfU4U76eKit0t7jFaooeF/t1ouYTbG7QCdr6zOqk3rLF9p6ltI8d7o5x1bJO4b9xn2ujK9DNZEpIjC8sDk67k3SgmCl6zhsZZeuTK4Ze/2IGca+03DrnPPrFWsj57y/IHj8rB8XU9xZdmnYy6lWo8A1wmlC60oVDtafa3LNuHXqxA1DsekI6HPIYX8DAAAAAAB0ni2L3AAIL6eAw4ubu6B5dts/mAMsU9n/8qINGYOFQE9CThoAAAAAANAFvKLs0lc4DqDXsUVFtat4KsCVpkJ+oAcjJw0AAAAAAOhEpn6B0aoMS6GFfP0M9HZenRzB+jvGqKoTi98GgJ6OIA0AAAAAAAAAAEAeUNwZAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAd9DjnsbwDodbZs2WJ/AQAAAAAAAED+DB8+3P6KIkgDAAAAAAAAAACQBxR3BgAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAIA8I0gAAAAAAAAAAAOQBQRoAAAAAAAAAAIA8IEgDAAAAAAAAAACQBwRpAAAAAAAAAAAA8oAgDQAAAAAAAAAAQB4QpAEAAAAAAAAAAMgDgjQAAAAAAAAAAAB5QJAGAAAAAAAAAAAgDwjSAAAAAAAAAAAA5AFBGgAAAAAAAAAAgDwgSAMAAAAAAAAAAJAHBGkAAAAAAAAAAADygCANAAAAAAAAAABAHhCkAQAAAAAAAAAAyAOCNAAAAAAAAAAAAHlAkAYAAAAAAAAAACAPCNIAAAAAAAAAAADkAUEaAAAAAAAAAACAPCBIAwAAAAAAAAAAkAcEaQAAAAAAAAAAAPKAIA0AAAAAAAAAAEAeEKQBAAAAAAAAAADIA4I0AAAAAAAAAAAAeUCQBgAAAAAAAAAAoMtJ/z+utyHC73KTgAAAAABJRU5ErkJggg==) - Click on **Manage > Assign devices** and then click on **+Add Devices** ![ADE enrollment profile | Assign devices](https://techuisitive.com/wp-content/uploads/2023/12/image-23.png)- Search for the device serial number, select the device, and click on **Add** to assign the device to the enrollment profile. ![Intune IOS ADE | Add a Device to enrollment profile](https://techuisitive.com/wp-content/uploads/2023/12/image-24.png) ## Wipe a Device to enroll with a new profile Once a device is assigned to an enrollment profile, you need to wipe the device. The device reboots after receiving the updated policy and its goes through the OOBE screens. - To wipe a device, navigate to **Intune admin center > Devices > All devices** - Search for the device using the device name or serial number - Click on the device and then click on **Wipe** from the top menu. ![Intune iOS | Wipe a device | iPhone iPad](https://techuisitive.com/wp-content/uploads/2023/12/image-25.png)As soon as the device receives an updated policy, it’s rebooted and the user needs to follow the instructions to complete iOS device enrollment. ## Related Posts - [Deny M365 Apps access from Untrusted Locations](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/ "Deny M365 Apps access from Untrusted Locations") - [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/ "How to Restrict Website Access Using Web Content Filter | Intune") - [Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/ "Fix Something went wrong – 2002 error on iOS | Intune") - [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/ "Configure Home Screen Layout on iOS using Intune") - [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) - [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) - [Create ADE Enrollment Profile in Microsoft Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune Guides, Intune iOS, Windows Experience --- ### [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) **Published:** March 13, 2024 **Author:** Equebal Ahmad **Content:** [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") has built-in policies that can manage software updates on iOS/iPadOS supervised devices. It’s recommended to use these policies to manage software updates through Intune and not leave the responsibility to install software updates to the end users. Leaving iOS update responsibility to the end user may lead to different issues. Users can apply iOS updates that your organization has not approved. This may break applications if they are not compatible with the latest iOS version. Users may also opt to simply avoid applying the required updates leaving the device vulnerable to security threats. In this blog post, we will understand how to manage iOS updates on iPad and iPhone devices. We will also go through the end-user experience for different update scenarios. Table Of Contents 1. [iOS/iPadOS Updates Default Behaviors](#iosipados-updates-default-behaviors) - [End User Experience When No Update Policy Deployed](#end-user-experience-when-no-update-policy-deployed) 2. [Defer Updates on iOS / iPadOS](#defer-updates-on-ios-ipados) - [How to a Create Device Restriction Policy to Defer Updates on iOS/iPadOS Devices](#how-to-a-create-device-restriction-policy-to-defer-updates-on-iosipados-devices) - - [End User Experience when Deferral Period Settings are Configured](#end-user-experience-when-deferral-period-settings-are-configured) 3. [Deploy Updates on IOS/iPadOS Devices](#deploy-updates-on-iosipados-devices) - [Schedule Updates on iOS / iPadOS](#schedule-updates-on-ios-ipados) - - [End User Experience for Scheduled Updates](#end-user-experience-for-scheduled-updates) 4. [End User Experience for Scheduled Updates on Shared iPads](#end-user-experience-for-scheduled-updates-on-shared-ipads) 5. [Related Posts](#related-posts) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## iOS/iPadOS Updates Default Behaviors By default, user can see the latest updates available on their devices from **Settings > General > Software Updates**. Users may receive a notification when the latest iOS software updates are available for iPhones / iPads. Users can choose to download and install the updates as per their preference. ### End User Experience When No Update Policy Deployed Users can go to Settings > General > Software Update on iPhone / iPad and check for the latest available software updates. If an update is available then the user can perform the below actions. - Users can choose to download and install updates. - Users can avoid installing required updates. ![Manage iOS Updates | iOS Software update intune](https://techuisitive.com/wp-content/uploads/2024/01/20231206_091505000_iOS-472x1024.jpg) ## Defer Updates on iOS / iPadOS The Software updates can be deferred up to 90 days on iOS/iPadOS devices. There are two settings: **Defer software updates** & **Delay default visibility of software updates** which need to be configured. These settings are available in **Device Configuration / Templates / Device Restriction** and can be deployed using a device restriction policy. ### How to a Create Device Restriction Policy to Defer Updates on iOS/iPadOS Devices You can follow the below steps to create a device restriction policy to defer software updates. - Open **Microsoft Intune admin center** - Navigate to **Devices > iOS/iPadOS > Configuration profiles** - Click on **Create** and select **New policy** - In the **Create a Profile** flyer window select the following and click on the **Create** button. - **Profile type:** Template - **Template Name** : Device restriction - In the Device Restrictions **Basics** page, provide policy **name** and **description** and click on **Next**. - In the **Configuration settings** page, expand the **General** ![Intune device restriction policy iOS](https://techuisitive.com/wp-content/uploads/2024/01/image-13.png)- Scroll down to find the below settings. **Defer software updates:** Turn on the settings. It represents days before software updates are visible to end users after release. This does not impact any scheduled updates. **Delay default visibility of software updates:** Specify the number of days (1-90) to delay the default visibility of all software updates. Available for devices running iOS 11.3 and later. ![Defer software updates iOS](https://techuisitive.com/wp-content/uploads/2024/01/image-14.png)- Go through the remaining steps of policy creation to assign the policy to Entra ID group, review the details, and create the policy. ### End User Experience when Deferral Period Settings are Configured Users will see the following message when software updates are deferred on the device using Microsoft Intune update policies for iOS. *Your iPhone is running the latest software update allowed by your administrator.* ![You iPhone is running the latest software update allowed by your administrator.](https://techuisitive.com/wp-content/uploads/2024/01/image-15.png) ## Deploy Updates on IOS/iPadOS Devices The iOS updates can be deployed on iPhones / iPads by scheduling the updates deployment. When update policies are deployed, it overrides the deferral period configured through the device configuration profile. An update can be scheduled during the next check-in, during a scheduled time, or outside a scheduled **time**. ### Schedule Updates on iOS / iPadOS The Intune update policies for iOS can be configured from the Intune admin center. Follow the below steps to create update policies for iOS/iPadOS. - Open **Microsoft Intune admin center** - Navigate to **Devices > iOS/iPadOS > Update policies for iOS/iPadOS** - Click on **Create profile** - In the **Create profile > Basic** page, enter the Name and Description for the profile and click on **Next**. - In the **Update policy settings** page, provide the following details. - **Select versions to install:** Latest update - Schedule Type: Update during the scheduled time - **Time Windows:** A period during which updates will be made available for automatic installation. You need to provide the start day, start time, end day, and end time for each time window. ![](https://techuisitive.com/wp-content/uploads/2024/02/image-1.png)- Click on Next to go to **Assignments** page. You can assign the policy to **All Uses**, **All Devices**, or an **Entra ID group**. - On the **Review+create** page, review the settings and click on Create button to create the policy. ### End User Experience for Scheduled Updates When checked for new updates from **Settings > General > Software Updates** on the devices where updates configured through update policies for iOS, the updates download started automatically. ![Intune iOS Updates End User Experience](https://techuisitive.com/wp-content/uploads/2024/01/image-19-1024x354.png)The following message appears on the lock screen. ![Intune iOS Updates notification](https://techuisitive.com/wp-content/uploads/2024/01/image-20.png)When the device was unlocked, the software update installation prompt appeared on the screen. You can postpone the update installation by clicking on the Later button. *Software Updates : iOS 17.2.1 is ready to install.* ![Intune iOS Updates popup](https://techuisitive.com/wp-content/uploads/2024/01/image-21.png)You may receive another prompt soon to install the software update and you won’t be able to defer the installation this time. *Software Update: iOS 17.2.1 is required by your organization.* ![Intune force iOS update](https://techuisitive.com/wp-content/uploads/2024/01/image-22.png)## End User Experience for Scheduled Updates on Shared iPads The end-user experience is different on shared iPads due to the limitations or restrictions applied. Users won’t be able to see the software updates on the settings app. The software updates on Shared iPad can only be initiated by MDM solution, or when the device is connected to Mac using an Apple configurator for Mac, or when the device is physically connected to Mac using the Finder. For iOS/iPadOS shared devices, to apply updates, all users must be signed out and the device is charging. The users can be signed out or the device can be rebooted, which automatically signs out users. If the **“Maximum seconds of inactivity until user session logs out”** setting is configured in the enrollment profile then the user session logs out automatically after the defined inactivity period. Otherwise, you need to consider other options such as rebooting the device to apply software updates on shared iPads. ## Related Posts - [Deny M365 Apps access from Untrusted Locations](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/ "Deny M365 Apps access from Untrusted Locations") - [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/ "How to Restrict Website Access Using Web Content Filter | Intune") - [Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/ "Fix Something went wrong – 2002 error on iOS | Intune") - [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/ "Configure Home Screen Layout on iOS using Intune") - [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) - [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) - [Create ADE Enrollment Profile in Microsoft Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune Guides, Intune iOS, Windows Updates --- ### [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/) **Published:** February 12, 2024 **Author:** Equebal Ahmad **Content:** [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") includes some built-in settings to configure different Apple features on iOS/iPadOS devices. One of such setting is to customize dock and home screen layout. The home screen layout setting applied to: - iOS 9.3 or newer - iPadOS 13.0 and newer - Automated device enrollment (supervised) When you apply a home screen layout through Intune policy, it’s overwrites any user defined layouts. Hence, it’s recommended to use this policy for userless device such as Kiosk or user device where you want to show only limited applications on home screen. Else, this may lead to user dissatisfactions. ## How to Configure Home Screen Layout Follow the below steps to configure iOS home screen layout using Intune device feature profiles. - On the Microsoft Intune admin center, navigate to **Devices > iOS/iPadOS > Configuration Profiles** - Click on **Create > New Policy** - On the **Create a profile** window, select **Templates** - On the templates list, select **Device features** and click on **Create**. - On the **Device features > Basics** page, provide the **Name** and **Description** for the profile and click on **Next**. - On the **Configuration settings** page, scroll down and expand **Home Screen layout**. ![iOS home screen layout Intune](https://techuisitive.com/wp-content/uploads/2024/01/image-26-1024x789.png)- In the **Grid size drop down**, select the grid size which you want to apply on iOS/iPadOS devices. If the target device doesn’t support selected layout then some app may not fit and pushed to next position. If you want to retain exact position for each application then you can consider creating separate device configuration policy for different screen size such as iPhone and iPad. - To add an app in the grid cell, click on **+ icon** , search for the application and add the same to grid cell. The apps added in the grid appear in the same order on home screen. Another apps that are already installed on the device are placed alphabetically after configured apps. If you don’t want to show any specific app installed on the device on home screen then you can [hide the application](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/ "How to Show or Hide Native Apps on iOS via Intune") using Intune device restriction policy. ![iPad home screen layout | iphone home screen layout](https://techuisitive.com/wp-content/uploads/2024/01/image-31-1024x600.png)Scroll down to go to **Dock** setting to add the apps that you want to show on the Dock screen. ![](https://techuisitive.com/wp-content/uploads/2024/01/image-29.png)- Click on **Next** to go to Scope tags. If you want to limit the policy scope then you can add the scope tags here. Else, click on **Next** to move to Assignment page. - On the **Assignment page**, assign the policy to Entra ID group or as per your requirements. You can also use [Intune assignment filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/ "Organizing Laptop and Desktop in Intune Using Filters") to further narrow down the deployment scope. - On the **Review+create** page, review the policy settings and click on Create to complete policy creation process. - Monitor the **notification area** to confirm successful policy creation. ## End User Experience ### Home Screen As you see in below screenshot, the home screen icons are organized in same ordered as configured in the device feature profile settings. The additional application installed on the device are added in the grid cells after configured applications in alphabetic order. ![ipad home screen](https://techuisitive.com/wp-content/uploads/2024/01/image-32-e1707159992695.png)### Dock Icons The below screenshot show the dock icons in similar orders as configured in Intune policy. We have configured the policy to add Settings, Camera, Safari and Photo apps in first 4 grid cells. The remaining grid cells taken over by other applications. ![iPad dock settings](https://techuisitive.com/wp-content/uploads/2024/01/image-36-e1707160211453.png)## Related Posts - [Deny M365 Apps access from Untrusted Locations](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/ "Deny M365 Apps access from Untrusted Locations") - [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/ "How to Restrict Website Access Using Web Content Filter | Intune") - [Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/ "Fix Something went wrong – 2002 error on iOS | Intune") - [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/ "Configure Home Screen Layout on iOS using Intune") - [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) - [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) - [Create ADE Enrollment Profile in Microsoft Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune Guides, Intune iOS, User Experience --- ### [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) **Published:** February 22, 2024 **Author:** Equebal Ahmad **Content:** [Microsoft Intune](https://techuisitive.com/microsoft-intune/) includes some built-in settings to configure different Apple features on iOS/iPadOS devices. One of such setting is to show or hide built-in (native) apps. You can configure the policy for visible or hidden apps through Intune device restriction profiles. This feature applies to below iOS/iPadOS versions. - iOS 9.3 and newer - iPadOS 13.0 and newer These settings are available for Automated Device Enrollment (Supervised) devices. ## How to Show or Hide Built-In iOS Apps Follow the below steps to create an Intune device restrictions profile to show or hide iOS native apps on iPhones and iPads. Apple prevents hiding a few default apps such as the Settings app cannot be hide. - On the Intune admin center, navigate to **Devices > iOS/iPadOS > Configuration** Profiles - Click on **Create** and select **New Policy**. - On the **Create a Profile** window, select **Template** under Profile type, select **Device restrictions** template, and click on **Create**. - Provide Policy **Name** and **Description** on Basic page. - Click on **Next** to go to **Configuration Settings** page. Expand **Show or Hide Apps**. ![Hide native apps on iOS | show native apps on iOS](https://techuisitive.com/wp-content/uploads/2024/01/image-34-1024x678.png)- Click on **Type of app list** combo box, and select **Hidden apps** as we are demonstrating to hide apps in this tutorial. If you want to show the apps then you can select “**Visible apps**“. - **Hidden Apps** – The apps added in Apps list are hidden from the user. The users can’t see or launch these apps. - **Visible Apps** – The apps added to the Apps list are visible to the user. The users can only see and launch these applications. Users won’t be able to see or launch other apps. - On the **Apps list**, add the **App bundle ID** and **App Name** for all the apps that you want to hide from the home screen. You can find Bundle IDs for native iPhone and iPad apps on Apple support page. Bundle IDs are case-sensitive. ![Hide apps on iPad / Hide apps on iPhone](https://techuisitive.com/wp-content/uploads/2024/01/image-35-1024x797.png)- Once you added all iOS apps that you want to hide, click on **Next** to go through **Assignment**, **Scope tags**, and **Review + create** to complete device restriction policy creation process. ## End User Experience In the below iPad home screen, you can see the native built-in applications such as Facetime, FindMy, and Freeform. The screenshot was taken before the policy to hide the native app was applied. You may have noticed that a few M365 Apps appear first on the home screen. Then native apps appear in alphabetical order.. This behavior is due to the policy applied to configure iOS home screen layout. You can check out Configure Home Screen Layout on iOS using Intune to learn more about configuring home screen layout on iPad / iPhone devices through Intune. ![Intune hide iOS apps | hide native apps on iOS](https://techuisitive.com/wp-content/uploads/2024/02/image-3.png)The below screenshot was taken after applying the policy to hide built-in apps. We have configured the policy to hide a few native apps (Health, Magnifier, Freeform, Facetime, and FindMy). Now, you can see in the below screenshot that apps like Facetime, FindMy, and Freeform are no longer visible on the home screen. ![Intune show IOS apps](https://techuisitive.com/wp-content/uploads/2024/01/image-37.png)## Related Posts - [Deny M365 Apps access from Untrusted Locations](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/ "Deny M365 Apps access from Untrusted Locations") - [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/ "How to Restrict Website Access Using Web Content Filter | Intune") - [Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/ "Fix Something went wrong – 2002 error on iOS | Intune") - [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/ "Configure Home Screen Layout on iOS using Intune") - [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) - [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) - [Create ADE Enrollment Profile in Microsoft Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune iOS, User Experience --- ### [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/) **Published:** January 13, 2024 **Author:** Equebal Ahmad **Content:** The Apple Web Content Filter settings can be used to allow / restrict the website access on iOS / iPadOS ( iPhone & iPad ) devices. [Microsoft Intune](https://techuisitive.com/category/intune/ "Microsoft Intune") provide an option to configure web content filters on Intune managed iOS devices. These settings are available in device feature profile. These settings works for supervised device enrolled to Intune using Apple business manager or Apple school manager. There are two types of filter available in web content filter. **Configure URLs:** Use Apple built in Web filters to block explicit contents. Apple automatically identify and block unsuitable content. If you want to override apple built-in filters then you can add the URLs to Permitted URLs / Blocked URLs. The URLs added to permitted list are allowed irrespective of built-in filters. Similarly, the URLs added to blocked list override built-in filters and blocked. **Specific Website Only** (For the Apple Safari browser only) : This filter type allow the websites access which are added in the allowed list. All other websites are blocked from the targeted iOS / iPadOS devices. If you don’t enter any URLs, then users can’t access any websites except for `microsoft.com`, `microsoft.net`, and `apple.com`. These URLs are automatically allowed by Intune. In this blog post, we will configure Intune Web content filter settings to only allow office.com portal access from Intune managed iOS devices. The settings will be applicable for Safari browser only. If user have other browser ( Microsoft Edge , Google Chrome etc.) installed on the device then they can still access other websites. ## Create a Device Feature Profile to Apply Web Content Filter Follow the below steps to configure web content filter on IOS devices using Microsoft Intune Device features profile. - In Microsoft Intune admin center, navigates to **Devices > iOS/iPadOS > Configuration profiles**. - Click on **Create** and select **New Policy**. ![Intune Configuration profiles ](https://techuisitive.com/wp-content/uploads/2024/01/image.png)In the new flyer window, select the following - **Profile type:** Templates - **Template name:** Device features ![Intune configuration profiles - Device features](https://techuisitive.com/wp-content/uploads/2024/01/image-1.png) In the **Device features > Basics** page, provide the **Profile name , Description** and click on **Next**. ![Device features - Web content filters](https://techuisitive.com/wp-content/uploads/2024/01/image-2.png)- In the **Configuration settings** page, expand **Web Content Filter** and select **Specific websites only** in **Filter Type**. ![Web content filters | Microsoft intune ios](https://techuisitive.com/wp-content/uploads/2024/01/image-5.png)In the **Specific website only** section, enter the URLs of all websites which access you want to allow. You need to provide website URL and Title. The bookmark path setting no longer works due to recent changes made by Apple for Safari browser. All the URLs are automatically added to Safari browser bookmarks. Click on Next to moved to **Assignment** page. ![Web content filters | Microsoft intune ios](https://techuisitive.com/wp-content/uploads/2024/01/image-7.png)In the **Assignments** page, assign the policy to Entra ID group and click on **Next**. ![Intune web content filter](https://techuisitive.com/wp-content/uploads/2024/01/image-8.png)In the **Review + create** page, review the settings and click on **Create button** to create the policy. You can monitor the notification in notification area to confirm successful policy creation. ![Review + create](https://techuisitive.com/wp-content/uploads/2024/01/image-9.png) ## Verify the Applied Policy on iOS/iPadOS You can see the web content filter URLs title in iOS/iPadOS settings app once policy is successfully applied on the device. Follow the below steps on iPad / iPhone to confirm if web content filter policy was successfully applied on the device. - Open **Settings** apps - Navigates to **General > VPN & Device Management > Management Profile** - Select **Restrictions** - Select **Web content filter** You can see the URLs title listed under **Allowed Bookmarks.** If you do not see Web content filters under **General > VPN & Device Management > Management Profile** **> Restrictions** then policy has not been applied yet. ![Web content filters - iOS](https://techuisitive.com/wp-content/uploads/2024/01/image-12.png) ## End User Experience We tried to access office.com portal from Apple Safari browser on the Microsoft Intune iOS device where web content filter policy was applied. The MS office portal worked fine. This was the expected result. ![Web content filters - allowed sites office,com](https://techuisitive.com/wp-content/uploads/2024/01/image-11.png)Now we tried to open gmail.com from Safari browse on same device. The gmail was not accessible. Again this was the expected result as we have only allowed office.com websites on the devices. User received below message. Restricted site : You cannot browse this page at “account.google,com” because it is restricted. ![Web content filter - blocked sites on iOS](https://techuisitive.com/wp-content/uploads/2024/01/image-10.png)## Related Posts - [Deny M365 Apps access from Untrusted Locations](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/ "Deny M365 Apps access from Untrusted Locations") - [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/ "How to Restrict Website Access Using Web Content Filter | Intune") - [Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/ "Fix Something went wrong – 2002 error on iOS | Intune") - [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/ "Configure Home Screen Layout on iOS using Intune") - [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) - [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) - [Create ADE Enrollment Profile in Microsoft Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Browser Configuration, Device Configuration, Intune Guides, Intune iOS --- ### [How to Fix "Could Not Find the Recovery Environment" Error During Windows Reset](https://techuisitive.com/windows-reset-could-not-find-the-recovery-environment-error/) **Published:** September 14, 2024 **Author:** Equebal Ahmad **Content:** *Windows Recovery Environment (WinRE*) is a recovery environment that can repair common causes of unbootable operating systems in Windows 10 / Windows 11. It can also be used to [reset the device to factory settings](https://techuisitive.com/how-to-reset-windows-11-pc-to-factory-settings/ "How to Reset Windows 11 PC to Factory Settings"). You may encounter a “Could not find the recovery environment” error when trying to reset the device to factory settings. Error: Could not find the recovery environment Insert your Windows installation or recovery media, and restart your PC with the media. ![Windows 10 Recovery Environment WinRE](https://techuisitive.com/wp-content/uploads/2024/07/image-3.png)The issue may happen if the recovery environment is not present on the device or is disabled. You can follow the steps below to check the status of Windows Recovery Environment (WinRE). REAgentC.exe is a command-line tool that comes with the Windows operating system. This tool is used to configure various settings for Windows Recovery Environment. We will use REAgentC.exe to check the status and enable WinRE. You can follow [this Microsoft documentation](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11 "this Microsoft documentation") to learn more about REAgentC.exe tool. Open the Command Prompt and type the following command. This command shows the current status of the Windows Recovery Environment. `reagentc /info` ![reagentc /info](https://techuisitive.com/wp-content/uploads/2024/07/image-4.png)The screenshot above shows that a Windows Recovery Environment is present on the device. However, it was disabled for some reason. Run the command below to enable the Windows Recovery Environment. If you don’t specify a Windows RE boot image, the computer attempts to enable Windows RE by using the default Winre.wim file from the `\Windows\System32\Recovery` folder. reagentc /enable ![reagentc /enable](https://techuisitive.com/wp-content/uploads/2024/07/image-5.png)The Windows Recovery Environment was enabled successfully by **reagentc /enable** command. You can run **reagentc /info** command again to see the current status. If the Windows Recovery Environment no longer exists or is corrupted and could be enabled by this command, then you need to use a Recovery disk to reinstall Windows. The reagentc /info command shows the details. - Windows RE status: - Windows RE location: - Boot Configuration Data (BCD) identifier: - Recovery image location: - Recovery image index: - Custom image location: - custom image index: ![reagentc /info](https://techuisitive.com/wp-content/uploads/2024/07/image-6.png)## Related Posts - [Bulk enrollment of Windows 10 / 11 Devices to Intune Using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [How to Reset Windows 11 PC to Factory Settings](https://techuisitive.com/how-to-reset-windows-11-pc-to-factory-settings/) - [How to Check Windows Build Version | OS Version | Release Information](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [How to Join Windows 10 Device to Azure Active Directory](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Windows 10 / 11 **Tags:** Windows 10/11 troubleshooting --- ### [How to Block USB Device Access with Exceptions using Microsoft Intune](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) **Published:** September 27, 2021 **Author:** Equebal Ahmad **Excerpt:** Microsoft Intune includes Endpoint security policies which you can use to secure your device and mitigate the risks. The Endpoint security blade list all the tools available through Endpoint Manager that you will use to keep devices secure. In this blog post, we will discuss how to block USB device access using Microsoft Intune Device Control settings. We will also discuss how to manage exceptions so user's with genuine business need can still access USB media's. **Content:** [Microsoft Intune](https://www.techuisitive.com/intune) includes **Endpoint security policies** that you can use to secure your device and mitigate the risks. The Endpoint security blade lists all the tools available through Endpoint Manager that you will use to keep devices secure. In this blog post, we will discuss how to block USB device access using Microsoft Intune Device Control settings. We will also discuss how to manage exceptions so users with genuine business needs can still access USB media. The option to block USB device no longer available through the Attack Surface Reduction policy. Please use the Settings Catalog as described in the new post [Deny Write Access to USB Devices Using Intune Settings Catalog](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/). Table Of Contents 1. [Create Azure AD Groups](#create-azure-ad-groups) 2. [Create a Device Control Policy to Block USB Device Access](#create-a-device-control-policy-to-block-usb-device-access) 3. [End User Experience](#end-user-experience) 4. [End User Experience After Applying Exception](#end-user-experience-after-applying-exception) 5. [Manage exceptions through Azure AD Group](#manage-exceptions-through-azure-ad-group) 6. [Related Posts](#related-posts) ## **Create Azure AD Groups** We will create two Azure Active Directory (AAD) groups to block USB device access and allow exceptions to devices when users have genuine business need. - **All Windows 10/11 Devices:** We will use this group to deploy the USB Device Control policy on all Windows 10/11 devices. - **USB Device Restrictions – Exception**: We will use this group to provide a temporary or permanent exception to user by adding their devices to AD group. Create both groups from Endpoint Manager admin center | Groups blade. **Group 1 :** Group Type: Security Name: All Windows 10/11 Devices Membership Type: Dynamic Devices ![Endpoint Manager | Group](https://techuisitive.com/wp-content/uploads/2023/03/image.jpeg)Dynamic membership rule: ``` (device.deviceOSType -contains "Windows") and (device.deviceOSVersion -startsWith "10.0") ``` ![](https://techuisitive.com/wp-content/uploads/2023/03/image-1.jpeg)**Group 2:** Create second Group **USB Device Restrictions – Exception** with the details in below screenshot. We are not adding any members in this group as of now. Group Type: Security Group Name: USB Device Restriction – Exceptions Membership Type: Assigned ![](https://techuisitive.com/wp-content/uploads/2023/10/image.jpeg)## **Create a Device Control Policy** to Block USB Device Access We will now create a Device control policy to deploy settings on Windows 10 / 11 devices. The device control policy will block USB device access once it’s applied to a device. To create a **Device control policy**, Go to **Microsoft Endpoint Manager admin center** and select **Endpoint security | Attack Surface reduction | Create policy** ![Endpoint security | Attack surface reduction](https://techuisitive.com/wp-content/uploads/2023/03/image-2.jpeg)Select the following details in **Create a profile** pane and click on **Create**. Platform: Windows and later Profile: Device control ![Endpoint security | Device control profile](https://techuisitive.com/wp-content/uploads/2023/03/image-3.jpeg)![Endpoint security | Device control profile | USB restriction](https://techuisitive.com/wp-content/uploads/2023/03/image-4.jpeg)In the Configuration settings tab, set **Block removable storage** setting to **Yes** and click on **Next** ![Endpoint security | Device control profile | Block USB Device Access](https://techuisitive.com/wp-content/uploads/2023/03/image-5.jpeg)Apply the scope tags in next screen if applicable, else click on **Next** to got to **Assignments** tab. Add **All Windows 10/11 Devices** AAD group in the **Included groups** section. Add **USB Device Restriction – Exception** AAD group in the **excluded groups** section. Click on **Next**. ![Endpoint security | Device control profile | USB restriction](https://techuisitive.com/wp-content/uploads/2023/03/image-6.jpeg)In the **Review + create** tab, review the settings and click on **Create** to complete profile creation process. ![Endpoint security | Device control profile | USB restriction](https://techuisitive.com/wp-content/uploads/2023/03/image-7.jpeg) You can validate profile from **Endpoint security | Attack surface reduction blade**. ![Endpoint security | Device control profile | Validate](https://techuisitive.com/wp-content/uploads/2023/03/image-8.jpeg)Force policy sync on your test device and check the policy Assignment Status after some time. The policy has been successfully applied now. ![Endpoint security | Device control profile | Validate](https://techuisitive.com/wp-content/uploads/2023/03/image-9.jpeg)You can also validate the per-setting status if you have added multiple settings in the same policy. ![Endpoint security | Device control profile | Per-setting status](https://techuisitive.com/wp-content/uploads/2023/03/image-10.jpeg)## **End User Experience** Once the policy successfully applied, a user would not be able to access the USB media. The following error will be shown when the user tries to access USB media. ![Endpoint security | Device control profile | End User Experience](https://techuisitive.com/wp-content/uploads/2023/03/image-11.jpeg)## **End User Experience After Applying Exception** To exclude a device from the USB block list, the user device needs to be added to the AAD group that we created in the beginning. Go to **Endpoint Manager | Groups** and select **USB Device Restriction – Exceptions** Group and select **Members**. Click on **Add Members** to add the device to Azure AD Group. ![Endpoint Manager | Group | Membership](https://techuisitive.com/wp-content/uploads/2023/03/image-12.jpeg)Once the policy is refreshed on the client, the user can access the USB device. We have added the same device in the exception where USB was blocked. ![](https://techuisitive.com/wp-content/uploads/2023/03/image-13.jpeg)## **Manage exceptions through Azure AD Group** As an MEM | Intune administrator, your responsibility should be limited to the policy implementation. Since the exception management for this policy will be an ongoing activity, this needs to be carefully planned and handed over to lower support tiers or location leads. Here is a simple plan which you can use to delegate the group membership. A global AAD group will be used for policy exclusion and a child group for each site ( This can be departments, business units, etc. based on your requirements) will be added to global group membership. The child group owner will be from the local site who can validate user exception requests and add the user to their site-specific exceptions group. See the illustration in the below screenshot. ![Endpoint Security | USB Exception Management Plan](https://techuisitive.com/wp-content/uploads/2023/03/image-14.jpeg)## **Related Posts** - [Block USB Device Access with Exceptions | Microsoft Intune](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows Local Administrator Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [Check OS Version Compliance with Device Compliance Policy & Notify User | Microsoft Intune](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/) - [How to manage the local administrators group on Azure AD joined devices | Intune](https://techuisitive.com/how-to-manage-the-local-administrators-group-on-azure-ad-joined-devices-intune/) Tags: [Device Configuration](https://techuisitive.com/tag/device-configuration/), [Intune Guides](https://techuisitive.com/tag/intune-guides/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Configuration, Intune Guides --- ### [How to Reset a Windows 11 PC to Factory Settings](https://techuisitive.com/how-to-reset-windows-11-pc-to-factory-settings/) **Published:** August 22, 2024 **Author:** Equebal Ahmad **Content:** A **factory reset in Windows 11** restores the computer to its original factory settings, removing all **data, apps, accounts, preferences, and personal files**. This option can be used to resolve issues such as **system crashes, performance problems, or sluggish behavior**. A factory reset is also required in **[Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/ "How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot") scenarios** when re‑provisioning a device for a new user or migrating the device between **Microsoft Entra ID (Azure AD) tenants**. Performing a reset ensures that all settings, configurations, and data associated with the previous user or tenant are completely removed, allowing the device to be enrolled cleanly. Follow the steps below to **factory reset Windows 11**. This process will restore the device to its original state, removing all data, apps, accounts, and personal preferences. Open the **Settings app** in Windows 11 and navigate to **System → Recovery**. Under *Recovery options*, click **Reset this PC** to begin the factory reset process. ![Reset Windows 11 PC to Factory Settings | factory reset win 11](https://techuisitive.com/wp-content/uploads/2024/07/image-28.png)On the **Choose an option** page, select the appropriate reset option and click **Next**. If you are resetting the device for **Windows Autopilot re‑provisioning** or migrating it to a new **Microsoft Entra ID (Azure AD) tenant**, it is recommended to choose **Remove everything**. This ensures that all user data, accounts, and settings from the previous configuration are completely erased ![reset windows 11 to factory](https://techuisitive.com/wp-content/uploads/2024/07/image-29.png)On the **How would you like to reinstall Windows?** page, select **Local reinstall**. This option reinstalls Windows 11 using the files already on your device, without downloading from the cloud. ![resetting windows 11 to factory | windows 11 factory reset from boot](https://techuisitive.com/wp-content/uploads/2024/07/image-30.png)On the **Additional settings** page, click **Next** to proceed with the default reset options. If you want to customize the reset behavior—such as whether to clean the drive or restore preinstalled apps—select **Change settings** before continuing. ![Reset windows 11 PC Additional Settings](https://techuisitive.com/wp-content/uploads/2024/07/image-31.png)On the **Ready to reset this PC** page, click **Reset** to begin the **Windows 11 factory reset process**. This action will restore the device to its original state, removing all data, apps, accounts, and personal settings. ![Ready to reset this PC | windows 11 reset](https://techuisitive.com/wp-content/uploads/2024/07/image-32.png)You will now see the **Preparing to reset** page. From here, you can **monitor the reset progress** as Windows 11 begins restoring the device to its factory settings. ![](https://techuisitive.com/wp-content/uploads/2024/07/image-33.png)The device will now **reboot automatically** and continue with the **Windows 11 factory reset process**. During this stage, the reset sequence removes all data, apps, and settings, preparing the device for a clean setup. ![](https://techuisitive.com/wp-content/uploads/2024/07/image-34-1024x778.png)After the **reset process** is complete, your device will display the **Out of Box Experience (OOBE)** screen. This guided setup walks you through the initial configuration of **Windows 11**, prompting you to select **language preferences, region settings, network connection, and user account setup**. Completing these steps ensures the system is personalized and ready for use. ![Windows 11 OOBE](https://techuisitive.com/wp-content/uploads/2024/07/image-39-1024x746.png)## Conclusion Resetting your Windows 11 PC to factory settings is a reliable way to resolve system issues, restore performance, and prepare devices for reuse in enterprise environments. Whether you’re troubleshooting crashes, clearing personal data, or re‑provisioning through **Windows Autopilot**, the factory reset process ensures a clean slate. By following the steps outlined in this guide, you can confidently return your device to its original state and get it ready for a fresh setup or deployment. ## Related Posts - [How to Fix Autopilot error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/ "How to Fix Autopilot error 80070002") - [Windows Autopilot Device Preparation – Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/ "Windows Autopilot Device Preparation aka Autopilot v2 Step by Step Guide") - [Windows 10 Autopilot Deployment Guide | Intune](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) - [Intune – Configure Enrollment Status Page (ESP)](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Bulk enrollment of Windows 10/ 11 Device to Intune using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Enroll Windows 11 Device to Intune through Azure AD Join method](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Windows 11 enrollment with Provisioning package failed with error code 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/). ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Windows 10 / 11 **Tags:** Windows Guides --- ### [How to Check Windows Build Version | OS Version | Release Information](https://techuisitive.com/windows-10-11-operating-system-build-versions/) **Published:** December 13, 2022 **Author:** Equebal Ahmad **Content:** Knowing your Windows 10 or Windows 11 build version is essential for troubleshooting, upgrade planning, and verifying support status. This guide provides a complete list of Windows 10 and Windows 11 build versions and shows how to check your current OS build using **Winver**, **PowerShell**, **Command Prompt**, and **Configuration Manager (SCCM)**. Whether you manage devices with **Microsoft Intune** or **ConfigMgr**, this reference helps you quickly identify the exact Windows version running on your systems. Table Of Contents 1. [Windows 11 Versions and Build Numbers](#windows-11-versions-and-build-numbers) 2. [Windows 10 Versions and Build Numbers](#windows-10-versions-and-build-numbers) 3. [How to Check Windows Build Version](#how-to-check-windows-build-version) 4. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) 5. [Related Posts:](#related-posts) ## **Windows 11 Versions and Build Numbers** Windows 11 continues to report its version as **10.0**, but its **build numbers start at 22000**. Therefore, any release with a version of **10.0.22000 or higher** corresponds to **Windows 11 or later builds**. Below are the detailed **Windows 11 build numbers** for reference. **Windows 11 Version****Build Number****Availability Date****End of servicing: Enterprise, Education, IoT Enterprise, and Enterprise multi-session**✅ Windows 11 version 25H226200.6584Sep 30, 2025Oct 10, 2028 (36 months from release date)✅ [Windows 11 version 24H2](https://learn.microsoft.com/en-us/lifecycle/products/windows-11-enterprise-and-education "Windows 11 version 24H2")26100.24542024-10-012027-10-12⚠️ [Windows 11 version 23H2](https://learn.microsoft.com/en-us/lifecycle/products/windows-11-enterprise-and-education "Windows 11 version 23H2")22631.30072023-10-132026-11-10❌ [​Windows 11 version 22H2](https://learn.microsoft.com/en-us/lifecycle/products/windows-11-enterprise-and-education "​Windows 11 version 22H2")​10.0.226212022-09-202025-10-14❌ [​Windows 11 version 22H1](https://learn.microsoft.com/en-us/lifecycle/products/windows-11-enterprise-and-education "​Windows 11 version 22H1")​10.0.22000​2021-10-042024-10-08## **Windows 10 Versions and Build Numbers** The **Windows 10 operating system** reports its version as **10.0**. The final build number for **Windows 10 version 22H2** is **19045**, making the complete version number **10.0.19045**. Below are the detailed **Windows 10 build version numbers**, which help administrators and IT professionals identify the exact release and ensure compatibility with applications, policies, and deployment tools. **Windows Version****​Build Number****Availability date****End of servicing: Enterprise, Education, IoT Enterprise, and Enterprise multi-session**❌ [Windows 10 version 22H2 (Final Version)](https://learn.microsoft.com/en-us/lifecycle/products/windows-10-enterprise-and-education?branch=live "Windows 10 version 22H2 (Final Version)")10.0.190452022-10-182025-10-14❌ ​Windows 10 version 21H2​10.0.190442021-11-16​2024-06-11❌ ​Windows 10 version 21H1​10.0.19043​2021-05-18End of Servicing❌ Windows 10 version 20H210.0.19042​2020-10-202023-05-09❌ Windows 10 version 200410.0.19041​​​End of servicing❌ Windows 10 version 190910.0.18363​​​End of servicing❌ Windows 10 version 190310.0.18362​​​End of servicing❌ Windows 10 version 180910.0.17763​​​End of servicing❌ Windows 10 version 180310.0.17134​​​End of servicing❌ Windows 10 version 170910.0.16299​​​End of servicing❌ Windows 10 version 170310.0.15063​​​End of servicing❌ Windows 10 version 160710.0.14393​​End of servicing❌ Windows 10 version 151110.0.10586​​​End of servicing❌ Windows 1010.0.10240​​​End of servicing## **How to Check Windows Build Version** ### Winver Tool To check the Windows version on a **Windows 10 or Windows 11 machine**, you can use the built‑in **Winver tool**: - **Method 1 – Search Box**: Type **Winver** in the Windows search box and select **Winver** from the search results. - **Method 2 – Run Dialog**: Press **Windows + R** to open the Run dialog box, enter **Winver.exe**, and press **Enter**. This will display the **Windows version and build number**, helping you identify whether the device is running **Windows 10 (e.g., 10.0.19045)** or **Windows 11 (e.g., 10.0.22000 and above)**. ![check windows 10 build version](https://techuisitive.co.in/wp-content/uploads/2023/04/image-155.png)### **How to Check Windows Build Version Through PowerShell** You can quickly check the **Windows build version** on a **Windows 10 or Windows 11 machine** using **PowerShell**. Type the following command and press **Enter**: Open **PowerShell**. ``` PowerShell ``` Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber ``` ``` To check the build version for a **remote computer**, simply add the `-ComputerName ` parameter to the command: ### **How to Check Windows Version for a Device from SCCM Resource Explorer** **System Center Configuration Manager (SCCM)** automatically collects **operating system version details** from client machines as part of its **hardware inventory**. You can view all inventory information for an individual client computer using the **SCCM Resource Explorer**. Follow these steps to check the **Windows OS build version** for a single device in SCCM: 1. In the **SCCM Console**, navigate to: **Asset and Compliance > Devices** 2. Right‑click the device name. 3. Select **Start > Resource Explorer**. 4. In **Resource Explorer**, expand **Operating System** to view the **OS version and build details**. This method allows administrators to quickly verify whether a client is running **Windows 10 (e.g., 10.0.19045)** or **Windows 11 (e.g., 10.0.22000 and above)**, ensuring accurate compliance and deployment reporting. ![check build version windows 10 | SCCM resource explorer | Windows OS Build numbers](https://static.wixstatic.com/media/64e6b8_919623a075d040fc87df64cb8da18754~mv2.png/v1/fill/w_592,h_138,al_c,q_85,usm_0.66_1.00_0.01,enc_auto/64e6b8_919623a075d040fc87df64cb8da18754~mv2.png)### **SCCM SQL Query for Windows 10 / Windows 11 Build Versions** In addition to using **Resource Explorer**, you can also run a **SQL query directly against the SCCM database** to pull **Windows 10 and Windows 11 version/build details** for all devices in your environment. This method is especially useful for administrators who need a consolidated view of OS versions across the enterprise. For step‑by‑step instructions and ready‑to‑use queries, check out this post: **[SCCM SQL Query for Windows 10 / 11 Build Versions](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/ "SCCM SQL Query for Windows 10 / 11 Build Versions")**. These queries allow you to quickly identify whether devices are running **Windows 10 (e.g., 10.0.19045)** or **Windows 11 (e.g., 10.0.22000 and above)**, ensuring accurate compliance, reporting, and deployment planning. ## Frequently Asked Questions (FAQs) ### 1. How do I check my Windows 10 or Windows 11 build version? You can check your build version using the **Winver tool** (press `Windows + R`, type `winver`, and hit Enter), or by running a **PowerShell command**: Get-CimInstance -ClassName Win32\_OperatingSystem | Select-Object Caption, Version, BuildNumber This will display the exact **Windows OS version and build number** (e.g., *Windows 10 version 22H2 – build 19045* or *Windows 11 version 23H2 – build 22631*). ### 2. What is the difference between Windows 10 build numbers and Windows 11 build numbers? - **Windows 10 builds** end with **19045** (final version 22H2). - **Windows 11 builds** start at **22000** and continue with newer releases like **22621 (22H2)** and **26200 (25H2)**. This distinction helps IT admins quickly identify whether a device is running Windows 10 or Windows 11. ### 3. Why is tracking Windows build versions important for IT administrators? Tracking build versions ensures: - **Compatibility** with enterprise apps and policies. - **Compliance** with Intune or SCCM deployment requirements. - **Support lifecycle awareness** (knowing end‑of‑servicing dates). For example, **Windows 10 version 22H2 (build 19045)** is supported until **October 14, 2025**, while **Windows 11 version 23H2 (build 22631)** is supported until **November 10, 2026**. ### 4. How can I check Windows OS build versions across multiple devices in SCCM? Use **SCCM Resource Explorer** or run a **SQL query** against the SCCM database to pull OS version/build details for all devices. This provides a consolidated view of **Windows 10 and Windows 11 build versions** across the enterprise. ### 5. What happens if my Windows build version is out of support? If your device is running an **unsupported build** (e.g., Windows 10 version 1909 or 2004), you may face: - Security vulnerabilities due to missing updates. - Incompatibility with modern apps and Intune policies. - Deployment failures in SCCM or Autopilot. Upgrading to a **supported build** (Windows 10 22H2 or Windows 11 23H2/24H2) is strongly recommended. ### 6. Is Windows 11 still reporting version 10.0 in build numbers? Yes. Windows 11 continues to report its version as **10.0**, but the **build number (22000 and above)** distinguishes it from Windows 10. 7\. What are the end‑of‑servicing dates for Windows 10 and Windows 11 builds? - **Windows 10 version 22H2 (build 19045):** Supported until **October 14, 2025**. - **Windows 11 version 23H2 (build 22631):** Supported until **November 10, 2026**. - **Windows 11 version 25H2 (build 26200):** Supported until **October 10, 2028**. ## **Related Posts:** - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM SQL Query for Windows 10 / 11 Version Summary](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) - [Configure Windows 10 / 11 Device as Kiosk | Microsoft Intune](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [Windows 11 enrollment failed with error 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [Enroll Windows 11 Device to Intune through Azure AD Join method | Corporate Devices](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Invalid\_Client error when joining Windows 10 device to Azure AD tenant](https://techuisitive.com/invalid_client-error-when-joining-windows-10-device-to-azure-ad-tenant/) - [Join Windows 10 Device to Azure Active Directory](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Bulk enrollment of Windows 10/ 11 Devices to Intune](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Microsoft Intune – Windows 10 MDM- Basic troubleshooting](https://www.techuisitive.com/post/intune-windows-10-mdm-basic-troubleshooting) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://www.techuisitive.com/post/that-account-info-didn-t-work-error-when-disconnecting-windows-10---11-work-or-school-account) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://www.techuisitive.com/post/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Windows 10 / 11 **Tags:** Windows Guides --- ### [Bulk Enrollment of Windows 10 / 11 Devices to Intune Using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) **Published:** September 17, 2022 **Author:** Equebal Ahmad **Content:** Managing hundreds of corporate-owned Windows devices can be complex without automation. Bulk enrollment of Windows 10 and Windows 11 devices into Microsoft Intune offers IT admins a fast, scalable way to configure and secure endpoints. By using provisioning packages with Windows Configuration Designer, organizations can automatically join devices to Microsoft Entra ID (formerly Azure Active Directory) and enroll them into Intune for centralized policy enforcement, app deployment, and compliance. This guide provides a clear, step-by-step walkthrough to help you streamline enrollment and simplify device management at scale. Related post: [Enroll Windows 11 Device to Intune through Azure AD Join method](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) Table Of Contents 1. [Create a Provisioning Package](#create-a-provisioning-package) 2. [Provision a Device Using Provisioning Package](#provision-a-device-using-provisioning-package) 3. [Different ways to apply a provisioning package](#different-ways-to-apply-a-provisioning-package) - [During initial setup](#during-initial-setup) - - [After Initial Setup – Apply directly](#after-initial-setup-apply-directly) - - [After Initial Setup – Add from Access work or school account](#after-initial-setup-add-from-access-work-or-school-account) 4. [Related Posts](#related-posts) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## **Create a Provisioning Package** We need Windows Configuration Designer to create a Provisioning package. The application can be installed from the Microsoft Store. Open **Windows Configuration Designer** and select **Provisioning Desktop Devices**. ![Provisioning package](https://techuisitive.com/wp-content/uploads/2023/04/image-13.jpeg)On the **New Project** window, specify the following information: - **Name** – Name for your project - **Project folder** – Location where you want to save the package - **Description** – Description of the project Click on **Finish**. ![Intune bulk enrollment provisioning package](https://techuisitive.com/wp-content/uploads/2023/04/image-14.jpeg)On the **Set up device** page, provide the following details. - **Device name:** Enter a unique name for your devices. The name can be based on the device’s serial number or a random set of characters. - **Product key:** Optionally, you can enter a product key if you want to upgrade to Windows edition. - **Configure devices for shared users:** You can enable and configure this option if the device is to be used by shared users. - **Remove pre-installed software:** You can enable and configure this option if you want to remove pre-installed software. ![Intune bulk enrollment provisioning package](https://techuisitive.com/wp-content/uploads/2023/04/image-15.jpeg)On the **Set up network** page, configure the WI-Fi network devices connect to when they first start. This is an optional configuration. If the Wi-Fi network is not configured, a wired network connection is required when the device is first started. ![Create provisioning package with the Windows Configuration Designer (WCD)](https://techuisitive.com/wp-content/uploads/2023/04/image-16.jpeg)On the **Account Management** page, select **Enroll in Azure AD ,** enter a **Bulk token Expiry** date, and then click on **Get Bulk Token**. The token validity period is 180 days. ![Windows Configuration Designer (WCD)](https://techuisitive.com/wp-content/uploads/2023/04/image-17.jpeg)**Important:** On the **Stay Signed** in to all your apps page, select No, sign in to this app only. If you press OK, the device you are using will become managed by your organization. If you do not intend for your device to be managed, make sure to select No, and **sign in to this app only**. ![provisioning package with the Windows Configuration Designer (WCD)](https://techuisitive.com/wp-content/uploads/2023/04/image-10.png)You will be prompted for Azure AD sign-in. Login with the user Azure AD account to proceed. Click **Next** when **Bulk Token** is fetched successfully. ![provisioning package with the Windows Configuration Designer (WCD) Intune bulk enrollment](https://techuisitive.com/wp-content/uploads/2023/04/image-18.jpeg)The **Add application** is an optional page, you can add the application that you want to install through the provisioning package. ![Intune Bulk Enrollment Provisioning Package](https://techuisitive.com/wp-content/uploads/2023/04/image-19.jpeg)The **Add certificates** is an optional page, you can add the certificate which you want to provision on the device. ![Enrolling Windows 11 into Intune using a Provisioning Package](https://techuisitive.com/wp-content/uploads/2023/04/image-20.jpeg)On the **Finish** page, review the details. You can protect your package with a password. Click on **Create** once you reviewed the details. ![Enrolling Windows 10 into Intune using a Provisioning Package](https://techuisitive.com/wp-content/uploads/2023/04/image-21.jpeg)Once the package is created, you will see the status message just below the Create button. ![Windows Bulk Enrollment Entra ID](https://techuisitive.com/wp-content/uploads/2023/04/image-22.jpeg)See the snapshot of the folder where the provisioning package was copied. The file with .ppkg is a provisioning package executable. ![Windows Provisioning Package](https://techuisitive.com/wp-content/uploads/2023/04/image-23.jpeg) ## **Provision a Device** Using Provisioning Package We will apply the provisioning package manually on a test device to test the enrollment. The below steps need to be followed. - Copy the provisioning package to a USB device or a network share. - Access the provisioning package - Double click on .ppkg file On the **Is this package from a source you trust?** window, click on **Yes, add it**. ![Windows Configuration Designer](https://techuisitive.com/wp-content/uploads/2023/04/image-24.jpeg)A provisioning package will apply and the device will automatically restart in a minute. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-25.jpeg)The device will be joined to Azure Active Directory post reboot. You can log on to the device using your organization user account. You can also see your organization tenant details in **Settings > Accounts > Access work or school** You can notice **Connected by** [**package\_xyz@yourdomain.com**](mailto:package_xyz@yourdomain.com) which indicates that the device was enrolled by a provisioning package. ![Access work or school](https://techuisitive.com/wp-content/uploads/2023/04/image-26.jpeg)You can also see the status in Azure AD. The device is now Azure AD Joined. ![](https://techuisitive.com/wp-content/uploads/2023/11/image.jpeg) ## **Different ways to apply a provisioning package** Provisioning package can be applied using different methods. ### **During initial setup** The provisioning package can be applied during the initial setup from a USB. The USB must be inserted during OOB experience screen when you see the Country / Region screen. If nothing happens when you insert the USB drive, press the Windows key five times and then follow the instructions. ### **After Initial Setup – Apply directly** Open File Explorer, and browse to the folder you copied the provisioning package. Double-click on the .ppkg file to begin the installation. We discussed this method in previous steps. ### **After Initial Setup – Add from Access work or school account** A provisioning package can be also applied from **Settings > Accounts > Access work or school > Add or remove a provisioning package** ## **Related Posts** - [SCCM Dynamic Collection for Windows 10 / 11 Devices](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [SCCM SQL Query for Windows 10 / 11 Version Summary](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) - [Configure Windows 10 / 11 Device as Kiosk | Microsoft Intune](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [Windows 11 enrollment failed with error 0x800700b7](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) - [Enroll Windows 11 Device to Intune through Azure AD Join method | Corporate Devices](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [Invalid\_Client error when joining Windows 10 device to Azure AD tenant](https://techuisitive.com/invalid_client-error-when-joining-windows-10-device-to-azure-ad-tenant/) - [Join Windows 10 Device to Azure Active Directory](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) - [How to Obtain Hardware Hash for Manually Registering Devices with Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) - [Bulk enrollment of Windows 10/ 11 Devices to Intune](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [Microsoft Intune – Windows 10 MDM- Basic troubleshooting](https://www.techuisitive.com/post/intune-windows-10-mdm-basic-troubleshooting) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://www.techuisitive.com/post/that-account-info-didn-t-work-error-when-disconnecting-windows-10---11-work-or-school-account) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://www.techuisitive.com/post/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Management, Intune Guides --- ### [Set Windows 11 Time Zone with Intune Device Configuration Profile](https://techuisitive.com/set-windows-11-time-zone-with-intune-device-configuration-profile/) **Published:** October 1, 2024 **Author:** Equebal Ahmad **Content:** You can configure the time zone automatically or manually on Windows 10 and Windows 11 devices. The setting can be configured from Settings > Time & Language. When you manage the devices through Microsoft Intune, you can leverage device catalog settings to configure the time zone. However, this method may not be suitable for the mobile devices carried by users to different time zones. Let’s understand how to use the Intune setting catalog to configure the time zone policy for Windows 10 / 11 devices. Table Of Contents 1. [Get Windows Time Zone Name](#get-windows-time-zone-name) 2. [Configure Time Zone through Intune Device Configuration Profile](#configure-time-zone-through-intune-device-configuration-profile) 3. [How to Monitor Device Configuration Profile Status](#how-to-monitor-device-configuration-profile-status) 4. [Related Posts](#related-posts) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## Get Windows Time Zone Name When creating a Windows device configuration profile to configure the time zone, we need to provide a Windows time zone name. Hence, getting the correct time zone name from Windows 10 / 11 is important to avoid any issues. If the time zone name you provided does not match the Windows time zone name then the policy won’t apply and you may see error 65000. To get a list of all time zones in Windows 10 / 11, open a command prompt and run the below command. You can also find the list of default time zones in Windows in Microsoft documentation [here](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-time-zones?view=windows-11 "here"). **`tzutil /l `** ![Windows 11 Time Zone tzutil](https://techuisitive.com/wp-content/uploads/2024/08/image-4-1024x561.png)To save the output to a text file, you can use the redirect option. **`tzutil /l >timzones.txt`** As you can see in the below text file, the time zone name for Central Time (US & Canada) is **Central Standard Time**. We will use this time zone in our device configuration profile. ![Windows 11 Time Zone tzutil](https://techuisitive.com/wp-content/uploads/2024/08/image-5-1024x517.png) ## Configure Time Zone through Intune Device Configuration Profile Follow the below steps to set the Windows time zone using the device configuration profile. - Open Microsoft Intune Admin Console and Navigate to **Windows > Devices > Configuration** - Click on **Create** and select the following details in the Create a Profile window. - Platform: **Windows 10 and later** - Profile type: **Settings catalog** - Click on **Create**. ![Intune device configuration profile | Set windows 11 time zone](https://techuisitive.com/wp-content/uploads/2024/08/image-6-1024x503.png)On the **Create profile > Basics** page, provide a suitable name for your time zone profile and click on Next. ![Intune Windows 11 time zone](https://techuisitive.com/wp-content/uploads/2024/08/image-7.png)- Perform the below steps on the **Configuration settings** page. - Click on **Add settings** - On the **Setting picker > Search box**, type Time zone and click on the **Search** button - Click on **Time Language Settings** in the search result - Select **Configure time zone** - Close the **Settings picker** window using the X mark on the top right side of screen. ![Intune Configure time zone Device configuration profile](https://techuisitive.com/wp-content/uploads/2024/08/image-8-1024x518.png)You are now back on the Configuration settings page and the **Configure Time zone** setting is now added. Enter the time zone name which you want to configure. We have added **Central Standard Time**. ![Intune Setting catalog Time zone](https://techuisitive.com/wp-content/uploads/2024/08/image-9.png)Click on **Next** to go to **the** Assignment page and apply the policy to the appropriate Entra ID group. You need to ensure that the policy is applied to only those devices that are in the respective time zone. Else, it will impact the users in other locations. On the **Review + Create** page, review the settings and click on Create to complete the policy creation process. Check the notification to ensure that the policy was successfully created. ## How to Monitor Device Configuration Profile Status You can monitor the policy assignment status from Devices > Windows > Configuration Blade. To check the policy status, click on the policy name. The dashboard shows the number of devices where policy evaluation was succeeded, failed, or in progress. Click on View Report to see the device-wise status. ![Intune Device configuration policy assignment status](https://techuisitive.com/wp-content/uploads/2024/08/image-10-1024x597.png)## Related Posts - [How to Enable Azure Single Sign-On in Google Chrome](https://techuisitive.com/enabling-azure-single-sign-on-in-google-chrome-with-intune-dont-miss-this-key-setting/ "How to Enable Azure Single Sign-On in Google Chrome") - [How to Allow Copilot in Microsoft Edge Using Intune](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/) - [Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [How to Configure Google Chrome settings using Administrative templates | Intune](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Manage Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Edge Chromium Favorites with Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Configuration --- ### [CMG Setup - Subscription ID drop down not populating | SCCM | ConfigMgr](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) **Published:** April 29, 2021 **Author:** Equebal Ahmad **Content:** When setting up a **Cloud Management Gateway (CMG)** in **SCCM/Configuration Manager**, you may encounter an issue where the **Subscription ID drop‑down list remains blank** even after a successful Azure sign‑in. While the dialog correctly displays the Azure AD app and tenant names, the Subscription ID field shows a red exclamation mark and fails to populate. This problem is typically caused by missing **Azure subscription owner permissions**, even if the user has Global Administrator rights. In this guide, we’ll explain the cause, show how to verify permissions, and provide the steps to resolve the issue. ## **Symptoms – Subscription ID Drop‑Down Blank in SCCM CMG Setup** When configuring the **Cloud Management Gateway (CMG)** in **SCCM/Configuration Manager**, the **Subscription ID drop‑down list remains blank** even after a successful Azure sign‑in. The setup wizard correctly displays the **Azure AD app** and **tenant names**, but the Subscription ID field stays empty and shows a **red exclamation mark**. This issue can occur even if the user has **Global Administrator permissions** in the Microsoft Azure tenant, highlighting that Global Admin rights alone are not sufficient for CMG setup. ![Subscription ID Drop down](https://techuisitive.com/wp-content/uploads/2023/04/image-167.jpeg)## **Root Cause – Missing Azure Subscription Owner Permission** To make changes to an Azure subscription, the user must have **Subscription Owner permissions**. In this scenario, although the user had **Global Administrator rights**, the **Subscription Owner role** was not assigned, which prevented the CMG setup from completing successfully. ## **Solution – Assign Azure Subscription Owner Role** The user must be assigned **Azure Subscription Owner permissions** to make changes at the subscription level. An existing administrator can grant the **Owner role** (an Azure RBAC role) at the subscription scope. For detailed steps, refer to the official Microsoft documentation on assigning the Subscription Owner role. ![Check user role assignment in Entra ID / Intune](https://techuisitive.co.in/wp-content/uploads/2023/04/image-168.jpeg)## **Related Posts:** - [SCCM Application Deployment Failed with Error 0x87d01106 | ConfigMgr](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) - [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) - [PXE-E99: Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) - [Configuration Manager OSD task sequence fails with error ](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005)[code ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)[0x80004005](https://www.techuisitive.com/post/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005) - [MECM OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) - [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [ccmsetup failed with error code 0x87d00227](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) - [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) - [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) - [CMG Setup – Subscription ID drop down not populating](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) - [CMG Setup – Error when granting Contributor permission to the Azure AD app](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) - [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) - [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM Troubleshooting --- ### [How to Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) **Published:** August 11, 2022 **Author:** Equebal Ahmad **Content:** Google Chrome remains one of the most widely used browsers in enterprise environments, and ensuring a consistent, secure deployment across managed devices is a key responsibility for IT admins. While SCCM traditionally handled browser deployments through packages and collections, Microsoft Intune offers a modern, cloud‑based approach using **Win32 app deployment**. In this guide, we’ll walk through how to package and deploy Google Chrome for Enterprise with Intune, including **[preparing the installer](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/ "How to Prepare Win32 App Installation source for Intune Using Intune WinAppUtil"), [configuring detection rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive"), [setting requirement conditions](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/ "Understanding Win32 App Requirements Rule in Microsoft Intune"), and applying [assignment filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/ "Intune Filters – Assign Microsoft Store App policy using Filters")**. By the end, you’ll have a repeatable process that ensures Chrome is deployed efficiently and securely across your Windows endpoints. Table Of Contents 1. [Prerequisites for Win32 App Deployment in Intune](#prerequisites-for-win32-app-deployment-in-intune) 2. [How to Download Google Chrome Enterprise](#how-to-download-google-chrome-enterprise) 3. [Prepare Win32 App content for Intune](#prepare-win32-app-content-for-intune) 4. [Create a Win32 Application for Google Chrome Enterprise Deployment](#create-a-win32-application-for-google-chrome-enterprise-deployment) 5. [Conclusion](#conclusion) 6. [Continue Learning](#continue-learning) 7. [Related posts](#related-posts) ## **Prerequisites for Win32 App Deployment in Intune** Before deploying Win32 applications with Intune, ensure the following requirements are met: - **Operating System:** Windows 10 version 1607 or later (Enterprise, Pro, or Education editions). - **Device Enrollment:** Devices must be enrolled in Intune and be one of the following: - Azure AD registered - Azure AD joined - Hybrid Azure AD joined - **Application Size:** The packaged Win32 app must not exceed **8 GB** per application. ## **How to Download Google Chrome Enterprise** You can download the latest version of **Google Chrome for Enterprise** directly from Google’s official site: 👉 Download Google Chrome Enterprise This package is specifically designed for enterprise environments, offering IT admins the ability to deploy Chrome with centralized policies, enhanced security, and streamlined updates. ## **Prepare Win32 App content for Intune** The **Intune Win32 Content Prep Tool** allows you to create a single, compressed package that can be uploaded and deployed through Microsoft Intune. This step is essential for deploying applications like **Google Chrome for Enterprise** using the Win32 app model. ### Steps to Prepare the Content 1. **Download and install the IntuneWinAppUtil tool** (Intune Content Prep Tool). 2. **Prepare the installation source files** for Google Chrome (e.g., MSI or EXE installer, along with any required scripts). 3. **Run the Content Prep Tool** to convert the source files into a `.intunewin` package. 4. **Upload the package to Intune** via the Endpoint Manager admin center. For a detailed walkthrough, follow our guide: 👉 *[How to prepare app installation source for Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/ "How to Prepare Win32 App Installation source for Intune Using Intune WinAppUtil")* ## **Create a Win32 Application** for Google Chrome Enterprise Deployment Once you have prepared the `.intunewin` package using the Intune Content Prep Tool, follow these steps to create the Win32 application in Intune: ### Add a New Win32 App in Intune **Log in** to the Microsoft Intune Admin Center. Navigate to: **Apps > Windows > Windows apps**. Click on +Add to **Add a New App** ![Intune Win32 app deployment](https://techuisitive.com/wp-content/uploads/2023/03/image-39.jpeg)On the **flyout window** that appears on the right side of the screen: - From the **App type** drop‑down list, select **Windows app (Win32)**. - Click **Select** to confirm your choice. This sets the stage for uploading the `.intunewin` package you prepared earlier and configure the deployment details for **Google Chrome Enterprise**. ![Intune Win32 app deployment](https://techuisitive.com/wp-content/uploads/2023/03/image-40.jpeg)### Upload the App Package File On the **App Information** page: - Click **Select app package file**. - In the dialog box, click **Browse** and locate the **Google Chrome Enterprise MSI** file you downloaded earlier. - Select the file and click **OK** to proceed. This will attach the Chrome installer to your Win32 app configuration, allowing you to continue with program details, requirements, and detection rules. ![Google Chrome Enterprise installation](https://techuisitive.com/wp-content/uploads/2023/03/image-41.jpeg)### Fill in App Information On the **App Information** page: Once all details are filled in, click **Next** to move to the **Program** page. Provide the required details for the application: **Name**: e.g., *Google Chrome Enterprise* **Description**: A short summary of the app and its purpose. **Publisher**: e.g., *Google LLC* **Version**: Enter the version of the MSI installer you are deploying. (Optional) Add **Category**, **Logo**, or other metadata for easier identification in the Intune portal. ![Intune Win32 App | Deploy Google chrome intune](https://techuisitive.com/wp-content/uploads/2023/03/image-42.jpeg)### Configure Program Details On the **Program** page: - You’ll notice that the **Install** and **Uninstall** command lines are automatically populated from the MSI package. - You can modify these commands as needed to suit your deployment requirements. For example: - **Enable verbose logging** by adding logging parameters to the install command. - **Run installation via a batch file or PowerShell script** if you need additional pre‑ or post‑install logic. Once you’ve reviewed or updated the commands, click **Next** to proceed to the **Requirements** page. ![Intune Win32 App | Intune Google chrome deployment](https://techuisitive.com/wp-content/uploads/2023/03/image-43.jpeg)### Configure Requirements On the **Requirements** page, you must configure at least the mandatory rules. **Win32 app requirements** define the conditions that must be met for the application to install. If the requirements are not satisfied, the app will not be deployed to the device. For **Google Chrome Enterprise deployment**, we’ve configured the following mandatory requirements: - **Operating System architecture:** 64‑bit - **Minimum Operating System:** Windows 10, version 1607 Once these requirements are set, click **Next** to proceed to the **Detection Rules** page. ![Intune Requirements page ](https://techuisitive.com/wp-content/uploads/2023/03/image-44.jpeg)### Configure Detection Rules On the **Detection Rules** page, you must configure at least one detection rule. **Detection rules** in Intune are used to determine whether a Win32 app is already present on a device. They ensure that: - The app installation only starts if the application is not already installed. - The same rules are used to confirm successful installation after deployment. For a deeper dive into detection logic, see our detailed guide: *[Understanding Intune Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive")*. To add a Detection rule, select “**Manually configure detection rules**” in **Rule format** and click on **Add**. ![Intune Win32 App | Deploy Google chrome enterprise](https://techuisitive.com/wp-content/uploads/2023/03/image-45.jpeg)On the **Detection Rules flyout window**, select **MSI** in the **Rule type** drop‑down; in most cases, the MSI product code will populate automatically from the uploaded package, but if it does not, you must manually provide the correct MSI product code to ensure Intune can properly detect the presence of Google Chrome Enterprise and validate the installation before proceeding to the Dependencies page. Click on **Ok** to close the window. ![MSI product code detection](https://techuisitive.com/wp-content/uploads/2023/03/image-46.jpeg)On the **Detection Rules page**, once you’ve configured the MSI detection rule, simply click **Next** to continue to the **Dependencies page**, where you can define any prerequisite applications that must be installed before Google Chrome Enterprise is deployed. ![Detection rules configuration in Intune](https://techuisitive.com/wp-content/uploads/2023/03/image-47.jpeg)### Configure App Dependencies **App dependencies** are applications that must be installed before your Win32 app can be deployed. This feature allows you to chain applications and their dependencies so they install in sequence, ensuring prerequisite software is in place before the main app runs. While this setting can be useful for complex deployments, it is optional and not required for **Google Chrome Enterprise**. If you’d like to explore this topic further, you can follow our detailed post on **Win32 App Dependencies** for best practices and advanced scenarios. Click on **Next** to move to the **Supersedence** page. ![Intune Dependencies page](https://techuisitive.com/wp-content/uploads/2023/03/image-48.jpeg)### Configure Supersendence In **Microsoft Intune**, *Supersedence* is an optional feature that allows you to update or replace existing Win32 applications with newer versions of the same app or even with a completely different Win32 app. This functionality helps streamline application lifecycle management by automatically removing or upgrading older versions when a new package is deployed. Since it is not required for **Google Chrome Enterprise deployment**, we will skip this step. If you’d like to explore the concept further, you can follow our detailed post on the **[Supersedence relationship in Intune Win32 apps](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/ "How to Upgrade / Replace App with Win32 App Supersedence relationship | Intune")** for advanced scenarios and best practices. Click on **Next** to go to the Assignment page. ![Intune Win32 App | Supersedence](https://techuisitive.com/wp-content/uploads/2023/03/image-49.jpeg)### Assign App On the **Assignment** page, click on **Add Group** under Required to add the Azure AD Group to which you want to assign this application. Select the AAD group from the Flyer Window and click on Select to return to the **Assignment** page. You can also use the Assignment Filters to further narrow down the scope of deployment. Check out below articles if you want to learn more about Intune assignment filters. [Intune Filters – Assign Microsoft Store App policy using Filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/) [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) **Note:** In Intune, **Required deployments** enforce installation of the application on the selected devices or groups automatically, ensuring the app is pushed without user intervention. By contrast, **Available deployments** make the application optional, allowing users to install it themselves from the **Company Portal** when needed. This distinction helps admins choose between mandatory rollout and self‑service availability depending on organizational requirements.![Assignment page Azure AD group selection](https://techuisitive.com/wp-content/uploads/2023/10/image-1.jpeg)On the **Assignment** page, you can configure the following additional deployment settings: - **End User notifications** – control whether users see prompts or messages during installation. - **Delivery optimization priority** – manage bandwidth usage and prioritize app delivery. - **App availability** – specify when the app becomes available in the Company Portal. - **App installation deadline** – enforce a required installation by a certain date. These options give admins more flexibility to balance user experience with organizational requirements before moving on to the **Review + Create** step. ![Intune Win32 App | Assignments Settings](https://techuisitive.com/wp-content/uploads/2023/03/image-50.jpeg)Click on Next on the **Assignment** page to move to the Review + create page. ### Review and Create Application On the **Review + Create** page, carefully review all the configuration settings you’ve entered for the Win32 app deployment—such as app information, program details, requirements, detection rules, dependencies, supersedence, and assignments. Once you’ve confirmed everything is correct, click **Create** to finalize and publish the application deployment in Intune. ![Review + Create page in Intune](https://techuisitive.com/wp-content/uploads/2023/03/image-51.jpeg)You can monitor the progress from the Notification area. ![Intune Win32 App | Notifications](https://techuisitive.com/wp-content/uploads/2023/03/image-52.jpeg)The **Google Chrome application** has now been successfully created in Intune, and you can monitor its assignment status by navigating to **Apps > Windows > \\**. From there, you’ll be able to track deployment progress, confirm which devices or groups have received the app, and review any installation success or error reports. This view provides admins with a centralized way to validate that the deployment is working as expected. ![Intune Apps > Windows > Chrome status view](https://techuisitive.com/wp-content/uploads/2023/03/image-53.jpeg)## Conclusion Deploying **Google Chrome for Enterprise with Intune Win32 apps** gives IT admins a modern, flexible way to manage browser installations across Windows devices. By combining **packaging, detection rules, requirement conditions, and assignment filters**, you can ensure Chrome is deployed consistently, securely, and only where it’s needed. This approach not only streamlines app deployment but also aligns with best practices for **cloud‑based endpoint management**. As organizations continue to move away from SCCM toward Intune, mastering Win32 app deployment is a critical skill for every admin. 👉 Stay tuned for more **Intune deployment guides, troubleshooting tips, and real‑world scenarios**. Subscribe to our blog or follow us for updates on **modern management, SCCM to Intune migration strategies, and enterprise app deployment best practices**. ## Continue Learning 📚 [Microsoft Intune Learning Path](https://techuisitive.com/microsoft-intune/ "Microsoft Intune Learning Path") ## **Related posts** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** App Deployment Featured, App Management Getting Started --- ### [How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) **Published:** July 17, 2023 **Author:** Equebal Ahmad **Content:** [Windows Local Administrator Password Solution (LAPS)](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) from Microsoft allows you to manage and rotate local administrator passwords on Windows devices. A custom RBAC role in Intune is required if you want to delegate password administration to help desk members. The password administration for Windows LAPS includes retrieving the password for a Windows device from the Microsoft Intune console and rotating the password for a device based on requirements. Let’s go through the below post to understand the steps required to delegate LAPS password administration to IT help desk by creating a custom Role Based Access Control (RBAC) role. Table Of Contents 1. [Create Azure AD Group](#create-azure-ad-group) 2. [Create Azure RBAC Custom Role to View password](#create-azure-rbac-custom-role-to-view-password) 3. [Assign Azure AD Custom Role](#assign-azure-ad-custom-role) 4. [Create Custom RBAC Role in Intune for LAPS Password Administration](#create-custom-rbac-role-in-intune-for-laps-password-administration) 5. [LAPS Password Administrators – Experience](#laps-password-administrators-experience) 6. [Related Posts](#related-posts) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## Create Azure AD Group An Azure AD group is required to simplify the Intune RBAC roles. The user who needs to work on Windows LAPS password administration can be simply added to this AAD group to get all necessary access. Follow the below steps to create an Azure Active Directory group. - On the Azure portal, go to Azure Active Directory > Groups and click on New Group ![Create Azure AD Group](https://techuisitive.com/wp-content/uploads/2023/07/image-1024x367.png)- On the **New Group** page, provide the following details. - **Group Type** : Security - **Group Name**: Provide group name as per your organization naming standards - **Azure AD roles can be assigned to the group** : Select Yes. - **Membership Type:** Assigned - **Members**: Add the user if you want to add any at this point of time. Click on **Create** to create AAD group. ![Create Azure AD Group](https://techuisitive.com/wp-content/uploads/2023/07/image-1.png)- Click **Yes** on the message box. ![Create Azure AD Group](https://techuisitive.com/wp-content/uploads/2023/07/image-2-1024x97.png)## Create Azure RBAC Custom Role to View password The next step is to create a custom AAD role to view Windows LAPS password. As of now Windows LAPS is in preview and no built-in role available in Azure AD for this. To view password details, your account must have one of the following Azure Active Directory permissions: - `microsoft.directory/deviceLocalCredentials/password/read` - `microsoft.directory/deviceLocalCredentials/standard/read` Follow the below steps to create a custom RBAC role in Azure AD. - On the **Azure portal**, navigates to **Azure Active Directory > Roles and administrators** , and click on “**New custom role**“ ![Create Azure AD role](https://techuisitive.com/wp-content/uploads/2023/07/image-3-1024x420.png)- On the next page, provide role name, description and click on **Next**. ![Intune rbac roles](https://techuisitive.com/wp-content/uploads/2023/07/image-4-1024x507.png)- On the **Permission** page, search for `microsoft.directory/deviceLocalCredentials` and select the permissions from the result. ![Create Azure AD role](https://techuisitive.com/wp-content/uploads/2023/07/image-5-1024x485.png)- On the **Review + create** page, review the details and click on **Create**. ![intune rbac custom role](https://techuisitive.com/wp-content/uploads/2023/07/image-6-1024x490.png) ## Assign Azure AD Custom Role We have created an Azure AD custom role in the last step. Now this role needs to be assigned to Azure AD Group which we created earlier. - On the Role and Administrator page, search for AD group you created for LAPS and click on the group. ![Assign Azure AD Role | rbac intune](https://techuisitive.com/wp-content/uploads/2023/07/image-7-1024x486.png)- Click on **Add Assignments**. ![Assign Azure AD Role](https://techuisitive.com/wp-content/uploads/2023/07/image-8-1024x379.png)- On the **Add assignments > Membership**, select the following. - Scope type : Directory - Select members : Select the AAD group you created for LAPS password administrators. - Click on Next ![Assign Azure AD Role](https://techuisitive.com/wp-content/uploads/2023/07/image-11.png)- On the **Add assignments > Settings page, select Active in Assignment type, provide the justification, and click on the** Assign button. ![Assign Azure AD Role](https://techuisitive.com/wp-content/uploads/2023/07/image-25.png)- The role is now assigned to the AAD group. You can see the details in the Assignment blade. ![Assign Azure AD Role](https://techuisitive.com/wp-content/uploads/2023/07/image-26-1024x320.png)## Create Custom RBAC Role in Intune for LAPS Password Administration We will now create a custom RBAC Intune role for LAPS password administration. This role allows user to access “Local Admin Password” blade for a device, view and rotate local admin password. - On the Microsoft Intune admin center, navigate to **Tenant administration > All roles** and click on **Create** ![Custom RBAC Role in Intune](https://techuisitive.com/wp-content/uploads/2023/07/image-14-1024x461.png)- On the **Basic** page, provide the profile **name** and **description** for Intune rbac roles. click on **Next**. ![Intune RBAC Role](https://techuisitive.com/wp-content/uploads/2023/07/image-15-1024x544.png)- On the Permission page, select the following permissions. - Manage Device: **Read** - Organization: **Read** - Remote tasks: **Rotate Local Admin Password** - Click on **Next** ![Intune RBAC Role](https://techuisitive.com/wp-content/uploads/2023/07/image-16.png)- On the Review + create page, review the details and click on Create. ![Intune RBAC Role](https://techuisitive.com/wp-content/uploads/2023/07/image-17.png)- The Intune rbac custom role is now created and you can see the same in **All roles**. Click on the newly created role to assign the role to Azure AD group. ![Intune RBAC Role](https://techuisitive.com/wp-content/uploads/2023/07/image-18-1024x371.png)- On the Assignments page, click on **Assign** link. ![Intune RBAC Role](https://techuisitive.com/wp-content/uploads/2023/07/image-20-1024x433.png)- On the Add **Role Assignment > Basics** page, provide the **name** and **description** for role assignment and click on **Next**. ![Intune RBAC Role](https://techuisitive.com/wp-content/uploads/2023/07/image-21-1024x410.png)- On the **Admin Groups** page, click on Add groups and select the AAD group you created for LAPS administrators. ![Intune RBAC Role](https://techuisitive.com/wp-content/uploads/2023/07/image-22-1024x484.png)- On the Scope Groups, select **All Devices** and click on Next. ![Intune RBAC Role](https://techuisitive.com/wp-content/uploads/2023/07/image-23-1024x479.png)- On the Review + create page, review the settings and click on Create. ![Intune RBAC Role](https://techuisitive.com/wp-content/uploads/2023/07/image-24-1024x637.png)The Intune rbac roles assignment steps are now completed. Users who are part of the Azure AD group can now able to view local admin password for a device. They can also rotate/change the password if required. ## LAPS Password Administrators – Experience When LAPS Administrator logon to Intune console, they can access Local admin password blade and view local admin password. ![Intune Windows LAPS](https://techuisitive.com/wp-content/uploads/2023/07/image-27-1024x541.png)They can also access **Rotate local admin password** option by clicking on 3 dots at top right. The other options are grayed out in the below screen as we have granted only LAPS password administration privilege to Azure AD group. If the same user is part of other roles, they would be able to perform other actions as well based on the permissions they have. ![Intune LAPS Rotate Local admin password](https://techuisitive.com/wp-content/uploads/2023/07/image-28-1024x347.png)## Related Posts - [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) - [Manage Edge Chromium favorites with Endpoint Manager | Intune](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Configure Edge Chromium Homepage & Startup Page](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) - [Configure Microsoft Edge Sleeping Tabs using Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Configure Google Chrome settings using Administrative templates | Intune | Endpoint Manager](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [Block USB Device with Exception](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/) - [Deny Write Access to USB Devices Using Intune Catalog Settings](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Manage Windows 10 /11 Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [Manage Local Admin Password with Intune & Windows LAPS](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) Tags: [Device Configuration](https://techuisitive.com/tag/device-configuration/), [Intune Guides](https://techuisitive.com/tag/intune-guides/), [Role Based Access Control](https://techuisitive.com/tag/role-based-access-control/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Device Configuration, Intune Guides, Role Based Access Control --- ### [How to Upgrade / Replace App with Win32 App Supersedence relationship | Intune](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) **Published:** July 7, 2021 **Author:** Equebal Ahmad **Content:** Managing application lifecycles in [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") can be challenging, especially when older versions need to be replaced or upgraded seamlessly. This is where **Win32 App Supersedence** comes in. Supersedence allows IT admins to automatically uninstall outdated apps and deploy newer versions—or even replace them with entirely different Win32 apps—without manual intervention. In this step‑by‑step guide, we’ll walk through how to configure Supersedence in Intune using a practical example with Notepad++. You’ll learn how to [prepare the installation source](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/ "How to Prepare Win32 App Installation source for Intune Using Intune WinAppUtil"), create the Intunewin package, set [detection rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive"), and validate the deployment, ensuring a smooth upgrade experience for both admins and end users. Table Of Contents 1. [Review the Existing Deployed Version](#review-the-existing-deployed-version) 2. [Prepare Win32 App Installation Source for Intune](#prepare-win32-app-installation-source-for-intune) 3. [Set up and Deploy Win32 App Supersedence Deployment in Intune](#set-up-and-deploy-win32-app-supersedence-deployment-in-intune) 4. [Validate the Supersedence Deployment on the Test Machine](#validate-the-supersedence-deployment-on-the-test-machine) 5. [End User Experience](#end-user-experience) 6. [Conclusion](#conclusion) 7. [Frequently Asked Questions (FAQs)](#frequently-asked-questions-faqs) 8. [Related Posts](#related-posts) ## **Review the Existing Deployed Version** Before upgrading or replacing an application, it’s important to **review the versions currently deployed in your environment**. Identify all older builds that will be superseded by the new deployment. This information is essential when configuring the **Supersedence relationship** later in Intune. In my test environment, only one older version of **Notepad++** is installed. The screenshot below shows the details of this deployment. For this walkthrough, we’ll replace that version with **Notepad++ 7.9.1**. ![Endpoint Manager - Check assigned applications](https://techuisitive.com/wp-content/uploads/2023/03/image-15.jpeg)## **Prepare Win32 App Installation Source for Intune** The **Intune Win32 Content Prep Tool** (`intuneWinAppUtil.exe`) is used to create a single deployment package for Microsoft Intune. In this example, we’ll generate an Intunewin package for **Notepad++ 7.9.1**. Follow these steps to prepare the package: - **Download the Intune Prep Tool** Obtain the `intuneWinAppUtil.exe` utility from Microsoft. - **Organize the Source Folder** Place all installation files—and any supporting files—inside a single source folder. *(For this walkthrough, the folder is named `Notepad++ 7.9.1`.)* - **Position the Prep Tool** Copy `intuneWinAppUtil.exe` **outside** of the installation source folder. This ensures the tool can correctly reference the source directory when packaging. ![IntuneWinApp - Folder structure](https://techuisitive.com/wp-content/uploads/2023/03/image-16.jpeg)- Once your source folder is ready, the next step is to generate the **Intunewin package** using the Intune Win32 Content Prep Tool. - **Open Command Prompt** Navigate to the root directory where you placed the installation source folder and the `intuneWinAppUtil.exe` file. - **Run the Prep Tool** Execute the utility and provide the required inputs when prompted: ``` IntuneWinAppUtil.exe ``` ![](https://techuisitive.com/wp-content/uploads/2023/03/image-17.jpeg)After running the **Intune Win32 Content Prep Tool**, the `.intunewin` file is generated in the root folder. This packaged file is what you’ll later select as the **source package** during Intune app deployment. In this example, the Notepad++ 7.9.1 `.intunewin` file appears in the root directory alongside the prep tool. This file will be referenced when configuring the application in Intune. ![IntuneWinApp - Folder structure](https://techuisitive.com/wp-content/uploads/2023/03/image-18.jpeg)## **Set up and Deploy Win32 App Supersedence Deployment in Intune** ### **Add Win32 App** On the Microsoft Intune admin console, select **Apps > Windows App > Add** Select **Windows app (Win32)** from the App type drop-down list Click on **Select** ![Endpoint Manager - Win32 App - App Type](https://techuisitive.com/wp-content/uploads/2023/03/image-19.jpeg)Click on **Select app package file** Browse to the folder where the `.intunewin` file was created and select it as the **package source**. Once selected, Intune will display the file details (such as name, size, and path). Review this information to confirm accuracy, then click **OK** to proceed ![](https://techuisitive.com/wp-content/uploads/2023/03/image-20.jpeg)### **App Information:** On the **App Information** page, review the default details and update them as needed to ensure clarity and consistency across your Intune environment. You can customize fields such as: - **Description** – Provide a clear summary of the app’s purpose or functionality. - **Publisher** – Enter the vendor or developer name (e.g., *Notepad++ Team*). - **Category** – Assign the app to a logical category for easier discovery and management. - **Logo** – Upload an application logo to improve visibility in the Company Portal. Updating these details not only helps with organization but also enhances the end‑user experience when browsing apps in the portal. Click on **Next** ![Endpoint Manager - Win32 App - App Information page](https://techuisitive.com/wp-content/uploads/2023/03/image-21.jpeg)### **Program:** On the **Program** page, review the available options and update them if your deployment requires customization. These settings control how the installer runs during deployment. For this walkthrough, we’ll proceed with the **default values**, as they are sufficient for deploying **Notepad++ 7.9.1** in this scenario. ![Endpoint Manager - Win32 App - Program page](https://techuisitive.com/wp-content/uploads/2023/03/image-22.jpeg)### **Requirements:** On the **Requirements** page, define the conditions that client devices must meet before the application can be installed. These rules ensure that the app is deployed only to compatible systems. For this deployment, we’ve configured the following requirements: - **Operating system architecture:** 64‑bit - **Minimum operating system:** Windows 10, version 1903 - **Disk space:** At least 500 MB free - **Physical memory:** Minimum 4 GB RAM By setting these requirements, Intune will automatically validate whether a device meets the criteria before attempting installation, reducing deployment errors and ensuring a smoother rollout. Check [this blog post](https://www.techuisitive.com/post/intune-understanding-win32-app-requirements-rule) if you want to deep dive into the Requirements rule. ![Endpoint Manager - Win32 App - Requirements page](https://techuisitive.com/wp-content/uploads/2023/03/image-23.jpeg)### **Detection rule:** Detection rules are used to **validate the presence of the application** on client devices. In the **Detection Rules** pane, you can define how Intune confirms that the app is installed correctly. For this deployment, we’ll use the **MSI product code** as the detection method. Follow these steps: - From the **Rules format** drop‑down list, select **Manually configure detection rules**. - Click **Add** to create a new rule. - Set **Rule type** to **MSI**. - The **MSI product code** will populate automatically based on the installer. - Click **OK** to save the rule. If you’d like to explore detection rules in more detail—including file, registry, and custom script options—check out the referenced blog post [Understanding Win32 app detection rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/ "Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive") for a deeper dive. ![Endpoint Manager - Win32 App - Detection Rule](https://techuisitive.com/wp-content/uploads/2023/03/image-24.jpeg)Review the Detection rule on the next page and click on Next ![Endpoint Manager - Win32 App - Detection Rule](https://techuisitive.com/wp-content/uploads/2023/03/image-25.jpeg)### **Dependencies:** On the **Dependencies** page, you can specify whether the application relies on other Win32 apps to function correctly. Dependencies ensure that prerequisite apps are installed before the main app is deployed. In this case, **Notepad++ has no dependencies**, so we can simply skip this step and click **Next** to continue. If you’d like to explore how dependencies work—including scenarios where apps require supporting components—check out the referenced blog post for a deeper dive into **[Win32 App Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/ "Win32 App Deployment with Dependencies | Microsoft Intune")**. ![Endpoint Manager - Win32 App - Dependencies](https://techuisitive.co.in/wp-content/uploads/2023/03/image-26.jpeg)### **Supersedence:** The **Win32 app Supersedence** option allows you to update or replace existing Win32 applications with newer versions—or even with a completely different app. Supersedence relationships define how Intune handles upgrades, replacements, and removals during deployment. Follow these steps to add a Supersedence relationship: - In the **Supersedence (Preview)** pane, click **Add**. - Select the existing application that will be superseded. - Define whether the new app should **replace** or **upgrade** the older version. - Save the configuration to establish the Supersedence relationship. This ensures that when the new package is deployed, Intune automatically manages the transition from the older version to the newer one, reducing manual effort and deployment errors. ![Endpoint Manager - Wind32 App - Create supersedence relationship](https://techuisitive.com/wp-content/uploads/2023/03/image-27.jpeg)To establish the Supersedence relationship, type the name of the application in the **search box** to quickly locate the version you want to replace. - Enter the application name (e.g., *Notepad++*). - From the search results, select the specific version to be superseded. - Click **Select** to confirm your choice. In this example, we’ve chosen **Notepad++ version 7.8.9**, which will be replaced by the newer **Notepad++ version 7.9.1** during deployment. ![Endpoint Manager - Wind32 App - Create supersedence relationship](https://techuisitive.com/wp-content/uploads/2023/03/image-28.jpeg)On the next screen, you’ll define how Intune should handle the older version of the application when deploying the new one. - **Select “Yes”** under **Uninstall the previous version** if you want the older app to be completely removed and replaced by the new version. - **Select “No”** if you prefer to **upgrade in place**, meaning the new version will install over the existing one (if supported by the installer). For this deployment, we’ll choose **Yes**, since the goal is to replace the older **Notepad++ 7.8.9** with the newer **Notepad++ 7.9.1**. Follow [Microsoft documentation](https://docs.microsoft.com/en-us/mem/intune/apps/apps-win32-supersedence) if you need further clarification on the supersedence behavior of an application. Click on **Next** ![Endpoint Manager - Win32 App - Supersedence relationship](https://techuisitive.com/wp-content/uploads/2023/03/image-29.jpeg)### **Assignments :** In the **Assignments** pane, you can control which users or devices receive the application. Intune allows you to target: - Specific **Azure AD groups** - **All users** - **All devices** For this deployment, we’ll configure a **mandatory assignment** to the Azure AD group named **“App Notepad++ users.”** This ensures that every member of the group automatically receives the new version of Notepad++ without requiring manual installation. Click on **Add group** under the **Required** section. Select the Azure AD group and click on **Select** ![Endpoint Manager - Wind32 App - Assignment](https://techuisitive.com/wp-content/uploads/2023/03/image-30.jpeg)Review the assignments and click on Next ![Endpoint Manager - Intune - Win32 App - Assignments](https://techuisitive.com/wp-content/uploads/2023/03/image-31.jpeg)### **Review** + create On the **Review + create** pane, carefully review all the configuration details you’ve entered—such as app information, program settings, requirements, detection rules, dependencies, and Supersedence relationships. Once you’ve confirmed everything is correct, click **Create** to finalize the deployment. Intune will then begin processing the application package and make it available according to the assignment settings you defined ![Endpoint Manager - Intune - Win32 App - Review + create](https://techuisitive.com/wp-content/uploads/2023/03/image-32.jpeg)## **Validate the Supersedence Deployment on the Test Machine** To check the deployment status of the application: - In the Intune portal, go to **Devices > Windows >** . - Review the application list and status indicators for the selected device. In this example: The **new version (Notepad++ 7.9.1)** shows a status of **Waiting for install**, meaning Intune has queued the deployment but installation has not yet completed. The **old version (Notepad++ 7.8.9)** is currently installed on the client. ![Endpoint Manager - Intune - Win32 App - Validate Deployment](https://techuisitive.com/wp-content/uploads/2023/03/image-34.jpeg)After waiting for some time, the deployment status has updated: - The **new version (Notepad++ 7.9.1)** now shows as **Installed** on the client. - The **old version (Notepad++ 7.8.9)** now shows as **Not Installed**. Because we configured a **Supersedence rule**, Intune automatically uninstalled the older version and installed the newer one. This confirms that the Supersedence relationship worked as expected, ensuring a clean upgrade path without requiring manual intervention. ![Endpoint Manager - Intune - Win32 App - Validate Deployment](https://techuisitive.com/wp-content/uploads/2023/03/image-35.jpeg)## **End User Experience** ### **Application Download:** When the deployment begins, the end user receives a **notification** indicating that the application is being downloaded. - The message clearly states that the targeted application will **replace an existing application**. - In this case, both applications share the same name because the **version number was not included in the deployment name**. ⚠️ **Note:** To avoid confusion for end users, it is a best practice to **add the version number to the deployment name** (e.g., *Notepad++ 7.9.1*). This ensures users can easily distinguish between the old and new versions during installation. ![Endpoint Manager - Intune - App Download Notification](https://techuisitive.com/wp-content/uploads/2023/03/image-36.jpeg)### **Application Uninstalled:** As part of the Supersedence process, the end user also receives a **notification** when the older version of the application is being uninstalled. - The notification confirms that the **previous version** of the app is being removed. - This step ensures a clean transition, preventing conflicts between the old and new versions. - Once the uninstall completes, Intune proceeds with installing the newer version automatically. This seamless uninstall/install workflow is the direct result of configuring the **Supersedence rule** during deployment. ![](https://techuisitive.com/wp-content/uploads/2023/03/image-37.jpeg)### **Application Installed:** After the uninstallation of the old version, the end user receives a **notification** confirming that the **new version of the application (Notepad++ 7.9.1)** is being installed. From the user’s perspective, the transition is smooth, with minimal disruption to productivity. The notification clearly indicates that the application is now being deployed. This step completes the Supersedence workflow: the older version was removed, and the newer version is installed seamlessly. ![Endpoint Manager - Intune - App Install Notification](https://techuisitive.com/wp-content/uploads/2023/03/image-38.jpeg)## Conclusion By leveraging **Win32 app Supersedence** in Intune, administrators can seamlessly manage application lifecycle updates—ensuring older versions are automatically uninstalled and replaced with newer ones. In our example, **Notepad++ 7.8.9** was cleanly removed and upgraded to **Notepad++ 7.9.1**, demonstrating how Supersedence simplifies version control, reduces manual effort, and enhances end‑user experience. Whether you’re deploying incremental upgrades or replacing applications entirely, Supersedence provides a reliable, automated way to keep your environment consistent and up to date. ## Frequently Asked Questions (FAQs) ### What is Win32 App Supersedence in Intune? Supersedence is a feature in Microsoft Intune that allows administrators to **upgrade or replace existing Win32 applications automatically**. It ensures older versions are uninstalled or updated seamlessly when deploying a newer version or a different app. ### How does Supersedence differ from Dependencies? Dependencies ensure prerequisite apps are installed before the main app. Supersedence defines how Intune handles upgrades or replacements of existing apps. In short, dependencies are about installation order, while supersedence is about lifecycle management. ### Can Supersedence uninstall the old version of an app? Yes. When configuring Supersedence, admins can choose to **uninstall the previous version** or simply upgrade in place. For example, Notepad++ 7.8.9 can be completely removed before installing Notepad++ 7.9.1. ### Can Supersedence replace an app with a completely different one? Yes. Supersedence is not limited to version upgrades—it can **replace one Win32 app with another entirely different app**, making it useful for migrations (e.g., replacing a legacy text editor with Notepad++). ### How can admins validate Supersedence deployment? Admins can check deployment status in the **Intune portal under Devices → Windows**. The portal shows whether the new app is installed and the old app is uninstalled, confirming the Supersedence relationship worked correctly. ## **Related Posts** - [Deploy Win32 App Using Intune Enterprise App Catalog](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) - [Understanding Win32 App Detection Rules](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Understanding Win32 App Requirements Rule](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [Upgrade / Replace Win32 Apps with Supersedence Relationship](https://techuisitive.com/upgrade-replace-win32-app-with-supersedence-relationship-intune/) - [Win32 App Deployment with Dependencies](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Win32 Apps vs LOB Apps](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation source for Microsoft Intune](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) - [SCCM Device Collection Equivalents in Microsoft Intune for App Deployment](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptop and Desktop in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Tags: [Intune Guides](https://techuisitive.com/tag/intune-guides/), [Win32 Apps](https://techuisitive.com/tag/win32-app/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Intune Guides, Win32 Apps --- ### [How to deal with wrong application deployment in ConfigMgr and Intune](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) **Published:** May 11, 2021 **Author:** Equebal Ahmad **Content:** You have just done away with a software deployment in the production environment. Soon, you were flooded with complaints that something went wrong with the deployment, and it needed to be stopped immediately. What should be your next step? What are the best practices to deal with misdeployments? The most common answer I have heard is: **Delete the deployment**. Well, that sounds good to stop the deployment on the new machine. You just deleted the deployment and relaxed. However, trouble is not over here. You got a call from higher management, and they asked you to provide the list of all users/machines impacted by the deployment. Once identified, you have to work on a remediation plan. Now you have another challenge. How can you pull out these details? When you delete the deployment, its remove all such details from SCCM along with the deployment. So, what are the best options to deal with wrong deployment? There are many such options available that you can use to stop the deployment. This will also ensure you have historical data available if required for reporting / remediation purposes. ## SCCM / Configuration Manager - Expire the deployment by setting the Deployment End Date to the past. - Remove the content from the distribution point(s). This way, the client would not be able to deploy when it has already received the policy. - Switch deployment target to a blank Collection. - If its CM2012 Application then you can just right click on an application and select “Retire”. ## Microsoft Intune - Remove the application assignment by removing Groups/All Users/All Devices from both Required and Available deployment. ## Related Posts - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [Software Deployment](https://techuisitive.com/tag/software-deployment/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** Software Deployment --- ### [Enabling Azure Single Sign-On in Google Chrome with Intune: Don’t Miss This Key Setting](https://techuisitive.com/enabling-azure-single-sign-on-in-google-chrome-with-intune-dont-miss-this-key-setting/) **Published:** March 28, 2026 **Author:** Equebal Ahmad **Content:** Seamless sign-on is one of the biggest productivity wins for IT admins. If your users are still being prompted for credentials in Chrome despite enabling browser sign-in, chances are you’ve overlooked one critical policy: **Allow automatic sign-in to Microsoft cloud identity providers**. Let’s walk through the complete setup so you can deliver true single sign-on (SSO) across Windows and Chrome. ## Why This Matters - **Without it**: Chrome may sign users into the browser, but Microsoft 365 apps (Teams, Outlook, SharePoint) still ask for credentials. - **With it**: Chrome automatically passes the Windows Entra ID account into Microsoft cloud services, eliminating repeated prompts. - **Result**: A consistent, frictionless identity experience aligned with your organization’s Azure AD (Entra ID) policies. --- ## Step-by-Step Configuration to Enable Single Sign-On in Google Chrome ### 1. Import Chrome ADMX Templates in Intune - Download the latest **[Google Chrome ADMX files](https://support.google.com/chrome/a/answer/187202?sjid=9950386243970472824-NC "Google Chrome ADMX files")**. - In Intune, go to **Devices > Windows > Configuration > Import ADMX** - Upload the ADMX templates so Chrome policies can be managed centrally. To upload the ADMX templates, select both the ADMX and ADML files and select Next. ![Import ADMX in Intune](https://techuisitive.com/wp-content/uploads/2026/03/image.png) On the Review + Create page, verify the ADMX and ADML file details to ensure the correct files are selected, then click Create ![How to Import Google Chrome ADMX in Intune to enable Single sign on (SSO)](https://techuisitive.com/wp-content/uploads/2026/03/image-1.png)You will now see the ADMX upload is in progress. ![Google chrome ADMX upload in Intune](https://techuisitive.com/wp-content/uploads/2026/03/image-2-1024x244.png) If the upload fails with the following error, it indicates that the `google.admx` file has not been uploaded. This file is a prerequisite for Chrome ADMX templates and must be added first. ADMX file referenced not found NamespaceMissing: Google.Policies Please upload it first. ![ADMX file referenced not found NamespaceMissing: Google.Policies Please upload it first.](https://techuisitive.com/wp-content/uploads/2026/03/image-3-1024x279.png) **Resolution:** - Upload the **google.admx** file first. - Delete the existing **chrome.admx** file. - Re‑upload the **chrome.admx** file again. This ensures that the Chrome ADMX template is properly recognized by **Group Policy** and avoids dependency errors during import. ### 2. Create a Configuration Profile You need to create a device configuration profile to enable Google Chrome SSO using Intune. Follow the steps below to create a configuration profile in Intune. - Navigate to **Devices > Windows > Configuration profiles**. - Select **+ Create profile**. - Choose **Platform: Windows 10 and later**. - Choose **Profile type: Templates > Imported Administrative Templates**. - Choose **Create**. ![Create device configuration profile using imported administrative templates](https://techuisitive.com/wp-content/uploads/2026/03/image-4-1024x466.png) ### 3. Configure Chrome Identity Policies Configure the following settings for Google Chrome. **Policy****Role in SSO****Browser sign-in settings****The Identity Foundation.** This establishes the user’s “Profile Identity” within the browser. Without this enabled, Chrome remains in a “guest-like” state regarding enterprise identity, meaning it won’t attempt to manage the user profiles necessary for identity passthrough. **Allow automatic sign-in to Microsoft cloud identity providers****The Authentication Connector.** This acts as the bridge between Chrome and the **Windows Web Account Manager (WAM)**. It specifically authorizes Chrome to request and pull the **Microsoft Entra ID (Azure AD)** token from the OS, enabling the “silent” sign-in experience. #### **Browser sign-in settings** → Enabled ![Browser sign-in settings for Chrome SSO](https://techuisitive.com/wp-content/uploads/2026/03/image-7-1024x527.png)#### **Allow automatic sign-in to Microsoft cloud identity providers** → Enabled ![Allow automatic sign-in to Microsoft cloud identity providers settings for Google chrome SSO](https://techuisitive.com/wp-content/uploads/2026/03/image-6-1024x559.png)### 4. Assign the Profile - Target the profile to your **Azure AD groups** (e.g., all Windows devices or specific departments). - Save and deploy. ## End User Experience - On a managed Windows device, open Google Chrome. - Users should be automatically signed in with their **Entra ID credentials**. - Test by accessing Microsoft 365 apps — no additional login should be required. ## Common Pitfalls - **Outdated Chrome versions**: Ensure Chrome 111+ is deployed. - **Hybrid join issues**: Devices must be properly joined/registered in Entra ID. - **Policy conflicts**: Group Policy Objects (GPOs) may override Intune settings. - **User expectations**: Once enabled, users cannot sign out of Chrome without signing out of Windows. ## Conclusion Setting up **Azure Single Sign-On (SSO)** in Google Chrome through **Microsoft Intune** is simple, but one key policy often gets missed: **Allow automatic sign-in to Microsoft cloud identity providers**. This setting is the bridge that lets Chrome talk directly to Windows and pull the **Entra ID (Azure AD) token** without asking users for their password again. When you combine it with **BrowserSignin**, **IdentityConsistencyEnabled**, and **EnableAutoLogin**, you create a truly seamless sign-in experience. ## Frequently Asked Questions (FAQ) ### Why is the “Allow automatic sign-in to Microsoft cloud identity providers” setting so important? This policy acts as the specific **bridge** between Google Chrome and the Windows Web Account Manager (WAM). While other settings prepare the browser for an identity, this one specifically authorizes Chrome to “silently” pull the Entra ID (Azure AD) token from the OS, which is what eliminates the password prompt for Microsoft 365 apps. ### I’ve enabled all policies, but my users still see a login prompt. What’s wrong? The most common culprit is the **Device Join Status**. For SSO to function, the device must be either **Microsoft Entra Joined** or **Hybrid Entra Joined**. You can verify this on the local machine by running the command `dsregcmd /status` and ensuring `AzureAdPrt` is set to **YES**. ### Do I still need the “Microsoft Single Sign-On” extension for Chrome? **No.** If you are using Chrome version 111 or later and have configured the *Allow automatic sign-in to Microsoft cloud identity providers* policy, the extension is no longer required. The browser now handles this communication natively at the OS level. ### Why can’t I find “EnableAutoLogin” or “IdentityConsistencyEnabled” in Intune? Google has updated its ADMX templates. **EnableAutoLogin** is now largely managed via the **Browser sign-in settings** toggle. **IdentityConsistencyEnabled** has been superseded by the **Microsoft cloud identity providers** policy. If you are using the latest templates, search for these newer names in the Settings Catalog. ### Does this SSO setup work in Incognito mode? No. By design, **Incognito mode** prevents the browser from accessing the user’s OS identity tokens to ensure privacy. SSO will only function within standard, managed Chrome profiles. ### Can a user sign out of Chrome once this is enabled? When these policies are strictly enforced, users generally cannot sign out of the Chrome profile without signing out of the Windows session itself. This ensures that the corporate identity remains consistent across the device. ## Related Posts - [How to Enable Windows SSO in Firefox Using Microsoft Intune](https://techuisitive.com/enabling-windows-sso-in-firefox-using-intune/ "How to Enable Windows SSO in Firefox Using Microsoft Intune ") - [Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [Manage Microsoft Edge Favorites with Intune for Windows 10/11](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [How to Configure Edge Chromium Homepage & Startup Page Using Intune](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[Device Configuration Guides](https://techuisitive.com/device-configurations/ "Device Configuration")** – Explore practical Microsoft Intune guides for configuring Windows and other devices, including device restrictions, browser settings, user experience, security, and system configuration. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Browser Configuration, Device Configuration, Intune Guides --- ### [Updating BIOS Version with HP CMSL](https://techuisitive.com/updating-bios-version-with-hp-cmsl/) **Published:** June 11, 2022 **Author:** Sabir Ali **Content:** We all know OEMs recommend updating the BIOS version to ensure safety and take advantage of critical vulnerability fixes and feature enhancements with new BIOS versions. But the truth is… deploying a BIOS update is somewhat not encouraging, well… traditionally! On one hand, an interrupted installation can corrupt the BIOS and “brick” the PC, leaving it unable to boot and on the other hand, it’s a nightmare for our IT Administrators to create packages after packages with each version release, not to mention for the different number of system models that exist in an enterprise environment. Another problem that has plagued IT Administrators is patching a BIOS that has an admin password configured. I know, WUfB delivers BIOS updates via UEFI capsule, which does not require entering the password to deploy the automatic update however this process lacks granularity and gives less control to an IT Administrator. In this article, we will focus on to eliminate these pain points and truly aid IT Administrators who want to automate PC Lifecycle Management tasks such as BIOS Update. The objective here is to help you create / setup an evergreen package which will have quite a few Safety nets to avoid “brick” situation. **Let’s get started…** In this article, I will walk you through how to: 1. Generate the secure BIOS password file and encryption key. 2. Deploy the script to update BIOS to the recommended version. 3. Deploy the script to update BIOS to the specified version. **The “Safety nets” in the script:** - If the device has USB drives attached, BIOS flashing process will be aborted. - If the device is not connected to an external power source, BIOS flashing process will be aborted. - If the device is not running Windows 10 1709 (Fall Creators Updated) and later, BIOS flashing process will be aborted. - If the boot mode is not UEFI, BIOS flashing process will be aborted. - If the script is running under 32-bit PowerShell, it will be re-launched automatically under 64-bit PowerShell. - If the current BIOS version installed on the PC is same as the latest version available on the HP Software & Driver webpage, BIOS flashing process will be aborted. **PowerShell Script** Download the zip file (the .zip file contains): [HP-BIOSUpdate.zip](https://techuisitive.com/wp-content/uploads/2023/09/HP-BIOSUpdate.zip) - HP-BIOSUpdate.ps1 – script to update BIOS. - Script and supporting files to generate a secure BIOS Setup Password file and corresponding AES encryption key – for customers who have set a unified BIOS Setup password across their fleet. 1. AES.key 2. Generate\_SecurePassword.ps1 3. Password.txt **Script Details** - The script will only run on HP manufactured devices and excludes virtual machines. - You must run the script with Administrative privileges. - Download the HP Client Management Script Library installer from and include the executable with the script. - Ensure that .ps1 and .exe files are in the same folder. - Logs are output to *“C:\\ProgramData\\HP\\CMSL\\Logs\_BIOSUpdate.log”* - BitLocker is suspended for one reboot to apply BIOS version upgrade, then BitLocker is re-enabled upon reboot. - BIOS Flash is only supported on Windows 10 1709 (Fall Creators Update) and later. - A UEFI boot mode is required for flashing, and legacy mode is not supported. - Remove external drives such as USB memory keys, external Hard Disk drives, etc. if attached to the PC, else the script will exit gracefully. - The script will exit without action if a BIOS password exists on a device but has not been specified in the script. If your devices share a unified BIOS password, you should use the enclosed “Generate\_SecurePassword.ps1” script to generate a BIOS password file and corresponding AES encryption key to package with the BIOS update script. However, DO NOT call on the “Generate\_SecurePassword.ps1” file in your “Install” Program in SCCM or any other Endpoint Management tool you prefer to deploy the PowerShell script. - The script detects the following chassis types when checking for external power source: 1. Notebook, Tablet 2. Desktop, Tower, Workstation, Mini PC 3. Small Form Factor, Convertibles 4. AiO (All in One) 5. PoS (Point of Sales) 6. Expansion Chassis, Sealed Case PC - See below table for the Standard Exit Codes Output by the PowerShell Script: **Exit Code****Description**0There is no error8Non-HP manufactured PC27OS version not supported64CMSL installer not found65CMSL install failure343General exceptions216BIOS password incorrect217BIOS download failure28USB drives attached29PC is not connected to AC power**Deploying the Script to Update BIOS to the Latest Version** Some examples of Endpoint Management tools you can use to deploy the script are Microsoft System Center Configuration Manager, Microsoft Endpoint Manager, VMware Workspace ONE, Tanium, DesktopCentral, Altiris etc. In the Endpoint Management tool of your choice, create a device group for the targeted devices regardless if the BIOS version is outdated or latest and target the script to those devices. In production environment, the script can be run silently, but for purposes of this article, we are showing the script’s output when run in a command prompt. The script does the BIOS Update automatically, and you can run it periodically to enforce the BIOS Update across your fleet. ![Updating BIOS Version HP CMSL](https://techuisitive.com/wp-content/uploads/2023/04/image-96.png)**Generating the Secure BIOS Password File and Encryption Key** If you have set a unified BIOS Setup password across your fleet, run the included “Generate\_SecurePassword.ps1” script to generate a secure password file and AES encryption key. This approach assumes that all devices share the same BIOS password. - Enter the BIOS Setup password in the “Generate\_SecurePassword.ps1” file. In this example, the password is “P@ssword1” ![](https://techuisitive.com/wp-content/uploads/2023/04/image-97.png)- Enter the same BIOS Setup password in the “Password.txt” and save the file. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-98.png)- Run “Generate\_SecurePassword.ps1” to generate a secure password.txt file and AES.key encryption key. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-99.png)- Include both the “Password.txt” file and “AES.key” files along with the “HP-BIOSUpdate.ps1” script & the “CMSL installer” when creating a Package and deploying to your fleet. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-100.png)**\[ OPTIONAL \]** **Deploying the Script to Update BIOS to a Specified Version:** This section describes how to update BIOS to a specific version across your environment and this gives you more control in order to revert back the changes / downgrade the BIOS version. The PowerShell script updates the fleet to the latest BIOS version if no parameter is specified. Use one of the following parameters if you need to Force update the BIOS to a specific version: **• -Force -File ** Updates the BIOS using the BIOS firmware file specified in the path. When using this parameter, the script will not download the firmware from the Internet and instead use the firmware in the specified path. **• -Force -Version ** Updates the BIOS to the BIOS version specified. When using this parameter, the script will download the firmware from the Internet. **Example of updating the BIOS with a specific BIOS firmware file:** *powershell -executionpolicy bypass -file HP-BIOSUpdate.ps1 -Force -File C:\\Windows\\Temp\\123.bin* ![](https://techuisitive.com/wp-content/uploads/2023/04/image-101.png)**Example of updating the BIOS to a specific BIOS version:** *powershell -executionpolicy bypass -file HP-BIOSUpdate.ps1 -Force -Version 1.15.00* ![](https://techuisitive.com/wp-content/uploads/2023/04/image-102.png)--- HP offers Proactive Insights powered by [HP TechPulse](https://www.youtube.com/watch?v=qhcdocBxLrY), a powerful telemetry and analytics platform that provides all the actionable insights for the enrolled devices through a single, simple to use dashboard (SaaS application). Using HP TechPulse, you can (among many other things)… 1. Identify devices that have outdated BIOS versions using HP TechPulse and use this device list to target the deployment only to the ‘required’ devices that is running on outdated BIOS versions. 2. Monitor the BIOS update status using an Excel report extracted from HP TechPulse. 3. Monitor the BIOS updates status using the dashboard widget in HP TechPulse. 4. Monitor the BIOS updates status using the missing BIOS update incidents automatically logged in HP TechPulse. --- **Additional Information:** - Detailed CMSL syntax available [here](https://developers.hp.com/hp-client-management/doc/bios-and-device) - HP CMSL Installer is available to download from [HP Download Library](https://www.hp.com/us-en/solutions/client-management-solutions/download.html) Important **Please ensure you perform adequate testing before rolling out the script to your fleet.** \* Please feel free to reach out with any comments or questions! [LinkedIn](https://www.linkedin.com/in/sabir-ali-54594a37/) [Twitter](https://twitter.com/sabiralicwi1324) ## Related Posts - [Manage Battery Health Manager (BHM) Settings with HP CMSL](https://techuisitive.com/manage-battery-health-manager-bhm-settings-with-hp-cmsl/) - [Updating BIOS Version with HP CMSL](https://techuisitive.com/updating-bios-version-with-hp-cmsl/) - [Manage BIOS Settings with HP CMSL](https://techuisitive.com/manage-bios-settings-with-hp-cmsl/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [SCCM Device Collection Based on Computer Hardware Details | ConfigMgr](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) ## Explore More Windows Guides Continue building your Windows administration skills with practical, step-by-step guides covering Windows configuration, troubleshooting, device management, PowerShell, and automation. - **[Windows 10/11 Guides](https://techuisitive.com/microsoft-windows/)** – Explore practical guides for Windows configuration, administration, troubleshooting, updates, PowerShell, and everyday Windows management. - **[Microsoft Intune Learning](https://techuisitive.com/microsoft-intune/)** – Learn how to manage Windows devices with Intune, including device enrollment, configuration, compliance, application deployment, and updates. - **[Automation](https://techuisitive.com/automation/)** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive administration tasks and manage Windows devices more efficiently. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Device Management - HP **Tags:** BIOS, HPCMSL --- ### [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) **Published:** June 6, 2022 **Author:** Equebal Ahmad **Excerpt:** Managed devices are devices that are under some sort of organization control. You administrator can setup or restrict some feature or control how device can be used. The devices managed by Microsoft Intune are called Intune Managed Devices. We can export managed device details from Microsoft Intune Admin Center. We can also use PowerShell SDK for Microsoft Intune Graph API to export the device details in CSV file. **Content:** Exporting managed device details from Microsoft Intune is essential for administrators who need to analyze inventory, troubleshoot issues, or migrate data. Intune offers two reliable methods: exporting directly from the Microsoft Endpoint Manager (MEM) admin center or using the PowerShell SDK for Intune Graph API. This guide walks you through both approaches, showing how to generate detailed reports in CSV format and leverage automation for scalable device management. Table Of Contents 1. [Export Managed Device Details from Microsoft Intune Admin Center](#export-managed-device-details-from-microsoft-intune-admin-center) 2. [Export Managed Device Details using PowerShell SDK for Intune Graph API – MSGraph (Legacy)](#export-managed-device-details-using-powershell-sdk-for-intune-graph-api-msgraph-legacy) 3. [Export Managed Device Details using Microsoft Graph API – MgGraph (Recommended)](#export-managed-device-details-using-microsoft-graph-api-mggraph-recommended) ## **Export Managed Device Details from Microsoft Intune Admin Center** To export the device list, sign in to Microsoft Intune Admin Center and navigate to **Devices > All Devices** When you export the data from the Intune admin center, you will have two options. - Only include the selected column in the exported file - Include all exported data in the exported file The first option will include all columns visible in the current view. If you want to add or remove columns, the current view can be customized. To add/remove a column in the current view, click on Column, select or unselect the column from the flyer display, and click on **Apply**. ![Intune Export managed device details](https://techuisitive.com/wp-content/uploads/2023/03/image-32.png)To export the device details in a CSV file, click on **Export** ![Intune managed devices export](https://techuisitive.com/wp-content/uploads/2023/03/image-33.png)A Pop-up will appear with the following options. Select the option that you want to go for and click on **Yes**. ![Managed devices list export intune](https://techuisitive.com/wp-content/uploads/2023/03/image-34.png)The export process will begin. You can monitor the progress in the notification area. You may get a dialogue box to save the file once the export is completed. ![Intune device inventory ](https://techuisitive.com/wp-content/uploads/2023/03/image-35.png)The exported data will be downloaded in .zip format. To open the file, double-click on the downloaded zip file and then open the CSV file. ![MEM | Exported Device Data](https://techuisitive.com/wp-content/uploads/2023/03/image-36.png)You can open a CSV file in Microsoft Excel and analyze the data. ![Intune device inventory ](https://techuisitive.com/wp-content/uploads/2023/10/image-58.png)## **Export Managed Device Details using PowerShell SDK for Intune Graph API** – MSGraph (Legacy) We need the PowerShell SDK for Intune Graph API to export the data using PowerShell. Follow the instructions in [Install PowerShell SDK for Microsoft Intune Graph API](https://www.techuisitive.com/post/install-powershell-sdk-for-microsoft-intune-graph-api) to know how to install the PowerShell module for Intune Graph API and connect with MSGraph. **Note:** The `MSGraph` PowerShell module is still supported and works for exporting Intune device data. However, Microsoft now recommends using the modern **Microsoft Graph PowerShell SDK (`Connect-MgGraph`)** for new scripts and automation, as it provides broader functionality and ongoing updates. Once connected with MSGraph, you can use **Get-IntuneManagedDevice** cmdlets to view/export the data from PowerShell. Let’s go through a few examples: **List all devices with selected inventory details in tabular format** ``` Get-IntuneManagedDevice | select-object deviceName,manageDeviceOwnerType,OperatingSystem,ComplianceState,userName,model,SerialNumber | Format-Table ``` ![Graph API CSV export](https://techuisitive.com/wp-content/uploads/2023/03/image-37.png)**Export all devices with selected inventory data in CSV** ``` Get-IntuneManagedDevice | select-object deviceName,manageDeviceOwnerType,OperatingSystem,ComplianceState,userName,model,SerialNumber | Export-csv -Path c:\temp\manageddevices.csv ``` **Export all devices with all inventory data in CSV** ``` Get-IntuneManagedDevice | select-object * | export-csv -Path c:\temp\ManagedDevices.csv ``` ![MEM | Export Intune Managed Devices](https://techuisitive.com/wp-content/uploads/2023/03/image-38.png)**Export all inventory data for virtual devices** ``` Get-IntuneManagedDevice | Where-Object {$_.model -match 'Virtual'}| Export-csv -Path c:\temp\virtualdevices.csv ``` ### Export all data for a specific hardware manufacturer The command below will export the list of all Dell devices from Microsoft Intune to a CSV file. You can update the command to pull the details for other manufacturers, such as HP, Lenovo, virtual devices, Surface devices, etc. `Get-IntuneManagedDevice | Where-Object {$_.manufacturer -match "Dell"} | Export-Csv -Path c:\temp\manageddevices.csv` ### Export Data for Single Device `Get-IntuneManagedDevice | Where-Object {$_.devicename -eq "DESKTOP-IG58DTD"} | Export-Csv -Path c:\temp\manageddevices.csv` ### List all Details for a single device `Get-IntuneManagedDevice | Where-Object {$_.devicename -eq "DESKTOP-IG58DTD"} ` ### List Serial Number for Single Device `Get-IntuneManagedDevice | Where-Object {$_.devicename -eq "DESKTOP-IG58DTD"} | Select-Object SerialNumber` ### Get a list of all non Compliant Devices `Get-IntuneManagedDevice | Where-Object {$_.compliancestate -eq "noncompliant"} | Select-Object deviceName,manageDeviceOwnerType,OperatingSystem,ComplianceState,userName,model,SerialNumber` ### Get a list of all Test Devices (Based on Device Categories) The command below lists all test devices whose [device category](https://techuisitive.com/how-to-create-and-manage-microsoft-intune-device-categories/ "How to Create and Manage Microsoft Intune Device Categories") is set to “Test Devices”. `Get-IntuneManagedDevice | Where-Object {$_.deviceCategoryDisplayName -eq "Test Devices"} | Select-Object deviceName,manageDeviceOwnerType,OperatingSystem,ComplianceState,userName,model,SerialNumber,deviceCategoryDisplayName` ## **Export Managed Device Details using** Microsoft Graph API – MgGraph (Recommended) Exporting managed device details from Microsoft Intune is a common requirement for administrators who need inventory reports, compliance checks, or migration data. While the legacy `MSGraph` module is still supported, the recommended approach is to use the **Microsoft Graph PowerShell SDK (`MgGraph`)**, which provides access to the full Microsoft Graph API with modern authentication and broader coverage. #### Install Microsoft Graph PowerShell SDK ``` Install-Module Microsoft.Graph -Scope CurrentUser ``` #### Connect to Microsoft Graph ``` Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All" ``` - You’ll be prompted to sign in with an account that has Intune admin permissions. - The scope ensures you can read managed device details. #### Retrieve Managed Device Details ``` # Pull all managed devices with key details Get-MgDeviceManagementManagedDevice | Select-Object Id, DeviceName, OperatingSystem, ComplianceState, SerialNumber ``` #### Export to CSV ``` Get-MgDeviceManagementManagedDevice | Select-Object Id, DeviceName, OperatingSystem, ComplianceState, SerialNumber | Export-Csv -Path "C:\IntuneDevices.csv" -NoTypeInformation ``` This will generate a CSV file containing key details such as **Device Name, OS, Compliance State, and Serial Number**. #### Pull Details for a Single Device ``` # Replace with the actual device Id Get-MgDeviceManagementManagedDevice -ManagedDeviceId | Select-Object DeviceName, SerialNumber, Model, OperatingSystem, ComplianceState ``` This command fetches detailed information for a specific device by its unique Id. #### Pull Devices by Specific Hardware Model ``` # Filter devices by hardware model, e.g., "Surface Pro 7" Get-MgDeviceManagementManagedDevice | Where-Object { $_.Model -eq "Surface Pro 7" } | Select-Object DeviceName, SerialNumber, Model, OperatingSystem ``` This example filters and lists only devices matching the specified hardware model. #### Export Filtered Devices to CSV ``` Get-MgDeviceManagementManagedDevice | Where-Object { $_.Model -eq "Surface Pro 7" } | Select-Object DeviceName, SerialNumber, Model, OperatingSystem | Export-Csv -Path "C:\SurfacePro7Devices.csv" -NoTypeInformation ``` ### **Related Posts** - [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) - [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/ "How to Bulk Sync Intune Devices with Microsoft Graph") - [Get AAD Group Members Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [Install PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Graph API, Intune Guides --- ### [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/) **Published:** January 20, 2024 **Author:** Equebal Ahmad **Content:** A dynamic group membership updates automatically based on defined rules. You can create attribute-based rules to update the group membership. You can create a dynamic group in Entra ID for users or devices. However, you can’t create rules that contain both the user and the device. You can add multiple membership rules in a dynamic device group. In this article, we will explain how to create an Azure AD dynamic group / Intune dynamic device group based on the device enrolment profile. You can have multiple enrolment profiles for different user groups or departments based on business requirements. The business units may also need different applications and configurations for different sets of users. You can create an Azure dynamic group based on enrolment profiles and assign [Microsoft Intune](https://techuisitive.com/microsoft-intune/ "Microsoft Intune") applications, device configuration, device restriction, and other policies to that Azure AD/Entra ID group. This automates the administration and no manual intervention is required for the device once enrolled. You can create dynamic groups for Windows Autopilot enrolment profiles, iOS Automated device enrolment (ADE) profiles, and Android enrolment profiles. Table Of Contents 1. [How to Create Dynamic Group Based on Enrollment Profile in Entra ID](#how-to-create-dynamic-group-based-on-enrollment-profile-in-entra-id) 2. [Sample Membership Rules for Dynamic Groups Based on Enrollment Profile Name](#sample-membership-rules-for-dynamic-groups-based-on-enrollment-profile-name) - [Entra ID dynamic group where device enrollment profile is "Production Floor Supervisors" and device type is iPad](#entra-id-dynamic-group-where-device-enrollment-profile-is-production-floor-supervisors-and-device-type-is-ipad) - - [Entra ID dynamic group where device enrollment profile is "Production Floor Supervisors" and device type is iPhone](#entra-id-dynamic-group-where-device-enrollment-profile-is-production-floor-supervisors-and-device-type-is-iphone) - - [Dynamic membership rules for profile name start with "Safety Inspections" and device type is either iPhone or iPad](#dynamic-membership-rules-for-profile-name-start-with-safety-inspections-and-device-type-is-either-iphone-or-ipad) - - [Dynamic membership rules for profile name start with "Field Supervisors" and device type is AndroidForWork](#dynamic-membership-rules-for-profile-name-start-with-field-supervisors-and-device-type-is-androidforwork) 3. [Related Posts](#related-posts) - [Subscribe to Techuisitive Newsletter](#subscribe-to-techuisitive-newsletter) ## How to Create Dynamic Group Based on Enrollment Profile in Entra ID Follow the below steps to create a dynamic group based on the device enrollment profile name. - Open Microsoft Intune admin center and navigate to **Groups** blade. - Click on **All Groups > New Group** ![Entra ID dynamic group based on enrollment profile](https://techuisitive.com/wp-content/uploads/2023/12/image-26-1024x397.png)- On the **New Group** page, provide the following details. - **Group Type:** Security - **Group Name:** Provide a meaningful name for the group - In the **Membership type**, select **Dynamic Device** - Click on **Add dynamic query** ![Azure AD dynamic group](https://techuisitive.com/wp-content/uploads/2023/12/image-27.png)- In the **Dynamic membership rules** page, add the following query builder rules. - **Property**: EnrollmentProfileName - **Operator**: Equals - **Value**: Enter an enrolment profile name - Click on **Save** You can also add additional membership rules. For example, an enrolment profile was used for iOS/iPadOS devices. However, in a dynamic group, you only want to have the iPad. in that case, you can add another rule “deviceOSversion = iPadOS”. ![Dynamic membership rules | Entra ID | Azure AD](https://techuisitive.com/wp-content/uploads/2023/12/image-28.png) Back to the **New Group** page, click on the **Create** button to create the Entra ID group. ![Entra ID group](https://techuisitive.com/wp-content/uploads/2023/12/image-29.png)- You can now see the newly created group in Entra ID Groups. ![Entra ID group | Intune dynamic device group](https://techuisitive.com/wp-content/uploads/2023/12/image-30.png)## Sample Membership Rules for Dynamic Groups Based on Enrollment Profile Name ### Entra ID dynamic group where device enrollment profile is “Production Floor Supervisors” and device type is iPad `(device.enrollmentProfileName -eq "Production Floor Supervisors") and (device.deviceOSType -eq "iPad")` ### Entra ID dynamic group where device enrollment profile is “Production Floor Supervisors” and device type is iPhone `(device.enrollmentProfileName -eq "Production Floor Supervisors") and (device.deviceOSType -eq "iPhone")` ### Dynamic membership rules for profile name start with “Safety Inspections” and device type is either iPhone or iPad `(device.enrollmentProfileName -startsWith "Safety Inspections") and ((device.deviceOSType -eq "iPad") or (device.deviceOSType -eq "iPhone"))` ### Dynamic membership rules for profile name start with “Field Supervisors” and device type is AndroidForWork `(device.enrollmentProfileName -startsWith "Field Supervisors") and (device.deviceOSType -eq "AndroidForWork")` ## Related Posts - [How to Get AAD Group Members’ Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) - [Powershell Script to Add Bulk Users / Computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/ "Dynamic Group Based on Enrollment Profile in Intune") - [Deny M365 Apps access from Untrusted Locations | Intune](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Entra ID, Intune Guides --- ### [How to Integrate WordPress with Microsoft Office 365 & Azure AD](https://techuisitive.com/how-to-integrate-wordpress-with-microsoft-office-365-azure-ad/) **Published:** May 15, 2023 **Author:** Equebal Ahmad **Content:** Microsoft Office 365 & Azure Active Directory (AD) allow for seamless and secure account management, especially when using multiple devices to access the same network of programs. It begins with joining Azure AD which is a relatively straightforward process, with steps involved depending on which Microsoft OS you use. If you have a [Windows 10 device](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) for instance, this task can be achieved via Settings and configuring a work or personal account. Once you have a Microsoft Office 365 or Azure AD account available, it may be used for integration with third-party applications. This guide shows how to set up a Microsoft 365 / Azure AD account to access WordPress. It will allow you to sign in to your site without the need to enter your WordPress login credentials. This is achieved through the [WPO365 | LOGIN plugin](https://www.pluginforthat.com/plugin/wpo365-login/) which features OpenID Connect and SAML 2.0 single sign-on (SSO) protocols. The integration not only improves security, it also provides Microsoft-based tasking like sending emails via Microsoft Graph and embedding Power BI data. Follow the steps below to integrate WordPress with Microsoft Office 365 and Azure Entra ID: ## Step 1: Pre-requisites For this method to work, your Azure AD account must be allowed to register new applications. If that’s not the case, you have to discuss this with your network administrator. Ensure that your WordPress admin login name is not the same as the Azure AD login name that will be used. Your WordPress admin email address, however, must be the same as your Office 365 Exchange email address. Doing this will let you send emails directly from your WordPress site. Your WordPress site should also be in HTTPS and have a valid SSL. If you’re running a [managed WordPress](https://namechk.com/web-hosting/managed-wordpress/) site, check with your hosting platform. In most cases, SSL is already included upon setting up your website. This is important because the Microsoft 365 ecosystem requires these protocols. Microsoft Outlook mailer, for example, will only work if you have a valid SSL certificate. This is critical if you plan to connect [Outlook ](https://www.wpbeginner.com/wp-tutorials/how-to-connect-microsoft-outlook-to-wordpress/)[to ](https://www.wpbeginner.com/wp-tutorials/how-to-connect-microsoft-outlook-to-wordpress/)[WordPress](https://www.wpbeginner.com/wp-tutorials/how-to-connect-microsoft-outlook-to-wordpress/) down the line and use it to manage business emails related to your site. ## Step 2: Register AD Application To register WordPress as an AD application, go to the Azure portal and navigate to Azure Active Directory. Select “App registrations” and click on “New registration.” Input your desired name, such as “WP Integration”. Choose the supported account types and enter the Redirect URI (e.g. https://example.com/wp-admin/admin.php?page=oauth-azuread). After registration, jot down the Application ID and Directory ID as you’ll need them later. ## Step 3: Configure Azure AD Settings Next, select your newly created application under “App registrations.” Go to Authentication and add a platform. Choose “Web” and enter the Redirect URI again. Under API permissions, click on “Add a permission” and select the desired Office 365 APIs you want to access. For example, you might need “Microsoft Graph” API permissions for user data. Grant admin consent for the permissions you added. ## Step 4: Install and configure WPO365 | LOGIN Plugin Go to your WordPress dashboard, navigate to Plugins then click “Add New.” Search for “WordPress + Microsoft Office 365 / Azure AD | LOGIN” then install and activate it. Next, open the plugin’s settings and enter the Azure AD Application ID and Directory ID you saved earlier. Configure other settings like the scope of permissions and user roles based on your requirements. ## Step 5: Test your Integration Log out of your WordPress site. On the login page, choose the option for Azure AD or Office 365 login. You should be redirected to the Azure AD login page, where you can enter your Office 365 credentials. Once authenticated, Azure AD will provide an access token to WordPress, allowing you to log in and access the site. When the testing phase proceeded without a hitch, it means you succeeded with the integration. Now you may explore other hacks like connecting your WordPress site with other Microsoft 365 applications. ## Related Posts - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [FeedSpot Top 25 SCCM Blogs to Follow in 2023](https://techuisitive.com/feedspot-top-25-sccm-blogs-to-follow-in-2023/) ## Explore More Intune Guides Continue building your Microsoft Intune skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - [**Intune Application Deployment & Management** ](https://techuisitive.com/application-management/ "Intune Application Management ")– Learn how to manage applications with Microsoft Intune, including app deployment, assignment, detection rules, updates, and troubleshooting. Explore practical guides for Microsoft Store apps, Win32 apps, and other application types. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft 365, Step by Step Guides --- ### [Fix Something went wrong - 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/) **Published:** February 5, 2024 **Author:** Equebal Ahmad **Content:** When you try to sign in to any M365 apps on Microsoft Intune-managed iOS / iPadOS devices ( iPads / iPhones ), the message something went wrong – 2002 may appear. The issue happens to all Microsoft 365 / o365 apps which include MS Excel , Word, PowerPoint , OneDrive , Power BI, etc. There may be different reasons behind this error. Different online forums talk about different issues behind this error. However, in this blog post, we will discuss the issue that caused **Something went wrong. \[2002\]** error for us and how we fixed that. ![Something went wrong. [2002]](https://techuisitive.com/wp-content/uploads/2024/02/image.png)## Why Does the Sign-In Error 2002 Occur We noticed that the issue was happening for a specific customer site. The devices were enrolled using a separate Apple Device Enrollment ( ADE ) profile. The separate Device configuration Feature & Restriction policies were applied to these devices. These devices were configured to allow only a few web applications and websites and access restriction was applied through Device Feature – Web Content Filter. When you select Specific websites only in Filter Type then only those websites will be allowed which URLs are added. All other websites will be blocked. The issue was happening as the o365 app sign-in URLs were not in the allowed list. The web filter “Specific websites only” restricts the site’s access from the Apple Safari browser. When the user tries to sign in to the application, the M365 sign-in page opens in the Safari web browser where website access is blocked. ![Web Content Filter | Something went wrong 2002 error](https://techuisitive.com/wp-content/uploads/2023/12/image-8.png) ## How to Fix Something Went Wrong – 2002 Error As per Microsoft documentation, the following URLs should be accessible for o365 apps to work. - https://live.com - https://office.com - https://office365.com We updated the Web Content Filter to allow these sites, forced policy sync on a device, and checked again. The issue was fixed quickly after the policy update. ![Fix Something went wrong. [2002] error](https://techuisitive.com/wp-content/uploads/2023/12/image-9.png)## Related Posts - [Deny M365 Apps access from Untrusted Locations](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/ "Deny M365 Apps access from Untrusted Locations") - [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/ "How to Restrict Website Access Using Web Content Filter | Intune") - [Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/ "Fix Something went wrong – 2002 error on iOS | Intune") - [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/ "Configure Home Screen Layout on iOS using Intune") - [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) - [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) - [Create ADE Enrollment Profile in Microsoft Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Intune iOS, Intune iOS Troubleshooting --- ### [Manage BIOS Settings with HP CMSL](https://techuisitive.com/manage-bios-settings-with-hp-cmsl/) **Published:** June 7, 2022 **Author:** Sabir Ali **Content:** Changes in the BIOS settings across site(s) have always been a cumbersome task for the IT shops when it comes to deploy it to an existing PC fleet. Not anymore! Let me guide you unleash the super-power that lies beneath [HP Client Management Script Library](https://developers.hp.com/hp-client-management/doc/client-management-script-library). ## **Pre-requisites:** 1. PowerShell 5.1 or higher 2. Windows 10 version 1709 or higher 3. System Manufacturer = HP ## **Let’s get started…** In this article, I will walk you through how to: 1. Generate the secure BIOS password file and encryption key. 2. Deploy the script to apply the desired BIOS settings across the fleet. ## **PowerShell Script** Download the zip file (the .zip file contains): [HP-BIOS-Settings-Compliance.zip](https://techuisitive.com/wp-content/uploads/2024/08/HP-BIOS-Settings-Compliance.zip "HP-BIOS-Settings-Compliance.zip") - Manage\_BIOS\_Settings.ps1 – script to enforce desired BIOS settings. - Script and supporting files to generate a secure BIOS Setup Password file and corresponding AES encryption key – for customers who have set a unified BIOS Setup password across their fleet. 1. AES.key 2. Generate\_SecurePassword.ps1 3. Password.txt **Script Details** - The script will only run on HP manufactured devices and excludes virtual machines. - You must run the script with Administrative privileges. - Download the HP Client Management Script Library installer from and include the executable with the script. - Ensure that .ps1 and .exe files are in the same folder. - Logs are output to “*C:\\ProgramData\\HP\\CMSL\\Logs\\\_BSC.log”* - BitLocker is suspended for one reboot to apply BIOS settings, then BitLocker is re-enabled upon reboot. - A reboot is not required for settings to take effect – only to re-enable BitLocker. - The script will exit without action if a BIOS password exists on a device but has not been specified in the script. If your devices share a unified BIOS password, you should use the enclosed “Generate\_SecurePassword.ps1” script to generate a BIOS password file and corresponding AES encryption key to package with the BIOS update script. However, DO NOT call on the “Generate\_SecurePassword.ps1” file in your “Install” Program in SCCM or any other Endpoint Management tool you prefer to deploy the PowerShell script that will apply BIOS settings remotely. - The script demonstrates applying the following BIOS settings by executing the default script. Note that some BIOS settings may differ based on the device model and BIOS version. Please ensure you perform adequate testing before rolling out the script to your fleet. \*NOTE: There are hundreds of settings in the BIOS, you can add / remove as many functions within the script to enable / disable certain settings in the BIOS that adheres to the recommendations from your IT shop. - 1. Set HP Application Driver to Enable 2. Set DMA Protection to Enable 3. Set Pre-boot DMA protection to All PCIe Devices 4. Set Virtualization Technology (VTx) to Enable 5. Set Virtualization Technology for Directed I/O (VTd) to Enable 6. Set Configure Legacy Support and Secure Boot to Legacy Support Disable and Secure Boot Enable 7. Set Video Memory Size to Maximum​ - See below table for the Standard Exit Codes Output by the PowerShell Script: **Exit Code****Description**0There is no error8Non-HP manufactured PC27OS version not supported64CMSL installer not found65CMSL install failure343General exceptions216BIOS password incorrect217BIOS download failure## **Deploying the Script to Set the Recommended BIOS Settings** Some examples of Endpoint Management tools you can use to deploy the script are Microsoft System Center Configuration Manager, Microsoft Endpoint Manager, VMware Workspace ONE, Tanium, DesktopCentral, Altiris etc. In the Endpoint Management tool of your choice, create a device group for the targeted devices regardless if the BIOS settings are set as per recommendations of your IT Organization or not and target the script to those devices. In production environment, the script can be run silently, but for purposes of this article, we are showing the script’s output when run in a command prompt: ![](https://techuisitive.com/wp-content/uploads/2023/04/image-1.png)### **Generating the Secure BIOS Password File and Encryption Key** If you have set a unified BIOS Setup password across your fleet, run the included “Generate\_SecurePassword.ps1” script to generate a secure password file and AES encryption key. This approach assumes that all devices share the same BIOS password. - Enter the BIOS Setup password in the “Generate\_SecurePassword.ps1” file. In this example, the password is “P@ssword1” ![Manage BIOS Settings](https://techuisitive.com/wp-content/uploads/2023/04/image-2.png) - Enter the same BIOS Setup password in the “Password.txt” and save the file. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-3.png)- Run “Generate\_SecurePassword.ps1” to generate a secure password.txt file and AES.key encryption key. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-4.png)- Include both the “Password.txt” file and “AES.key” files along with the “Manage\_BIOS\_Settings.ps1” script & the “CMSL installer” when creating a Package and deploying to your fleet. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-5.png)### **Review BIOS Setting Changes** Finally, let’s see how you can determine whether the BIOS setting changes have taken effect. **To review the BIOS setting changes:** 1\. After the successful deployment of the “Manage\_BIOS\_settings” script, Launch PowerShell and run this command: ***Get-HPBIOSSettingsList | Out-File -FilePath ‘C:\\ProgramData\\HP\\CMSL\\Logs\\BSC.txt’*** ![](https://techuisitive.com/wp-content/uploads/2023/04/image-6.png)2\. Open “BSC.txt” file from the file location “*C:\\ProgramData\\HP\\CMSL\\Logs*” and review the settings as written in the script. \* indicates the currently ‘enabled’ or ‘selected’ values. For example, if you look at the below screenshot that I took from BSC.txt file, you’ll see the highlighted value is \*Enable for the setting named “Virtualization Technology (VTx)”. Similarly, look for the other settings you intended to modify as per the script. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-7.png)### **To monitor the BIOS setting changes across the fleet:** - You can add WMI classes you want to inventory to SCCM DB and write a WQL query to generate the report. For the HP systems – the information is all stored in the HP Namespace: *root/hp/instrumentedBIOS*. In order to get this information into ConfigMgr, you just need to add the classes to your SCCM Hardware Inventory. Note When you add new classes to Configuration Manager hardware inventory, the size of the inventory file that is collected and sent to the site server will increase. This might negatively affect the performance of your network and Configuration Manager site. Hence, enable only the inventory classes that you want to collect. --- HP offers Proactive Insights powered by [HP TechPulse](https://www.youtube.com/watch?v=qhcdocBxLrY), a powerful telemetry and analytics platform that provides all the actionable insights for the enrolled devices through a single, simple to use dashboard (SaaS application). Using HP TechPulse dashboard, you can (among many other things)… - Identify current BIOS settings on the devices across your end user computing environment and easily decide which computers you need to target for the deployment via your Endpoint Management tool such as SCCM. - Monitor the BIOS setting changes using an Excel report extracted from HP TechPulse after the successful deployment of the BIOS settings compliance script. --- **Additional Information:** - Detailed CMSL syntax available [here](https://developers.hp.com/hp-client-management/doc/bios-and-device) - HP CMSL Installer is available to download from [HP Download Library](https://www.hp.com/us-en/solutions/client-management-solutions/download.html) --- Important **Please ensure you perform adequate testing before rolling out the script to your fleet.** \* Please feel free to reach out with any comments or questions! [LinkedIn](https://www.linkedin.com/in/sabir-ali-54594a37/) [Twitter](https://twitter.com/sabiralicwi1324) ## Related Posts - [Manage Battery Health Manager (BHM) Settings with HP CMSL](https://techuisitive.com/manage-battery-health-manager-bhm-settings-with-hp-cmsl/) - [Updating BIOS Version with HP CMSL](https://techuisitive.com/updating-bios-version-with-hp-cmsl/) - [Manage BIOS Settings with HP CMSL](https://techuisitive.com/manage-bios-settings-with-hp-cmsl/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [SCCM Device Collection Based on Computer Hardware Details | ConfigMgr](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) ## Explore More Windows Guides Continue building your Windows administration skills with practical, step-by-step guides covering Windows configuration, troubleshooting, device management, PowerShell, and automation. - **[Windows 10/11 Guides](https://techuisitive.com/microsoft-windows/)** – Explore practical guides for Windows configuration, administration, troubleshooting, updates, PowerShell, and everyday Windows management. - **[Microsoft Intune Learning](https://techuisitive.com/microsoft-intune/)** – Learn how to manage Windows devices with Intune, including device enrollment, configuration, compliance, application deployment, and updates. - **[Automation](https://techuisitive.com/automation/)** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive administration tasks and manage Windows devices more efficiently. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Device Management - HP --- ### [How to Get AAD Group Members Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) **Published:** May 26, 2022 **Author:** Equebal Ahmad **Content:** We will use PowerShell module for Microsoft Intune Graph API to get Azure AD group members details. If you have not already installed PowerShell SDK for Microsoft Intune Graph API then follow the steps provided in [this article](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/) to install the PowerShell module and connect with MSGraph API with admin consent for the first time. ## **Connect with MSGraph** Type the below command on PowerShell and press enter. Provide your Azure AD credential when you get a prompt to connect with MSGraph. ``` Connect-MSGraph ``` ## **Get Members Details** We have to use **Get-AADGroup** & **GetAADGroupMember** cmdlet to get member details of specific Azure Active Directory groups. **List all Azure AD groups** ``` Get-AADGroup ``` **List specific AD Group** ``` $GroupName = "All Windows 10 and Later Devices" Get-AADGroup | Where-Object {$_.DisplayName -eq $GroupName} ``` **Get members of specific AD Group** ``` $GroupName = "All Windows 10 and Later Devices" Get-AADGroup | Where-Object {$_.DisplayName -eq $GroupName} | Get-AADGroupMember ``` **Format the output** ``` $GroupName = "All Windows 10 and Later Devices" Get-AADGroup | Where-Object {$_.DisplayName -eq $GroupName} | Get-AADGroupMember | Select-Object DisplayName, OperatingSystem, enrollmentType | Format-Table ``` **Export the output** ``` $GroupName = "All Windows 10 and Later Devices" Get-AADGroup | Where-Object {$_.DisplayName -eq $GroupName} | Get-AADGroupMember | Select-Object * | Export-Csv -Path "C:\temp\Groupmembers.csv" ``` ## **The Script** Here is a final script which you can use to export AAD group membership details in CSV. The script will prompt for the AAD group name and export the details of all members in a CSV file. The file will be named as “AAD Group Name-members.csv” and saved in the script directory. ``` $GroupName = Read-Host "Enter AAD Group Name" $Outfile = "$PSScriptRoot\$GroupName" + "-members.csv" #Connect with MSGraph if not already connected Connect-MSGraph $groupobj = Get-AADGroup | Where-Object {$_.DisplayName -eq $GroupName} if ($groupobj -eq $null) {write-host "Error: Group '$GroupName' Not Found" -ForegroundColor Red} else { Get-AADGroup -groupId $groupobj.groupId | Get-AADGroupMember | Export-csv -Path $Outfile Write-Host "Details exported in $outfile" -ForegroundColor Green} ``` [](https://www.wix.app/stores/15be98d9-a214-4e79-9328-db5bbdccc2e7/catalog/a92cb4f4-59b8-4071-0009-8fe69beb7688?d=https://www.techuisitive.com/product-page/export-aad-group-members) ## Related Posts - [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) - [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/ "How to Bulk Sync Intune Devices with Microsoft Graph") - [Get AAD Group Members Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [Install PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Graph API, Intune Graph API, Intune Guides --- ### [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) **Published:** July 6, 2022 **Author:** Equebal Ahmad **Content:** The PowerShell SDK for Intune Graph API helps IT professionals automate and manage their [Microsoft Intune](https://www.techuisitive.com/intune) environment through PowerShell without going to the Endpoint Manager Admin Center. In this article, we will see how to export the serial number for multiple devices using the PowerShell module for Intune Graph API. If you don’t have PowerShell SDK installed, check [this article](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/) to install it and connect it with Microsoft Graph. ## **Get-IntuneManageDevices cmdlets** This cmdlets can be used to retrieve the details of all Intune managed devices. The below command without any parameters will list all Intune managed devices with all available properties. ``` Get-IntuneManagedDevice ``` ![Intune | Get-IntuneManagedDevice cmdlet | Export Serial Number](https://techuisitive.com/wp-content/uploads/2023/04/image-34.png)The result can be filtered using **Where-Object** cmdlets which filter the output and only show the result which you want to see. Here we used the Where-Object cmdlet to see a single device’s output. ``` Get-IntuneManagedDevice | Where-Object {$_.deviceName -eq 'TESTVM01'} ``` The above example will list all properties for a specific device. Now we will use **Select-Object** cmdlets to only show selected properties in the output. The below command will show only selected properties (Manufacturer, Model, and Serial number) for specific devices. ``` Get-IntuneManagedDevice | Where-Object {$_.deviceName -eq 'TESTVM01'} | select-object deviceName,manufacturer,serialnumber ``` ![Intune | Get-IntuneManagedDevice cmdlet](https://techuisitive.com/wp-content/uploads/2023/04/image-35.png)## **The Script** Let’s see how we can export the details for multiple devices. The below PowerShell script will export the details for multiple devices at once. You need to provide the device name in a CSV file in the below format. ![Export Serial number in Intune](https://techuisitive.com/wp-content/uploads/2023/04/image-36.png)Name the CSV file as ‘Devices.csv’ and copy the same in the script folder. The result will be saved in the ‘Devices\_serials.csv’ file in the script directory. Here is the output in the CSV file ![Intune Export Serial number](https://techuisitive.com/wp-content/uploads/2023/04/image-37.png)**Script:** ``` $inFile = $PSScriptRoot + '\devices.csv' $outFile = $PSScriptRoot + '\devices_details.csv' $Results = @() $devices = Import-csv -Path $inFile foreach($device in $devices){ $intuneDevice = Get-IntuneManagedDevice | Where-Object { $_.deviceName -eq $device.'Device Name'} $properties = @{ DeviceName=$device.'Device Name' Manufacturer=$intuneDevice.manufacturer Model=$intuneDevice.model SerialNumber=$intuneDevice.serialNumber } $Results += New-Object psobject -Property $properties } $Results | Select-Object deviceName,manufacturer,model,serialNumber | Export-Csv -Path $outFile -NoTypeInformation ``` ## **Related Posts** - [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) - [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/ "How to Bulk Sync Intune Devices with Microsoft Graph") - [Get AAD Group Members Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [Install PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Graph API, Intune Guides --- ### [Microsoft Excel String Functions - UPPER, LOWER & PROPER](https://techuisitive.com/string-functions-upper-lower-proper-microsoft-excel/) **Published:** September 30, 2021 **Author:** Equebal Ahmad **Content:** Microsoft Excel String functions are used in computer programming languages to manipulate a string. Microsoft Excel also have many string functions which you can use to manipulate strings. The most basic example of a string function in Excel is LEN function which return the length (Number of character) of a string. In this video series we will discuss about different functions in Microsoft Excel. The below video cover String functions UPPER, LOWER and PROPER. Please watch Youtube video to understand how these functions works. **Download**: You can download the excel sheet used in this exercise from [here](https://15be98d9-a214-4e79-9328-db5bbdccc2e7.filesusr.com/ugd/64e6b8_fe2b497c584d42b99e6ae42d422a7928.xlsx?dn=Microsoft_Excel_Functions_Upper_lower_Proper.xlsx). ## **Related Posts:** - [String Functions : UPPER, LOWER & PROPER | Microsoft Excel](https://techuisitive.com/string-functions-upper-lower-proper-microsoft-excel/) - [How To Join Texts Using TEXTJOIN & IF Functions | Microsoft Excel](https://techuisitive.com/how-to-join-texts-using-textjoin-if-functions-microsoft-excel/) - [Basic Excel Functions you should know to make your work life easier](https://techuisitive.com/basic-excel-functions-you-should-know-to-make-your-work-life-easier/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Microsoft Excel – Vlookup Explained](https://techuisitive.com/microsoft-excel-vlookup-explained/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Excel **Tags:** Excel Functions --- ### [What’s new in Microsoft Intune - 2212 (December) edition | Technology Updates](https://techuisitive.com/whats-new-in-microsoft-intune-2212-december-edition-technology-updates/) **Published:** December 29, 2022 **Author:** Equebal Ahmad **Content:** ## **Add Microsoft Store apps to Microsoft Intune** Notes from [Microsoft Tech Community blog.](https://techcommunity.microsoft.com/t5/microsoft-intune-blog/what-s-new-in-microsoft-intune-2212-december-edition/ba-p/3699163) This feature is definitely one that Intune admins have been waiting for. We are improving IT productivity by connecting the[ Windows Package Manager](https://learn.microsoft.com/windows/package-manager/) framework into the Intune app service. The resulting workflow allows these experiences to work together seamlessly, providing the ability to add apps from the Microsoft Store for Business to Microsoft Intune. You can now browse, deploy and monitor apps inside Intune. And, you have complete control to curate what your users can install. Once apps are deployed, Intune will automatically apply updates when new versions are available. Keeping these apps up to date improves security. Apps supported by the Microsoft Store include UWP apps, desktop apps packaged in *.msix*, and Win32 apps packaged in *.exe* or *.msi* installers. The most important feature to make note of is the ability to browse and search for store apps from Intune. Additionally, admins can monitor the installation progress for store apps. Explore this capability in more depth with this Microsoft Mechanics video! ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Technology Updates --- ### [SCEP outdated signature Troubleshooting](https://techuisitive.com/scep-troubleshooting-outdated-signature-issue/) **Published:** March 16, 2021 **Author:** Equebal Ahmad **Content:** Outdated definition is one of the common issue you may encounter while managing System Center Endpoint Protection (SCEP). There may be various reason behind that. In this article, we will discuss about the issue caused by missing WMI namespace / class which prevent virus definition update. ## **Issue 1 : root\\Microsoft\\SecurityClient WMI Namespace is missing** The WMI **namespace** for **SCEP** is root\\Microsoft\\**SecurityClient**. The Configuration Manager client agent monitor the classes in this namespace for any changes and a state message is sent when a change detected. As name suggest, this WMI class represent Microsoft Antimalware service status. Corrupt or missing SecurityClient namespace is one of the primary reason behind outdated definition. You can follow the below steps to diagnose and fix the issue with with WMI namespace. 1. Open WBEM on local machine using wbemtest command. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-227.jpeg)2\. This will open Windows Management Instrumentation Tester window. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-228.jpeg)3\. Click on connect button, under Namespace put **root\\Microsoft\\securityclient** and click connect. If there are no issue with the WMI namespace then all greyed out buttons will be enabled. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-229.jpeg)4\. If you see below error then there are an issue with WMI namespace and you need to fix the same. Please continue with next steps to fix the issue. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-230.jpeg)5\. Navigate to **C:\\Program Files\\Microsoft Security Client** folder and check if the following file exist or not. - ClientWMIInstall.mof - AmMonitoringInstall.mof - AmStatusInstall.mof If these file exist then run the below command from command prompt or PowerShell. If the file doesn’t exist then you need to reinstall SCEP. ``` mofcomp 'C:\Program Files\Microsoft Security Client\ClientWMIInstall.mof' mofcomp 'C:\Program Files\Microsoft Security Client\AmMonitoringInstall.mof' mofcomp 'C:\Program Files\Microsoft Security Client\AmStatusInstall.mof' ``` ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-231.jpeg)6\. After running the above command, open command prompt and run the below command to refresh SCCM client state messages. ``` WMIC /namespace:\\root\ccm path sms_client CALL TriggerSchedule "{00000000- 0000-0000-0000-000000000111}" /NOINTERACTIVE ``` ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-166.png)7\. Wait for an hour and reopen wbemtest, connect to root\\Microsoft\\SecurityClient. You should be able to connect to it. You can check the definition status in SCCM after a day. ## **Issue 2: AntimalwareHealthStatus Class is missing in WMI** 1\. Open wbemtest and connect to root\\Microsoft\\SecurityClient. Follow the same steps provided earlier to connect with WMI namespace. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-232.jpeg)2\. Click on query and type **SELECT \* FROM AntimalwareHealthStatus** and click apply ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-233.jpeg)3\. If you see below error then AntimalwareHealthStatus class is missing and you need to reinstall SCEP. Error Number: 0x80041013 Facility: WMI Description: Provider Load Failure ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-234.jpeg)4\. Uninstall and reinstall SCEP using below command. - Silently uninstall SCEP using below command ``` c:\windows\ccmsetup>SCEPInstall.exe /u /s ``` - Validate if System Center Endpoint Protection has been removed. Reboot the machine. - Install SCEP using below command. ``` c:\windows\ccmsetup>SCEPInstall.exe /s ``` 5\. Once SCEP is installed, open SCEP console on client machine and Run Update Definitions. 6\. Try to connect with AnitmalwareHealthStatus class again. It should work fine. If issue persists then reinstall SCCM client. ## Related Posts - [SCEP – Troubleshooting outdated signature issue](https://techuisitive.com/scep-troubleshooting-outdated-signature-issue/) - [Troubleshooting System Center Endpoint Protection (SCEP) Client](https://techuisitive.com/troubleshooting-system-center-endpoint-protection-scep-client/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM --- ### [macOS : Understanding Keychain](https://techuisitive.com/macos-understanding-keychain/) **Published:** May 12, 2022 **Author:** Tabrez Alam **Content:** Keychain is a container which saves and retrieves password as and when necessary, at system level. The passwords (can be password of multiple things which are used to access websites, FTP servers, SSH accounts, network shares, wireless networks, groupware applications, encrypted disk images), private keys, certificates, and secure notes are stored in an application in MAC OS is called Keychain. One can open Keychain by opening Finder from the Dock, click open Applications, then Utilities, there double click on Keychain. In macOS, keychain files are stored in ~/Library/Keychains/ (and subdirectories), /Library/Keychains/, and /Network/Library/Keychains/. The file extension for a Keychain file is .keychian. ![macOs keychain](https://techuisitive.co.in/wp-content/uploads/2023/04/image-152.png)The password can be shared with other Apple devices and synced so that passwords can be used uniformly on all apps across Apple devices. This is possible via iCloud Keychain. Keychain Access works in collaboration with iCloud Keychain, to create and manage the iCloud Keychain, one must sign into iCloud with the Apple ID. Please refer [the Apple Support link](https://support.apple.com/en-gb/HT204085) for setting up iCloud Keychain. **Repair Keychain:** This is done when Due to any reasons the stored password got corrupted. If the applications refuse to accept the “correct” password and you are being prompted to enter the password multiple times. Then we do Keychain repair. This step is highly recommended in fixing login issues at enterprise level wherein users are supposed to change their log in password every 90 days and the password sync does not happen with, keychain and filevault. Open the Keychain Access menu > Keychain First Aid. Enter your Username and Password when prompted. Then click on Verify to check for corrupted passwords (red entries). After that select the Repair option. ## **Related Posts:** - [macOS : System Preferenes and it’s Components](https://techuisitive.com/macos-system-preferenes-and-its-components/) - [macOS : Understanding Keychain](https://techuisitive.com/macos-understanding-keychain/) - [macOS: Plist files](https://techuisitive.com/macos-plist-file/) - [macOS: FileVault](https://techuisitive.com/macos-filevault/) - [macOS : Enterprise device, MDM and Management tools](https://techuisitive.com/macos-enterprise-device-mdm-and-management-tools/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Mac OS / iOS --- ### [Intune filters to target apps and policies to specific devices](https://techuisitive.com/mem-filters-to-target-apps-and-policies-to-specific-devices/) **Published:** May 24, 2021 **Author:** Equebal Ahmad **Content:** Microsoft introduced Intune Filters, available in public preview with the May release of Microsoft Intune, the filters feature gives IT admins more flexibility and helps them protect data within applications, simplify app deployments, and speed up software updates. With filters, administrators can achieve granular targeting of policies and applications to users on specific devices. See the complete article on Microsoft Endpoint Manager [blog](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/use-microsoft-endpoint-manager-filters-to-target-apps-and/ba-p/2333342). ## Related Posts - [What’s new in Microsoft Intune – 2212 (December) edition | Technology Updates](https://techuisitive.com/whats-new-in-microsoft-intune-2212-december-edition-technology-updates/) - [What’s new in Microsoft Endpoint Manager – 2208 (August) edition](https://techuisitive.com/whats-new-in-microsoft-endpoint-manager-2208-august-edition/) - [Microsoft Connected Cache for Configuration Manager generally available](https://techuisitive.com/microsoft-connected-cache-for-configuration-manager-generally-available/) - [General availability – Android Enterprise corporate-owned devices with a work profile](https://techuisitive.com/general-availability-android-enterprise-corporate-owned-devices-with-a-work-profile/) - [Microsoft Introduced Windows 365 Cloud PC](https://techuisitive.com/microsoft-introduced-windows-365-cloud-pc/) - [Unpacking endpoint management: the series](https://techuisitive.com/unpacking-endpoint-management-the-series/) - [MEM filters to target apps and policies to specific devices](https://techuisitive.com/mem-filters-to-target-apps-and-policies-to-specific-devices/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Technology Updates --- ### [macOS : Enterprise device, MDM and Management tools](https://techuisitive.com/macos-enterprise-device-mdm-and-management-tools/) **Published:** December 27, 2021 **Author:** Tabrez Alam **Content:** Macintosh or fondly referred as MAC, is the first personal computer with a GUI to be sold to end users or customer since 1984. Known for its ease of use, lucidity of the machine, picturesque looks, amazing features to name a few. Who does not wants an iPhone or a MAC device these days, be it an individual or an enterprise. Users by the MAC due to above reasons whereas enterprise use them as they are easy to use by organizational individuals, needs less security maintenance as compared to Windows, they have a great build quality, it integrates seamlessly with other MAC devices, it can be easily managed and deployed lastly the bonus reason they are just amazing ([nearly half of smartphones in use at U.S. enterprises are iPhones](https://www.statista.com/statistics/266572/market-share-held-by-smartphone-platforms-in-the-united-states/)). ### **Mobile Device Management or MDM** Mobile device management or simply MDM is a security software used for administration of devices, such as smartphones, tablets, laptops, desktops etc. Apple uses MDM to configure, manage, deploy MAC devices. For Apple devices in an Enterprise environment; the IT department uses MDM for various purposes like zero touch deployment, enrollment, wireless configuration, update settings, update policies, monitor compliance, manage software and apps, even remotely wipe or lock managed and supervised devices. There are few of the basic ones whereas its application or usage is very varied and vast. ### **Apple Management Tools** 1\) JAMf Pro 2\) Centrify Direct Control 3\) Thursby’s ADmitMac 4\) FileWave 5\) LANDesk 6\) Flexera 7\) Puppet 8\) Faronics Deep Freeze for Mac These are to name a few, there are more MAC management software but by far JAMf is the most known, used and scalable MAC management software. There will be more detailed information and discussion on JAMf in the upcoming MAC series in [Techuisitive](https://www.techuisitive.com/). Stay Tuned. ## **Related Posts:** - [macOS : System Preferenes and it’s Components](https://techuisitive.com/macos-system-preferenes-and-its-components/) - [macOS : Understanding Keychain](https://techuisitive.com/macos-understanding-keychain/) - [macOS: Plist files](https://techuisitive.com/macos-plist-file/) - [macOS: FileVault](https://techuisitive.com/macos-filevault/) - [macOS : Enterprise device, MDM and Management tools](https://techuisitive.com/macos-enterprise-device-mdm-and-management-tools/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Mac OS / iOS --- ### [Understanding SCCM SQL Views](https://techuisitive.com/understanding-sccm-sql-views/) **Published:** December 8, 2018 **Author:** Equebal Ahmad **Content:** The Configuration Manager 2012 / Current Branch come with many built in reports which are sufficient for day to day requirements. However, you still have to deal with SQL query to pull custom details directly from SCCM database based on requirement. As an SCCM administrator you must have good understanding of SQL query in order order to pull these information from SCCM database directly. One of the key requirement here is to have understanding of SCCM DB schema. Once you know which information are stored in which SQL view, you can easily write a SQL query to pull out information. ## **Know SCCM SQL Views:** The SCCM SQL View **v\_SchemaViews** contain the details of all views. You can use below SQL query to get a list of all views. ***Select \* from v\_SchemaViews*** Since, SCCM creates one separate view for each collection, the list will be quite long. You can filter the result by excluding Collection views from query. ***Select \* from v\_SchemaViews where Type <> ‘Collection’*** ![](https://techuisitive.com/wp-content/uploads/2023/04/image-68.jpeg) ## **Details of SCCM Views and Their Naming Conventions:** These views can be grouped into following. ### **Resource Views:** Resource views represent discovery data, which include any resources that were discovers on the network. These views name start with V\_R. The four main discovery views are , **v\_R\_System** for system resources, **v\_R\_User** for user resources, **v\_R\_UserGroup** for user group resources, and **v\_R\_UnknownSystem** for unknown systems. ### **Resource Array Views:** Resource Array views contain data where there can be more than one value for a resource, such as IP Address or User Organizational Unit (OU) name. The name of most of these views start with V\_RA. **Examples:** **V\_RA\_System\_IPAddresess** : List the IP addresses of discovered system resource **V\_RA\_System\_SystemGroupName** : List all system resources which are in an associated Active Directory group. You can find more details about Discovery Views (Resource & Resource Array) [here](https://learn.microsoft.com/en-us/previous-versions/system-center/system-center-2012-R2/dn581928%28v%3Dtechnet.10%29). ### **Inventory Views:** Inventory views contain current inventory data for hardware, software ,clients, files, products, and so forth in the Configuration Manager hierarchy. These views are named as V\_GS. ***Select \* from v\_SchemaViews where type = ‘inventory’*** ![](https://techuisitive.com/wp-content/uploads/2023/04/image-95.png)### **Inventory History Views:** Inventory History views contain inventory history data for hardware, software ,clients, files, products, and so forth in the Configuration Manager hierarchy. These views are named as V\_HS\_. ### **Other Views** **V\_Collection :** The V\_Collection SQL view display the properties of site’s collections. **v\_Package :** The v\_Package SQL view display the properties of site’s packages. **v\_Advertisements:** The v\_Advertisements SQL view display the properties of Advertisements. **v\_Reports:** Display the properties of Reports You can find complete details of all views in Configuration Manager 2012 [here](https://learn.microsoft.com/en-us/previous-versions/system-center/system-center-2012-R2/dn581978%28v%3Dtechnet.10%29). ## Related Posts - [SCCM SQL Query to list Desktop & Laptop Devices](https://techuisitive.com/sccm-sql-query-to-list-desktop-laptop-devices/ "SCCM SQL Query to list Desktop & Laptop Devices") - [SCCM SQL Query for Windows 10 / 11 Version Summary](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) - [SQL Query to Get Maintenance Window for member of specific collection | SCCM](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) - [Understanding SCCM SQL Views](https://techuisitive.com/understanding-sccm-sql-views/) - [SCCM Collection Queries for System Resource (SMS\_R\_System) Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) ## Explore More SCCM Guides Continue building your Microsoft Intune & SCCM skills with step-by-step tutorials covering device management, application deployment, automation, and troubleshooting. - [**Microsoft Intune Learning** ](https://techuisitive.com/microsoft-intune/)– Explore comprehensive guides on device enrollment, compliance policies, application deployment, Windows updates, and more. - **[SCCM (Configuration Manager) Guides](https://techuisitive.com/sccm/ "SCCM (Configuration Manager)")** – Explore more **SCCM guides** covering device management, application deployment, software updates, troubleshooting, and automation. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** SCCM SQL Queries --- ### [Manage Battery Health Manager (BHM) Settings with HP CMSL](https://techuisitive.com/manage-battery-health-manager-bhm-settings-with-hp-cmsl/) **Published:** July 27, 2022 **Author:** Sabir Ali **Content:** Remote work / Hybrid work is a new normal since pandemic and therefore notebooks being utilized as dedicated desktops requires a focus on battery management to increase the device’s battery life and thus maximizing user uptime. A continuously charged battery and incorrect battery management settings can lead to conditions of mechanical failure and can accelerate the degradation of the expected battery life. In this article, I will walk you through how to: Deploy the script to set the proper BHM settings across the fleet based on HP’s recommendation. ## **HP Battery Health Manager Recommendation** A new BIOS-level setting, **HP** **Battery Health Manager (BHM)**, was implemented in 2020. HP BHM is designed to help mitigate the exposure of the notebook battery to key factors that can accelerate battery degradation and swelling over time. HP recommends that customers update their BIOS to include the latest version of HP BHM and enable HP BHM to one of the two options below based on usage environment and or the age of the notebook: - Set devices with batteries manufactured in 2020 and later to **Let HP manage my battery charging**. - Set devices with batteries manufactured before 2020 to **Maximize my battery health**. For more information about HP BHM and the two options, see: - [HP Introduces HP Battery Health Manager to Help Optimize Battery Health](https://support.hp.com/us-en/document/c06179452) - [Using HP Battery Health Manager](https://support.hp.com/us-en/document/c06465959) **Additional Recommendation:** For the **Maximize my battery health** setting: - There is a one-time recommendation that the end-users unplug the device for up to 2 hours to discharge the battery to about 75%, and then they can choose to leave the device plugged into the power source. - The battery icon in Windows will show 80% as per design. We recommend that you notify the end-users of this expected behavior to avoid any confusion. ## **Requirements** - Ensure that the HP Windows 10 Notebook devices have the BIOS version supporting BHM. \[You can refer to my [Previous Article](https://www.techuisitive.com/post/updating-bios-version-with-hp-cmsl) to prepare for BIOS Update\] - Download the remediation PowerShell Script files that will be used to set the BHM settings. - Access to an Endpoint Management tool to deploy the PowerShell scripts. ## **PowerShell Script** Download the remediation PowerShell script files to set the BHM settings. [HP-ConfigureBHMSettings](http://techuisitive.co.in/wp-content/uploads/2023/04/HP-ConfigureBHMSettings.zip)[Download](http://techuisitive.co.in/wp-content/uploads/2023/04/HP-ConfigureBHMSettings.zip) - HP-ConfigureBHMSettings.ps1 – script to update the Battery Health Manager (BHM) Setting based on the battery manufactured year. - Script and supporting files to generate a secure BIOS Setup Password file and corresponding AES encryption key – for customers who have set a unified BIOS Setup password across their fleet. 1. AES.key 2. Generate\_SecurePassword.ps1 3. Password.txt ### **Script Details** - The script will only run on HP manufactured devices and excludes virtual machines. - You must run the script with Administrative privileges. - Download the HP Client Management Script Library installer from and include the executable with the script. - Ensure that .ps1 and .exe files are in the same folder. - Logs are output to *“C:\\ProgramData\\HP\\CMSL\\\_BHM.log”* . - Devices with batteries manufactured >= 2020 will be updated to “Let HP manage my battery charging.” - Devices with batteries manufactured <= 2019 will be updated to “Maximize my battery health.” - A registry key *HKLM:\\SOFTWARE\\HP\\HPDeviceManagement\\CMSL\\BHM* will be created and will record the BHM setting configured by the script. - A reboot is not required after the script runs; the BHM setting will take effect immediately. ## **Standard Exit Codes** See below table for the Standard Exit Codes Output by the PowerShell Script: **Exit Code****Description**0There is no error8Non-HP manufactured PC27OS version not supported64CMSL installer not found65CMSL install failure343General exceptions216BIOS password incorrect217BIOS download failure ## **Deploying the Script to Set the Recommended BHM Settings** Some examples of Endpoint Management tools you can use to deploy the script are Microsoft System Center Configuration Manager, Microsoft Endpoint Manager, VMware Workspace ONE, Tanium, DesktopCentral, Altiris etc. In the Endpoint Management tool of your choice, create a device group for the targeted devices regardless if the BHM settings are set as per HP recommendation or not and target the script to those devices. In production, the script runs silently, but for purposes of this article, we are showing the output of the script when run in a command prompt. The script applies the BHM settings automatically, and you can run it periodically to enforce the BHM settings within the fleet. ![HP CMSL](https://techuisitive.com/wp-content/uploads/2023/04/image-109.png)**Generating the Secure BIOS Password File and Encryption Key** If you have set a unified BIOS Setup password across your fleet, run the included “Generate\_SecurePassword.ps1” script to generate a secure password file and AES encryption key. This approach assumes that all devices share the same BIOS password. - Enter the BIOS Setup password in the “Generate\_SecurePassword.ps1” file. In this example, the password is “P@ssword1” ![](https://techuisitive.com/wp-content/uploads/2023/04/image-110.png)- Enter the same BIOS Setup password in the “Password.txt” and save the file. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-111.png) - Run “Generate\_SecurePassword.ps1” to generate a secure password.txt file and AES.key encryption key. ![](https://techuisitive.com/wp-content/uploads/2023/11/image.png)- Include both the “Password.txt” file and “AES.key” files along with the “HP-ConfigureBHMSettings.ps1” script & the “CMSL installer” when creating a Package and deploying to your fleet. --- HP offers Proactive Insights powered by [HP TechPulse](https://www.youtube.com/watch?v=qhcdocBxLrY), a powerful telemetry and analytics platform that provides all the actionable insights for the enrolled devices through a single, simple to use dashboard (SaaS application). Using HP TechPulse dashboard, you can (among many other things)… 1. Identify devices in your fleet with BIOS versions which do not meet the minimum required version for BHM. 2. Identify BIOSs that have the incorrect BHM settings according to the HP Service Advisory. 3. Monitor the BHM setting changes using an Excel report extracted from HP TechPulse. 4. Monitor the BHM setting changes using the Dashboard widget. --- ###### **Related Articles** [Mitigating Battery Swelling](https://h20195.www2.hp.com/v2/GetDocument.aspx?docname=4AA7-8410ENW) [One Time Battery Replacement Service](https://services.corp.hpicloud.net/Solutions/ViewID/1265) **Additional Information:** - Detailed CMSL syntax available [here](https://developers.hp.com/hp-client-management/doc/bios-and-device) - HP CMSL Installer is available to download from [HP Download Library](https://www.hp.com/us-en/solutions/client-management-solutions/download.html) Important **Please ensure you perform adequate testing before rolling out the script to your fleet.** \* Please feel free to reach out with any comments or questions! [LinkedIn](https://www.linkedin.com/in/sabir-ali-54594a37/) [Twitter](https://twitter.com/sabiralicwi1324) ## Related Posts - [Manage Battery Health Manager (BHM) Settings with HP CMSL](https://techuisitive.com/manage-battery-health-manager-bhm-settings-with-hp-cmsl/) - [Updating BIOS Version with HP CMSL](https://techuisitive.com/updating-bios-version-with-hp-cmsl/) - [Manage BIOS Settings with HP CMSL](https://techuisitive.com/manage-bios-settings-with-hp-cmsl/) - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [SCCM Device Collection Based on Computer Hardware Details | ConfigMgr](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) ## Explore More Windows Guides Continue building your Windows administration skills with practical, step-by-step guides covering Windows configuration, troubleshooting, device management, PowerShell, and automation. - **[Windows 10/11 Guides](https://techuisitive.com/microsoft-windows/)** – Explore practical guides for Windows configuration, administration, troubleshooting, updates, PowerShell, and everyday Windows management. - **[Microsoft Intune Learning](https://techuisitive.com/microsoft-intune/)** – Learn how to manage Windows devices with Intune, including device enrollment, configuration, compliance, application deployment, and updates. - **[Automation](https://techuisitive.com/automation/)** – Discover PowerShell and Microsoft Graph automation solutions to simplify repetitive administration tasks and manage Windows devices more efficiently. ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Device Management - HP --- ### [How To Join Texts Using TEXTJOIN & IF Functions | Microsoft Excel](https://techuisitive.com/how-to-join-texts-using-textjoin-if-functions-microsoft-excel/) **Published:** June 21, 2022 **Author:** Equebal Ahmad **Excerpt:** The TEXTJOIN is a new function introduced in 2019 and available in Microsoft Excel 2019, Excel 2021 and Excel for M365. The TEXTJOIN function combines the text from multiple strings or range separated by delimiter. While we can use TEXTJOIN to combine the texts , the above requirements cannot be achieved alone with TEXTJOIN as we need to combine the data for each user separately. Hence we need to use TEXTJOIN and IF functions together to achieve the desired result. **Content:** The TEXTJOIN is a new function introduced in 2019 and available in Microsoft Excel 2019, Excel 2021 and Excel for M365. The TEXTJOIN function combines the text from multiple strings or range separated by delimiter. Let’s try to understand the usage of TEXTJOIN function using below example. The Table A have list of users and computers assigned to them and you need to report the data to management in the format given in Table B. ![Microsoft Excel | TEXTJOIN](https://techuisitive.com/wp-content/uploads/2023/04/image-47.png)While we can use TEXTJOIN to combine the texts , the above requirements cannot be achieved alone with TEXTJOIN as we need to combine the data for each user separately. Hence we need to use TEXTJOIN and IF functions together to achieve the desired result. **Let’s understand the TEXTJOIN function first.** SYNTAX: TEXTJOIN(delimiter,ignore\_empty,text1,text2….) ![](https://techuisitive.com/wp-content/uploads/2023/04/image-48.png)TEXTJOIN Syntax Let’s see how we can join texts with this function. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-49.png)The result: ![](https://techuisitive.com/wp-content/uploads/2023/04/image-50.png)The below example show how you can join the text from multiple cells into a single cell separating them by comma. ![EXCEL | TEXTJOIN | Join text into single cell](https://techuisitive.com/wp-content/uploads/2023/04/image-51.png)Here is the result. All the values from B2:B6 combined in D2. All values were separated by comma which we given as delimiter. ![EXCEL | TEXTJOIN | Join text into single cell](https://techuisitive.com/wp-content/uploads/2023/04/image-52.png) **Now, try to understand IF function** The Excel IF function perform logical test on given condition and return one value for TRUE result and another value for a FALSE result. In this example, we will understand how to use IF function to find a value and then return a value from given range. Syntax: IF(logical\_test,\[value\_if\_true\],\[value\_if\_false\]) ![Microsoft Excel - IF Function](https://techuisitive.com/wp-content/uploads/2023/04/image-53.png)Now, see below example. The below formula will check all cells with in A2:A6 for value “User1”. If a match found then it will return corresponding value from B2:B6. If no match found then blank value will be returned for that row which we defined in last parameter. ![Microsoft Excel | IF Function](https://techuisitive.com/wp-content/uploads/2023/04/image-54.png)Here is the result ![Microsoft Excel | IF Function](https://techuisitive.com/wp-content/uploads/2023/04/image-55.png)Let’s come back to our original requirements where we need the device details for each user in single cells. We will now use both TEXTJOIN and IF function to achieve the result. This can be achieved using below formula. We have nested IF function inside TEXTJOIN. The IF function will return all matching value for a user1, which will then combined using TEXTJOIN function separated by comma. ![Excel | TEXTJOIN & IF](https://techuisitive.com/wp-content/uploads/2023/04/image-56.png)Here is the result. ![Excel | TEXTJOIN & IF](https://techuisitive.com/wp-content/uploads/2023/04/image-57.png)Now apply the above logic to original table to get the desired result. The IF function will search the value in D5 in range A5:A20 and return the corresponding value from B5:B20. All the returned values will be passed to TEXTJOIN which will combines then separated by comma. ![Excel | TEXTJOIN & IF](https://techuisitive.com/wp-content/uploads/2023/04/image-58.png)Now you can see the result in E5 for User1. To get the same result for another user, you simply need to drag or copy the formula to E6:E10. Here is final result. ![](https://techuisitive.com/wp-content/uploads/2023/04/image-59.png)## **Related Posts:** - [String Functions : UPPER, LOWER & PROPER | Microsoft Excel](https://techuisitive.com/string-functions-upper-lower-proper-microsoft-excel/) - [How To Join Texts Using TEXTJOIN & IF Functions | Microsoft Excel](https://techuisitive.com/how-to-join-texts-using-textjoin-if-functions-microsoft-excel/) - [Basic Excel Functions you should know to make your work life easier](https://techuisitive.com/basic-excel-functions-you-should-know-to-make-your-work-life-easier/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Microsoft Excel – Vlookup Explained](https://techuisitive.com/microsoft-excel-vlookup-explained/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Excel **Tags:** Excel Functions --- ### [Powershell - Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) **Published:** December 24, 2021 **Author:** Equebal Ahmad **Content:** ### **Scenario:** The details of application installed on different machines need to be collected through PowerShell script in CSV file, named as computername.csv. Once the details collected, all CSV files need to be merged. While merging the file, the file name (computer name) need to be added as an additional column in merged CSV file. This script has been created for above scenario. However this can be used to combine multiple CSV files into a single CSV file irrespective of what details you have in your files. ### **Get Software details:** The following PowerShell script has been used to export the list of installed software from different computers. ``` $paths = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' Get-ItemProperty $paths | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Export-csv -path "$env:computername.csv" ``` Powershell script to export installed software details in CSV file ### **Merge CSV files:** The following PowerShell script can be used to merge all CSV files in one. This script will insert one additional column at end with source CSV file name as cell value. Since the above script used the computer name as file name, the resulted column will have the computer name. You can quickly remove .CSV extension in Microsoft Excel using Find & Replace. ``` $sourcefolder = "C:\CSVfiles" $sourcefiles = Get-ChildItem -Path $sourcefolder -Filter *.csv $SourceFiles | ForEach-Object { # $fileName = $_ $output = Import-Csv -Path $_.FullName | Add-Member -MemberType NoteProperty -Name 'Filename' -Value $_.Name -Passthru $combinedoutput += $output } $combinedoutput | Export-Csv "$sourcefolder\CombinedSoftwareList.csv" -NoTypeInformation Write-Host "Data merged to single CSV to $sourcefolder\CombinedSoftwareList.csv" -ForegroundColor Green ``` ## **Related Posts:** - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell **Tags:** PowerShell --- ### [How to Install PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/) **Published:** May 13, 2022 **Author:** Equebal Ahmad **Excerpt:** Microsoft is deprecating the Azure AD PowerShell Module and MS Online module in 2022. So, admin need to migrate to either PowerShell SDK for Microsoft Intune Graph API or Microsoft Graph API. Let's see how we can install PowerShell SDK for Microsoft Intune Graph API from PowerShell Gallery. **Content:** Microsoft is deprecating the Azure AD PowerShell Module and MS Online module in 2022. So, admin need to migrate to either PowerShell SDK for Microsoft Intune Graph API or Microsoft Graph API. Let’s see how we can install PowerShell SDK for Microsoft Intune Graph API from PowerShell Gallery. ## How to Install Microsoft Intune Graph API To install PowerShell module for Intune Graph API, open PowerShell with admin privilege’s and run below command. ``` Install-Module -Name Microsoft.Graph.Intune ``` Once you have installed it, you can verify the installation using below command. ``` Get-InstalledModule -name Microsoft.Graph.Intune ``` ![PowerShell Get-InstalledModule Microsoft Intune Graph API](https://techuisitive.com/wp-content/uploads/2023/03/image-27.png)Now you need to connect with MSGraph using admin consent. The admin consent is required for first time connect only. ``` Connect-MSGraph -AdminConsent ``` This will ask for permission similar to any other Graph/ REST application when you connect to O365. ![Connect_MSGraph Sign-in Prompt](https://techuisitive.com/wp-content/uploads/2023/03/image-28.png)The next screen **“Permission requested. Review for your organization”** list all permissions which are required for Graph API to work. Review the permissions and click on **Accept** to go ahead. ![MSGraph - Intune - Admin Consent](https://techuisitive.com/wp-content/uploads/2023/03/image-29.png)For subsequent usage, you can simply Connect-MSGraph without any parameters ``` Connect-MSGraph ``` Once connected, you will see the user name and Tenant ID you connected with. ![Connect-MSGraph Intune](https://techuisitive.com/wp-content/uploads/2023/03/image-30.png)Now you can run the commands which are available such as list of all managed devices can be retrieved using **Get-IntuneManagedDevice** command. [Cisco CCNA Certification Exam Dumps](https://www.examlabs.com/ "Cisco CCNA Certification Exam Dumps") ![Get-IntuneManagedDevice](https://techuisitive.com/wp-content/uploads/2023/03/image-31.png)## **Related Posts** - [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) - [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/ "How to Bulk Sync Intune Devices with Microsoft Graph") - [Get AAD Group Members Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [Install PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Step by Step Guides **Tags:** Graph API, Intune Guides --- ### [macOS: FileVault](https://techuisitive.com/macos-filevault/) **Published:** May 5, 2022 **Author:** Tabrez Alam **Content:** The MAC OS’s built-in disk encryption feature is known as FileVault. It’s designed to encrypt your Mac’s hard drive and all the files located on the drive using 128-bit AES encryption with a 256-bit key. This prevents unauthorized access to the information on your startup disk. It can be accessed by clicking on the Apple menu > System Preferences, then clicking on Security & Privacy > then the FileVault tab. ![FileVault](https://static.wixstatic.com/media/64e6b8_63ff7ceaf34d497a88a8852d4451d22d~mv2.png/v1/fill/w_592,h_477,al_c,q_85,usm_0.66_1.00_0.01,enc_auto/64e6b8_63ff7ceaf34d497a88a8852d4451d22d~mv2.png)The FileVault can be turned off as well, by default at enterprise level the FileVault is always switched on. It is also advised to users using the MAC not to switch it off. Individual and enterprise users are concerned with security and privacy of data. If the mac is stolen the FileVault will prevent it from gaining unauthorized access. ## Related Posts - [macOS : System Preferenes and it’s Components](https://techuisitive.com/macos-system-preferenes-and-its-components/) - [macOS : Understanding Keychain](https://techuisitive.com/macos-understanding-keychain/) - [macOS: Plist files](https://techuisitive.com/macos-plist-file/) - [macOS: FileVault](https://techuisitive.com/macos-filevault/) - [macOS : Enterprise device, MDM and Management tools](https://techuisitive.com/macos-enterprise-device-mdm-and-management-tools/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Mac OS / iOS --- ### [macOS : System Preferences and it's Components](https://techuisitive.com/macos-system-preferenes-and-its-components/) **Published:** March 25, 2022 **Author:** Tabrez Alam **Content:** **System Preferences** is an application included with macOS. It allows users to modify various system settings, which are divided into separate Preference Panes. The System Preferences application was introduced in the first version of Mac OS X to replace the control panels found in earlier versions of the Mac operating system. ![macOS - System Preferences](https://techuisitive.co.in/wp-content/uploads/2023/04/image-153.png)**System Preferences Components****It’s uses or features**GeneralChanges the general color scheme of the OS, as well as placement of scroll arrows and font smoothing.​Desktop & Screensaver​Used to set the desktop picture as well as the screensaver, and their settings.Dock​Adjust the dock size as well as magnification and position on screen.​Mission ControlChanges the preferences for the Mission Control application, such as showing the Dashboard as its own space or automatically rearranging spaces based on most recent use. Also sets Active Screen Corners and keyboard and mouse settings to activate certain applications such as Launchpad or to show the Desktop.​Language & Region​Set the default OS language as well as numerical, measurement, currency, date, and time formats.Security & PrivacySet “FileVault” and account security settings, set up the firewall.Spotlight​Set the preferences for the Spotlight system-wide search application. Command + Space​Notifications​Configures settings for notifications, such as the manner they’re presented in (banner, alert, etc.) and which applications can display notifications and which ones can’t.DisplaysUsed to set screen resolution and color settings.Energy SaverOptimize energy settings as well as set sleep times and processor usage.KeyboardSet keyboard settingsMouse​Set mouse preferences. If using a Magic Mouse, provides preferences for the multitouch gestures like double-tapping with two fingers and swiping between pages.​TrackpadAdjust tracking, clicking, and scrolling speed. Also allows users to adjust multi-touch gestures on newer MacBooksPrinters & ScannersSet the default printer as well as scanner settings.SoundSet alert sound, volume and input/output options.Startup DiskSet the default disk, for the computer to boot into.iCloudConfigure iCloud, Apple’s cloud storage and cloud computing service.Internet AccountsYou can use Exchange, Google, Yahoo, and other internet accounts in Mac apps by adding the accounts to your Mac. You add internet accounts, and manage account settings, in Internet Accounts preferences. You can also add internet accounts from some apps that use them.Software UpdateSet default times to check for updates, and view updates already installed.NetworkSet Ethernet, AirPort, Modem and VPN Settings.BluetoothPair Bluetooth devices and edit Bluetooth settingsExtensionsSystem extensions are a category of software that works in the background to extend the functionality of your Mac. Some apps install kernel extensions, which are a kind of system extension that works using older methods that aren’t as secure or reliable as modern alternatives.SharingSet the computer name, sharing and remote management services.Users & GroupsSet the computer name, sharing and remote management services.Users & GroupsControl user creation/deletion, administrator privileges and user limitations.Parental ControlsManage parental controls for accounts, and view account usage data.SiriSiri is a virtual assistant that is part of Apple Inc.’s iOS, iPadOS, watchOS, macOS, tvOS, and audioOS operating systems.Date & TimeUsed to set the date and time of the computer, as well as how the clock appears on the menu bar.Time MachineSet the Time Machine drive and backup options.AccessibilityThe Accessibility Options panel offers shortcuts to quickly turn on or turn off common accessibility features such as Zoom, VoiceOver, Sticky Keys etc.ProfilesOnly appears if the computer is enrolled in a device management solutionThis article is part of our macOS Basics series. You can check other articles [here](https://www.techuisitive.com/blog/tags/macos-basics). ## **Related Posts:** - [macOS : System Preferenes and it’s Components](https://techuisitive.com/macos-system-preferenes-and-its-components/) - [macOS : Understanding Keychain](https://techuisitive.com/macos-understanding-keychain/) - [macOS: Plist files](https://techuisitive.com/macos-plist-file/) - [macOS: FileVault](https://techuisitive.com/macos-filevault/) - [macOS : Enterprise device, MDM and Management tools](https://techuisitive.com/macos-enterprise-device-mdm-and-management-tools/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Mac OS / iOS --- ### [Microsoft Connected Cache for Configuration Manager generally available](https://techuisitive.com/microsoft-connected-cache-for-configuration-manager-generally-available/) **Published:** April 7, 2022 **Author:** Equebal Ahmad **Content:** Microsoft Connected Cache is a dedicated caching solution that complements Delivery Optimization’s capabilities, providing organizations with a comprehensive approach to minimize internet bandwidth consumption for diverse networks. With Microsoft Connected Cache, cloud content that would have been repeatedly downloaded by each client is downloaded the first time a client requests it. All subsequent requests for that content come from the cache. This content includes anything downloaded using Delivery Optimization: Windows Updates, Microsoft Store apps, Microsoft 365 Apps, Intune applications, and [more](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization#requirements). Read complete article on Microsoft Endpoint Manager blog [here](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/microsoft-connected-cache-for-configuration-manager-generally/ba-p/2910802). ## Related Posts - [What’s new in Microsoft Intune – 2212 (December) edition | Technology Updates](https://techuisitive.com/whats-new-in-microsoft-intune-2212-december-edition-technology-updates/) - [What’s new in Microsoft Endpoint Manager – 2208 (August) edition](https://techuisitive.com/whats-new-in-microsoft-endpoint-manager-2208-august-edition/) - [Microsoft Connected Cache for Configuration Manager generally available](https://techuisitive.com/microsoft-connected-cache-for-configuration-manager-generally-available/) - [General availability – Android Enterprise corporate-owned devices with a work profile](https://techuisitive.com/general-availability-android-enterprise-corporate-owned-devices-with-a-work-profile/) - [Microsoft Introduced Windows 365 Cloud PC](https://techuisitive.com/microsoft-introduced-windows-365-cloud-pc/) - [Unpacking endpoint management: the series](https://techuisitive.com/unpacking-endpoint-management-the-series/) - [MEM filters to target apps and policies to specific devices](https://techuisitive.com/mem-filters-to-target-apps-and-policies-to-specific-devices/) **Categories:** ConfigMgr | SCCM, Technology Updates --- ### [Understanding macOS Plist File](https://techuisitive.com/macos-plist-file/) **Published:** May 31, 2022 **Author:** Equebal Ahmad **Content:** The Property List File used by macOS is a setting file popularly known as plist file. It contains properties and configuration settings for various programs and application and bundling together with them. Property list files use the filename extension .plist, hence, often referred to as plist file. The extension of Property List File is .plist; its located at /Library/Preferences and ~/Library/Preferences folders. The file names take the form of a reversed domain name, an application name, and a .plist file extension. Examples are: com.apple.dock.plist and com.google.Chrome.plist. Reference Picture. ![Plist File](https://techuisitive.co.in/wp-content/uploads/2023/04/image-106.png)NOTE: While doing applications-based troubleshooting there are multiple instances wherein one can delete plist files of applications from the said locations. This is done as while uninstalling the applications these plist files are not removed by default. One simple way of making sure that there are no traces of an app or its subsidiary files or folders within mac is by using a simple and light uninstaller named [Appcleaner](https://freemacsoft.net/appcleaner/). This makes sure that the application being uninstalled is uninstalled completely and with it all its subsidiary items. ## Related Posts - [macOS : System Preferenes and it’s Components](https://techuisitive.com/macos-system-preferenes-and-its-components/) - [macOS : Understanding Keychain](https://techuisitive.com/macos-understanding-keychain/) - [macOS: Plist files](https://techuisitive.com/macos-plist-file/) - [macOS: FileVault](https://techuisitive.com/macos-filevault/) - [macOS : Enterprise device, MDM and Management tools](https://techuisitive.com/macos-enterprise-device-mdm-and-management-tools/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Mac OS / iOS --- ### [Azure AD is becoming Microsoft Entra ID](https://techuisitive.com/azure-ad-is-becoming-microsoft-entra-id/) **Published:** July 14, 2023 **Author:** Equebal Ahmad **Content:** Microsoft announced that Microsoft Azure Active Directory (Azure AD) is becoming Microsoft Entra ID. Excerpts from Microsoft article: As part of our ongoing commitment to simplify secure access experiences for everyone, the rebranding of Azure AD to Microsoft Entra ID is designed to make it easier for you to use and navigate the unified and expanded Microsoft Entra portfolio. I want to assure you that your work protecting your organization, customers, partners, and the investments you’ve made in deploying Azure AD will continue uninterrupted. All configurations and integrations will continue to work as they do today, without any action needed from you. You’ll see the new name start appearing in Microsoft product experiences In August 2023. ![Entra ID](https://techuisitive.com/wp-content/uploads/2023/07/image-34.png)See the complete article [here](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/azure-ad-is-becoming-microsoft-entra-id/ba-p/2520436). ## Related Posts - [What’s new in Microsoft Intune – 2212 (December) edition | Technology Updates](https://techuisitive.com/whats-new-in-microsoft-intune-2212-december-edition-technology-updates/) - [What’s new in Microsoft Endpoint Manager – 2208 (August) edition](https://techuisitive.com/whats-new-in-microsoft-endpoint-manager-2208-august-edition/) - [Microsoft Connected Cache for Configuration Manager generally available](https://techuisitive.com/microsoft-connected-cache-for-configuration-manager-generally-available/) - [General availability – Android Enterprise corporate-owned devices with a work profile](https://techuisitive.com/general-availability-android-enterprise-corporate-owned-devices-with-a-work-profile/) - [Microsoft Introduced Windows 365 Cloud PC](https://techuisitive.com/microsoft-introduced-windows-365-cloud-pc/) - [Unpacking endpoint management: the series](https://techuisitive.com/unpacking-endpoint-management-the-series/) - [MEM filters to target apps and policies to specific devices](https://techuisitive.com/mem-filters-to-target-apps-and-policies-to-specific-devices/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Technology Updates **Tags:** Technology Updates --- ### [Troubleshooting System Center Endpoint Protection (SCEP) Client](https://techuisitive.com/troubleshooting-system-center-endpoint-protection-scep-client/) **Published:** May 13, 2017 **Author:** Equebal Ahmad **Content:** Microsoft System Center Endpoint Protection provides an antimalware and security solution for the Microsoft platform. This can be integrated with System Center Configuration Manager. I have consolidated the information which are useful for SCEP client side troubleshooting. ## **Managing Endpoint Protection client with Command Line Interface – MpCmdRun.exe** The MpCmdRun.exe (Microsoft Antimalware service command line utility) is very useful tool to manage local Endpoint protection client with command line. The MpCmdRun.exe is located in **C:\\Program Files\\Microsoft Security Client** folder. On Windows 10 machines, the MpCmdRun.exe is available in **C:\\Program Files\\Windows Defender** folder. When executed, this command automatically creates a log file named as MpCmdRun.log in C:\\Users\\ username\\AppData\\Local\\Temp folder. This log file records the commands that are executed using MpCmdRun.exe. Few of most commonly used command lines are listed below. For a complete l list of available switches please see MpCmdRun help using **MpCmdRun.exe /?** Command line. ### **Scan:** Default Scan: *MpCmdRun.exe –scan* Quick Scan: *MpCmdRun*.exe –ScanType 1 Full System Scan: *MpCmdRun.exe –ScanType 2* File and Directory Custom Scan: *MpCmdRun.exe –ScanType 3 –File* ### **Managing Definitions:** Signature Update: *MpCmdRun.exe –SignatureUpdate* **Remove Bad Definitions**: Sometime you may be in a situation when a new definition caused a server, workstation or application to act abnormaly. An application issue after latest update is quite common in large and complex environment with thousands of applications. The following commands can help you in this kind of situation. You can remove all defintions or roll back to previous version to validate if you application or OS is working fine after removing SCEP definition. Remove Definitions (Rollback to previous version, SCEP stores up to 3 previous version of definition files): ***MpCmdRun.exe –RemoveDefinitions*** Remove All Definitions: ***MpCmdRun.exe –RemoveDefinitions – All*** ### **Collecting SCEP support logs:** SCEP client missing latest definitions is one of the common issue. To troubleshoot the issue you have to look into few log files available at different location. However, you can use MpCmdRun command to gather all support logs at one location. – Go to “C:\\Program Files\\Microsoft Security Client\\Antimalware” or “C:\\Program Files\\Windows Defender” depends on Operating System – Run following command **MpCmdRun.exe -getfiles** You can find all logs files in “C:\\ProgramData\\Microsoft\\Antimalware\\Support” or “C:\\ProgramData\\Windows Defender\\Support” folder ## **Endpoint Protection Log Files** **EndpointProtectionAgent.log:** This log records the details about the installation of EP client. **C:\\ProgramData\\Microsoft\\Microsoft Antimalware\\Support:** This folder contain bunch of log files which provide more information about SCEP definition updates and SCEP functionality. The name of these log files are following. · MpCacheStats.log · MpDetection.log · MpLog.log ## **Troubleshooting Windows Defender or Endpoint Protection client** The below Microsoft article should be useful in troubleshooting Windows Defender / Endpoint Protection clients. [· Troubleshooting Endpoint Protection Client](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/troubleshoot-endpoint-client) [· How to Troubleshoot Definition update issue for Windows Defender](https://support.microsoft.com/en-us/help/918355/how-to-troubleshoot-definition-update-issues-for-windows-defender) ## **SCEP basic Troubleshooting’s** **WMI Namespace and Classes for System Center Endpoint Protection** Before we move with troubleshooting tips & tricks, let’s have the information about WMI namespace and classes for SCEP. The WMI namespace for SCEP is root\\Microsoft\\SecurityClient. You can find following Classes in this namespace. The Configuration Manager client agent monitor these classes for any changes and a state message is sent when a change detected. ### **AntiMalwareHealthStatus** As name suggest, this WMI class represent Microsoft Antimalware service status. You can use below Powershell command to list all properties of this class. **Get-WmiObject** **-Namespace** **root\\Microsoft\\SecurityClient** **-class** **AntimalwareHealthStatus** \_\_GENUS : 2 \_\_CLASS : AntimalwareHealthStatus \_\_SUPERCLASS : ProtectionTechnologyStatus \_\_DYNASTY : SerializableToXml \_\_RELPATH : AntimalwareHealthStatus=@ \_\_PROPERTY\_COUNT : 31 \_\_DERIVATION : {ProtectionTechnologyStatus, SerializableToXml} \_\_SERVER : DESKTOP01 \_\_NAMESPACE : root\\Microsoft\\SecurityClient \_\_PATH : \\DESKTOP01\\root\\Microsoft\\SecurityClient:AntimalwareHealthStatus=@ AntispywareEnabled : True AntispywareSignatureAge : 0 AntispywareSignatureUpdateDateTime : 2018-12-09T14:58:32.000Z AntispywareSignatureVersion : 1.283.218.0 AntivirusEnabled : True AntivirusSignatureAge : 0 AntivirusSignatureUpdateDateTime : 2018-12-09T14:58:32.000Z AntivirusSignatureVersion : 1.283.218.0 BehaviorMonitorEnabled : True Enabled : True EngineVersion : 1.1.15500.2 IoavProtectionEnabled : True LastFullScanAge : 4294967295 LastFullScanDateTimeEnd : LastFullScanDateTimeStart : LastFullScanSource : 0 LastQuickScanAge : 4294967295 LastQuickScanDateTimeEnd : LastQuickScanDateTimeStart : LastQuickScanSource : 0 Name : Antimalware NisEnabled : True NisEngineVersion : 1.1.15500.2 NisSignatureVersion : 1.283.218.0 OnAccessProtectionEnabled : True ProductStatus : 524288 RealTimeScanDirection : 0 RtpEnabled : True SchemaVersion : 1.0.0.1 Version : 4.18.1810.5 PSComputerName : DESKTOP01 ### **AntiMalwareDetectionStatus** This is a class that represent a single detection. You can use below Powershell command to list all properties of this class. Get-WmiObject -Namespace root\\Microsoft\\SecurityClient -class AntiMalwareDetectionStatus ### **AntiMalwareInfectionStatus** This class represent Microsoft Antimalware service infection status. You can use below Powershell command to get the list of all properties with in this class. \_\_GENUS : 2 \_\_CLASS : AntimalwareInfectionStatus \_\_SUPERCLASS : SerializableToXml \_\_DYNASTY : SerializableToXml \_\_RELPATH : AntimalwareInfectionStatus=@ \_\_PROPERTY\_COUNT : 10 \_\_DERIVATION : {SerializableToXml} \_\_SERVER : DESKTOP01 \_\_NAMESPACE : root\\Microsoft\\SecurityClient \_\_PATH : \\DESKTOP01\\root\\Microsoft\\SecurityClient:AntimalwareInfectionStatus=@ ComputerStatus : 1 CriticallyFailedDetections : {} PendingActionDetections : {} PendingFullScan : False PendingManualSteps : False PendingOfflineScan : False PendingReboot : False RecentlyCleanedDetections : {} SchemaVersion : 1.0.0.0 PSComputerName : DESKTOP01 ### **Check SCEP Definitions version on client** Get-WmiObject -ComputerName Desktop01 -Query “select \* from AntiMalwareHealthStatus” -Namespace “root\\Microsoft\\SecurityClient” | Select-object PSComputerName,Version,AntivirusSignatureVersion,AntiVirusSignatureUpdateDateTime,AntivirusEnabled | Format-List ### **Force State Message for SCEP on SCCM Client** You may have a scenario when everything looks good at client end for SCEP & SCCM. However, latest definition status is not being reported to SCCM. You can try the below Powershell script to force sending status message. **Warning:** The below script remove CCM\_StateMsg WMI class and restart WMI service. This will force re-creation of WMI class which will refresh state message. You should try this script on individual machines or test environment. you should never try this script for mass fix of the issues on multiple machines as that may create another issues. Please test this in your test environment before executing the same into production. $Computer = “MyTestPC” Get-WMIobject -ComputerName $Computer -Namespace root\\ccm\\StateMsg -Class CCM\_StateMsg -Filter “TopicType=’1901′” |Remove-WmiObject Get-Service -ComputerName $computer -Name winmgmt |Restart-Service -Force ## Related Posts - [SCEP – Troubleshooting outdated signature issue](https://techuisitive.com/scep-troubleshooting-outdated-signature-issue/) - [Troubleshooting System Center Endpoint Protection (SCEP) Client](https://techuisitive.com/troubleshooting-system-center-endpoint-protection-scep-client/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM --- ### [PowerShell - Get System up time](https://techuisitive.com/powershell-get-system-up-time/) **Published:** April 30, 2017 **Author:** Equebal Ahmad **Content:** Checking system uptime is a quick way to know how long the system has been running without interruptions to service. The quickest way to check the system up time on your own machine to check the same from Task Manager. You can launch task manager and go to performance tab to find system uptime. You can use below PowerShell script to quickly check the uptime of a remote machine. The script will use WMI call to retrieve the information. ``` $Computer = Read-Host   "Input Computer Name " $LastBoot = (Get-WmiObject -Class Win32_OperatingSystem -ComputerName $Computer ).LastBootUpTime $uptime = (Get-Date) - [System.Management.ManagementDateTimeconverter]::ToDateTime($LastBoot) Write-Host  "$Computer uptime is:"     [$uptime]   [dd:hh:mm:ss.ms] ``` ## **Related Posts:** - [Powershell – Get System up ](https://techuisitive.com/powershell-get-system-up-time/)[time](https://techuisitive.com/powershell-get-system-up-time/) - [Powershell Script : List AD Organizational Unit and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) - [Powershell – Compare hardware and software details on two computers](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) - [Powershell Script : Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Powershell Script: Validate if Computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) - [Powershell remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) - [Powershell script to Add bulk users / computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) - [PowerShell Script : Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) - [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** PowerShell **Tags:** PowerShell --- ### [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) **Published:** December 25, 2020 **Author:** Equebal Ahmad **Content:** A good software deployment strategy is required when you are deploying an application from Microsoft Endpoint Configuration Manager. A robust deployment plan will help you in error free deployment , limit the damage in case of an issue and minimize the recovery efforts. In this post, I will brief you about deployment approach which you should follow to plan your deployment. We will not dive into technical details such as creating a deployment in MECM. The phased deployment approach is most commonly used deployment strategy used by most of MECM administrators. The deployment usually start with Test and Pre-pilot deployment and then move to Pilot deployment. The final phase is production deployment, which again split into multiple phase based on organization priority, deployment timeline, criticality, bandwidth, IT support personals availability etc. ## **Understanding Requirements** You should carefully review deployment request submitted by requester. Please note that many requester come for deployment at last moment and they request deployment on large number of machine in very strict timeline. However going with the deployment in hurry do more harm than good. The following points should be checked with requester before proceeding with deployment. This will help you in better deployment planning. - Have they tested and certified the application? - Application SME and their availability during deployment? - Availability of vendor support agreement - Inclusion of technology aware application user in pilot deployment to get the right feedback at right time - Application criticality - Whether its a new deployment or upgrade for existing users. ## **Test and Pre-pilot Deployment** This should be first step towards error free software deployment through MECM. Once you setup the Package or Application in MECM, you must test the deployment to ensure it’s successfully installed on targeted machines. You should also have a small scale deployment (Pre-pilot) to ensure application has correctly setup in MECM. The targeted users can be from your own deployment team or it may be other IT users who can quickly report if any issues encountered during deployment. Once you are satisfied with the result, you can move to next stage of deployment which is Pilot Deployment. ## **Pilot Deployment** A pilot deployment prior to full production rollout is necessary. It’s almost impossible to simulate every aspect of your production environment in your test lab. A pilot deployment ensure extended testing of software in production like environment while limiting the scope to select group of users in your organizations. Formation of pilot user group is one of the key part of pilot deployment. The MECM team usually maintain pilot user groups for organization wide deployments. However the requester should provide the list of pilot user for department specific application. The question may arise that how many users you should have in pilot group? You may think about having 5% – 10% of your entire population. However the tricky part here is to have participation from all departments. Your pilot deployment participants should be representative sampling of the organization. They should also have knowledge of application or at least good understanding of computer so that they can easily communicate the problems to IT department. You have to ensure that pilot user’s list are up to date. Otherwise it can have adverse impact on deployment success rate. You should also have a strategy in place to maintain pilot user list up to date. We will talk about the same in future posts. Communicating pilot user about the deployment is another key factor you should think about. The communication should have sufficient details for end user to share the deployment feedback with IT department. In many organization, Application owners own this piece and MECM administrator just focus on deployment. If the responsibility is not clearly defined in your organization then get this clarified from Application owners or deployment requestor to avoid any issues post deployment. Once you reach end of the pilot deployment, please analyse the failure rate and failure cause carefully. If failure rates are higher then you should identify the root cause of the issue and work on remediation prior to moving ahead with production deployment. For the failures, don’t just look into percentage. The number also matter a lot. If you have 100 pilot user then 5% failure rate comes to 5 and may be acceptable. However, if you deploy the package on 10k machines then 5% failure can impact 500 users and it may lead to high number of incidents inflow to IT support. ## **Production Deployment** You should begin with production deployment once fully comfortable with pilot deployment result. The production deployment should also divided into multiple phase with few days gaps in between for better control. The total number of phase again depends on different factors we discussed above. You can start with less number of client in initial phase and increase the count in later phase. For example, you have 10k machines for deployment and want to schedule the deployment in five phases. You can plan something like below. First Phase – 500 Second Phase – 1500 Third Phase – 2000 Fourth Phase – 3000 Fifth Phase – 3000 ## **Phased Deployment – Collection membership planning** There are different way you can divide the users or machine in different phase. The static collection can help you in having exact number of client in a collection. You can also have dynamic collection based on different criteria. I am listing few options which you can use when creating collection for phased deployment. Static Collection : You can simply divide total number of machines in desired batches and add them in collection. You can simply pick random machines or can use your own sorting method to divide them in multiple phase. A separate collection should be created for each phase. Dynamic Collection : The dynamic collection can be based on different criteria and it can help you in targeting the deployment to different groups at a time. For example, the collection membership can be based on below criteria’s. - Machines member of specific AD group - Machines in an AD Organizational Unit - Machines where specific version of application is installed - Machines with specific OS version - Machines belongs to specific department There can be N number of criteria’s. You should review the number of machines falling in each dynamic group and plan phased deployment collection accordingly. ## **Related Posts:** - [Configure Management Point for HTTPS | ConfigMgr | SCCM](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) - [Configure Software Update Point for SSL | ConfigMgr | SCCM](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) - [Deploy client authentication certificate for SCCM clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) - S[CCM CMG Part 1 | Cloud Management Gateway (CMG) Setup Guide](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) - [SCCM CMG Part 2 | Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) - [SCCM CMG Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) - [SCCM CMG Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) - [SCCM CMG Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) - [SCCM CMG Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) - [Location of smsts.log file during Operating System Deployment (OSD)](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) - [Check Software Center Business Hours of Remote Computer](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) - [SCCM Software deployment strategy](https://techuisitive.com/sccm-software-deployment-strategy/) - [How to deal with wrong deployment in ConfigMgr](https://techuisitive.com/system-center-configuration-manager-how-to-deal-with-wrong-deployment/) - [How to Initiate SCCM client agent actions using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) Tags: [Software Deployment](https://techuisitive.com/tag/software-deployment/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM **Tags:** Software Deployment --- ### [How to Enroll Android Mobile Device to Microsoft Intune](https://techuisitive.com/how-to-enroll-android-mobile-device-to-microsoft-intune/) **Published:** April 25, 2021 **Author:** Equebal Ahmad **Content:** This blog post provide step by step guides to enroll an Android mobile device to Microsoft Intune. 1. Download and install Intune Company Portal from Google Play Store to your Android Device which you want to enroll to Intune. 2. Launch Company Portal application and tap Sign In button. ![](https://static.wixstatic.com/media/64e6b8_5ee694e67d124839a26ee7f249e20b28~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_5ee694e67d124839a26ee7f249e20b28~mv2.jpg)3\. Type your company Azure Active Directory email ID and click on Next. ![](https://static.wixstatic.com/media/64e6b8_f2722e282e8d4e80bbbcc78e6eb64d82~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_f2722e282e8d4e80bbbcc78e6eb64d82~mv2.jpg)4\. Your company identity will be validated and you will be presented with your organization logo in next page. Enter your Azure AD password and click on Sign In. ![](https://static.wixstatic.com/media/64e6b8_f09d20b7fb5e4e5dbfa5bdeea22f10c1~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_f09d20b7fb5e4e5dbfa5bdeea22f10c1~mv2.jpg)5\. On “Help us to protect your account” Click on “Skip for Now (14 days until this is required). You can configure Multi Factor Authentication (MFA) later once enrollment completed. ![](https://static.wixstatic.com/media/64e6b8_459546b5e31a4c94bb78c7d2f612f51a~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_459546b5e31a4c94bb78c7d2f612f51a~mv2.jpg)6\. If you do not see **Access Setup** page in next screen then click on the Notification bell icon. ![](https://static.wixstatic.com/media/64e6b8_56ff6aed53bf49769204f858ebcda135~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_56ff6aed53bf49769204f858ebcda135~mv2.jpg)7\. Click on **Company Access Setup** **is incomplete** ![](https://static.wixstatic.com/media/64e6b8_46034cdd9c4444a5accbe9166418388a~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_46034cdd9c4444a5accbe9166418388a~mv2.jpg)8\. On the “Access Setup” screen click on **Begin**. ![](https://static.wixstatic.com/media/64e6b8_7a7bdaddc7a84f9bb01fa4225c71e500~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_7a7bdaddc7a84f9bb01fa4225c71e500~mv2.jpg)9\. Review the privacy and click on **Continue**. ![](https://static.wixstatic.com/media/64e6b8_3734f4082b7340aaa0fa133ef5e9b5e8~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_3734f4082b7340aaa0fa133ef5e9b5e8~mv2.jpg)10\. On What’s next? page click **Next** ![](https://static.wixstatic.com/media/64e6b8_52f6537c333c43329a6c12d63d68eccd~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_52f6537c333c43329a6c12d63d68eccd~mv2.jpg)11\. On **Device Administrator** page, Review the details and click on **Activate**. ![](https://static.wixstatic.com/media/64e6b8_2b044e53111c4a938dd729d23da8f94b~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_2b044e53111c4a938dd729d23da8f94b~mv2.jpg)12\. The next screen will show the progress of device registration. ![](https://static.wixstatic.com/media/64e6b8_d2ecdc3821e544748abe2d2a3fb234e5~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_d2ecdc3821e544748abe2d2a3fb234e5~mv2.jpg)13\. Once device registration is completed, you will see next screen to setup **Android Work Profile**. Click on **Next** to setup work profile. ![](https://static.wixstatic.com/media/64e6b8_5481ee5d829d4734ba7b72fc0a7c9c99~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_5481ee5d829d4734ba7b72fc0a7c9c99~mv2.jpg)14\. Next few screens will show the progress of Android work profile setup. ![](https://static.wixstatic.com/media/64e6b8_690d363a7e484e5c9a4ecf78cc353497~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_690d363a7e484e5c9a4ecf78cc353497~mv2.jpg)![](https://static.wixstatic.com/media/64e6b8_52ea1c6f575249588de1fb77507a87bd~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_52ea1c6f575249588de1fb77507a87bd~mv2.jpg)![](https://static.wixstatic.com/media/64e6b8_92ffe62d20dd4f65b144f7bd29abb915~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_92ffe62d20dd4f65b144f7bd29abb915~mv2.jpg)![](https://static.wixstatic.com/media/64e6b8_e8253c7a34cc46cfb812155167efda91~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_e8253c7a34cc46cfb812155167efda91~mv2.jpg)15\. Once setup is completed, you can find “Work Profile” folder with all work applications on your device. Android Enterprise Work Profiles create a sandbox and separate work data from personal data. ![](https://static.wixstatic.com/media/64e6b8_7bf8b78cef4a441a840a0273e1afcc93~mv2.jpg/v1/fill/w_360,h_640,al_c,q_80,usm_0.66_1.00_0.01,enc_auto/64e6b8_7bf8b78cef4a441a840a0273e1afcc93~mv2.jpg)16\. You can turn off / on Work mode from shortcut menu. Turning off Work mode will disable all work applications and stop email syncs. ![](https://static.wixstatic.com/media/64e6b8_48f47ab88d714d069d5e47f0c633cd41~mv2.png/v1/fill/w_360,h_241,al_c,q_85,usm_0.66_1.00_0.01,enc_auto/64e6b8_48f47ab88d714d069d5e47f0c633cd41~mv2.png)## Related Posts - [How to deploy Android APK apps in Microsoft Intune](https://techuisitive.com/how-to-deploy-android-apk-apps-in-microsoft-intune/ "How to deploy Android .APK Apps in Microsoft Intune") - [How to Enroll Android Mobile Device to Microsoft Intune](https://techuisitive.com/how-to-enroll-android-mobile-device-to-microsoft-intune/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune **Tags:** Android --- ### [FeedSpot Top 25 SCCM Blogs to Follow in 2023](https://techuisitive.com/feedspot-top-25-sccm-blogs-to-follow-in-2023/) **Published:** March 17, 2023 **Author:** Equebal Ahmad **Content:** It gives me immense pleasure to announce that Techuisitive blog has been featured in [25 Best SCCM Blogs and Websites (System Center Configuration Manager)](https://blog.feedspot.com/sccm_blogs/) ranked by FeedSpot. FeedSpot ranked best SCCM blogs from thousands of blogs on the web by traffic, social media followers, domain authority & freshness. ## **Best SCCM Blogs to Follow by FeedSpot** [Feedspot](https://blog.feedspot.com/sccm_blogs/) has placed Techuisitive blog () at the #9 position among all SCCM blogs. This is truly inspiring and motivate me to continue with contribution towards IT Pro communities. While I started my blogging journey long back with , the routine blogging started in 2022 with my new blog Apart from ConfigMgr, I also write blog posts about Microsoft Intune, Windows Autopilot, Windows 10 / 11 and Microsoft Excel. [Subscribe ](https://www.techuisitive.com/subscribe)Techuisitive blog to get new posts and newsletters directly in your inbox. ## **About Feedspot Lists and Ranking** According to FeedSpot: [Feedspot](https://blog.feedspot.com/?_src=aboutlist) discovers, categorises and ranks blogs, podcasts and influencers in several niche categories. With millions of blogs on the web, finding influential, **authority** and **trustworthy** bloggers in a niche industry is a hard problem to address. Our experience leads us to believe that a thoughtful combination of both algorithmic and human editing offers the best means of curation. There are several ways we discover new feeds. - Publishers submit their blogs, podcasts or youtube channels on Feedspot using the ‘Submit’ form at the top of this page. - We have a research team who does extensive research on google and social media platforms to discover new influencers. - Feedspot has in-house media monitoring tools for discovering bloggers in several niche categories. Our expert editorial team reviews each blog before adding them to relevant category list. **Ranking** is based on - Relevancy - Industry blogs (those not favoring a specific brand) are given higher rank than blogs by individual brands(who often tend to promote their own products). - Blog post frequency(freshness) - Social media follower counts and engagements - Domain authority - Age of a blog - Alexa Web Traffic Rank and many other parameters. ## Related Posts - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [FeedSpot Top 25 SCCM Blogs to Follow in 2023](https://techuisitive.com/feedspot-top-25-sccm-blogs-to-follow-in-2023/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM --- ### [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) **Published:** March 10, 2022 **Author:** Equebal Ahmad **Content:** This post is a collection of Microsoft Endpoint Manager / Intune error codes and reference articles. ## **Intune : Win32 App Deployment** **Intune : Win32 app deployment failed with error code [0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/)** Error code : 0x87D300C9 Error Description: The unmonitored process is in progress, however it may timeout. **Intune : Win32 app deployment failed with error code** [**​**](https://www.techuisitive.com/post/intune-win32-app-failed-with-error-code-0x80070653)**[0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/)** Error code: [​](https://www.techuisitive.com/post/intune-win32-app-failed-with-error-code-0x80070653)0x80070653 Decimal: 1619 Error Name: ERROR\_INSTALL\_PACKAGE\_OPEN\_FAILED Error Description: ​This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package. **Intune : Win32 app deployment failed with error code [0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/)** Error code : ​0x87D1041C Error Description: ​The application was not detected after installation completed successfully. **Intune: Win32 app deployment failed with error code [0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/)** Error code: ​0x80070643 Decimal: 1603 Error Name: ​ERROR\_INSTALL\_FAILURE Error Description: ​​Fatal Error during installation. ## **Intune : Device Enrollment** **Intune: Invalid\_Client error when joining Windows 10 Device to Azure AD** Error Description**:** [Looks like we can’t connect to the URL for your organization’s MDM terms of use. Try again, or contact your system administrator with the problem information from this page.](https://techuisitive.com/invalid_client-error-when-joining-windows-10-device-to-azure-ad-tenant/) Error: Invalid\_Client Description: Failed to authenticate user **Device enrollment failed with Error code [0xcaa9001f ](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/)in hybrid AD join** Error Description: MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f ## **Cloud Attach / CMG** **CMG Setup – Error when granting Contributor permission to the Azure AD app** Error Description : [Error occurred when granting Contributor permission to the Azure AD app for the resource group . For more information see SmsAdminUI.log](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) **MECM : Failed to connect with DP, Error code [0x8004100e](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/)** Error code **:** [**​**](https://www.techuisitive.com/post/intune-win32-app-deployment-failed-with-error-0x87d1041c)0x8004100e Error Name: WBEM\_E\_INVALID\_NAMESPACE Error Description: ERROR DPConnection::ConnectRemoteIISManagementWMI() – Failed to connect to . error = 0x8004100e ## **MECM : OSD** **Configuration Manager OSD task sequence fails with error code [0x80004005](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/)** Error code: 0x80004005 Error Description: An error occurred while retrieving policy for this computer (0x80004005). ## Related Posts - [Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment failed with error 0x87D300C9](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Win32 App failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [Intune – Windows 10 MDM- Basic troubleshooting](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Windows 10 / 11 Operating System Build Versions](https://techuisitive.com/windows-10-11-operating-system-build-versions/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code : 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [Intune Bulk Enrollment with Provisional Package failed Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/ "Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C") - [How to Fix Intune Win32 App Deployment Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM, Microsoft Intune **Tags:** Troubleshooting --- ### [Microsoft Excel: VLOOKUP Explained](https://techuisitive.com/microsoft-excel-vlookup-explained/) **Published:** March 11, 2019 **Author:** Equebal Ahmad **Content:** VLOOKUP is a function in Excel that perform a vertical lookup by searching for a value in the first column of a table and returning for a value in the same row in the index number position. VLOOKUP is simple, yet confusing for many. I have tried to explain this function with help of very simple example in below You Tube video. Hope this will be helpful. ## **Related Posts:** - [String Functions : UPPER, LOWER & PROPER | Microsoft Excel](https://techuisitive.com/string-functions-upper-lower-proper-microsoft-excel/) - [How To Join Texts Using TEXTJOIN & IF Functions | Microsoft Excel](https://techuisitive.com/how-to-join-texts-using-textjoin-if-functions-microsoft-excel/) - [Basic Excel Functions you should know to make your work life easier](https://techuisitive.com/basic-excel-functions-you-should-know-to-make-your-work-life-easier/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Microsoft Excel – Vlookup Explained](https://techuisitive.com/microsoft-excel-vlookup-explained/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Excel **Tags:** Excel Functions --- ### [Basic Excel Functions you should know to make your work life easier](https://techuisitive.com/basic-excel-functions-you-should-know-to-make-your-work-life-easier/) **Published:** January 16, 2019 **Author:** Equebal Ahmad **Content:** As an IT Professional you may have to deal with lots of data every day. I have seen many experienced IT admins spending quite lots of time on the activities which can be quickly performed in Excel if you know few basic Excel formulas. I will explain most commonly used Excel functions here. Let’s start with the String Functions. **String Functions:** Microsoft Excel offers many functions to manipulate string data. **1. LEFT()** LEFT Function allows you to extract the leftmost characters from a string. **Syntax** : =LEFT(Text,Num\_Chars) - The **Text** parameter refers to the string you want to manipulate - The **Num\_Chars** parameter refers to the number of characters from left side of string you want to extract. Example: In the below example, we have extracted first 4 characters from left. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-180.png)**2. RIGHT()** RIGHT Function allows you to extract the rightmost characters from a string. **Syntax** : =RIGHT(Text,Num\_Chars) - The **Text** parameter refers to the string you want to manipulate - The **Num\_Chars** parameter refers to the number of characters from right side of string you want to extract. Example: In the below example, we have extracted last 8 characters from string. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-181.png)**3. MID()** MID Function allows you to extract the characters from middle of a string. **Syntax** : =MID(Text,Start\_Num, Num\_Chars) - The **Text** parameter refers to the string you want to manipulate - The **Start\_Num** parameter refers to the numeric **start position** for extraction with in source string. - The **Num\_Chars** parameter refers to the number of characters you want to extract from **Start Position** of source string. Example: In the below example, we have extracted a word ‘EXAMPLE’ from source string. Start Position :12 No Of characters to extract: 7 ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-182.png)**4. LEN()** Len() function return the length of source string in number of characters. **Syntax** : =LEN(Text) - The **Text** parameter refers to the string which length you want to know. Example: ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-183.png)**5. FIND()** FIND() function allow you to know the starting position of certain character / word with in source string. The function return the starting position of character / word with in source string. **Syntax** : =FIND(find\_text,within\_text) - The **Text** parameter refers to the sub string which you want to find in source string. - The **Within\_text** parameter refer to the source string where you want to find a text. Example: ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-184.png)**Note**: Please note that FIND() function is CASE SENSITIVES. We have another function ‘SEARCH()’ in Excel which is not case sensitive. The syntax of functions are same. Hence you can use them based on your requirements. **6. TRIM()** The Excel TRIM() function removes extra spaces from source string. The TRIM function removes extra spaces from beginning of string, end of string, and between the string leaving only single space between words. **Syntax** : =TRIM(text) - The **Text** parameter refers to the string which you want to truncates. Example: ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-185.png)**Real world examples:** Now, you are familiar with basic string functions. Let’s go through few real world examples utilizing combination of above functions to understand them better. **Example 1: FIND and LEFT** You need NETBIOS name for 1000+ computers. However, the list which you received contains computer FQDN. The challenge here is that Netbios name length is different for each computers. Hence you can’t rely solely on LEFT() function. The solution would be to dynamically find number of characters which you want to extract. Once you know the number of characters to be extracted, you can use LEFT() function to extract the characters. See the approach below which we can use in this scenario. - Find the position of first **“.”** in given string. The position number returned will always 1 more than length of Netbios name. - Nest the Find() formula with in LEFT() function. So, instead of providing no of characters to extract, you have to nest FIND() function with in LEFT function to dynamically find number of characters to be extracted. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-186.png)**Example 2 : TRIM** You received list of employee which are in First Name and Last name format. However, you need to present that in Display Name format. Both first name and last name contains extra spaces and when you join them using & the result does not looks good. Please see the example in first picture. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-187.png)Now you can use TRIM function to rescue your self. Please see the example below to understand how you can use TRIM function along with ampersand (&) Operator to join the string after truncates extra space using TRIM function. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-188.png)Stay tuned. We will publish more articles to give you more examples (easy and complex) from real world. You can subscribe to the blog if you want an alert when a new article published. The Excel workbook used for above examples are available [here ](https://www.techuisitive.com/dlmsexcel)for your reference. ## **Related Posts:** - [String Functions : UPPER, LOWER & PROPER | Microsoft Excel](https://techuisitive.com/string-functions-upper-lower-proper-microsoft-excel/) - [How To Join Texts Using TEXTJOIN & IF Functions | Microsoft Excel](https://techuisitive.com/how-to-join-texts-using-textjoin-if-functions-microsoft-excel/) - [Basic Excel Functions you should know to make your work life easier](https://techuisitive.com/basic-excel-functions-you-should-know-to-make-your-work-life-easier/) - [Powershell – Merge CSV files & Insert file name as a column](https://techuisitive.com/powershell-merge-csv-files-insert-file-name-as-a-column/) - [Microsoft Excel – Vlookup Explained](https://techuisitive.com/microsoft-excel-vlookup-explained/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Excel **Tags:** Excel Functions --- ### [Configuration Manager: Slow Operating System Deployment (OSD) caused by IPv6 6to4 tunnel adapter](https://techuisitive.com/configuration-manager-slow-operating-system-deployment-osd-caused-by-ipv6-6to4-tunnel-adapter/) **Published:** November 11, 2015 **Author:** Equebal Ahmad **Content:** Recently we had an issue with a site where OSD was taking long time on random basis. When I was trying to gather more information about similar issues I come across below article. This article very well describe IP6To4 tunnel adapter and it’s impact in network / AD environment. The OSD was extremely slow on random basis. Even few MBs file were taking hours to download. As described in above article, the public IP address was being used in this site as well. The IP 6to4 tunnel adapter was also enabled on SCCM server and client workstations. Once we disabled the IP 6to4 tunnel adapter on SCCM server the build started working fine. We have also disabled this adapter on all workstations via GPO as it may also impact network performance. It’s over a month now and issue has not been reported back. ## Related Posts - [SCCM OSD – Domain Join Failed with Error code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) - [PXE-E99: Unexpected network error – SCCM OSD]() - [Location of smsts.log file during SCCM OSD](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) - [ConfigMgr OSD – PXE Troubleshooting](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) - [OSD Task Sequence Failed with Error 0x80072EE7](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) - [Configuration Manager OSD task sequence fails with error code 0x80004005](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** ConfigMgr | SCCM --- ### [Basic Knowledge for Windows Desktop Support Engineer](https://techuisitive.com/basic-knowledge-for-windows-desktop-support-engineer/) **Published:** April 1, 2019 **Author:** Equebal Ahmad **Content:** **Windows Basics** **Windows 10 System Settings Explained** **Windows** [**Services:** https://www.techuisitive.com/post/windows-administrator-basics-windows-services](https://www.techuisitive.com/post/windows-administrator-basics-windows-services) **Windows Registry Basics:** **Event Viewer:** **Task Manager:** **Windows Administrative Tools:** **Device Manager** **A Beginner Guide to Windows Command Line** **System and User Environment Variable in Windows – Explained** **Problem Steps Recorder** **Windows Performance Monitoring Tool – PerfMon** **Windows Performance Counters:** **Troubleshoot Windows 10 Blue Screen of Death (BSOD) issue** **Network Basics** **Understanding DNS – Beginner Guide to DNS** ‘ **Understanding IP v4 Addressing** **DHCP Basics** ## Related Posts - [Windows 10 – Remote administration through PowerShell – Part 1](https://techuisitive.com/windows-10-remote-administration-through-powershell-part-1/) - [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) - [Windows Administrator Basics: Windows Services](https://techuisitive.com/windows-administrator-basics-windows-services/) - [Windows Administrator Basics: Managing Windows Services from Powershell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) - [Windows Administrator Basics: Windows Registry](https://techuisitive.com/windows-administrator-basics-windows-registry/) - [Basic Knowledge for Windows Desktop Support Engineer](https://techuisitive.com/basic-knowledge-for-windows-desktop-support-engineer/) - [Windows 10 /11 : Create a virtual drive with SUBST command](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Windows 10 / 11 **Tags:** Windows Admin Basics --- ### [Unpacking endpoint management: the series](https://techuisitive.com/unpacking-endpoint-management-the-series/) **Published:** June 3, 2021 **Author:** Equebal Ahmad **Content:** If you’re looking for tips and tricks to help you optimize and simplify the way you manage your endpoints, Microsoft got a great new series for you. Available Episodes: - [Episode 1: Policy transformation](https://www.youtube.com/watch?v=_dz1ERLa3Mk&t=1500s) - [Episode 2: Data-driven decisions with Endpoint analytics](https://www.youtube.com/watch?v=dYUTcANUqMc) - [Episode 3: “The big 3” for cloud transformation](https://www.youtube.com/watch?v=nCxLcKwY4OQ) Future Episodes: - Managing Microsoft Edge on Windows, Android, and iOS devices - Device join strategies - Device provisioning - Application management - Data-driven decisions - Onboarding iOS devices to Microsoft Intune You can find the updated details on [Microsoft Endpoint Manager blog](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/unpacking-endpoint-management-the-series/ba-p/2200356). ## Related Posts - [What’s new in Microsoft Intune – 2212 (December) edition | Technology Updates](https://techuisitive.com/whats-new-in-microsoft-intune-2212-december-edition-technology-updates/) - [What’s new in Microsoft Endpoint Manager – 2208 (August) edition](https://techuisitive.com/whats-new-in-microsoft-endpoint-manager-2208-august-edition/) - [Microsoft Connected Cache for Configuration Manager generally available](https://techuisitive.com/microsoft-connected-cache-for-configuration-manager-generally-available/) - [General availability – Android Enterprise corporate-owned devices with a work profile](https://techuisitive.com/general-availability-android-enterprise-corporate-owned-devices-with-a-work-profile/) - [Microsoft Introduced Windows 365 Cloud PC](https://techuisitive.com/microsoft-introduced-windows-365-cloud-pc/) - [Unpacking endpoint management: the series](https://techuisitive.com/unpacking-endpoint-management-the-series/) - [MEM filters to target apps and policies to specific devices](https://techuisitive.com/mem-filters-to-target-apps-and-policies-to-specific-devices/) ### Subscribe to Techuisitive Newsletter Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news. [Subscribe](https://mailchi.mp/1a5dee9d6602/subscribe) **Categories:** Microsoft Intune, Technology Updates --- ### [Microsoft introduced LAMBDA: Turn Excel formulas into custom functions](https://techuisitive.com/microsoft-introduced-lambda-turn-excel-formulas-into-custom-functions/) **Published:** December 6, 2020 **Author:** Equebal Ahmad **Content:** Microsoft introduced a new capability that will revolutionize how you build formulas in Excel. The new feature called LAMBDA is currently available to M365 Beta customers. LAMBDA allow you to define a custom function in Excel’s own formula language. Moreover, one function can call another, so there is no limit to the power you can deploy with a single function call. Read the complete article [here](http://bit.ly/39SxSKZ). **Categories:** Microsoft Excel, Technology Updates --- ### [What is Microsoft modern management – and how can it help you overcome your MDM challenges?](https://techuisitive.com/what-is-microsoft-modern-management-and-how-can-it-help-you-overcome-your-mdm-challenges/) **Published:** September 28, 2020 **Author:** Equebal Ahmad **Content:** A comprehensive article about Microsoft Modern Device Management. You can read complete article [here](https://thirdspace.net/blog/what-microsoft-modern-device-management-mdm-challenges/). **Categories:** Technology Updates --- ### [Unify endpoint security with Microsoft Endpoint Manager and MDATP](https://techuisitive.com/unify-endpoint-security-with-microsoft-endpoint-manager-and-mdatp/) **Published:** November 7, 2020 **Author:** Equebal Ahmad **Content:** Learn how Microsoft is delivering a best-in-class security and management experience by connecting the power of cloud-based Microsoft Defender Advanced Threat Protection with Microsoft Intune and Configuration Manager. This integration brings SecOps and IT pros together with a connected experience across security and device management, including security baselines, BitLocker encryption, Firewall management and more **Categories:** Technology Updates --- ### [Microsoft Endpoint Analytics](https://techuisitive.com/microsoft-endpoint-analytics/) **Published:** February 9, 2021 **Author:** Equebal Ahmad **Content:** Take a deep dive into Endpoint Analytics to understand and improve the end-user experience in your organization through deep insights into a day in the life of your employees on their PCs. **Categories:** Technology Updates --- ### [What’s new in Microsoft Endpoint Manager - 2208 (August) edition](https://techuisitive.com/whats-new-in-microsoft-endpoint-manager-2208-august-edition/) **Published:** September 22, 2022 **Author:** Equebal Ahmad **Content:** Microsoft Endpoint Manager’s August 2208 service release includes two extensibility capabilities providing IT admins with greater control over compliance for Zero Trust security management. The release include custom compliance for Windows, which allows IT admins to collect customer-specific compliance settings to make better informed decisions about access to corporate resources. The release also include control for macOS compliance, giving admins the ability to view macOS shell scripts and custom attributes during upload and after policy creation. Read the complete article [here ](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/what-s-new-in-microsoft-endpoint-manager-2208-august-edition/ba-p/3603889)on Microsoft Tech Community blog. **Categories:** Technology Updates --- ### [Technology Update: Kernel Data Protection](https://techuisitive.com/technology-update-kernel-data-protection/) **Published:** July 15, 2020 **Author:** Equebal Ahmad **Content:** Microsoft introduces new security Technology to prevent data corruption. Called Kernel Data Protection (KDP), the technology prevents data corruption attacks by protecting parts of the Windows kernel and drivers through virtualization-based security (VBS). Read the complete article [here](http://bit.ly/3j6WQHk). **Categories:** Technology Updates --- ### [General availability - Android Enterprise corporate-owned devices with a work profile](https://techuisitive.com/general-availability-android-enterprise-corporate-owned-devices-with-a-work-profile/) **Published:** July 2, 2021 **Author:** Equebal Ahmad **Content:** Microsoft announce the general availability of Android Enterprise corporate-owned devices with a work profile in Endpoint Manager. With this release, Endpoint Manager now supports the complete set of Android Enterprise management scenarios, including dedicated devices, fully managed devices, and personally-owned devices with a work profile Please see the full article on Microsoft Endpoint Manager blog. **Categories:** Technology Updates --- ### [Get started with Microsoft Endpoint Manager](https://techuisitive.com/get-started-with-microsoft-endpoint-manager/) **Published:** January 16, 2021 **Author:** Equebal Ahmad **Content:** Leverage your existing investments in Configuration Manager to enable cloud value. Topics covered in this session: Co-managing devices with Microsoft Intune and Configuration Manager, Tenant Attach, Endpoint Analytics, Best Practices Learn more: **Categories:** Technology Updates --- ### [MECM 2101 Technical Preview](https://techuisitive.com/mecm-2101-technical-preview/) **Published:** January 31, 2021 **Author:** Equebal Ahmad **Content:** Microsoft released Microsoft Endpoint Configuration Manager version 2101 Technical Preview. This includes many new or improved features such as Console extension, Features update deployment through Task sequence etc. Please visit Microsoft document repository [here ](https://docs.microsoft.com/en-us/mem/configmgr/core/get-started/2021/technical-preview-2101)for complete details. **Categories:** Technology Updates --- ### [MECM 2006 - Work From Anywhere](https://techuisitive.com/mecm-2006-work-from-anywhere/) **Published:** December 26, 2020 **Author:** Equebal Ahmad **Content:** Microsoft Endpoint Configuration Manager version 2006 includes many improvements such as allowing clients to upgrade on metered networks, making it easier to download content from the cloud instead of a VPN, and simplifying remote provisioning among other things. Please check the complete article on Configuration Manager [blog](https://techcommunity.microsoft.com/t5/configuration-manager-blog/update-2006-for-microsoft-endpoint-configuration-manager-current/ba-p/1569562). **Categories:** Technology Updates --- ### [Flexible paths to cloud management with Microsoft Endpoint Manager](https://techuisitive.com/flexible-paths-to-cloud-management-with-microsoft-endpoint-manager/) **Published:** November 3, 2020 **Author:** Equebal Ahmad **Content:** Learn how to go from your current on-premises endpoint manager solution, to a cloud-connected solution using Microsoft Endpoint Manager. In this session we will show you how to use tenant attach and co-management to add the power of the cloud to Windows and other devices. **Categories:** Technology Updates --- ### [Microsoft Introduced Windows 365 Cloud PC](https://techuisitive.com/microsoft-introduced-windows-365-cloud-pc/) **Published:** June 14, 2021 **Author:** Equebal Ahmad **Content:** Microsoft announce [Windows 365](https://news.microsoft.com/?p=443183), a cloud service that introduces a new way to experience Windows 10 or Windows 11 (when it’s generally available later this calendar year) for workers from interns and contractors to software developers and industrial designers. Windows 365 takes the operating system to the Microsoft Cloud, securely streaming the full Windows experience—including all your apps, data, and settings—to your personal or corporate devices. This approach creates a fully new personal computing category, specifically for the hybrid world: the Cloud PC. **Categories:** Technology Updates --- ### [Managing Windows devices with Microsoft Endpoint Manager](https://techuisitive.com/managing-windows-devices-with-microsoft-endpoint-manager/) **Published:** January 23, 2021 **Author:** Equebal Ahmad **Content:** Microsoft Endpoint Manager allows a cloud-based, on-premises, or hybrid approach to managing all of your devices. In this session learn how to use the power of Microsoft Endpoint Manager on your Windows devices. Check complete video here. **Categories:** Microsoft Intune, Technology Updates --- ### [Managing Android devices with Microsoft Endpoint Manager](https://techuisitive.com/managing-android-devices-with-microsoft-endpoint-manager/) **Published:** January 26, 2021 **Author:** Equebal Ahmad **Content:** Many of your end-users are accessing their email and other confidential data using the personal or BYOD devices. Learn how to use Microsoft Endpoint Manager to deploy, secure, and manage the devices running Android–and explore the latest features and functionality. **Categories:** Microsoft Intune, Technology Updates --- ### [Microsoft Endpoint Manager Configuration Manager Deep Dive](https://techuisitive.com/microsoft-endpoint-manager-configuration-manager-deep-dive/) **Published:** November 7, 2020 **Author:** Equebal Ahmad **Content:** Get deep insights from a panel of Endpoint Manager engineers on how to optimize your on-premises Endpoint Manager Configuration Manager services to optimize remote work with tenant attach to Intune, Cloud Management Gateway, software updates, application distribution, and security. **Categories:** ConfigMgr | SCCM, Technology Updates --- ### [New Feature: Update 2107 for MECM support implicit uninstall of application](https://techuisitive.com/new-feature-update-2107-for-mecm-support-implicit-uninstall-of-application/) **Published:** April 15, 2021 **Author:** Equebal Ahmad **Content:** Update 2107 for Microsoft Endpoint Configuration Manager current branch is now available. Many customers have lots of collections because for every application they need at least two collections: one for install and another for uninstall. This practice adds overhead of managing more collections and can reduce site performance for collection evaluation. Starting in this release, you can enable an application deployment to support implicit uninstall. If a device is in a collection, the application installs. Then when you remove the device from the collection, the application uninstalls. ![](https://techuisitive.co.in/wp-content/uploads/2023/04/image-107.png)There are many more new features. Please see [Microsoft ConfigMgr blog](https://techcommunity.microsoft.com/t5/configuration-manager-blog/update-2107-for-microsoft-endpoint-configuration-manager-current/ba-p/2596409) for complete details. **Categories:** ConfigMgr | SCCM, Technology Updates --- ### [Windows Autopilot for pre-provisioned deployment](https://techuisitive.com/windows-autopilot-for-pre-provisioned-deployment/) **Published:** October 1, 2020 **Author:** Equebal Ahmad **Content:** **Notes**: The **Windows Autopilot white glove feature** has been renamed to **Windows Autopilot for pre-provisioned deployment** Windows Autopilot helps organizations easily provision new devices by using the preinstalled OEM image and drivers. This lets end users get their devices business-ready by using a simple process. Please read the complete article [here](https://docs.microsoft.com/en-us/mem/autopilot/pre-provision) on Microsoft documentation portal. **Categories:** Microsoft Intune, Technology Updates --- ## Pages ### [Home](https://techuisitive.com/) **Published:** July 14, 2026 **Author:** Equebal Ahmad **Content:** ## **MODERN DEVICE MANAGEMENT** Learn Microsoft Intune, Windows Autopilot, Configuration Manager (SCCM), app deployment, and device management with practical guides, troubleshooting articles, PowerShell automation, and certification resources. [**Explore Learning Paths**](#learning-paths) [**Browse Latest Articles**](#Latest-articles) ![Modern Device Management](https://techuisitive.com/wp-content/uploads/2026/07/Devices-1024x1024.jpg) ## 📚 Learning Paths Choose a learning path based on your role or the topic you want to master. Each path brings together tutorials, troubleshooting guides, automation, quizzes, and related resources. [](https://techuisitive.com/microsoft-intune/)### Microsoft Intune Master Microsoft Intune device configuration with step-by-step practical guides. [](https://techuisitive.com/autopilot/)### Windows Autopilot Expand your Windows Autopilot knowledge with practical tutorials, guides, and real-world solutions. [](https://techuisitive.com/device-configurations/)### Device Configuration Configure and manage Windows devices with practical Microsoft Intune policy guides. [](https://techuisitive.com/application-management/)### App Deployment Master application deployment with step-by-step guides for Win32, Microsoft Store, and LOB apps. [](https://techuisitive.com/automation/)### Automation Master Microsoft Intune automation with practical guides to PowerShell and Microsoft Graph. [](https://techuisitive.com/microsoft-windows/)### Windows 10/11 Learn Windows deployment, updates, troubleshooting, and essential management. ## 📄 Latest Articles Stay up to date with the latest tutorials, troubleshooting guides, PowerShell automation, and Microsoft Intune insights published on Techuisitive. [![Intune Enrollment Error 0x8018000A](https://techuisitive.com/wp-content/uploads/2026/08/Intune-Enrollment-Error-1024x538.jpg) ](https://techuisitive.com/fix-device-enrollment-error-deviceaadjoin-failed-with-error-0x8018000a/) #### [Fix Device Enrollment Error: DeviceAADJoin Failed with Error 0x8018000A](https://techuisitive.com/fix-device-enrollment-error-deviceaadjoin-failed-with-error-0x8018000a/) The DeviceAADJoin failed with 0x8018000A error typically appears during Windows device enrollment into Microsoft Intune… [![Automate-Fixed-with-Intune-Remediation-script](https://techuisitive.com/wp-content/uploads/2026/07/Automate-Fixed-with-Intune-Remediation-script-1024x538.jpg) ](https://techuisitive.com/the-remediation-playbook-how-intune-admins-can-automate-fixes-in-2026/) #### [The Remediation Playbook: How Intune Admins Can Automate Fixes in 2026](https://techuisitive.com/the-remediation-playbook-how-intune-admins-can-automate-fixes-in-2026/) Modern endpoint management goes way beyond just pushing out policies – it’s about getting devices… [![Intune remediation script](https://techuisitive.com/wp-content/uploads/2026/07/Create-Intune-remediation-script-1024x538.jpg) ](https://techuisitive.com/how-to-create-intune-detection-and-remediation-scripts-step-by-step-guide/) #### [How to Create Intune Detection and Remediation Scripts (Step‑by‑Step Guide)](https://techuisitive.com/how-to-create-intune-detection-and-remediation-scripts-step-by-step-guide/) Microsoft Intune provides powerful capabilities to keep devices compliant and secure. One of the most… [![Laptop with blue cloud graphics next to the headline 'Windows Autopilot Quiz Test Your Knowledge'.](https://techuisitive.com/wp-content/uploads/2026/07/Windows-Autopilot-Quiz-1024x538.jpg) ](https://techuisitive.com/mastering-windows-autopilot-quick-quiz-challenge/) #### [Mastering Windows Autopilot: Quick Quiz Challenge](https://techuisitive.com/mastering-windows-autopilot-quick-quiz-challenge/) This quick set of 10 multiple-choice questions is designed to test your knowledge of Windows… [![Illustration of a person at a laptop with charts and gears beside the title 'Automating Intune Reports Using PowerShell & Graph API'](https://techuisitive.com/wp-content/uploads/2026/06/Automate-Intune-reports-1024x538.jpg) ](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/) #### [Automating Intune Reports Using PowerShell and Microsoft Graph API](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/) Managing Microsoft Intune environments often requires administrators to export reports regularly for compliance checks, device… [![Illustration of a person at a laptop with gears, accompanying the title about Bulk Win32 App Upload to Intune Using Graph API.](https://techuisitive.com/wp-content/uploads/2026/05/App-Deployment-1-1024x538.jpg) ](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) #### [Bulk Upload Win32 Apps to Intune With PowerShell and Microsoft Graph API](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) Bulk uploading Win32 applications to Microsoft Intune can become time-consuming when you need to package… [View All Articles](https://techuisitive.com/blog/) ## ⭐Popular Guides Explore some of the most useful and popular guides on Techuisitive, covering Microsoft Intune, Windows Autopilot, application deployment, device management, automation, and ConfigMgr. [![Illustration of a person at a laptop with gears, accompanying the title about Bulk Win32 App Upload to Intune Using Graph API.](https://techuisitive.com/wp-content/uploads/2026/05/App-Deployment-1-1024x538.jpg) ](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) #### [Bulk Upload Win32 Apps to Intune With PowerShell and Microsoft Graph API](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) Bulk uploading Win32 applications to Microsoft Intune can become time-consuming when you need to package… [![Laptop with blue cloud graphics on the left and the title 'Windows Autopilot Device Preparation v2' on the right.](https://techuisitive.com/wp-content/uploads/2024/11/Autopilot-Device-preparation-v2-1-1024x538.jpg) ](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) #### [Windows Autopilot Device Preparation aka Autopilot v2 Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) Windows Autopilot Device Preparation, also known as Autopilot v2, is Microsoft’s latest evolution in device… [![Illustration of a person configuring a Windows kiosk in Microsoft Intune with gears and screens; a 'Configuration' badge in the top-left.](https://techuisitive.com/wp-content/uploads/2023/01/Windows-Kiosk-1024x538.jpg) ](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) #### [How to Configure Windows Kiosk Using Microsoft Intune | Windows 10 / 11](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) Windows kiosk is a lockdown mechanism to restrict device access to pre-defined applications. The applications… [![Laptop with blue cloud icons emerging from the screen, next to a bold headline about provisioning Windows 10/11 devices with Autopilot, and an Autopilot badge in the top-left corner.](https://techuisitive.com/wp-content/uploads/2022/03/Windows-Autopilot-1-1024x538.jpg) ](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) #### [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Windows Autopilot is a modern deployment solution from Microsoft that simplifies how IT teams provision,… [![Hero illustration: a person using a laptop beside large blue gears, accompanying the heading 'Understanding Win32 App Detection Rules'](https://techuisitive.com/wp-content/uploads/2022/03/Win32-App-Detection-Rules-1024x538.jpg) ](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) #### [Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) Win32 app detection rules in Microsoft Intune are critical for ensuring accurate application deployment and… [View All Articles](https://techuisitive.com/blog/) ![](https://techuisitive.com/wp-content/uploads/2026/08/Intune-Quiz-1024x1024.jpeg) ## Interactive Device Management Quizzes ### Test Your Skills. Learn Faster. Challenge yourself with practical quizzes covering Microsoft Intune, Windows 10/11, Windows Autopilot, ConfigMgr (SCCM), Microsoft Entra, and PowerShell. Build confidence, prepare for certifications, and strengthen your skills through interactive assessments designed for IT professionals. 🔵 Microsoft Intune, Windows & Autopilot 🔵 Scenario-Based Questions for IT Professionals 🔵 Instant Results & Performance Insights [Start a Quiz](https://techuisitive.com/quiz/) ## About Techuisitive At Techuisitive, we believe the best way to learn device management is through practical experience. That’s why we publish in-depth guides, troubleshooting articles, automation scripts, and learning resources covering Microsoft Intune, Windows Autopilot, Configuration Manager (SCCM), and enterprise endpoint management. Our goal is to create a trusted resource where IT professionals can learn, troubleshoot, and stay up to date with Microsoft’s evolving device management ecosystem. ![Device Management](https://techuisitive.com/wp-content/uploads/2026/07/b11249af-aa80-4188-86d7-30b7bbd24bf0-1-1024x723.jpg "b11249af-aa80-4188-86d7-30b7bbd24bf0") --- ### [SCCM](https://techuisitive.com/sccm/) **Published:** July 24, 2026 **Author:** Equebal Ahmad **Content:** ## SCCM / Microsoft Configuration Manager #### Configuration Manager, MECM & Endpoint Management Learn Microsoft Configuration Manager (SCCM) from deployment to troubleshooting. Explore operating system deployment, application management, software updates, reporting, and endpoint administration with practical, step-by-step guides. ✅ Application Management ✅ Operating System Deployment ✅ Software Updates ✅ Troubleshooting & Administration ![SCCM (Configuration Manager)](https://techuisitive.com/wp-content/uploads/2026/07/2c2d99fe-c51b-4f7e-ba4d-b5bd64a4adff-1024x751.jpg) Table Of Contents 1. [SCCM / Microsoft Configuration Manager](#sccm-microsoft-configuration-manager) 2. [Infrastructure & Site Administration](#infrastructure-site-administration) 3. [Collections & Device Management](#collections-device-management) 4. [Software Deployment](#software-deployment) 5. [Reporting & SQL Queries](#reporting-sql-queries) 6. [🔧Troubleshooting](#troubleshooting) 7. [📚 Continue Learning](#continue-learning) ## Infrastructure & Site Administration Learn how to deploy, configure, and maintain your Configuration Manager infrastructure. Explore guides covering Cloud Management Gateway (CMG), site systems, boundaries, certificates, and other essential components that keep your environment running smoothly. [![Blue illustration of a computer monitor, server racks, and a database stack in front of a cloud, with the text 'SCCM Cloud Management Gateway Setup Guide' on the right.](https://techuisitive.com/wp-content/uploads/2022/11/SCCM-Infra-CMG-1024x538.jpg) ](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) #### [SCCM CMG Setup Guide – Part 6 | Validate CMG Health & Client Communication](https://techuisitive.com/sccm-cmg-setup-guide-part-6-validate-cmg-health-client-communication/) The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over… [![Blue illustration of a computer monitor, server racks, and a database stack in front of a cloud, with the text 'SCCM Cloud Management Gateway Setup Guide' on the right.](https://techuisitive.com/wp-content/uploads/2022/11/SCCM-Infra-CMG-1024x538.jpg) ](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) #### [SCCM CMG Setup Guide – Part 5 | Setup Cloud Management Gateway](https://techuisitive.com/sccm-cmg-setup-guide-part-5-setup-cloud-management-gateway/) The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over… [![Blue illustration of a computer monitor, server racks, and a database stack in front of a cloud, with the text 'SCCM Cloud Management Gateway Setup Guide' on the right.](https://techuisitive.com/wp-content/uploads/2022/11/SCCM-Infra-CMG-1024x538.jpg) ](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) #### [SCCM CMG Setup Guide – Part 4 | Integrate Azure Active Directory with ConfigMgr](https://techuisitive.com/sccm-cmg-setup-guide-part-4-integrate-azure-active-directory-with-configmgr/) The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over… [![Blue illustration of a computer monitor, server racks, and a database stack in front of a cloud, with the text 'SCCM Cloud Management Gateway Setup Guide' on the right.](https://techuisitive.com/wp-content/uploads/2022/11/SCCM-Infra-CMG-1024x538.jpg) ](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) #### [SCCM CMG Setup Guide – Part 3 | Configure SCCM Site for SSL](https://techuisitive.com/sccm-cmg-setup-guide-part-3-configure-sccm-site-for-ssl/) The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over… [![Blue illustration of a computer monitor, server racks, and a database stack in front of a cloud, with the text 'SCCM Cloud Management Gateway Setup Guide' on the right.](https://techuisitive.com/wp-content/uploads/2022/11/SCCM-Infra-CMG-1024x538.jpg) ](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) #### [SCCM CMG Setup Guide (Part 2): Issue, Enroll & Export Server Authentication Certificate](https://techuisitive.com/sccm-cmg-setup-guide-part-2-issue-enroll-export-server-authentication-certificate/) The cloud management gateway (CMG) provides a simple way to manage Configuration Manager client over… [![Blue illustration of a computer monitor, server racks, and a database stack in front of a cloud, with the text 'SCCM Cloud Management Gateway Setup Guide' on the right.](https://techuisitive.com/wp-content/uploads/2022/11/SCCM-Infra-CMG-1024x538.jpg) ](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) #### [Cloud Management Gateway – CMG Setup Guide – Part 1 | SCCM | ConfigMgr](https://techuisitive.com/cloud-management-gateway-cmg-setup-guide-part-1-sccm-configmgr/) The SCCM cloud management gateway (CMG) provides a simple way to manage Configuration Manager clients… [![Graphic showing a computer monitor, server stacks and a database in blue, with the title 'Auto Enroll Client Authentication Certificate for SCCM Clients'.](https://techuisitive.com/wp-content/uploads/2022/11/Enroll-Client-Authentical-Certificate-1024x538.jpg) ](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) #### [How to Issue & Auto enroll Client Authentication Certificate for SCCM Clients](https://techuisitive.com/issue-autoenroll-client-authentication-certificate-for-sccm-clients/) Issuing and enrolling Client Authentication Certificates for SCCM clients is a critical step in enabling… [![SCCM banner with a monitor, server stack and cloud on the left, and the text 'Configure SCCM Software Update Point for SSL' on the right.](https://techuisitive.com/wp-content/uploads/2022/11/Software-Update-Point-SSL-1024x538.jpg) ](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) #### [Configure SCCM Software Update Point for SSL](https://techuisitive.com/configure-software-update-point-for-ssl-configmgr-sccm/) Microsoft deprecated HTTP-only communication in Configuration Manager to increase security. The HTTP-only communication will not… [![SCCM banner with a blue server and database illustration beside the title 'Configure SCCM Management Point for HTTPS'.](https://techuisitive.com/wp-content/uploads/2022/11/Configure-Management-Point-for-Https-1024x538.jpg) ](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) #### [How to Configure SCCM Management Point for HTTPS | ConfigMgr](https://techuisitive.com/configure-management-point-for-https-configmgr-sccm/) Microsoft deprecated HTTP-only communication in Configuration Manager to increase security. The HTTP-only communication will not… ## Collections & Device Management Master the creation and management of device and user collections for software deployment, compliance, maintenance, and administrative tasks. Discover practical collection queries and management techniques for real-world scenarios. [![Blue illustration of computer monitors and a laptop with a SQL badge, beside the heading 'Understanding SCCM Incremental Collection'.](https://techuisitive.com/wp-content/uploads/2023/09/Understanding-Incremenatal-Collection-1024x538.jpg) ](https://techuisitive.com/understanding-sccm-incremental-collection-evaluation-and-monitoring/) #### [Understanding SCCM Incremental Collection , Evaluation and monitoring](https://techuisitive.com/understanding-sccm-incremental-collection-evaluation-and-monitoring/) System Center Configuration Manager (SCCM) uses collection evaluation to update membership based on defined rules…. [![Informational hero image with blue IT devices (monitors and laptop) on the left and the text 'SCCM Maintenance Windows Guide' on the right.](https://techuisitive.com/wp-content/uploads/2023/09/SCCM-Maintenance-Windows-1024x538.jpg) ](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/) #### [How to Create , View and Organize SCCM Maintenance Windows](https://techuisitive.com/how-to-create-view-and-organize-sccm-maintenance-windows/) A Configuration Manager maintenance windows restrict the deployments on SCCM client during specified timeframe. The… [![Illustration of multiple blue computer screens and a laptop with a blue circular background; title reads 'SCCM Dynamic Collections by Baseline Compliance' in bold blue text. SCCM badge sits in the top-left corner.](https://techuisitive.com/wp-content/uploads/2023/06/SCCM-Collection-configuration-baseline-1024x538.jpg) ](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) #### [How to Create SCCM Dynamic Collection Based on Configuration Baseline Compliance Status](https://techuisitive.com/sccm-dynamic-collection-based-on-configuration-baseline-compliance-status-configmgr/) Compliance Settings are business or technical conditions to assess compliance of a device. There may… [![Illustration of multiple blue computer screens and a laptop with the caption 'Check the Software Center Business Hours' on the right.](https://techuisitive.com/wp-content/uploads/2023/06/Business-Hours-1024x538.jpg) ](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) #### [How to Check Software Center Business Hours of Remote Computer | ConfigMgr](https://techuisitive.com/check-software-center-business-hours-of-remote-computer-configmgr/) Troubleshooting software update deployments in ConfigMgr often requires checking whether Software Center business hours are… [![Illustration of multiple computer screens and a laptop with a blue background, beside the headline 'Schedule SCCM Client Reboot through ConfigMgr'.](https://techuisitive.com/wp-content/uploads/2023/05/SCCM-Client-Reboot-1024x538.jpg) ](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) #### [How to Schedule SCCM Client Reboot through ConfigMgr](https://techuisitive.com/schedule-sccm-client-reboot-through-configmgr/) You may have a requirement to reboot SCCM client computers which have not been rebooted… [![Blue illustration of multiple computer screens and a laptop beside the heading 'SCCM Dynamic Collections by Application Deployment Status'. The top-left badge reads 'SCCM'.](https://techuisitive.com/wp-content/uploads/2023/05/SCCM-collection-by-Application-status-1024x538.jpg) ](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) #### [SCCM Dynamic Collection using Application Deployment Status](https://techuisitive.com/sccm-dynamic-collection-using-application-deployment-status/) The SMS\_AppDeploymentAssetDetails Windows Management Instrumentation (WMI) class is an SMS Provider server class in Configuration Manager that… [![Blue illustration of multiple computer screens on the left and the heading “SCCM Dynamic Collections by OS Optional Features” in blue on the right.](https://techuisitive.com/wp-content/uploads/2023/03/SCCM-Collection-OS-Optional-Features-1024x538.jpg) ](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) #### [SCCM Collection Based on Operating System Optional Features | ConfigMgr](https://techuisitive.com/sccm-collection-based-on-operating-system-optional-features-configmgr/) Win32\_OptionalFeature WMI class represents the status of the optional features that are present on the… [![Blue illustration of multiple monitors and a laptop representing IT infrastructure, beside the heading 'SCCM Dynamic Collections by Installed Products' with a brown SCCM badge in the top-left.](https://techuisitive.com/wp-content/uploads/2023/02/SCCM-Collection-by-Installed-Software-1024x538.jpg) ](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) #### [Create SCCM Device Collection Based on Installed Software Products & Inventoried Files](https://techuisitive.com/sccm-device-collection-based-on-installed-software-products-inventoried-files/) SCCM collect software information from client using different methods such as Software inventory ,… [![Blue illustration of a monitor, laptop, and tablet with the title 'SCCM Dynamic Collection by Hardware Details' on a white background (SCCM badge in top-left).](https://techuisitive.com/wp-content/uploads/2023/02/SCCM-Collection-By-Hardware-Details-1024x538.jpg) ](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) #### [How to Create SCCM Device Collection Based on Computer Hardware Details | ConfigMgr](https://techuisitive.com/sccm-device-collection-based-on-computer-hardware-details-configmgr/) SCCM Computer hardware classes can be used to create dynamic query based device collection. There… [![Illustration of blue computer screens and a laptop with a SQL badge, beside the title 'SCCM Dynamic Collection by Operating System Attributes'.](https://techuisitive.com/wp-content/uploads/2022/12/SCCM-Collection-by-OS-Attributes-1024x538.jpg) ](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) #### [How to Create SCCM Collection Based on Operating System Attribute Class | ConfigMgr](https://techuisitive.com/sccm-collection-queries-for-opearting-system-attribute-class-configmgr/) SCCM collects operating system details from client as part of inventory. We can create SCCM… [![Illustration of blue computer monitors and a laptop with a SQL badge, next to the title 'SCCM Dynamic Collection by System Resource Attributes'.](https://techuisitive.com/wp-content/uploads/2022/12/SCCM-Collection-by-System-Resource-1024x538.jpg) ](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) #### [How to Create SCCM Collection based on System Resource Attribute Class](https://techuisitive.com/sccm-collection-queries-for-system-resource-sms_r_system-attribute-class/) The SMS_R_System Windows Management Instrumentation (WMI) class) is an SMS Provider server class in Configuration… [![Blue illustration of multiple computer screens and a laptop with a SQL badge, paired with the heading 'Create Dynamic Collection in SCCM'.](https://techuisitive.com/wp-content/uploads/2022/12/Create-Dynamic-Collection-in-SCC-1024x538.jpg) ](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) #### [Create Dynamic Collections in SCCM for Different Attribute Classes | ConfigMgr](https://techuisitive.com/create-dynamic-collections-in-sccm-for-different-attribute-classes-configmgr/) Dynamic collections in Microsoft Configuration Manager (SCCM/ConfigMgr) allow administrators to automate device grouping using WQL… [![Blue illustration of multiple computer screens and a laptop with the title 'Enclosure Chassis Types Value & Description' on the right, SCCM badge in top-left (informational banner).](https://techuisitive.com/wp-content/uploads/2022/10/Enclosure-Chassis-Types-1024x538.jpg) ](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) #### [Enclosure Chassis Types Value & Description | ConfigMgr | SCCM](https://techuisitive.com/enclosure-chassis-types-value-description-configmgr-sccm/) A chassis or cabinet is a physical enclosure that houses the internal components of a computer… [![Blue illustration of a monitor, laptop, and tablet connected together beside the title 'Create Dynamic Collection Based on Device Type'](https://techuisitive.com/wp-content/uploads/2022/10/Dynamic-Collection-based-on-Device-Type-1024x538.jpg) ](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) #### [How to Create SCCM Dynamic Collection Based on Device Type](https://techuisitive.com/sccm-dynamic-collection-based-on-device-type-collection-queries/) Want to simplify device targeting in SCCM? This guide shows how to create dynamic collections… [![Blue illustration of a desktop monitor, tablet, and laptop with an SQL label, beside the heading “Create Dynamic Collection for Windows 10/11 Devices.” SCCM badge appears in the top-left corner, indicating branding.](https://techuisitive.com/wp-content/uploads/2022/10/SCCM-Collection-for-Windows1011-1024x538.jpg) ](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) #### [SCCM Dynamic Collection for Windows 10 / 11 Devices | ConfigMgr](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) In ConfigMgr , a dynamic collection membership is based on query rules. A dynamic or… [![Blue-toned illustration of a desktop monitor, laptop and tablet with a SQL badge, beside the title 'Location of smsts.log File During SCCM OSD'](https://techuisitive.com/wp-content/uploads/2018/02/smsts-log-location-1024x538.jpg) ](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) #### [Location of smsts.log file during SCCM OSD](https://techuisitive.com/location-of-smsts-log-file-during-sccm-osd/) The smsts.log is the primary source for troubleshooting SCCM task sequence failures. The smsts.log records… ## Software Deployment Deploy applications, packages, operating systems, and software updates with confidence. This section covers deployment strategies, best practices, and configuration tips to help you deliver software reliably across managed devices. [![Banner illustration with blue computer monitors and a laptop on the left and the headline 'Configure & Approve User Application Requests in SCCM' on the right.](https://techuisitive.com/wp-content/uploads/2023/08/Configure-and-Approve-User-Application-Requests-in-SCCM-1024x538.jpg) ](https://techuisitive.com/how-to-configure-and-approve-user-application-requests-in-sccm/) #### [How to Configure and Approve User Application Requests in SCCM](https://techuisitive.com/how-to-configure-and-approve-user-application-requests-in-sccm/) SCCM allows application deployment in way that it goes through approval process. Users requests the… [![Blue isometric computers with a small SCCM badge in the top-left, and the title 'Run a Script in SCCM Without Creating an Application' on the right.](https://techuisitive.com/wp-content/uploads/2023/08/Run-script-in-SCCM-without-creating-a-package-application-1024x538.jpg) ](https://techuisitive.com/how-to-run-a-script-without-creating-a-package-application-in-sccm-configmgr/) #### [How to Run script in SCCM without creating a package / application](https://techuisitive.com/how-to-run-a-script-without-creating-a-package-application-in-sccm-configmgr/) Configuration Manager has an integrated ability to run PowerShell scripts. This can be used to… ## Reporting & SQL Queries Extract valuable insights from Configuration Manager using SQL queries and reporting techniques. Find ready-to-use queries, reporting tips, and database examples to simplify administration and troubleshooting. [![SCCM SQL Query to list Desktop & Laptop Devices banner with a computer and database icons on the left.](https://techuisitive.com/wp-content/uploads/2023/07/SCCM-SQL-Query-1024x538.jpg) ](https://techuisitive.com/sccm-sql-query-to-list-desktop-laptop-devices/) #### [SCCM SQL Query to list Desktop & Laptop Devices](https://techuisitive.com/sccm-sql-query-to-list-desktop-laptop-devices/) As an SCCM administrator, you often need custom reports that go beyond the built‑in options…. [![Illustration of IT equipment with SQL/database icons and a blue computer, showing the title 'SCCM SQL Query to Summarize Devices by Windows Version'.](https://techuisitive.com/wp-content/uploads/2023/05/SQL-Query-Windows-Versions-1024x538.jpg) ](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) #### [SCCM SQL Query to Summarize Windows 10/11 Versions and Device Counts](https://techuisitive.com/sccm-sql-query-for-windows-10-11-version-summary/) The below SCCM SQL query will summarize the list of Windows 10 / 11 versions… [![Illustration showing a computer monitor, server stacks and SQL icon with an SCCM badge, beside the title 'Understanding SCCM SQL Views'.](https://techuisitive.com/wp-content/uploads/2018/12/SCCM-SQL-View-1024x538.jpg) ](https://techuisitive.com/understanding-sccm-sql-views/) #### [Understanding SCCM SQL Views](https://techuisitive.com/understanding-sccm-sql-views/) The Configuration Manager 2012 / Current Branch come with many built in reports which are… #### [SQL Query to Get Maintenance Window for member of specific collection | SCCM | ConfigMgr](https://techuisitive.com/sql-query-to-get-maintenance-window-for-member-of-specific-collection-sccm-configmgr/) In Configuration Manager, a Maintenance Window allows client configuration changes at a specific time defined… ## 🔧Troubleshooting Resolve common Configuration Manager issues with step-by-step troubleshooting guides. Learn how to diagnose client problems, deployment failures, CMG issues, and other challenges using logs and proven troubleshooting methods. [![Troubleshooting graphic: computer and server/database illustration beside the title 'Fix SCCM Management Point Installation Issue'](https://techuisitive.com/wp-content/uploads/2023/07/SCCM-Troubleshooting-Management-Point-Installation-Failed-1024x538.jpg) ](https://techuisitive.com/management-point-installation-failed-after-sccm-2303-upgrade/) #### [Fix SCCM Management Point Installation Issue after SCCM 2303 Upgrade](https://techuisitive.com/management-point-installation-failed-after-sccm-2303-upgrade/) Issue After SCCM 2303 Upgrade from 2111, the Management Point installation failed on all MPs… [![Troubleshooting guide image showing a laptop with a browser window; article title: 'Fix WSUS Scan Error 0x80004005' on the right.](https://techuisitive.com/wp-content/uploads/2023/06/WSUS-Scan-Error-0x80004005-1-1024x538.jpg) ](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) #### [Failed to Add Update Source for WUAgent of type (2) and id ({ID). Error = 0x80004005 | ConfigMgr](https://techuisitive.com/failed-to-add-update-source-for-wuagent-of-type-2-and-id-id-error-0x80004005-configmgr/) When working with Configuration Manager (ConfigMgr/SCCM), software update scans may fail with the error “Failed… [![Troubleshooting header with a laptop and browser window illustration on the left and the text 'Application Deployment error 0x87d00213' on the right.](https://techuisitive.com/wp-content/uploads/2023/03/Application-Deployment-error-0x87d00213-1024x538.jpg) ](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) #### [Fix Application Deployment error 0x87d00213 in ConfigMgr](https://techuisitive.com/fix-application-deployment-error-0x87d00213-in-configmgr/) What is Error 0x87d00213? ConfigMgr error 0x87d00213 indicates that an application deployment has timed out…. [![Top-left Troubleshooting badge with a laptop illustration and the headline: 'Fix SCCM OSD Domain Join Error Code 0x54b'](https://techuisitive.com/wp-content/uploads/2023/03/Domain-Join-Failed-with-Error-code-0x54b-1024x538.jpg) ](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) #### [SCCM OSD – Domain Join Failed with Error Code 0x54b on HP Elitebook 840 G8](https://techuisitive.com/sccm-osd-domain-join-failed-with-error-code-0x54b-on-hp-elitebook-840-g8/) When deploying Windows 10 using SCCM OSD on HP EliteBook 840 G8 devices, you may… [![Troubleshooting banner with a laptop and browser search bar beside the title 'Fix SCCM Client Installation Error 0x87d00227'.](https://techuisitive.com/wp-content/uploads/2023/01/SCCM-Client-Installation-Error-0x87d00227-1024x538.jpg) ](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) #### [Fix SCCM Client Installation Error 0x87d00227 (ccmsetup Failed) – ConfigMgr Troubleshooting Guide](https://techuisitive.com/ccmsetup-failed-with-error-code-0x87d00227-configmgr-sccm/) When deploying the SCCM client, you may encounter the error ccmsetup failed with error code… [![Troubleshooting banner with a laptop illustration and the headline 'Fix SCCM Application Deployment Error 0x87d0106'](https://techuisitive.com/wp-content/uploads/2022/12/SCCM-Application-Deployment-Error-0x87d01106-1024x538.jpg) ](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) #### [How to Fix SCCM Application Deployment Error 0x87d01106](https://techuisitive.com/sccm-application-deployment-failed-with-error-0x87d01106-configmgr/) When monitoring the application deployment through SCCM report, the following deployment error was logged for… [![Troubleshooting badge with a laptop graphic and the headline 'Fix SCCM Client Push Installation Error 0x800706ba'.](https://techuisitive.com/wp-content/uploads/2022/11/Fix-SCCM-Client-installation-Error-0x800706ba-1024x538.jpg) ](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) #### [SCCM Client Push Installation Failed with Error 0x800706ba](https://techuisitive.com/sccm-client-push-installation-failed-with-error-0x800706ba/) When deploying the Configuration Manager (ConfigMgr/SCCM) client using the push installation method, you may encounter… [![Troubleshooting banner with a computer and server illustration next to the headline “Fix CMG Connection Point Status: Disconnected.”](https://techuisitive.com/wp-content/uploads/2022/10/CMG-Connection-Point-Status-Disconnected-1024x538.jpg) ](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) #### [CMG Connection Point Status Disconnected | SCCM | ConfigMgr](https://techuisitive.com/cmg-connection-point-status-disconnected-sccm-configmgr/) In Configuration Manager (SCCM/ConfigMgr), you may encounter a situation where the Cloud Management Gateway (CMG)… [![Troubleshooting banner: illustration of a laptop with a browser window and search icon, placed beside the heading 'Fix SCCM Client Installation Error 0x87D00215'.](https://techuisitive.com/wp-content/uploads/2022/10/SCCM-Client-Installation-Error-Code-0x87d00215-1024x538.jpg) ](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) #### [SCCM Client Installation Failed With Error Code 0x87d00215](https://techuisitive.com/sccm-client-installation-failed-with-error-code-0x87d00215/) SCCM client installation fails with error 0x87d00215 – Failed to get DP locations as the… [![SCCM OSD PXE Troubleshooting Guide title with a laptop illustration on a white background.](https://techuisitive.com/wp-content/uploads/2022/06/SCCM-PXE-Troubleshooting-1024x538.jpg) ](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) #### [SCCM PXE Boot Troubleshooting Guide: Fix OSD Deployment Failures in ConfigMgr](https://techuisitive.com/sccm-mecm-configmgr-osd-pxe-troubleshooting/) Preboot Execution Environment (PXE) boot in SCCM enables administrators to easily access the Windows Preinstallation… [![Troubleshooting banner showing a laptop with a web browser window and the headline 'Fix SCCM OSD PXE-E99 Unexpected Network Error'.](https://techuisitive.com/wp-content/uploads/2022/04/SCCM-PXE-E99-Error-1024x538.jpg) ](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) #### [PXE-E99 : Unexpected network error – SCCM OSD](https://techuisitive.com/pxe-e99-unexpected-network-error-sccm-osd/) Encountering PXE-E99: Unexpected Network Error during SCCM OSD can be frustrating, especially when it happens… [![Troubleshooting badge in the top-left with a laptop illustration and the headline: 'Fix SCCM OSD Task Sequence Error 0x80072EE7'](https://techuisitive.com/wp-content/uploads/2022/03/SCCM-OSD-Error-0x80072EE7-1024x538.jpg) ](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) #### [OSD Task Sequence Failed with Error 0x80072EE7 | SCCM | ConfigMgr](https://techuisitive.com/osd-task-sequence-failed-with-error-0x80072ee7-sccm-configmgr/) Configuration Manager Windows 10 / Windows 11 Operating System Deployment failed with Error code 0x80072ee7… [![Troubleshooting banner with a laptop illustration and the title 'Fix SCCM Client Installation Error 0x87d00027e'.](https://techuisitive.com/wp-content/uploads/2022/03/SCCM-Client-Installation-error-0x87d0027e-1024x538.jpg) ](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) #### [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/) ConfigMgtr | SCCM client installation may fail with below error when management point is configured… [![Illustration of multiple blue computer screens with the title 'Initiate SCCM Client Agent Actions Using PowerShell' on the right side](https://techuisitive.com/wp-content/uploads/2022/03/SCCM-Client-Agent-Action-1024x538.jpg) ](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) #### [How to Initiate SCCM Client Agent Actions Using PowerShell](https://techuisitive.com/how-to-initiate-sccm-client-agent-actions-using-powershell/) The SCCM client agent actions can be manually triggered to force SCCM client agent to… [![Troubleshooting banner: blue illustration of servers and a database on the left with the title 'Fix CMG Error: Granting Contributor Permission to the Azure AD App' on the right.](https://techuisitive.com/wp-content/uploads/2021/04/Error-when-granting-Contributor-permission-to-the-Azure-AD-app-1024x538.jpg) ](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) #### [CMG Setup Error: Failed to Grant Contributor Permission to Azure AD App](https://techuisitive.com/cmg-setup-error-when-granting-contributor-permission-to-the-azure-ad-app/) When setting up a Cloud Management Gateway (CMG) in Microsoft Configuration Manager, you may encounter… [![Troubleshooting banner: computer and data servers beside a cloud with the headline 'Fix SCCM Error 0x8004100E: Failed to Connect with Distribution Point'](https://techuisitive.com/wp-content/uploads/2021/04/Fix-SCCM-Error-0x8004100E-Failed-to-Connect-with-Distribution-Point-1024x538.jpg) ](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) #### [Failed to connect with DP – Error Code 0x8004100e | ConfigMgr | SCCM](https://techuisitive.com/failed-to-connect-with-dp-error-code-0x8004100e-configmgr-sccm/) Issue: The SCCM package distribution was failing on one of the newly commissioned Distribution Point…. [![Troubleshooting badge with a blue computer and server illustration beside the title: Fix CMG Setup: Subscription ID Dropdown Not Populating](https://techuisitive.com/wp-content/uploads/2021/04/Fix-CMG-Setup-Subscription-ID-Dropdown-Not-Populating-1024x538.jpg) ](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) #### [CMG Setup – Subscription ID drop down not populating | SCCM | ConfigMgr](https://techuisitive.com/cmg-setup-subscription-id-drop-down-not-populating-sccm-configmgr/) When setting up a Cloud Management Gateway (CMG) in SCCM/Configuration Manager, you may encounter an… [![Troubleshooting banner over a laptop illustration; title reads 'Fix SCCM OSD task sequence error 0x8004005'](https://techuisitive.com/wp-content/uploads/2018/06/SCCM-OSD-task-sequence-error-0x80004005-1-1024x538.jpg) ](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/) #### [Configuration Manager OSD task sequence fails with error code 0x80004005](https://techuisitive.com/configuration-manager-osd-task-sequence-fails-with-error-code-0x80004005/) The MECM / SCCM task sequence may fail with following error: An error occurred while… [![Troubleshooting banner: laptop illustration with a search bar and the title 'SCCM Software Distribution Troubleshooting'.](https://techuisitive.com/wp-content/uploads/2017/11/SCCM-Software-Distribution-Troubleshooting-1024x538.jpg) ](https://techuisitive.com/sccm-software-distribution-troubleshooting/) #### [SCCM Software Distribution Troubleshooting](https://techuisitive.com/sccm-software-distribution-troubleshooting/) Software distribution failures in SCCM can stem from issues with content delivery, client health, or… [![Troubleshooting banner with a blue server illustration and the title 'Fix WSUS server not configured Error in SCCM' for a tech guide.](https://techuisitive.com/wp-content/uploads/2010/03/WSUS-Sync-error-1024x538.jpg) ](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) #### [SCCM WSUS sync error – Sync Failed – WSUS server not configured](https://techuisitive.com/sccm-wsus-sync-error-sync-failed-wsus-server-not-configured/) Consider the following scenario The WSUS is installed on SCCM central site server. The correct… ## 📚 Continue Learning Choose a learning path based on your role or the topic you want to master. Each path brings together tutorials, troubleshooting guides, automation, quizzes, and related resources. [](https://techuisitive.com/application-management/)### App Deployment Master application deployment with step-by-step guides for Win32, Microsoft Store, and LOB apps. [](https://techuisitive.com/autopilot/)### Windows Autopilot Expand your Windows Autopilot knowledge with practical tutorials, guides, and real-world solutions. [](https://techuisitive.com/device-configurations/)### Device Configuration Configure and manage Windows devices with practical Microsoft Intune policy guides. [](https://techuisitive.com/microsoft-intune/)### Microsoft Intune Master Microsoft Intune device configuration with step-by-step practical guides. [](https://techuisitive.com/automation/)### Automation Master Microsoft Intune automation with practical guides to PowerShell and Microsoft Graph. [](https://techuisitive.com/microsoft-windows/)### Windows 10/11 Learn Windows deployment, updates, troubleshooting, and essential management. --- ### [Quiz](https://techuisitive.com/quiz/) **Published:** July 13, 2026 **Author:** Equebal Ahmad **Content:** ## Device Management Quizzes #### Test your Device Management knowledge Reinforce your learning with interactive quizzes designed for Microsoft Intune and modern device management professionals. Test your knowledge, identify knowledge gaps, and build confidence through practical, real-world scenarios. ✅ Challenge yourself with interactive quizzes. ✅ Assess your understanding of modern endpoint management. ✅ Learn through practical, real-world scenarios. ✅ Track your progress as you advance your skills. ![Device management Quiz](https://techuisitive.com/wp-content/uploads/2026/07/319402e6-add0-444e-a21c-ccb0e49285e3-1024x682.jpg) Table Of Contents 1. [Device Management Quizzes](#device-management-quizzes) 2. [Microsoft Intune](#microsoft-intune) 3. [Windows Autopilot](#windows-autopilot) 4. [SCCM (Configuration Manager)](#sccm-configuration-manager) 5. [Endpoint Administrator Associate (MD-102)](#endpoint-administrator-associate-md-102) 6. [📚 Continue Learning](#continue-learning) ## Microsoft Intune Test your Microsoft Intune knowledge with practical quizzes covering device management, app deployment, compliance, security, and troubleshooting. [![Illustration of a person adjusting a gear on a laptop showing 75% progress beside a cloud download icon; the title 'Windows Update Quiz Test Your Knowledge' on the right in bold blue Schrift.](https://techuisitive.com/wp-content/uploads/2026/01/Windows-Update-Quiz-1024x538.jpg) ](https://techuisitive.com/microsoft-intune-windows-update-quiz-2/) #### [Microsoft Intune Windows Update Quiz – Test Your Admin Skills](https://techuisitive.com/microsoft-intune-windows-update-quiz-2/) Managing Windows updates effectively is a critical skill for IT administrators working with Microsoft Intune…. [![Quiz banner: cartoon of a person placing a large gear beside a laptop showing 75% installing, with a cloud download icon; title reads 'Security & Update Enforcement Quiz'.](https://techuisitive.com/wp-content/uploads/2025/12/Security-update-quiz_20260726_104150_0000-1024x538.jpg) ](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-2/) #### [Microsoft Intune – Security and Update Enforcement – Quiz 2](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-2/) Microsoft Intune plays a pivotal role in safeguarding corporate devices and ensuring compliance with organizational… [![Illustration of a person configuring a computer interface with gears; banner text reads 'Microsoft Intune Device Configuration Quiz', yellow 'Quiz' badge in corner.](https://techuisitive.com/wp-content/uploads/2025/11/Microsoft-Intune-Quiz-1024x538.jpg) ](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz-02/) #### [Mastering Intune Configuration Profiles: Admin Essentials Quiz 02](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz-02/) Welcome to the Intune Configuration Profiles Quiz! This follow‑up quiz challenges you to dive deeper… [![Illustration of a person configuring a computer interface with gears; banner text reads 'Microsoft Intune Device Configuration Quiz', yellow 'Quiz' badge in corner.](https://techuisitive.com/wp-content/uploads/2025/11/Microsoft-Intune-Quiz-1024x538.jpg) ](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz/) #### [Mastering Intune Configuration Profiles: Admin Essentials Quiz 01](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz/) Welcome to the Intune Configuration Profiles Quiz! This quiz tests your understanding of how Microsoft… [![Quiz banner: cartoon of a person placing a large gear beside a laptop showing 75% installing, with a cloud download icon; title reads 'Security & Update Enforcement Quiz'.](https://techuisitive.com/wp-content/uploads/2025/12/Security-update-quiz_20260726_104150_0000-1024x538.jpg) ](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-1/) #### [Microsoft Intune – Security and Update Enforcement – Quiz 1](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-1/) Microsoft Intune plays a crucial role in security and update enforcement, ensuring devices meet compliance… [![Illustration of a person adjusting a gear on a laptop showing 75% progress beside a cloud download icon; the title 'Windows Update Quiz Test Your Knowledge' on the right in bold blue Schrift.](https://techuisitive.com/wp-content/uploads/2026/01/Windows-Update-Quiz-1024x538.jpg) ](https://techuisitive.com/microsoft-intune-software-update-quiz-1/) #### [Microsoft Intune – Windows Update Quiz 1](https://techuisitive.com/microsoft-intune-software-update-quiz-1/) Windows Update is a service that keeps devices secure and up to date by delivering… ## Windows Autopilot Challenge yourself with curated Windows Autopilot quizzes designed for IT administrators and endpoint management professionals. [![Laptop with blue cloud graphics next to the headline 'Windows Autopilot Quiz Test Your Knowledge'.](https://techuisitive.com/wp-content/uploads/2026/07/Windows-Autopilot-Quiz-1024x538.jpg) ](https://techuisitive.com/mastering-windows-autopilot-quick-quiz-challenge/) #### [Mastering Windows Autopilot: Quick Quiz Challenge](https://techuisitive.com/mastering-windows-autopilot-quick-quiz-challenge/) This quick set of 10 multiple-choice questions is designed to test your knowledge of Windows… ## SCCM (Configuration Manager) Assess your understanding of SCCM with quizzes covering application deployment, collections, boundaries, client settings, and reporting. [![Quiz banner for an SCCM ConfigMgr quiz, with a blue computer and server illustration on the left and the title on the right.](https://techuisitive.com/wp-content/uploads/2023/04/SCCM-Quiz-1024x538.jpg) ](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) #### [Configuration Manager | SCCM Quiz – Set 02](https://techuisitive.com/configuration-manager-sccm-quiz-set-02/) This SCCM quiz includes multiple choice questions to help you enhance your SCCM knowledge. You… [![Quiz slide with the title 'SCCM (ConfigMgr) Quiz' and a blue illustration of a computer monitor and server stacks on the left.](https://techuisitive.com/wp-content/uploads/2023/04/SCCM-Quiz-1-1024x538.jpg) ](https://techuisitive.com/configuration-manager-sccm-quiz-01/) #### [Configuration Manager | SCCM Quiz – Set 01](https://techuisitive.com/configuration-manager-sccm-quiz-01/) This SCCM quiz includes multiple choice questions to help you enhance your SCCM knowledge. You… ## Endpoint Administrator Associate (MD-102) Test your understanding of the MD-102 exam topics through interactive quizzes designed to strengthen your knowledge and boost your exam confidence. [![Illustration of a person adjusting a tech dashboard with gears, next to the title 'Endpoint Administrator Associate (MD-102) Quiz'.](https://techuisitive.com/wp-content/uploads/2021/04/MD-102-Quiz-1024x538.jpg) ](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) #### [Endpoint Administrator Associate: MD-102 Quiz – Set 02](https://techuisitive.com/modern-device-management-md-101-quiz-set-02/) This modern device management quiz includes multiple-choice questions to help you enhance your knowledge about… [![Illustration of a person adjusting a tech dashboard with gears, next to the title 'Endpoint Administrator Associate (MD-102) Quiz'.](https://techuisitive.com/wp-content/uploads/2021/04/MD-102-Quiz-1024x538.jpg) ](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) #### [Endpoint Administrator Associate: MD-102 Quiz – Set 01](https://techuisitive.com/modern-desktop-management-md-101-quiz-set-01/) This Microsoft 365 Certified: Endpoint Administrator Associate (MD-102) quiz includes multiple-choice questions to help you… ## 📚 Continue Learning Choose a learning path based on your role or the topic you want to master. Each path brings together tutorials, troubleshooting guides, automation, quizzes, and related resources. [](https://techuisitive.com/microsoft-intune/)### Microsoft Intune Master Microsoft Intune device configuration with step-by-step practical guides. [](https://techuisitive.com/autopilot/)### Windows Autopilot Expand your Windows Autopilot knowledge with practical tutorials, guides, and real-world solutions. [](https://techuisitive.com/device-configurations/)### Device Configuration Configure and manage Windows devices with practical Microsoft Intune policy guides. [](https://techuisitive.com/application-management/)### App Deployment Master application deployment with step-by-step guides for Win32, Microsoft Store, and LOB apps. [](https://techuisitive.com/automation/)### Automation Master Microsoft Intune automation with practical guides to PowerShell and Microsoft Graph. [](https://techuisitive.com/sccm/)### ConfigMgr | SCCM Learn how to deploy, manage, and maintain Windows devices using Configuration Manager (SCCM). --- ### [Automation](https://techuisitive.com/automation/) **Published:** July 17, 2026 **Author:** Equebal Ahmad **Content:** ## Automation #### PowerShell, Microsoft Graph API & IT Automation Automate Microsoft Intune and modern endpoint management using PowerShell, Microsoft Graph API, and practical automation solutions. Learn how to streamline administration, generate reports, deploy applications, and eliminate repetitive tasks. ✅ PowerShell Automation ✅ Microsoft Graph API ✅ Automated Reporting ✅ Intune Administration Scripts ![Intune Automation](https://techuisitive.com/wp-content/uploads/2026/07/3254-1-1024x804.jpg) Table Of Contents 1. [Automation](#automation) 2. [🚀Featured Automation](#featured-automation) 3. [💻PowerShell & Graph API](#powershell-graph-api) 4. [🖥️Device Management Scripts](#device-management-scripts) 5. [📚 Continue Learning](#continue-learning) ## 🚀Featured Automation Save time and simplify repetitive administrative tasks with ready-to-use PowerShell and Microsoft Graph API automation scripts. Whether you’re managing Microsoft Intune, Microsoft Entra ID, Active Directory, or Windows devices, these featured automations help you perform common tasks more efficiently, reduce manual effort, and improve consistency across your environment. [![Intune-Remediate-Script-Creation](https://techuisitive.com/wp-content/uploads/2026/04/Intune-Remediate-Script-Creation-1024x538.jpg) ](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) #### [Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) The remediation scripts in Microsoft Intune are a powerful way to remediate issues. We can… [![Illustration of a person at a laptop with gears, accompanying the title about Bulk Win32 App Upload to Intune Using Graph API.](https://techuisitive.com/wp-content/uploads/2026/05/App-Deployment-1-1024x538.jpg) ](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) #### [Bulk Upload Win32 Apps to Intune With PowerShell and Microsoft Graph API](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) Bulk uploading Win32 applications to Microsoft Intune can become time-consuming when you need to package… [![Illustration of a person at a laptop with charts and gears beside the title 'Automating Intune Reports Using PowerShell & Graph API'](https://techuisitive.com/wp-content/uploads/2026/06/Automate-Intune-reports-1024x538.jpg) ](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/) #### [Automating Intune Reports Using PowerShell and Microsoft Graph API](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/) Managing Microsoft Intune environments often requires administrators to export reports regularly for compliance checks, device… ## 💻PowerShell & Graph API Explore practical PowerShell and Microsoft Graph API scripts designed to automate everyday administrative tasks. From Microsoft Intune and Microsoft Entra ID to Microsoft 365, these scripts help you simplify management, eliminate repetitive work, and improve operational efficiency with ready-to-use automation. [![Banner illustration of a person using a laptop with charts and gears, caption reads 'Bulk Add Devices to Entra ID Group' on the right.](https://techuisitive.com/wp-content/uploads/2025/06/Bulk-Add-Devices-to-Entra-Group-1024x538.jpg) ](https://techuisitive.com/powershell-script-add-device-to-entra-id-group-from-csv-file/) #### [Bulk Add Devices to Entra ID Group from CSV File](https://techuisitive.com/powershell-script-add-device-to-entra-id-group-from-csv-file/) This PowerShell script adds devices to an Entra ID group via a CSV file, streamlining… [![Intune-Remediate-Script-Creation](https://techuisitive.com/wp-content/uploads/2026/04/Intune-Remediate-Script-Creation-1024x538.jpg) ](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) #### [Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) The remediation scripts in Microsoft Intune are a powerful way to remediate issues. We can… [![Automation banner illustrating bulk sync of Intune devices using PowerShell and Graph API; a person stands beside a laptop with charts on the screen.](https://techuisitive.com/wp-content/uploads/2026/01/Bulk-Sync-Devices-1024x538.jpg) ](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/) #### [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/) If you want a reliable, scalable way to trigger device sync across your Intune fleet,… [![Illustration of a person beside a laptop and a robotic arm, symbolizing bulk export of Entra ID group members.](https://techuisitive.com/wp-content/uploads/2026/01/Entra-ID-Group-Members-1024x538.jpg) ](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) #### [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) Exporting Azure AD group members at scale is a common need for IT administrators, whether… [![Illustration of a person at a laptop with gears, accompanying the title about Bulk Win32 App Upload to Intune Using Graph API.](https://techuisitive.com/wp-content/uploads/2026/05/App-Deployment-1-1024x538.jpg) ](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) #### [Bulk Upload Win32 Apps to Intune With PowerShell and Microsoft Graph API](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) Bulk uploading Win32 applications to Microsoft Intune can become time-consuming when you need to package… [![Illustration of a person at a laptop with charts and gears beside the title 'Automating Intune Reports Using PowerShell & Graph API'](https://techuisitive.com/wp-content/uploads/2026/06/Automate-Intune-reports-1024x538.jpg) ](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/) #### [Automating Intune Reports Using PowerShell and Microsoft Graph API](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/) Managing Microsoft Intune environments often requires administrators to export reports regularly for compliance checks, device… ## 🖥️Device Management Scripts Discover practical PowerShell scripts for everyday device management tasks. Whether you’re administering Windows devices, Active Directory, Group Policy, or system configurations, these ready-to-use scripts help automate repetitive tasks, simplify administration, and improve efficiency. [![Banner illustration: laptop with code, magnifying glass, and warning icon, labeled 'Automation' for a PowerShell bulk AD group script](https://techuisitive.com/wp-content/uploads/2017/04/Powershell-Script-to-Add-Bulk-Users-Computers-to-AD-Group-1024x538.jpg) ](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) #### [Powershell Script to Add Bulk Users / Computers to AD Group](https://techuisitive.com/powershell-script-to-add-bulk-users-computers-to-ad-group/) Managing Active Directory (AD) groups manually can be tedious and error‑prone, especially when dealing with… [![Automation banner showing a laptop with code and a magnifying glass, plus a warning icon, next to the heading 'PowerShell Validate Computer in AD'](https://techuisitive.com/wp-content/uploads/2020/09/PowerShell-Verify-Computer-in-Active-Directory-_20260725_230842_0000-1024x538.jpg) ](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) #### [PowerShell Script: Validate if a computer account exists in Active Directory](https://techuisitive.com/powershell-script-validate-if-computer-account-exists-in-active-directory/) The script below will let you quickly validate whether given computers exist in Active Directory…. [![Illustration showing code on a laptop screen with a magnifying glass beside the heading 'PowerShell Copy AD Group Membership' and an 'Automation' badge in the corner.](https://techuisitive.com/wp-content/uploads/2020/09/PowerShell-Copy-AD-Group-Members-_20260725_230320_0000-1024x538.jpg) ](https://techuisitive.com/powershell-script-copy-ad-group-membership/) #### [PowerShell Script: Copy AD Group Membership](https://techuisitive.com/powershell-script-copy-ad-group-membership/) This PowerShell script copies all members from a source Active Directory group to a target… [![Automation banner with a laptop illustration: code window, magnifying glass, and a warning icon leading to the 'PowerShell Get AD Computers' heading on the right.](https://techuisitive.com/wp-content/uploads/2020/09/PowerShell-AD-Computers_20260725_225808_0000-1024x538.jpg) ](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) #### [Powershell Script to Retrieve AD Computers Properties](https://techuisitive.com/powershell-script-to-retrieve-ad-computers-properties/) \# Retrieve Active Directory computer properties such as LastLogonDate. # The list of machine need… [![Laptop-like illustration with code and a magnifying glass; heading reads 'PowerShell Get AD OU and Linked GPO' (Automation badge in corner).](https://techuisitive.com/wp-content/uploads/2020/09/PowerShell-OU-and-GPO_20260725_232227_0000-1024x538.jpg) ](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) #### [PowerShell Script to List AD OU and GPOs linked to them](https://techuisitive.com/powershell-script-list-ad-organizational-unit-and-gpos-linked-to-them/) This PowerShell script searches Active Directory for all Organizational Units (OUs) whose names contain a… ## 📚 Continue Learning Choose a learning path based on your role or the topic you want to master. Each path brings together tutorials, troubleshooting guides, automation, quizzes, and related resources. [](https://techuisitive.com/application-management/)### App Deployment Master application deployment with step-by-step guides for Win32, Microsoft Store, and LOB apps. [](https://techuisitive.com/autopilot/)### Windows Autopilot Expand your Windows Autopilot knowledge with practical tutorials, guides, and real-world solutions. [](https://techuisitive.com/device-configurations/)### Device Configuration Configure and manage Windows devices with practical Microsoft Intune policy guides. [](https://techuisitive.com/sccm/)### SCCM (ConfigMgr) Learn how to deploy, manage, and maintain Windows devices using Configuration Manager (SCCM). [](https://techuisitive.com/microsoft-intune/)### Microsoft Intune Master Microsoft Intune device configuration with step-by-step practical guides. [](https://techuisitive.com/microsoft-windows/)### Windows 10/11 Learn Windows deployment, updates, troubleshooting, and essential management. --- ### [Microsoft Windows](https://techuisitive.com/microsoft-windows/) **Published:** August 1, 2026 **Author:** Equebal Ahmad **Content:** ## Windows 10/11 #### Windows Administration, Updates & Troubleshooting Master Windows 10 and Windows 11 with practical guides covering OS features, version updates, troubleshooting, deployment, and device management. Learn how to maintain secure, reliable, and up-to-date Windows devices in both enterprise and personal environments. ✅ Windows Features & Administration ✅ Build Version & Release Information ✅ Windows Update & Servicing ✅ Troubleshooting & Error Resolution ![Windows 10/11 Guides](https://techuisitive.com/wp-content/uploads/2026/08/Microsoft-Windows-Feature-image-1024x1024.jpeg) Table Of Contents 1. [Windows 10/11](#windows-1011) 2. [🪟 Windows 10/11 Guides](#windows-1011-guides) 3. [🪟 Windows Administration Basics](#windows-administration-basics) 4. [🔧Windows 10/11 Troubleshooting](#windows-1011-troubleshooting) 5. [📚 Continue Learning](#continue-learning) ## 🪟 Windows 10/11 Guides Explore practical Windows 10 and Windows 11 guides covering updates, system configuration, built-in features, administration, and everyday management. Whether you’re an IT administrator or an advanced user, these step-by-step tutorials help you deploy, manage, and troubleshoot Windows with confidence. [![Illustration of a laptop displaying code with a magnifying glass over the code, a Windows 10/11 label in the corner, and the heading 'Using PowerShell Behind a Proxy Server' on the right.](https://techuisitive.com/wp-content/uploads/2022/09/Using-PowerShell-behind-a-Proxy-1024x538.jpg) ](https://techuisitive.com/using-powershell-behind-a-proxy-server/) #### [Using PowerShell Behind a Proxy Server](https://techuisitive.com/using-powershell-behind-a-proxy-server/) If your computer is on a corporate network behind a proxy server, by default you… [![Laptop with code on screen and a magnifying glass, next to a Windows 10/11 badge, accompanying the headline 'Compare Hardware and Software Details Between Two Computers'.](https://techuisitive.com/wp-content/uploads/2021/02/Compare-hardware-and-software-details-on-two-computers-1-1024x538.jpg) ](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) #### [Compare Hardware and Software Details Between Two Computers Using PowerShell](https://techuisitive.com/powershell-compare-hardware-and-software-details-on-two-computers/) This tool allows you to quickly compare the hardware configuration, installed software, and software updates… [![Laptop illustration with a browser window and search icon, placed beside the title 'How to Reset Windows 11 PC to Factory Settings'.](https://techuisitive.com/wp-content/uploads/2024/08/Reset-Windows-1011-1024x538.jpg) ](https://techuisitive.com/how-to-reset-windows-11-pc-to-factory-settings/) #### [How to Reset a Windows 11 PC to Factory Settings](https://techuisitive.com/how-to-reset-windows-11-pc-to-factory-settings/) A factory reset in Windows 11 restores the computer to its original factory settings, removing… [![Laptop illustration with a browser window and search icon, next to the bold title 'Windows 10 & Windows 11 Build Version Guide' on the right.](https://techuisitive.com/wp-content/uploads/2022/12/Windows-1011-Guides-1024x538.jpg) ](https://techuisitive.com/windows-10-11-operating-system-build-versions/) #### [How to Check Windows Build Version | OS Version | Release Information](https://techuisitive.com/windows-10-11-operating-system-build-versions/) Knowing your Windows 10 or Windows 11 build version is essential for troubleshooting, upgrade planning,… ## 🪟 Windows Administration Basics Explore practical Windows 10 and Windows 11 guides covering updates, system configuration, built-in features, administration, and everyday management. Whether you’re an IT administrator or an advanced user, these step-by-step tutorials help you deploy, manage, and troubleshoot Windows with confidence. [![Laptop with a browser window and search bar, Windows 10/11 badge in the corner, beside the page title: 'Windows Administrator Basics: Understanding Windows Registry'](https://techuisitive.com/wp-content/uploads/0202/10/Windows-Admin-Basics-1024x538.jpg) ](https://techuisitive.com/windows-administrator-basics-windows-registry/) #### [Windows Administrator Basics: Windows Registry](https://techuisitive.com/windows-administrator-basics-windows-registry/) The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows… [![Header image for Windows Administrator Basics: Managing Windows Services, showing a laptop with a search bar and a Windows 10/11 badge.](https://techuisitive.com/wp-content/uploads/2018/04/Windows-Admin-Basics-1-1024x538.jpg) ](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) #### [Windows Administrator Basics: Managing Services from Command Line](https://techuisitive.com/windows-administrator-basics-managing-services-from-command-line/) This is the second article for Windows Services. You can access previous article Windows Services… [![Header image for Windows Administrator Basics: Managing Windows Services, showing a laptop with a search bar and a Windows 10/11 badge.](https://techuisitive.com/wp-content/uploads/2018/04/Windows-Admin-Basics-1-1024x538.jpg) ](https://techuisitive.com/windows-administrator-basics-windows-services/) #### [Windows Administrator Basics: Windows Services](https://techuisitive.com/windows-administrator-basics-windows-services/) What is Windows Services A Windows Service is a computer program that operates in the… [![Header image for Windows Administrator Basics: Managing Windows Services, showing a laptop with a search bar and a Windows 10/11 badge.](https://techuisitive.com/wp-content/uploads/2018/04/Windows-Admin-Basics-1-1024x538.jpg) ](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) #### [Windows Administrator Basics: Managing Windows Services from PowerShell](https://techuisitive.com/windows-administrator-basics-managing-windows-services-from-powershell/) This is the third post for Windows services. You can access previous posts using below… [![Illustration of a laptop with a browser window and circular tech accents, plus a Windows 10/11 badge; title: Create a virtual drive with SUBST command.](https://techuisitive.com/wp-content/uploads/2017/12/Windows-Admin-Basics-2-1024x538.jpg) ](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/) #### [Windows 10 /11: Create a virtual drive with the SUBST command](https://techuisitive.com/windows-10-create-a-virtual-drive-with-subst-command/) SUBST is a command in the Microsoft Windows operating system. This command can be used… ## 🔧Windows 10/11 Troubleshooting Resolve common Windows 10 and Windows 11 issues with practical troubleshooting guides and step-by-step fixes. From update failures and installation errors to performance problems and system configuration issues, find proven solutions to get your Windows devices running smoothly. [![Troubleshooting banner with a laptop and browser window; headline: 'Fix WinRM cannot complete the operation in PowerShell'.](https://techuisitive.com/wp-content/uploads/2023/06/Fix-WinRM-cannot-complete-the-operation-1024x538.jpg) ](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) #### [PowerShell Remote – WinRM cannot complete the operation](https://techuisitive.com/powershell-remote-winrm-cannot-complete-the-operation/) Enter-PSSession : Connecting to remote server failed with the following error message : WinRM cannot… [![Windows recovery environment](https://techuisitive.com/wp-content/uploads/2024/09/Windows-recovery-environment-error-1024x538.jpg) ](https://techuisitive.com/windows-reset-could-not-find-the-recovery-environment-error/) #### [How to Fix “Could Not Find the Recovery Environment” Error During Windows Reset](https://techuisitive.com/windows-reset-could-not-find-the-recovery-environment-error/) Windows Recovery Environment (WinRE) is a recovery environment that can repair common causes of unbootable… ## 📚 Continue Learning Choose a learning path based on your role or the topic you want to master. Each path brings together tutorials, troubleshooting guides, automation, quizzes, and related resources. [](https://techuisitive.com/application-management/)### App Deployment Master application deployment with step-by-step guides for Win32, Microsoft Store, and LOB apps. [](https://techuisitive.com/autopilot/)### Windows Autopilot Expand your Windows Autopilot knowledge with practical tutorials, guides, and real-world solutions. [](https://techuisitive.com/device-configurations/)### Device Configuration Configure and manage Windows devices with practical Microsoft Intune policy guides. [](https://techuisitive.com/sccm/)### SCCM (ConfigMgr) Learn how to deploy, manage, and maintain Windows devices using Configuration Manager (SCCM). [](https://techuisitive.com/microsoft-intune/)### Microsoft Intune Master Microsoft Intune device configuration with step-by-step practical guides. [](https://techuisitive.com/automation/)### Automation Master Microsoft Intune automation with practice guides to PowerShell and Microsoft Graph. --- ### [Device Configurations](https://techuisitive.com/device-configurations/) **Published:** July 22, 2026 **Author:** Equebal Ahmad **Content:** ## Device Configurations #### Configure, Secure & Standardize Devices Learn how to configure Windows devices using Microsoft Intune. Explore step-by-step guides for configuration profiles, administrative templates, device restrictions, settings catalog, custom policies, and best practices to deliver a consistent, secure, and productive user experience. ✅ Configuration Profiles ✅ Settings Catalog and Administrative Templates ✅ Device Restriction & Policies ✅ Configuration Troubleshooting ![Device configuration](https://techuisitive.com/wp-content/uploads/2026/07/Device-Configurations-1024x1024.jpg) Table Of Contents 1. [Device Configurations](#device-configurations) 2. [🚀Getting Started](#getting-started) 3. [🌐Browser Configuration](#browser-configuration) 4. [💻Device Experience](#device-experience) 5. [🚫Device Restrictions](#device-restrictions) 6. [👤User Experience](#user-experience) 7. [🛠️ Device Settings](#device-settings) 8. [🔒Security](#security) 9. [Device Updates](#device-updates) 10. [🔧Common Device Configuration Errors & Solutions](#common-device-configuration-errors-solutions) 11. [📚 Continue Learning](#continue-learning) ## 🚀Getting Started New to Microsoft Intune device configuration? Start here to learn the fundamentals of configuring Windows devices, creating and assigning policies, and understanding how different configuration options work together. These beginner-friendly guides provide the foundation you need before exploring advanced settings and deployment scenarios. [![Illustration of a technician beside a laptop showing a gear and 75% installing progress, with a cloud download icon and the heading 'Understanding Windows Autopatch with Intune'](https://techuisitive.com/wp-content/uploads/2025/06/Windows-Autopatch-1024x538.jpg) ](https://techuisitive.com/understanding-windows-autopatch-with-intune/) #### [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) In today’s fast‑moving digital world, keeping devices secure and updated is critical. But manually patching… [![Illustration of a person adjusting computer settings with gears beside the text 'Microsoft Intune Manage Desktop Wallpaper' on a white background, representing configuration.](https://techuisitive.com/wp-content/uploads/2021/10/Desktop-Wallpaper-1024x538.jpg) ](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) #### [Manage Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) On Windows 10 and Windows 11 desktops, the wallpaper (background) is the image displayed behind… [![Hero illustration showing a person adjusting settings with gears and a browser window, conveying configuring Edge favorites with Intune, text on right reads ‘Manage Microsoft Edge Favorites with Intune’.](https://techuisitive.com/wp-content/uploads/2021/09/Edge-favorites-_20260725_235543_0000-1024x538.jpg) ](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) #### [Manage Microsoft Edge Favorites with Intune for Windows 10/11](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) Managing browser favorites may seem minor, but for IT administrators, it’s a powerful way to… ## 🌐Browser Configuration Configure and manage enterprise browsers with Microsoft Intune using step-by-step guides for Microsoft Edge, Google Chrome, Mozilla Firefox, and other supported browsers. Learn how to deploy browser policies, secure web access, enforce organizational standards, and troubleshoot common configuration issues to deliver a consistent and secure browsing experience across your managed devices. [![Illustration of a person adjusting software settings with gears on a computer screen, accompanying the title “Enable Single Sign On in Google Chrome.”](https://techuisitive.com/wp-content/uploads/2026/03/Chrome-SSO_20260723_000953_0000-1024x538.png) ](https://techuisitive.com/enabling-azure-single-sign-on-in-google-chrome-with-intune-dont-miss-this-key-setting/) #### [Enabling Azure Single Sign-On in Google Chrome with Intune: Don’t Miss This Key Setting](https://techuisitive.com/enabling-azure-single-sign-on-in-google-chrome-with-intune-dont-miss-this-key-setting/) Seamless sign-on is one of the biggest productivity wins for IT admins. If your users… [![Illustration of a person configuring a large computer window with gears, a small user icon, and a 'Configuration' badge; title reads 'Allow Copilot in Microsoft Edge Using Intune'](https://techuisitive.com/wp-content/uploads/2026/02/Copilot-in-Edge-1024x538.jpg) ](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/) #### [How to Allow Copilot in Microsoft Edge Using Intune](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/) Microsoft Edge now includes Copilot, an AI assistant that helps people work smarter by giving… [![Configuration badge and an illustration of a tablet, phone, and cloud, with the heading 'iOS - Restrict Website Access Using Web Content Filter'.](https://techuisitive.com/wp-content/uploads/2024/01/ios-Restrict-Website-Access-Using-Web-Content-Filter-1024x538.jpg) ](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/) #### [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/) The Apple Web Content Filter settings can be used to allow / restrict the website… [![Illustration of a person configuring settings on a large screen with gears; page title reads 'Manage Chrome Settings Using Administrative Templates' with an orange 'Configuration' badge.](https://techuisitive.com/wp-content/uploads/2022/08/Chrome-Settings-_20260723_004716_0000-1024x538.png) ](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) #### [How to Configure Google Chrome settings using Administrative templates | Intune](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) Managing browser settings across an enterprise can be challenging, especially when relying on custom OMA-URI… [![Illustration of a person adjusting settings on a large computer screen with gears, beside the text 'Configure Microsoft Edge Sleeping Tab'.](https://techuisitive.com/wp-content/uploads/2022/06/Edge-sleeping-tab_20260723_005515_0000-1024x538.png) ](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) #### [Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) Microsoft Edge’s Sleeping Tabs feature is a smart way to optimize browser performance by reducing… [![Hero illustration showing a person adjusting settings with gears and a browser window, conveying configuring Edge favorites with Intune, text on right reads ‘Manage Microsoft Edge Favorites with Intune’.](https://techuisitive.com/wp-content/uploads/2021/09/Edge-favorites-_20260725_235543_0000-1024x538.jpg) ](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) #### [Manage Microsoft Edge Favorites with Intune for Windows 10/11](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) Managing browser favorites may seem minor, but for IT administrators, it’s a powerful way to… [![Illustration of a person configuring a webpage with gears on computer screens beside the article title.](https://techuisitive.com/wp-content/uploads/2021/09/Configure-Edge-Home-Page-1-1024x538.jpg) ](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) #### [Configure Edge Homepage & Startup Page Using Intune Administrative Templates](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) Microsoft Endpoint Manager (Intune) Device Configuration profiles allow you to add and configure settings, and… ## 💻Device Experience looks and behaves for users. Learn how to configure the desktop, Start menu, taskbar, lock screen, notifications, Windows Spotlight, widgets, and other user-facing features to create a consistent, secure, and productive experience across your organization’s devices. [![Illustration of a person configuring software on a large screen with gears; page title 'Disable Copilot via Intune Settings Catalog'](https://techuisitive.com/wp-content/uploads/2025/12/Disable-Copilot-1024x538.jpg) ](https://techuisitive.com/disable-copilot-via-intune-settings-catalog/) #### [How to Disable Copilot via Intune Settings Catalog](https://techuisitive.com/disable-copilot-via-intune-settings-catalog/) Microsoft introduced Copilot with Windows 11. Copilot is a built‑in AI assistant that helps boost… [![](https://techuisitive.com/wp-content/uploads/2024/07/ios-Block-built-in-apps-1024x538.jpg) ](https://techuisitive.com/how-to-block-built-in-apps-on-ios-using-intune/) #### [How to Block Built-in Apps on iOS Using Intune](https://techuisitive.com/how-to-block-built-in-apps-on-ios-using-intune/) Microsoft Intune includes built-in settings to configure different Apple features on iOS and iPadOS devices. One… [![Orange 'Configuration' tag with a tech-device illustration (tablet, phone, cloud) representing device enrollment in Intune; title reads 'iOS – Create Automated Device Enrollment Profile in Intune'](https://techuisitive.com/wp-content/uploads/2024/03/iOS-ADE-Enrollment-Profile-1024x538.jpg) ](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) #### [Create ADE Enrollment Profile in Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) The corporate-owned devices purchased through Apple Business Manager or Apple School Manager can be enrolled… [![Illustration of a person adjusting computer settings with gears beside the text 'Microsoft Intune Manage Desktop Wallpaper' on a white background, representing configuration.](https://techuisitive.com/wp-content/uploads/2021/10/Desktop-Wallpaper-1024x538.jpg) ](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) #### [Manage Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) On Windows 10 and Windows 11 desktops, the wallpaper (background) is the image displayed behind… ## 🚫Device Restrictions The **Device Restrictions** section covers Microsoft Intune policies that control device capabilities and enforce organizational security standards. Learn how to configure settings that restrict hardware, operating system features, privacy options, Microsoft Store access, removable storage, and other device behaviors to help secure and standardize Windows devices across your organization. [![Deny write access USB](https://techuisitive.com/wp-content/uploads/2022/05/Deny-Write-Access-to-USB-1024x538.jpg) ](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) #### [Deny Write Access to USB Devices Using Intune Settings Catalog](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) USB devices are convenient for transferring files, but they pose a significant data security risk… ## 👤User Experience Ensure devices meet your organization’s security and compliance requirements with Microsoft Intune. Learn how to create compliance policies, evaluate device health, enforce Conditional Access, and maintain a secure endpoint environment. [![Hero illustration showing a person configuring a computer screen with gears; banner reads 'Configure Intune Shared Multi User Device'](https://techuisitive.com/wp-content/uploads/2025/04/Configure-Intune-Shared-Multi-User-Device-1024x538.jpg) ](https://techuisitive.com/how-to-configure-intune-shared-multi-user-device/) #### [How to Configure Intune Shared Multi User Device](https://techuisitive.com/how-to-configure-intune-shared-multi-user-device/) Managing Windows devices in environments like schools, libraries, or retail stores often requires a secure,… [![Configuration badge with illustration of tablet, phone and cloud; header: 'iOS - Configure iOS Lock Screen Message through Intune'.](https://techuisitive.com/wp-content/uploads/2024/05/Configure-iOS-Lock-Screen-Message-through-Intune-1024x538.jpg) ](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) #### [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) Microsoft Intune includes some built-in settings to configure different Apple features on iOS/iPadOS devices. One such… [![Illustration of a tablet, phone, and cloud with a gear icon beside the heading about configuring iOS apps via Intune (Configuration badge in top-left).](https://techuisitive.com/wp-content/uploads/2024/02/ios-Show-or-Hide-Native-Apps-on-iOS-via-Intune-1024x538.jpg) ](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) #### [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) Microsoft Intune includes some built-in settings to configure different Apple features on iOS/iPadOS devices. One of… [![Illustration of a tablet, phone, gear and cloud icons beside the article title: 'iOS - Configure Home Screen Layout on iOS using Intune'](https://techuisitive.com/wp-content/uploads/2024/02/iOS-Home-Screen-Layout-1024x538.jpg) ](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/) #### [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/) Microsoft Intune includes some built-in settings to configure different Apple features on iOS/iPadOS devices. One… [![Illustration of a person configuring a Windows kiosk in Microsoft Intune with gears and screens; a 'Configuration' badge in the top-left.](https://techuisitive.com/wp-content/uploads/2023/01/Windows-Kiosk-1024x538.jpg) ](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) #### [How to Configure Windows Kiosk Using Microsoft Intune | Windows 10 / 11](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) Windows kiosk is a lockdown mechanism to restrict device access to pre-defined applications. The applications… ## 🛠️ Device Settings Configure and customize Windows devices with Microsoft Intune device settings. Explore guides for Settings Catalog, Administrative Templates, Custom OMA-URI, Property Catalog, and other configuration options to standardize device behavior and simplify management. [![Intune Device Inventory](https://techuisitive.com/wp-content/uploads/2025/03/Device-Inventory-1-1024x538.jpg) ](https://techuisitive.com/collect-device-inventory-using-intune-properties-catalog/) #### [Collect Device Inventory Using Intune Properties Catalog](https://techuisitive.com/collect-device-inventory-using-intune-properties-catalog/) Managing devices effectively requires accurate and detailed inventory data. Microsoft Intune makes this easier with… ## 🔒Security Proactively identify and resolve device issues with Microsoft Intune Remediations. Learn how to create detection and remediation scripts, automate common fixes, and improve device health and user experience across your organization. [![Illustration of a person configuring a computer interface with gears beside the title 'Manage Local Administrators with Microsoft Intune'.](https://techuisitive.com/wp-content/uploads/2023/07/Manage-Local-Admin-Account-1024x538.jpg) ](https://techuisitive.com/how-to-manage-the-local-administrators-group-on-azure-ad-joined-devices-intune/) #### [How to Manage Local Administrators Group Membership on Microsoft Entra Joined Devices Using Intune](https://techuisitive.com/how-to-manage-the-local-administrators-group-on-azure-ad-joined-devices-intune/) Starting with Windows 10 version 20H2, you can use Azure AD groups to manage local… [![Windows LAPs](https://techuisitive.com/wp-content/uploads/2023/07/Windows-LAPS-1024x538.jpg) ](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) #### [How to Manage Windows LAPS with Intune](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) Windows LAPS (Local Administrator Password Solution) is now built directly into Windows and does not… ## Device Updates Proactively identify and resolve device issues with Microsoft Intune Remediations. Learn how to create detection and remediation scripts, automate common fixes, and improve device health and user experience across your organization. [![Illustration of a technician beside a laptop showing a gear and 75% installing progress, with a cloud download icon and the heading 'Understanding Windows Autopatch with Intune'](https://techuisitive.com/wp-content/uploads/2025/06/Windows-Autopatch-1024x538.jpg) ](https://techuisitive.com/understanding-windows-autopatch-with-intune/) #### [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) In today’s fast‑moving digital world, keeping devices secure and updated is critical. But manually patching… [![Person stands beside a laptop with a large gear and 75% progress, symbolizing driver updates with Intune.](https://techuisitive.com/wp-content/uploads/2025/04/Drivers-Updates-_20260726_110912_0000-1024x538.jpg) ](https://techuisitive.com/manage-windows-drivers-update-with-intune/) #### [Manage Windows Drivers Update with Intune](https://techuisitive.com/manage-windows-drivers-update-with-intune/) Windows Driver Update Management in Microsoft Intune allows you to manage the drivers for Windows… [![Illustration of tablet, phone, gear, and cloud with an orange Configuration badge next to the title about iOS updates on supervised devices.](https://techuisitive.com/wp-content/uploads/2024/03/Intune-Manage-iOS-Updates-1024x538.jpg) ](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) #### [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) Microsoft Intune has built-in policies that can manage software updates on iOS/iPadOS supervised devices. It’s… ## 🔧Common Device Configuration Errors & Solutions Resolve common Microsoft Intune device configuration issues with practical troubleshooting guides. Learn how to diagnose deployment failures, enrollment problems, application errors, and configuration issues using proven solutions and best practices. [![Illustration of a person beside a laptop showing a gear and 75% progress, with the headline 'Monitor and Troubleshoot Windows Autopatch' on the right and an 'Updates' badge in the corner.](https://techuisitive.com/wp-content/uploads/2025/07/Monitor-and-Troubleshoot-Windows-Autopatch-1024x538.jpg) ](https://techuisitive.com/how-to-monitor-and-troubleshoot-windows-autopatch-issues/) #### [How to Monitor and Troubleshoot Windows Autopatch Issues](https://techuisitive.com/how-to-monitor-and-troubleshoot-windows-autopatch-issues/) Windows Autopatch is a cloud-based service built into Microsoft Intune that automates the deployment of… [![Illustration of a person with a large gear on a laptop screen showing 75%Installing, next to a blue cloud download icon; header reads 'Fix Incorrect Driver Update Status in Intune'.](https://techuisitive.com/wp-content/uploads/2025/05/Drivers-Updates-1024x538.jpg) ](https://techuisitive.com/intune-driver-update-device-not-reporting-correct-status/) #### [Fix Incorrect Driver Update Status in Intune](https://techuisitive.com/intune-driver-update-device-not-reporting-correct-status/) Microsoft Intune Driver Update Management streamlines how IT admins deploy and monitor Windows driver updates…. [![Troubleshooting banner with the title 'Fix BitLocker Encryption Method Mismatch' and a person adjusting settings on a computer.](https://techuisitive.com/wp-content/uploads/2025/01/BitLocker-Encryption-1024x538.jpg) ](https://techuisitive.com/bitlocker-the-encryption-method-of-the-os-volume-doesnt-match-the-bitlocker-policy/) #### [BitLocker : The encryption method of the OS volume doesn’t match the BitLocker policy](https://techuisitive.com/bitlocker-the-encryption-method-of-the-os-volume-doesnt-match-the-bitlocker-policy/) We identified a BitLocker encryption issue impacting Windows 10 and Windows 11 devices managed through… ## 📚 Continue Learning Choose a learning path based on your role or the topic you want to master. Each path brings together tutorials, troubleshooting guides, automation, quizzes, and related resources. [](https://techuisitive.com/application-management/)### App Deployment Master application deployment with step-by-step guides for Win32, Microsoft Store, and LOB apps. [](https://techuisitive.com/autopilot/)### Windows Autopilot Expand your Windows Autopilot knowledge with practical tutorials, guides, and real-world solutions. [](https://techuisitive.com/device-configurations/)### Device Configuration Configure and manage Windows devices with practical Microsoft Intune policy guides. [](https://techuisitive.com/sccm/)### ConfigMgr | SCCM Learn how to deploy, manage, and maintain Windows devices using Configuration Manager (SCCM). [](https://techuisitive.com/automation/)### Automation Master Microsoft Intune automation with practical guides to PowerShell and Microsoft Graph. [](https://techuisitive.com/microsoft-windows/)### Windows 10/11 Learn Windows deployment, updates, troubleshooting, and essential management. --- ### [Windows Autopilot](https://techuisitive.com/autopilot/) **Published:** July 9, 2026 **Author:** Equebal Ahmad **Content:** ## Windows Autopilot #### Complete Guides, Troubleshooting & Deployment Learn how to deploy, configure, troubleshoot, and automate Windows Autopilot using Microsoft Intune. Explore step-by-step guides, deployment best practices, PowerShell automation, and practical solutions to common Autopilot issues. ✅ Step-by-Step Tutorials ✅ Practical Troubleshooting ✅ PowerShell Automation ✅ Beginner-Friendly ![Windows Autopilot](https://techuisitive.com/wp-content/uploads/2026/07/Autopilot-2-1-1024x825.jpg) [Explore Guides](#getting-started) Table Of Contents 1. [Windows Autopilot](#windows-autopilot) 2. [🚀Getting Started](#getting-started) 3. [⚙️Deployment & Configuration](#deployment-configuration) 4. [🔧 Troubleshooting](#troubleshooting) 5. [📚 Continue Learning](#continue-learning) ## 🚀Getting Started New to Windows Autopilot? Start with these beginner-friendly guides to understand device provisioning, enrollment, and the core concepts of deploying Windows devices using Microsoft Intune. [![Laptop with blue cloud graphics on the left and the title 'Windows Autopilot Device Preparation v2' on the right.](https://techuisitive.com/wp-content/uploads/2024/11/Autopilot-Device-preparation-v2-1-1024x538.jpg) ](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) #### [Windows Autopilot Device Preparation aka Autopilot v2 Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) Windows Autopilot Device Preparation, also known as Autopilot v2, is Microsoft’s latest evolution in device… [![Laptop with blue cloud icons emerging from the screen, next to a bold headline about provisioning Windows 10/11 devices with Autopilot, and an Autopilot badge in the top-left corner.](https://techuisitive.com/wp-content/uploads/2022/03/Windows-Autopilot-1-1024x538.jpg) ](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) #### [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Windows Autopilot is a modern deployment solution from Microsoft that simplifies how IT teams provision,… [![Autopilot branding in top-left with a blue laptop and clouds illustration, and the title: Configure Enrollment Status Page (ESP) in Intune.](https://techuisitive.com/wp-content/uploads/2022/04/Enrollment-Status-Page-1-1024x538.jpg) ](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) #### [How to Configure Enrollment Status Page (ESP) in Microsoft Intune](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) The Enrollment Status Page (ESP) shows the progress of device provisioning when a new device… ## ⚙️Deployment & Configuration Learn how to configure Windows Autopilot for your organization, including Device Preparation, Enrollment Status Page (ESP), hardware hash collection, and deployment best practices. [![Laptop with blue cloud graphics on the left and the title 'Windows Autopilot Device Preparation v2' on the right.](https://techuisitive.com/wp-content/uploads/2024/11/Autopilot-Device-preparation-v2-1-1024x538.jpg) ](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) #### [Windows Autopilot Device Preparation aka Autopilot v2 Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) Windows Autopilot Device Preparation, also known as Autopilot v2, is Microsoft’s latest evolution in device… [![Illustration of a blue laptop with cloud icons, left; bold text 'Bulk Update Autopilot Group Tags' on the right.](https://techuisitive.com/wp-content/uploads/2024/09/Group-tag-update-1024x538.jpg) ](https://techuisitive.com/bulk-update-autopilot-group-tag-using-powershell/) #### [Bulk Update Autopilot Group Tag Using PowerShell](https://techuisitive.com/bulk-update-autopilot-group-tag-using-powershell/) Windows Autopilot group tags are used to categorize devices based on specific attributes. You can assign… [![Laptop with blue cloud illustration and the headline ‘Create an offline domain join configuration profile’ on a white background, with an Autopilot badge in the top-left corner.](https://techuisitive.com/wp-content/uploads/2024/08/Windows-Autopilot_20260725_235035_0000-1024x538.jpg) ](https://techuisitive.com/create-an-offline-domain-join-configuration-profile-in-intune/) #### [Create an offline domain join configuration profile in Intune](https://techuisitive.com/create-an-offline-domain-join-configuration-profile-in-intune/) The offline Domain join feature was introduced in Windows Server 2008 R2. A command line… [![Laptop with blue cloud icons emerging from the screen, beside the title 'Windows Autopilot Dynamic Group Creation' and an Autopilot badge in the top-left.](https://techuisitive.com/wp-content/uploads/2024/08/Entra-Group-1024x538.jpg) ](https://techuisitive.com/create-group-based-on-windows-autopilot-group-tag/) #### [Create Group Based on Windows Autopilot Group Tag](https://techuisitive.com/create-group-based-on-windows-autopilot-group-tag/) Windows Autopilot group tags make dynamic device management simple. By mapping group tags to Microsoft… [![](https://techuisitive.com/wp-content/uploads/2023/01/Hardware-Hash-1024x538.jpg) ](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) #### [Get Hardware Hash for Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/) To identify a device with Windows Autopilot, the device’s unique hardware identify (hardware hash) must… [![Laptop with blue cloud icons emerging from the screen, next to a bold headline about provisioning Windows 10/11 devices with Autopilot, and an Autopilot badge in the top-left corner.](https://techuisitive.com/wp-content/uploads/2022/03/Windows-Autopilot-1-1024x538.jpg) ](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) #### [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Windows Autopilot is a modern deployment solution from Microsoft that simplifies how IT teams provision,… [![Autopilot branding in top-left with a blue laptop and clouds illustration, and the title: Configure Enrollment Status Page (ESP) in Intune.](https://techuisitive.com/wp-content/uploads/2022/04/Enrollment-Status-Page-1-1024x538.jpg) ](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) #### [How to Configure Enrollment Status Page (ESP) in Microsoft Intune](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) The Enrollment Status Page (ESP) shows the progress of device provisioning when a new device… ## 🔧 Troubleshooting Resolve common Windows Autopilot issues with practical troubleshooting guides covering enrollment failures, provisioning errors, Windows Hello setup, and other deployment challenges. [![Laptop with blue cloud icons beside the text 'Fix Windows Hello Error 0x80090010' for troubleshooting.](https://techuisitive.com/wp-content/uploads/2026/04/Autopilot-Error-0x80090010-1-1024x538.jpg) ](https://techuisitive.com/fixing-windows-autopilot-error-0x80090010-during-windows-hello-setup/) #### [Fix Windows Hello for Business Error 0x80090010 During Autopilot](https://techuisitive.com/fixing-windows-autopilot-error-0x80090010-during-windows-hello-setup/) The Windows Autopilot Device Preparation streamlines the device provisioning. However, sometimes things don’t go as… [![Troubleshooting banner with a blue laptop and clouds; headline reads 'Fix Autopilot Device Preparation Error 8018003'](https://techuisitive.com/wp-content/uploads/2025/01/Autopilot-Error-80180003-1024x538.jpg) ](https://techuisitive.com/autopilot-device-preparation-error-80180003/) #### [How to Fix Autopilot Device Preparation Error 80180003](https://techuisitive.com/autopilot-device-preparation-error-80180003/) Windows Autopilot simplifies device deployment, but errors like Device Preparation Error 80180003 can disrupt enrollment…. [![Troubleshooting banner with a blue laptop and cloud graphic next to the text 'Fix Windows Autopilot error 80070002'.](https://techuisitive.com/wp-content/uploads/2024/07/Autopilot-error-80070002-1024x538.jpg) ](https://techuisitive.com/how-to-fix-autopilot-error-80070002/) #### [How to Fix Autopilot Error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/) Windows Autopilot Error 80070002 typically occurs during Hybrid Azure AD Join deployments when the Offline… ## 📚 Continue Learning Choose a learning path based on your role or the topic you want to master. Each path brings together tutorials, troubleshooting guides, automation, quizzes, and related resources. [](https://techuisitive.com/microsoft-intune/)### Microsoft Intune Master Microsoft Intune device configuration with step-by-step practical guides. [](https://techuisitive.com/application-management/)### App Deployment Master application deployment with step-by-step guides for Win32, Microsoft Store, and LOB apps. [](https://techuisitive.com/device-configurations/)### Device Configuration Configure and manage Windows devices with practical Microsoft Intune policy guides. [](https://techuisitive.com/sccm/)### ConfigMgr | SCCM Learn how to deploy, manage, and maintain Windows devices using Configuration Manager (SCCM). [](https://techuisitive.com/automation/)### Automation Master Microsoft Intune automation with practical guides to PowerShell and Microsoft Graph. [](https://techuisitive.com/microsoft-windows/)### Windows 10/11 Learn Windows deployment, updates, troubleshooting, and essential management. --- ### [Application Management](https://techuisitive.com/application-management/) **Published:** July 23, 2026 **Author:** Equebal Ahmad **Content:** ## Application Management #### Deploy, Manage & Troubleshoot Applications Learn how to package, deploy, update, and troubleshoot applications using Microsoft Intune. Explore step-by-step guides for Win32 apps, Microsoft Store apps, Microsoft 365 Apps, Line-of-Business (LOB) apps, and enterprise application deployment best practices. ✅ Win32 App Deployment ✅ Microsoft Store & Microsoft 365 Apps ✅ App Packaging & Configuration ✅ Deployment Troubleshooting ![Intune Application management ](https://techuisitive.com/wp-content/uploads/2026/07/App-Deployment-2.jpeg) Table Of Contents 1. [Application Management](#application-management) 2. [🚀Getting Started](#getting-started) 3. [📦Win32 Apps & Enterprise Apps Catalog](#win32-apps-enterprise-apps-catalog) 4. [🪟Microsoft Store & Microsoft 365 Apps](#microsoft-store-microsoft-365-apps) 5. [📱iOS & Android Apps](#ios-android-apps) 6. [🔧Common Application Errors & Solutions](#common-application-errors-solutions) 7. [📚 Continue Learning](#continue-learning) ## 🚀Getting Started New to application deployment in Microsoft Intune? Start here to learn the fundamentals of application deployment. These guides will help you understand the deployment process, prepare applications, and successfully deploy software to Windows devices. [![Illustration of a person at a laptop with gear icons and a cloud download symbol, beside the headline 'Deploy Win32 Apps Using Enterprise App Catalog'.](https://techuisitive.com/wp-content/uploads/2025/02/Win32-App-Enterprise-catalog-1024x538.jpg) ](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) #### [Deploy Win32 App Using Intune Enterprise App Catalog \[Step-by-step Guide\]](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) Microsoft Intune Enterprise App Management makes it simple to discover, deploy, and keep applications up… [![Illustration of a person at a laptop with gears and a cloud, beside the title 'Deploy Win32 App using Microsoft Store app (new)'.](https://techuisitive.com/wp-content/uploads/2023/08/Win32-Store-App-1024x538.jpg) ](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) #### [Deploy Win32 App using Microsoft Store app (new) | Intune](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) The new Microsoft Store app integration in Intune makes it easier than ever to deploy… [![Illustration of a person at a laptop with large gear icons, for a guide about deploying Google Chrome Win32 apps, with the title text nearby.](https://techuisitive.com/wp-content/uploads/2022/08/Deploy-Google-Chrome-1024x538.jpg) ](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) #### [How to Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) Google Chrome remains one of the most widely used browsers in enterprise environments, and ensuring… ## 📦Win32 Apps & Enterprise Apps Catalog Deploy and manage Windows applications with Microsoft Intune using Win32 apps and the Enterprise App Catalog. Learn how to package applications, configure detection and requirement rules, troubleshoot deployments, and simplify software distribution across your organization. [![Illustration of a person at a laptop with gear icons and a cloud download symbol, beside the headline 'Deploy Win32 Apps Using Enterprise App Catalog'.](https://techuisitive.com/wp-content/uploads/2025/02/Win32-App-Enterprise-catalog-1024x538.jpg) ](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) #### [Deploy Win32 App Using Intune Enterprise App Catalog \[Step-by-step Guide\]](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) Microsoft Intune Enterprise App Management makes it simple to discover, deploy, and keep applications up… [![Illustration of a person at a laptop with gears and a cloud, beside the title 'Deploy Win32 App using Microsoft Store app (new)'.](https://techuisitive.com/wp-content/uploads/2023/08/Win32-Store-App-1024x538.jpg) ](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) #### [Deploy Win32 App using Microsoft Store app (new) | Intune](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) The new Microsoft Store app integration in Intune makes it easier than ever to deploy… [![Illustration of a person at a laptop with gears and a cloud, beside the headline 'Deploy Microsoft SQL Server Management Studio 19.02'.](https://techuisitive.com/wp-content/uploads/2023/05/Deploy-SQL-Management-Studio-1024x538.jpg) ](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) #### [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) Deploy Microsoft SQL Server Management Studio (SSMS) 20.x through Intune Microsoft SQL Server Management Studio… [![Illustration of a person with a laptop and gear icons, plus a cloud download symbol, beside the title 'Prepare Win32 App Installation source for Intune' with an Apps badge in the corner.](https://techuisitive.com/wp-content/uploads/2022/08/Prepare-Win32-App-Source-1024x538.jpg) ](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) #### [How to Prepare Win32 App Installation Source for Intune Using Intune WinAppUtil](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/) Win32 apps provide us greater control over the deployment of application. We can deploy 32… [![Illustration of a person at a laptop with gears and a cloud, titled 'SCCM Device Collection Equivalents in Microsoft Intune' (Apps banner shown)](https://techuisitive.com/wp-content/uploads/2022/05/SCCM-Device-Collection-Equivalents-in-Microsoft-Intune-1024x538.jpg) ](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) #### [SCCM Device Collection Equivalents in Microsoft Intune](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) In SCCM, collections have always been the go‑to mechanism for targeting deployments. For example, if… [![Illustration of a person with a laptop beside blue gears and a cloud download icon, accompanying the title 'Win32 App Requirements Rules in Microsoft Intune' on the right.](https://techuisitive.com/wp-content/uploads/2022/04/Win32-App-requirement-rules-1024x538.jpg) ](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) #### [Understanding Win32 App Requirements Rule in Microsoft Intune](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) Deploying Win32 apps in Microsoft Intune isn’t just about packaging and pushing software—it’s about ensuring… [![Hero illustration: a person using a laptop beside large blue gears, accompanying the heading 'Understanding Win32 App Detection Rules'](https://techuisitive.com/wp-content/uploads/2022/03/Win32-App-Detection-Rules-1024x538.jpg) ](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) #### [Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) Win32 app detection rules in Microsoft Intune are critical for ensuring accurate application deployment and… [![Illustration of a man with a laptop beside gears and a cloud download icon, next to the title 'Win32 App Deployment with Dependencies'.](https://techuisitive.com/wp-content/uploads/2022/02/Win32-App-Deployment-with-Dependencies-1024x538.jpg) ](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) #### [Win32 App Deployment with Dependencies | Microsoft Intune](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) Windows Apps (Win32) in Microsoft Intune / Endpoint Manager provide us with greater control over… [![Illustration of a person at a laptop with gears and a cloud, beside the headline 'Intune Application Deployment LOB vs Win32 Apps'.](https://techuisitive.com/wp-content/uploads/2022/01/LOB-vs-Win32-Apps-1024x538.jpg) ](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) #### [Microsoft Intune LOB vs Win32 Apps: Which Application Type Should You Use?](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/) Line of Business Application (LOB) is legacy application deployment method in Microsoft Intune. The LOB… ## 🪟Microsoft Store & Microsoft 365 Apps Deploy and manage Microsoft Store apps with Microsoft Intune using step-by-step guides. Explore app assignments, deployment options, updates, and troubleshooting to simplify application management. [![Illustration of a person at a laptop with gears and a cloud, beside the title 'Deploy Win32 App using Microsoft Store app (new)'.](https://techuisitive.com/wp-content/uploads/2023/08/Win32-Store-App-1024x538.jpg) ](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) #### [Deploy Win32 App using Microsoft Store app (new) | Intune](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) The new Microsoft Store app integration in Intune makes it easier than ever to deploy… [![Illustration of a person at a laptop with gear icons and a cloud symbol, beside the heading 'Assign Microsoft Store Apps Using Intune Filters'.](https://techuisitive.com/wp-content/uploads/2021/05/Assign-store-apps-using-assignment-filters-1024x538.jpg) ](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/) #### [Assign Microsoft Store Apps Using Intune Filters](https://techuisitive.com/intune-filters-assign-microsoft-store-app-policy-using-filters/) Microsoft recently introduced Filters in Microsoft Endpoint Manager / Intune, which allow more granular targeting… ## 📱iOS & Android Apps Learn how to deploy, configure, and manage iOS and Android applications with Microsoft Intune. Explore step-by-step guides for app deployment, app protection policies, troubleshooting, and best practices to securely deliver mobile apps across your organization. [![Hero illustration showing devices and cloud for an article about deploying Android APKs in Microsoft Intune.](https://techuisitive.com/wp-content/uploads/2023/07/Deploy-Android-APK-1024x538.jpg) ](https://techuisitive.com/how-to-deploy-android-apk-apps-in-microsoft-intune/) #### [How to deploy Android .APK Apps in Microsoft Intune](https://techuisitive.com/how-to-deploy-android-apk-apps-in-microsoft-intune/) Use the Manage Google Play App option in Intune to deploy custom Android APK files…. ## 🔧Common Application Errors & Solutions Troubleshoot application deployment issues in Microsoft Intune with practical, step-by-step guides. Learn how to diagnose installation failures, resolve detection rule issues, fix deployment errors, and ensure successful app installations on Windows devices. [![Troubleshooting banner with a person at a laptop and blue gears; headline reads 'Fix Intune Win32 App Error 0x87D30006'.](https://techuisitive.com/wp-content/uploads/2024/05/Win32-App-Error-0x87D30006-1024x538.jpg) ](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) #### [How to Fix Intune Win32 App Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) Deploying Win32 applications through Microsoft Intune can sometimes throw unexpected errors that block installations. One… [![Troubleshooting banner with a laptop and search window, and the text 'Fix Microsoft 365 Apps Stuck Downloading in Company Portal'](https://techuisitive.com/wp-content/uploads/2023/05/App-Download-stuck-in-Company-Portal-1024x538.jpg) ](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) #### [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) Microsoft 365 Apps can be deployed using Intune and deployed as Microsoft 365 Apps Type…. [![Troubleshooting banner with blue gears and a person at a laptop on the left, and the heading 'Fix Intune Win32 App Error 0x80070643' on the right.](https://techuisitive.com/wp-content/uploads/2022/02/Win32-App-Error-0x80070643-1-1024x538.jpg) ](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) #### [Intune – Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) The Win32 app in Microsoft Intune offers enhanced control over application deployment. However, deployment failures… [![Illustration of a person at a laptop with gears and a cloud icon beside a greenish-blue color, accompanying the heading 'Fix Intune Win32 App Error 0x87D1041C' in a troubleshooting guide.](https://techuisitive.com/wp-content/uploads/2022/02/Win32-App-Error-0x87D1041C-1024x538.jpg) ](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) #### [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) Deploying Win32 applications with Microsoft Intune can sometimes fail with the error code 0x87D1041C, which… [![Troubleshooting banner featuring gears and a person at a laptop next to the headline: Fix Intune Win32 App Error 0x87d300c9](https://techuisitive.com/wp-content/uploads/2022/02/Win32-App-error-0x87d300c9-1024x538.jpg) ](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) #### [Fix Intune Win32 App Deployment Error 0x87d300c9 (Step‑by‑Step Guide)](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) Deploying Win32 apps through Intune can sometimes throw unexpected errors that leave administrators puzzled. One… [![Troubleshooting banner with blue gears and a person at a laptop; title: Fix Intune Win32 App Error 0x80070653.](https://techuisitive.com/wp-content/uploads/2022/01/Win32-App-Error-0x80070653-1-1024x538.jpg) ](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) #### [Intune Win32 App Deployment failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) Deploying Win32 applications through Microsoft Intune can sometimes throw unexpected errors that leave administrators puzzled…. ## 📚 Continue Learning Choose a learning path based on your role or the topic you want to master. Each path brings together tutorials, troubleshooting guides, automation, quizzes, and related resources. [](https://techuisitive.com/microsoft-intune/)### Microsoft Intune Master Microsoft Intune device configuration with step-by-step practical guides. [](https://techuisitive.com/autopilot/)### Windows Autopilot Expand your Windows Autopilot knowledge with practical tutorials, guides, and real-world solutions. [](https://techuisitive.com/device-configurations/)### Device Configuration Configure and manage Windows devices with practical Microsoft Intune policy guides. [](https://techuisitive.com/sccm/)### ConfigMgr | SCCM Learn how to deploy, manage, and maintain Windows devices using Configuration Manager (SCCM). [](https://techuisitive.com/automation/)### Automation Master Microsoft Intune automation with practical guides to PowerShell and Microsoft Graph. [](https://techuisitive.com/microsoft-windows/)### Windows 10/11 Learn Windows deployment, updates, troubleshooting, and essential management. --- ### [Microsoft Intune](https://techuisitive.com/microsoft-intune/) **Published:** July 11, 2026 **Author:** Equebal Ahmad **Content:** ## Microsoft Intune #### Deployment, Security & Endpoint Management Learn how to deploy, secure, manage, and troubleshoot Windows devices with Microsoft Intune. Explore step-by-step guides, App deployment, device configuration, and practical troubleshooting resources. ✅ Device Management ✅ Application & Deployment ✅ Automation & Scripting ✅ Troubleshooting Guides ![Microsoft Intune](https://techuisitive.com/wp-content/uploads/2026/07/1e4ab21f-b0c3-4311-ad91-062b4e33252f-1024x1024.jpg) Table Of Contents 1. [Microsoft Intune](#microsoft-intune) 2. [🚀Getting Started](#getting-started) 3. [🚀Windows Autopilot](#windows-autopilot) 4. [📦Application Management](#application-management) 5. [⚙️Device Configurations](#device-configurations) 6. [🖥️Device Management](#device-management) 7. [🛡️Device Compliance & Conditional Access](#device-compliance-conditional-access) 8. [📋Policy Management](#policy-management) 9. [🔄 Remediation](#remediation) 10. [🔧Common Intune Errors & Solutions](#common-intune-errors-solutions) 11. [📚 Continue Learning](#continue-learning) ## 🚀Getting Started **New to Microsoft Intune?** Start with these beginner-friendly guides to learn the fundamentals of device management, application deployment, and endpoint security. Build a strong foundation before exploring advanced Intune features and automation. [![Illustration of a person configuring a Windows kiosk in Microsoft Intune with gears and screens; a 'Configuration' badge in the top-left.](https://techuisitive.com/wp-content/uploads/2023/01/Windows-Kiosk-1024x538.jpg) ](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) #### [How to Configure Windows Kiosk Using Microsoft Intune | Windows 10 / 11](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/) Windows kiosk is a lockdown mechanism to restrict device access to pre-defined applications. The applications… [![Illustration of a person at a laptop with gear icons and a cloud download symbol, beside the headline 'Deploy Win32 Apps Using Enterprise App Catalog'.](https://techuisitive.com/wp-content/uploads/2025/02/Win32-App-Enterprise-catalog-1024x538.jpg) ](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) #### [Deploy Win32 App Using Intune Enterprise App Catalog \[Step-by-step Guide\]](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) Microsoft Intune Enterprise App Management makes it simple to discover, deploy, and keep applications up… [![Illustration of a person configuring a webpage with gears on computer screens beside the article title.](https://techuisitive.com/wp-content/uploads/2021/09/Configure-Edge-Home-Page-1-1024x538.jpg) ](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) #### [Configure Edge Homepage & Startup Page Using Intune Administrative Templates](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/) Microsoft Endpoint Manager (Intune) Device Configuration profiles allow you to add and configure settings, and… ## 🚀Windows Autopilot Learn how to configure Windows Autopilot for your organization, including Device Preparation, Enrollment Status Page (ESP), hardware hash collection, and deployment best practices. [![Laptop with blue cloud graphics on the left and the title 'Windows Autopilot Device Preparation v2' on the right.](https://techuisitive.com/wp-content/uploads/2024/11/Autopilot-Device-preparation-v2-1-1024x538.jpg) ](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) #### [Windows Autopilot Device Preparation aka Autopilot v2 Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) Windows Autopilot Device Preparation, also known as Autopilot v2, is Microsoft’s latest evolution in device… [![Autopilot branding in top-left with a blue laptop and clouds illustration, and the title: Configure Enrollment Status Page (ESP) in Intune.](https://techuisitive.com/wp-content/uploads/2022/04/Enrollment-Status-Page-1-1024x538.jpg) ](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) #### [How to Configure Enrollment Status Page (ESP) in Microsoft Intune](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/) The Enrollment Status Page (ESP) shows the progress of device provisioning when a new device… [![Laptop with blue cloud icons emerging from the screen, next to a bold headline about provisioning Windows 10/11 devices with Autopilot, and an Autopilot badge in the top-left corner.](https://techuisitive.com/wp-content/uploads/2022/03/Windows-Autopilot-1-1024x538.jpg) ](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) #### [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/) Windows Autopilot is a modern deployment solution from Microsoft that simplifies how IT teams provision,… [Explore Windows Autopilot](https://techuisitive.com/autopilot/) ## 📦Application Management Simplify application management with Microsoft Intune. Explore step-by-step guides for deploying Win32, Microsoft Store, Microsoft 365, Line-of-Business (LOB), and mobile apps, along with deployment strategies, best practices, and troubleshooting. [![Illustration of a person at a laptop with gear icons and a cloud download symbol, beside the headline 'Deploy Win32 Apps Using Enterprise App Catalog'.](https://techuisitive.com/wp-content/uploads/2025/02/Win32-App-Enterprise-catalog-1024x538.jpg) ](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) #### [Deploy Win32 App Using Intune Enterprise App Catalog \[Step-by-step Guide\]](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/) Microsoft Intune Enterprise App Management makes it simple to discover, deploy, and keep applications up… [![Illustration of a person at a laptop with large gear icons, for a guide about deploying Google Chrome Win32 apps, with the title text nearby.](https://techuisitive.com/wp-content/uploads/2022/08/Deploy-Google-Chrome-1024x538.jpg) ](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) #### [How to Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) Google Chrome remains one of the most widely used browsers in enterprise environments, and ensuring… [![Hero illustration: a person using a laptop beside large blue gears, accompanying the heading 'Understanding Win32 App Detection Rules'](https://techuisitive.com/wp-content/uploads/2022/03/Win32-App-Detection-Rules-1024x538.jpg) ](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) #### [Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) Win32 app detection rules in Microsoft Intune are critical for ensuring accurate application deployment and… [View All](https://techuisitive.com/application-management/) ## ⚙️Device Configurations Configure Windows devices with Microsoft Intune using practical, step-by-step guides. Learn how to deploy configuration profiles, manage device settings, enforce security policies, and deliver a consistent user experience across your organization. [![Illustration of a person configuring a large computer window with gears, a small user icon, and a 'Configuration' badge; title reads 'Allow Copilot in Microsoft Edge Using Intune'](https://techuisitive.com/wp-content/uploads/2026/02/Copilot-in-Edge-1024x538.jpg) ](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/) #### [How to Allow Copilot in Microsoft Edge Using Intune](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/) Microsoft Edge now includes Copilot, an AI assistant that helps people work smarter by giving… [![Illustration of a person adjusting computer settings with gears beside the text 'Microsoft Intune Manage Desktop Wallpaper' on a white background, representing configuration.](https://techuisitive.com/wp-content/uploads/2021/10/Desktop-Wallpaper-1024x538.jpg) ](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) #### [Manage Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) On Windows 10 and Windows 11 desktops, the wallpaper (background) is the image displayed behind… [![Hero illustration showing a person configuring a computer screen with gears; banner reads 'Configure Intune Shared Multi User Device'](https://techuisitive.com/wp-content/uploads/2025/04/Configure-Intune-Shared-Multi-User-Device-1024x538.jpg) ](https://techuisitive.com/how-to-configure-intune-shared-multi-user-device/) #### [How to Configure Intune Shared Multi User Device](https://techuisitive.com/how-to-configure-intune-shared-multi-user-device/) Managing Windows devices in environments like schools, libraries, or retail stores often requires a secure,… [View All](https://techuisitive.com/device-configurations/) ## 🖥️Device Management Learn how to enroll, manage, and troubleshoot Windows devices using Microsoft Intune. From Microsoft Entra ID join and provisioning packages to device actions, inventory, and lifecycle management, this section provides step-by-step guides to help you deploy, secure, and maintain corporate devices throughout their entire management journey. [![Illustration of a person arranging multiple screens and tablets under a blue 'Devices' label on the left side of the image.](https://techuisitive.com/wp-content/uploads/2023/05/Organize-Laptops-1024x538.jpg) ](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) #### [Organizing Laptops and Desktops in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) Organizing laptops and desktops in device management has always been a challenge. In SCCM, we… [![Illustration of a person renaming a device on a desktop monitor, with tablets and a phone nearby, for a Microsoft Intune article.](https://techuisitive.com/wp-content/uploads/2025/01/Rename-a-Device_20260725_233333_0000-1024x538.jpg) ](https://techuisitive.com/how-to-rename-device-from-intune/) #### [How to Rename Device from Intune](https://techuisitive.com/how-to-rename-device-from-intune/) You may need to rename a device that is not named per organization standard. The… [![Illustration: a person configures Windows 10 devices (phone, tablet, monitor) for Entra ID, with a blue 'Devices' badge at top-left.](https://techuisitive.com/wp-content/uploads/2021/11/Windows-10-Entra-1024x538.jpg) ](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) #### [How to Join a Windows 10 Device to Entra ID](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) Microsoft Entra ID (Formerly Azure Active Directory) is a cloud version of on-premises Active Directory…. [![Intune Enrollment](https://techuisitive.com/wp-content/uploads/2022/08/Entra-Join-1024x538.jpg) ](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) #### [How to Enroll a Windows 11 Device in Intune Using Microsoft Entra Join](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) Enrolling Windows 11 corporate devices into Microsoft Intune is a critical step for IT administrators… [![Illustration of a person standing beside a monitor and tablets with a blue 'Devices' badge, accompanying the title 'Bulk Device Enrollment with Provisioning Package' on the right.](https://techuisitive.com/wp-content/uploads/2022/09/Device-Enrollment-1-1024x538.jpg) ](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) #### [Bulk Enrollment of Windows 10 / 11 Devices to Intune Using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) Managing hundreds of corporate-owned Windows devices can be complex without automation. Bulk enrollment of Windows… [![Illustration of a person organizing devices on a large monitor with tablets nearby and a teal 'Devices' badge in the corner, conveying device management context.](https://techuisitive.com/wp-content/uploads/2023/10/Device-Categories-_20260725_232814_0000-1024x538.jpg) ](https://techuisitive.com/how-to-create-and-manage-microsoft-intune-device-categories/) #### [How to Create and Manage Microsoft Intune Device Categories](https://techuisitive.com/how-to-create-and-manage-microsoft-intune-device-categories/) Microsoft Intune device categories allow you to manage easily and group devices. Intune device category… ## 🛡️Device Compliance & Conditional Access Ensure devices meet your organization’s security and compliance requirements with Microsoft Intune. Learn how to create compliance policies, evaluate device health, enforce Conditional Access, and maintain a secure endpoint environment. [![Conditional Access](https://techuisitive.com/wp-content/uploads/2024/01/Conditional-access-1024x538.jpg) ](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/) #### [Deny M365 Apps access from Untrusted Locations | Intune](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/) Conditional Access is a feature of Microsoft Entra ID that helps organizations improve security and compliance. Conditional… [![Banner illustration: technician at a computer with a shield icon, promoting OS version compliance policy and user notifications.](https://techuisitive.com/wp-content/uploads/2021/09/Device-Compliance-OS-1024x538.jpg) ](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/) #### [Check OS Version Compliance with Intune Compliance Policy](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/) Microsoft Intune compliance policies can be used to check whether Windows devices are running a… ## 📋Policy Management **Configure, organize, and manage Microsoft Intune policies with confidence.** Learn how to create, assign, monitor, and troubleshoot configuration, compliance, security, and update policies to ensure devices remain secure, compliant, and consistently managed. [![Illustration of a computer monitor with a person beside server racks and cloud icons, next to the heading 'Export Endpoint Security Policies in Intune' and an orange 'Policy Management' badge.](https://techuisitive.com/wp-content/uploads/2023/12/Export-Endpoint-Security-Policies-1024x538.jpg) ](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune/) #### [How to Export Endpoint Security Policies in Intune](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune/) Exporting and importing endpoint security policies in Microsoft Intune can save administrators significant time when… [![Policy Management banner with a blue computer-and-server illustration; title reads 'Export Device Configuration Profiles in Intune' in blue text.](https://techuisitive.com/wp-content/uploads/2023/12/Export-Device-Configuration-Profiles-1024x538.jpg) ](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/) #### [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/) You may have a requirement to export or import Microsoft Intune policies while working on… [![Policy Management banner with a blue computer illustration and the heading 'Export and Import Device Compliance Policies in Intune'.](https://techuisitive.com/wp-content/uploads/2023/11/Export-and-Import-Device-Compliance-Policies-in-Intune-1024x538.jpg) ](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/) #### [Export and Import Device Compliance Policies in Intune](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/) You may have a requirement to export or import Microsoft Intune policies while working on… [![Illustration of a person at a computer with a server stack, representing policy management and exporting settings in Intune.](https://techuisitive.com/wp-content/uploads/2023/11/Export-Settings-Catalog-Policy-in-Intune-1024x538.jpg) ](https://techuisitive.com/export-settings-catalog-policy-in-intune/) #### [How to Export Settings Catalog Policy in Intune](https://techuisitive.com/export-settings-catalog-policy-in-intune/) Intune Settings catalog are new way of managing settings through Intune. Settings catalog lists all… [![Policy Management badge with a blue computer illustration and cloud, stating 'Export Device Configuration Profiles List in Intune'](https://techuisitive.com/wp-content/uploads/2023/10/Export-Device-Configuration-Profiles-List-in-Intune-1024x538.jpg) ](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/) #### [Export Device Configuration Profiles List in Intune](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/) While managing an Intune environment, the number of policies grows over time. At some point… ## 🔄 Remediation Proactively identify and resolve device issues with Microsoft Intune Remediations. Learn how to create detection and remediation scripts, automate common fixes, and improve device health and user experience across your organization. [![Automate-Fixed-with-Intune-Remediation-script](https://techuisitive.com/wp-content/uploads/2026/07/Automate-Fixed-with-Intune-Remediation-script-1024x538.jpg) ](https://techuisitive.com/the-remediation-playbook-how-intune-admins-can-automate-fixes-in-2026/) #### [The Remediation Playbook: How Intune Admins Can Automate Fixes in 2026](https://techuisitive.com/the-remediation-playbook-how-intune-admins-can-automate-fixes-in-2026/) Modern endpoint management goes way beyond just pushing out policies – it’s about getting devices… [![Intune remediation script](https://techuisitive.com/wp-content/uploads/2026/07/Create-Intune-remediation-script-1024x538.jpg) ](https://techuisitive.com/how-to-create-intune-detection-and-remediation-scripts-step-by-step-guide/) #### [How to Create Intune Detection and Remediation Scripts (Step‑by‑Step Guide)](https://techuisitive.com/how-to-create-intune-detection-and-remediation-scripts-step-by-step-guide/) Microsoft Intune provides powerful capabilities to keep devices compliant and secure. One of the most… [![Intune-Remediate-Script-Creation](https://techuisitive.com/wp-content/uploads/2026/04/Intune-Remediate-Script-Creation-1024x538.jpg) ](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) #### [Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) The remediation scripts in Microsoft Intune are a powerful way to remediate issues. We can… ## 🔧Common Intune Errors & Solutions Resolve common Microsoft Intune issues with practical troubleshooting guides. Learn how to diagnose deployment failures, enrollment problems, application errors, and configuration issues using proven solutions and best practices. [![Intune Enrollment Error 0x8018000A](https://techuisitive.com/wp-content/uploads/2026/08/Intune-Enrollment-Error-1024x538.jpg) ](https://techuisitive.com/fix-device-enrollment-error-deviceaadjoin-failed-with-error-0x8018000a/) #### [Fix Device Enrollment Error: DeviceAADJoin Failed with Error 0x8018000A](https://techuisitive.com/fix-device-enrollment-error-deviceaadjoin-failed-with-error-0x8018000a/) The DeviceAADJoin failed with 0x8018000A error typically appears during Windows device enrollment into Microsoft Intune… [![Fix Intune Enrollment Error 0x800705b4](https://techuisitive.com/wp-content/uploads/2024/05/Fix-Intune-Enrollment-Error-0x800705b4-1024x538.jpg) ](https://techuisitive.com/how-to-fix-intune-enrollment-error-0x800705b4/) #### [How to Fix Intune Enrollment Error 0x800705b4](https://techuisitive.com/how-to-fix-intune-enrollment-error-0x800705b4/) When enrolling Windows devices into Microsoft Intune, administrators may encounter the error code 0x800705b4, often… [![Troubleshooting banner with a computer illustration featuring a gear, wrench, and checkmark; title reads 'Fix Intune Bulk Enrollment Error 0xCAA2000C'](https://techuisitive.com/wp-content/uploads/2023/07/Intune-bulk-Enrollment-Error-1024x538.jpg) ](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/) #### [Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/) Using provisioning package device failed to complete AAD Join with error 0xCAA2000C. The issue can… [![Troubleshooting banner with a monitor illustration showing a gear, wrench, and checkmark beside the headline 'Fix Intune Enrollment Error 0x800700b7'](https://techuisitive.com/wp-content/uploads/2022/09/Intune-Enrollment-Error-1-1024x538.jpg) ](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) #### [Fix Windows 11 Intune Enrollment Error 0x800700b7 \[Step-by-Step Guide\]](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/) You may encounter below error when trying to enroll Windows 11 device to Intune with… [![Troubleshooting article header with a laptop illustration and the title: Fix 'That Account Info Didn't Work' error when disconnecting work or school account.](https://techuisitive.com/wp-content/uploads/2022/09/That-account-info-didnt-work-1024x538.jpg) ](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) #### [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) You may encounter the following error when trying to disconnect a Work or School account… [![Troubleshooting image: computer with a gear and checkmark, and the title 'Fix Win32 Error 0xCAA9001F During Intune Enrollment'.](https://techuisitive.com/wp-content/uploads/2022/03/Fix-Unknown-Win32-Error-code-0xcaa9001f-1024x538.jpg) ](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) #### [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code: 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) In a hybrid Azure AD setup, you may encounter situations where a workstation fails to… [![Troubleshooting banner showing a monitor with a blue gear and checkmark, a wrench, and a checkbox, beside the headline about fixing Invalid_Client error when joining Windows 10 to Entro ID.](https://techuisitive.com/wp-content/uploads/2021/09/Invalid_Client-Error-1024x538.jpg) ](https://techuisitive.com/invalid_client-error-when-joining-windows-10-device-to-azure-ad-tenant/) #### [Fix Invalid\_Client Error When Joining Windows 10 to Azure AD (Microsoft Entra ID)](https://techuisitive.com/invalid_client-error-when-joining-windows-10-device-to-azure-ad-tenant/) When trying to join a Windows 10 or Windows 11 device to the Azure AD… [![Banner labeled Troubleshooting: Intune Issues on Windows 10 / Windows 11, showing a laptop illustration with a search bar and a red Troubleshooting badge.](https://techuisitive.com/wp-content/uploads/2021/06/Troubleshooting-Intune-issue-1024x538.jpg) ](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) #### [Troubleshooting Intune Issues on Windows 10 / Windows 11](https://techuisitive.com/intune-windows-10-mdm-basic-troubleshooting/) Troubleshooting Intune MDM on Windows 10 and Windows 11 devices is a critical skill for… ## 📚 Continue Learning Choose a learning path based on your role or the topic you want to master. Each path brings together tutorials, troubleshooting guides, automation, quizzes, and related resources. [](https://techuisitive.com/application-management/)### App Deployment Master application deployment with step-by-step guides for Win32, Microsoft Store, and LOB apps. [](https://techuisitive.com/autopilot/)### Windows Autopilot Expand your Windows Autopilot knowledge with practical tutorials, guides, and real-world solutions. [](https://techuisitive.com/device-configurations/)### Device Configuration Configure and manage Windows devices with practical Microsoft Intune policy guides. [](https://techuisitive.com/sccm/)### ConfigMgr | SCCM Learn how to deploy, manage, and maintain Windows devices using Configuration Manager (SCCM). [](https://techuisitive.com/automation/)### Automation Master Microsoft Intune automation with practical guides to PowerShell and Microsoft Graph. [](https://techuisitive.com/microsoft-windows/)### Windows 10/11 Learn Windows deployment, updates, troubleshooting, and essential management. --- ### [Contact](https://techuisitive.com/contact/) **Published:** February 2, 2021 **Author:** Equebal Ahmad **Content:** ## **Get in Touch** *Have a question about Microsoft Intune, Windows Autopilot, Configuration Manager, or one of our tutorials? We’d love to hear from you.* #### Contact options 📧 **Email** For questions, corrections, feedback, or business inquiries: **contactus@techuisitive.com** *We usually respond within 1–3 business days.* ![](https://techuisitive.com/wp-content/uploads/2026/07/Contact-us-1024x682.jpg) ## **What you can contact us about** - Technical questions about published articles - Report an error or outdated information - Suggest a new tutorial Business - partnerships or sponsorships - Guest post proposals (if you accept them) ## **Before contacting us** Please check: - Search the website for existing guides. - Read the comments on the relevant article (if enabled). - Include screenshots, error codes, and your environment details for troubleshooting questions. - This helps you get a faster and more accurate response. Email contactus@techuisitive.com Follow Us: [ ](https://www.facebook.com/techuisitive/) [ ](https://www.instagram.com/techuisitive/) [ ](https://twitter.com/techuisitive) [ ](https://www.youtube.com/channel/UCz4SluFVr2536gkzECoa9MQ) ### Help Us Grow Together We invite you to be part of our vibrant community by contributing your knowledge and experience. Your insights can empower IT professionals and learners worldwide. Ready to share your expertise? Join us today and make a meaningful impact! Submit your articles, guides, or scripts. Collaborate on innovative projects. Help shape the future of cloud and endpoint management. Together, let’s build a resource that drives success and innovation. [Contributor Guidelines](https://techuisitive.com/contributor-guidelines/) --- ### [About](https://techuisitive.com/about/) **Published:** February 2, 2021 **Author:** Equebal Ahmad **Content:** ## **Learn. Deploy. Automate.** Techuisitive is a learning platform dedicated to Microsoft endpoint management, helping IT professionals deploy, manage, troubleshoot, and automate Windows devices using Microsoft Intune, Windows Autopilot, Configuration Manager (SCCM), and other modern workplace technologies. ![](https://techuisitive.com/wp-content/uploads/2026/07/About-us-1024x1024.jpg) ## **About Techuisitve** At Techuisitive, we believe the best way to learn device management is through practical experience. That’s why we publish step-by-step tutorials, troubleshooting guides, automation scripts, quizzes, and practical learning resources based on real-world scenarios. Our content focuses on technologies including Microsoft Intune, Windows Autopilot, Configuration Manager (SCCM), Windows 10/11, Microsoft Entra ID, Microsoft Edge management, PowerShell, and Microsoft Graph API. Whether you’re deploying applications, configuring security policies, troubleshooting enrollment issues, or automating routine administrative tasks, our goal is to provide practical guidance that you can apply with confidence. We strive to create a trusted resource where IT administrators, endpoint engineers, consultants, and learners can stay up to date with Microsoft’s evolving device management ecosystem while continuously building their technical skills. ### Our Mission - Publish practical, easy-to-follow technical guides. - Share reliable troubleshooting solutions for real-world issues. - Simplify endpoint management through automation. - Build structured learning resources that help IT professionals grow. Thank you for visiting Techuisitive. We hope our content helps you solve problems faster, learn with confidence, and stay ahead in the ever-evolving world of Microsoft endpoint management. --- ### [Home-old](https://techuisitive.com/home-old/) **Published:** February 2, 2021 **Author:** Equebal Ahmad **Content:** # MODERN DEVICE MANAGEMENT BLOG **Modern Device Management** combines cloud-based management and security to keep users productive and protected across devices, anywhere. In today’s distributed business world, cloud management is essential. **Microsoft Intune** delivers mobile device and app management (MDM/MAM) for phones, tablets, laptops, and desktops. It protects organizational data on both corporate and personal (BYOD) devices, separating work from personal information. Intune supports Android, iOS/iPadOS, Linux Ubuntu Desktop, macOS, and Windows. Explore the **Techuisitive blog** for insights on Device Management, Microsoft Intune, and Configuration Manager (SCCM ConfigMgr) [ Read Blog ](https://techuisitive.com/blog/) ![Person analyzing digital market trends on tablet with laptop showing financial charts.](https://techuisitive.com/wp-content/uploads/2026/04/pexels-photo-5833296-5833296-768x576.jpg) ## Techuisitive Knowledge Hub Discover guides on Intune, ConfigMgr, Autopilot, Windows 10/11, and modern cloud management. [ ](https://techuisitive.com/category/intune/) ### [ Microsoft Intune ](https://techuisitive.com/category/intune/) [ ](https://techuisitive.com/category/windowsautopilot/) ### [ Windows Autopilot ](https://techuisitive.com/category/windowsautopilot/) [ ](https://techuisitive.com/category/sccm/) ### [ Configuration Manager ](https://techuisitive.com/category/sccm/) [ ](https://techuisitive.com/category/windows/) ### [ Windows 10 / 11 ](https://techuisitive.com/category/windows/) ![A modern tablet displaying various widgets next to a small potted plant on a wooden table.](https://techuisitive.com/wp-content/uploads/2025/04/pexels-photo-3785868-3785868-scaled.jpg) ## MODERN DEVICE MANAGEMENT QUIZZES Quizzes are a quick way to assess knowledge. Incorrectly answered questions immediately highlight areas needing further revision. Regular quizzes help prevent forgetting. Testing after learning episodes reinforces memory and ensures better retention of information. Our modern device management quizzes includes multiple choice questions to help you enhance your knowledge about device management tools & technologies such as Microsoft Intune & Configuration Manager. You can use these quizzes to practice for exams such as Modern Desktop Management – MD-101 and MD-102. [ Try Now ](https://techuisitive.com/category/quiz/) --- ### [Microsoft Intune](https://techuisitive.com/microsoft-intune-old/) **Published:** January 11, 2024 **Author:** Equebal Ahmad **Content:** ## Microsoft Intune blog Microsoft Intune is a cloud-based management tool by Microsoft designed for mobile devices. It offers unified endpoint management for both corporate and BYOD devices while safeguarding corporate data. This platform extends key features of Microsoft Configuration Manager (SCCM) from on-premises to the Microsoft Azure cloud. Intune operates without the need for on-premises infrastructure, with management being conducted through a web-based portal available at . For further insights on various Microsoft Intune topics, explore the Techuisitive Intune blog. **Recent posts:** - [Fix Device Enrollment Error: DeviceAADJoin Failed with Error 0x8018000A](https://techuisitive.com/fix-device-enrollment-error-deviceaadjoin-failed-with-error-0x8018000a/)The DeviceAADJoin failed with 0x8018000A error typically appears during Windows device enrollment into Microsoft Intune when the Microsoft Entra join process cannot be completed. Although the error message is generic, the underlying cause can range from enrollment limits and licensing issues to stale device objects or incorrect enrollment settings. This article walks through the most… [Read more: Fix Device Enrollment Error: DeviceAADJoin Failed with Error 0x8018000A](https://techuisitive.com/fix-device-enrollment-error-deviceaadjoin-failed-with-error-0x8018000a/) - [The Remediation Playbook: How Intune Admins Can Automate Fixes in 2026](https://techuisitive.com/the-remediation-playbook-how-intune-admins-can-automate-fixes-in-2026/)Modern endpoint management goes way beyond just pushing out policies – it’s about getting devices to fix themselves. With Microsoft Intune’s detection and remediation scripts, you can catch and fix issues automatically before users even realize anything is wrong. Now that we are dealing with hybrid work setups and managing Windows 10 and 11, having… [Read more: The Remediation Playbook: How Intune Admins Can Automate Fixes in 2026](https://techuisitive.com/the-remediation-playbook-how-intune-admins-can-automate-fixes-in-2026/) - [How to Create Intune Detection and Remediation Scripts (Step‑by‑Step Guide)](https://techuisitive.com/how-to-create-intune-detection-and-remediation-scripts-step-by-step-guide/)Microsoft Intune provides powerful capabilities to keep devices compliant and secure. One of the most useful features is detection and remediation scripts that allow us to use small PowerShell scripts to check for issues and automatically fix them. If you’re new to Intune automation, start here. Once you understand how to create scripts manually, you… [Read more: How to Create Intune Detection and Remediation Scripts (Step‑by‑Step Guide)](https://techuisitive.com/how-to-create-intune-detection-and-remediation-scripts-step-by-step-guide/) - [Automating Intune Reports Using PowerShell and Microsoft Graph API](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/)Managing Microsoft Intune environments often requires administrators to export reports regularly for compliance checks, device auditing, and operational monitoring. While Intune provides built-in reporting in the admin center, manually exporting reports and emailing them repeatedly can quickly become time-consuming. In this guide, we’ll build a PowerShell-based Intune reporting automation framework that: By the end, you’ll… [Read more: Automating Intune Reports Using PowerShell and Microsoft Graph API](https://techuisitive.com/automating-intune-reports-using-powershell-and-microsoft-graph-api/) - [Bulk Upload Win32 Apps to Intune With PowerShell and Microsoft Graph API](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/)Bulk uploading Win32 applications to Microsoft Intune can become time-consuming when you need to package applications, create Entra ID groups, configure detection rules, assign applications, and repeat the same process for dozens of applications. This guide demonstrates how to automate the complete deployment process using PowerShell and the Microsoft Graph API. Instead of uploading every… [Read more: Bulk Upload Win32 Apps to Intune With PowerShell and Microsoft Graph API](https://techuisitive.com/bulk-win32-app-deployment-to-intune-using-powershell-and-microsoft-graph-api/) - [Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/)The remediation scripts in Microsoft Intune are a powerful way to remediate issues. We can use a remediation script to automatically fix common Windows issues across managed devices. We can also leverage the Microsoft Graph API to automate remediation script creation and assignment. In this post, we’ll walk through: Pre‑requisites & Required permissions Before running… [Read more: Automating Intune Remediation Script Creation with Microsoft Graph API](https://techuisitive.com/automating-intune-remediation-script-creation-with-microsoft-graph-api/) - [How to Enable Windows SSO in Firefox Using Microsoft Intune](https://techuisitive.com/enabling-windows-sso-in-firefox-using-intune/)Firefox Windows SSO enables users to seamlessly authenticate to supported enterprise web applications in Firefox using their existing Windows or Microsoft Entra ID credentials. This guide explains how Firefox Windows SSO works and how administrators can configure it using enterprise policies. What Is Firefox Windows SSO and How Does It Work? Firefox Windows SSO (Single… [Read more: How to Enable Windows SSO in Firefox Using Microsoft Intune](https://techuisitive.com/enabling-windows-sso-in-firefox-using-intune/) - [Fix Windows Hello for Business Error 0x80090010 During Autopilot](https://techuisitive.com/fixing-windows-autopilot-error-0x80090010-during-windows-hello-setup/)The Windows Autopilot Device Preparation streamlines the device provisioning. However, sometimes things don’t go as planned, and you may encounter different issues. One common issue you may encounter is Error code: 0x80090010. This error often points to issues with the device’s TPM or cryptographic services. In this post, we will discuss the issues and possible… [Read more: Fix Windows Hello for Business Error 0x80090010 During Autopilot](https://techuisitive.com/fixing-windows-autopilot-error-0x80090010-during-windows-hello-setup/) - [Enabling Azure Single Sign-On in Google Chrome with Intune: Don’t Miss This Key Setting](https://techuisitive.com/enabling-azure-single-sign-on-in-google-chrome-with-intune-dont-miss-this-key-setting/)Seamless sign-on is one of the biggest productivity wins for IT admins. If your users are still being prompted for credentials in Chrome despite enabling browser sign-in, chances are you’ve overlooked one critical policy: Allow automatic sign-in to Microsoft cloud identity providers. Let’s walk through the complete setup so you can deliver true single sign-on… [Read more: Enabling Azure Single Sign-On in Google Chrome with Intune: Don’t Miss This Key Setting](https://techuisitive.com/enabling-azure-single-sign-on-in-google-chrome-with-intune-dont-miss-this-key-setting/) - [How to Allow Copilot in Microsoft Edge Using Intune](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/)Microsoft Edge now includes Copilot, an AI assistant that helps people work smarter by giving quick tips, summarizing web pages, and connecting safely with Microsoft 365 data. For IT admins, turning on Copilot across managed devices is simple—you just need to set the right Intune policies. This guide shows you step by step how to… [Read more: How to Allow Copilot in Microsoft Edge Using Intune](https://techuisitive.com/how-to-allow-copilot-in-microsoft-edge-using-intune/) - [Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/)Exporting Azure AD group members at scale is a common need for IT administrators, whether for auditing, reporting, or compliance. This PowerShell script uses the Microsoft Graph API to automate bulk group membership exports. By reading group names from a CSV file and generating individual CSV reports for each group, the script simplifies Azure Active… [Read more: Bulk Export Entra ID Group Members with PowerShell & Microsoft Graph API](https://techuisitive.com/bulk-export-entra-id-group-members-with-powershell-microsoft-graph-api/) - [How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/)If you want a reliable, scalable way to trigger device sync across your Intune fleet, the Microsoft Graph PowerShell SDK is your best route. This post walks you through a practical, step‑by‑step guide with ready‑to‑use PowerShell examples using the SDK—so you can automate sync requests without worrying about raw REST calls. Along the way, you’ll… [Read more: How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/) - [Microsoft Intune Windows Update Quiz – Test Your Admin Skills](https://techuisitive.com/microsoft-intune-windows-update-quiz-2/)Managing Windows updates effectively is a critical skill for IT administrators working with Microsoft Intune. This quiz is designed to test your knowledge of Intune’s update management capabilities, including deadline settings, servicing profiles, compliance enforcement, and best practices for deploying updates across diverse devices. Whether you’re preparing for certification, brushing up on Intune fundamentals, or… [Read more: Microsoft Intune Windows Update Quiz – Test Your Admin Skills](https://techuisitive.com/microsoft-intune-windows-update-quiz-2/) - [Microsoft Intune – Security and Update Enforcement – Quiz 2](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-2/)Microsoft Intune plays a pivotal role in safeguarding corporate devices and ensuring compliance with organizational standards. This section focuses on security policies and update enforcement, helping professionals evaluate their knowledge and apply best practices effectively Techuisitive Quiz helps professionals evaluate their knowledge of Intune’s security policies, enabling them to apply best practices effectively. Programming MCQ Quiz… [Read more: Microsoft Intune – Security and Update Enforcement – Quiz 2](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-2/) - [Mastering Intune Configuration Profiles: Admin Essentials Quiz 02](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz-02/)Welcome to the Intune Configuration Profiles Quiz! This follow‑up quiz challenges you to dive deeper into Microsoft Intune’s configuration profiles and how they shape device management. You’ll encounter questions on profile types, deployment methods, applicability rules, and resolving conflicts—mirroring the real decisions IT admins face every day. Designed for learners, professionals, or anyone curious about… [Read more: Mastering Intune Configuration Profiles: Admin Essentials Quiz 02](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz-02/) - [How to Disable Copilot via Intune Settings Catalog](https://techuisitive.com/disable-copilot-via-intune-settings-catalog/)Microsoft introduced Copilot with Windows 11. Copilot is a built‑in AI assistant that helps boost productivity and improve the user experience. While Copilot can be useful, some organizations may want to turn it off for reasons like compliance, security, or simply to keep the user experience consistent. IT admins can centrally manage this setting through… [Read more: How to Disable Copilot via Intune Settings Catalog](https://techuisitive.com/disable-copilot-via-intune-settings-catalog/) - [Mastering Intune Configuration Profiles: Admin Essentials Quiz 01](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz/)Welcome to the Intune Configuration Profiles Quiz! This quiz tests your understanding of how Microsoft Intune manages device settings through configuration profiles, including profile types, deployment strategies, applicability rules, and conflict resolution. Each multiple-choice question focuses on practical, real-world scenarios, helping IT admins, learners, and curious readers sharpen their endpoint management skills. Take your time,… [Read more: Mastering Intune Configuration Profiles: Admin Essentials Quiz 01](https://techuisitive.com/mastering-intune-configuration-profiles-admin-essentials-quiz/) - [How to Monitor and Troubleshoot Windows Autopatch Issues](https://techuisitive.com/how-to-monitor-and-troubleshoot-windows-autopatch-issues/)Windows Autopatch is a cloud-based service built into Microsoft Intune that automates the deployment of updates for Windows, Microsoft 365 Apps, Edge, and Teams. It streamlines patch management through phased deployment rings and centralized monitoring. Even with automation, proactive monitoring and troubleshooting remain essential. Intune equips admins with dashboards, alerts, diagnostic tools, and Graph API/Copilot… [Read more: How to Monitor and Troubleshoot Windows Autopatch Issues](https://techuisitive.com/how-to-monitor-and-troubleshoot-windows-autopatch-issues/) - [Bulk Add Devices to Entra ID Group from CSV File](https://techuisitive.com/powershell-script-add-device-to-entra-id-group-from-csv-file/)This PowerShell script adds devices to an Entra ID group via a CSV file, streamlining device management. It reads a CSV containing device name, authenticates to Entra ID, and processes each entry, assigning devices to the specified group. For an Intune admin, this script eliminates manual data entry, reducing errors and saving valuable time. It… [Read more: Bulk Add Devices to Entra ID Group from CSV File](https://techuisitive.com/powershell-script-add-device-to-entra-id-group-from-csv-file/) - [Microsoft Intune – Security and Update Enforcement – Quiz 1](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-1/)Microsoft Intune plays a crucial role in security and update enforcement, ensuring devices meet compliance standards and receive timely updates. It allows administrators to enforce minimum OS versions, BitLocker encryption, and Windows Defender settings to protect corporate data. Update rings enable gradual rollouts, minimizing disruptions while ensuring stability. Deadline enforcement guarantees critical patches are installed… [Read more: Microsoft Intune – Security and Update Enforcement – Quiz 1](https://techuisitive.com/microsoft-intune-security-and-update-enforcement-quiz-1/) - [Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/)In today’s fast‑moving digital world, keeping devices secure and updated is critical. But manually patching Windows and Microsoft 365 apps can be a heavy burden for IT teams. That’s where Windows Autopatch comes in. It’s a cloud-based service built into Microsoft Intune that automates updates and makes patch management simple. This guide will cover: What… [Read more: Understanding Windows Autopatch with Intune](https://techuisitive.com/understanding-windows-autopatch-with-intune/) - [Microsoft Intune – Windows Update Quiz 1](https://techuisitive.com/microsoft-intune-software-update-quiz-1/)Windows Update is a service that keeps devices secure and up to date by delivering patches, feature enhancements, and security improvements. Microsoft Intune streamlines software updates by providing automated deployment, compliance enforcement, and flexible update scheduling for Windows, macOS, iOS, and Android devices. Intune ensures updates are applied efficiently, reducing downtime and security vulnerabilities. To… [Read more: Microsoft Intune – Windows Update Quiz 1](https://techuisitive.com/microsoft-intune-software-update-quiz-1/) - [Fix Incorrect Driver Update Status in Intune](https://techuisitive.com/intune-driver-update-device-not-reporting-correct-status/)Microsoft Intune Driver Update Management streamlines how IT admins deploy and monitor Windows driver updates. However, some devices may report incorrect compliance status even after successfully installing the driver. In this guide, we explain why devices get stuck in the “offering” state, how to confirm installation, and the steps to force a full telemetry sync… [Read more: Fix Incorrect Driver Update Status in Intune](https://techuisitive.com/intune-driver-update-device-not-reporting-correct-status/) - [Manage Windows Drivers Update with Intune](https://techuisitive.com/manage-windows-drivers-update-with-intune/)Windows Driver Update Management in Microsoft Intune allows you to manage the drivers for Windows devices. You can review, approve, and pause the deployment of driver updates on managed Windows 10 and Windows 11 devices. Microsoft Intune and Windows Update for Business deployment service identify the required drivers for the devices based on the driver… [Read more: Manage Windows Drivers Update with Intune](https://techuisitive.com/manage-windows-drivers-update-with-intune/) - [How to Configure Intune Shared Multi User Device](https://techuisitive.com/how-to-configure-intune-shared-multi-user-device/)Managing Windows devices in environments like schools, libraries, or retail stores often requires a secure, multi‑user setup. Microsoft Intune’s Shared PC mode simplifies this by ensuring each user gets a clean, temporary session while administrators retain control over accounts, storage, and policies. In this guide, we’ll walk through how to configure a shared multi‑user device… [Read more: How to Configure Intune Shared Multi User Device](https://techuisitive.com/how-to-configure-intune-shared-multi-user-device/) - [Collect Device Inventory Using Intune Properties Catalog](https://techuisitive.com/collect-device-inventory-using-intune-properties-catalog/)Managing devices effectively requires accurate and detailed inventory data. Microsoft Intune makes this easier with the Properties Catalog, a powerful feature that allows IT admins to collect and report on hardware and software details directly from enrolled endpoints. By leveraging Intune device inventory through the Properties Catalog, organizations can track compliance, monitor configurations, and generate… [Read more: Collect Device Inventory Using Intune Properties Catalog](https://techuisitive.com/collect-device-inventory-using-intune-properties-catalog/) - [Deploy Win32 App Using Intune Enterprise App Catalog \[Step-by-step Guide\]](https://techuisitive.com/deploy-win32-app-using-intune-enterprise-app-catalog/)Microsoft Intune Enterprise App Management makes it simple to discover, deploy, and keep applications up to date using the Enterprise App Catalog. The catalog is a curated collection of both Microsoft and non‑Microsoft Win32 applications, packaged and hosted by Microsoft for seamless deployment. - [How to Bulk Rename Windows Devices from Intune](https://techuisitive.com/how-to-bulk-rename-windows-devices-from-intune/)The Bulk device actions in Microsoft Intune allow you to perform remote actions on the managed devices. You can run the remote actions on up to 100 devices for most of the actions. The following remote actions can be performed on the managed Windows devices. Not all remote actions are available for all platforms. You… [Read more: How to Bulk Rename Windows Devices from Intune](https://techuisitive.com/how-to-bulk-rename-windows-devices-from-intune/) - [How to Rename Device from Intune](https://techuisitive.com/how-to-rename-device-from-intune/)You may need to rename a device that is not named per organization standard. The device can be renamed from the Intune console and no hand and feet support is required. Follow the below steps to rename a device from the Microsoft Intune admin center. On the Rename device flyer window, you can enter the… [Read more: How to Rename Device from Intune](https://techuisitive.com/how-to-rename-device-from-intune/) - [How to Fix Autopilot Device Preparation Error 80180003](https://techuisitive.com/autopilot-device-preparation-error-80180003/)Windows Autopilot simplifies device deployment, but errors like Device Preparation Error 80180003 can disrupt enrollment. This guide explains the root causes—such as MDM authority misconfiguration, device type restrictions, and licensing issues—and provides step-by-step troubleshooting to help IT admins resolve the error quickly and ensure seamless Intune onboarding. Issue – The user is not authorized to… [Read more: How to Fix Autopilot Device Preparation Error 80180003](https://techuisitive.com/autopilot-device-preparation-error-80180003/) - [BitLocker : The encryption method of the OS volume doesn’t match the BitLocker policy](https://techuisitive.com/bitlocker-the-encryption-method-of-the-os-volume-doesnt-match-the-bitlocker-policy/)We identified a BitLocker encryption issue impacting Windows 10 and Windows 11 devices managed through Microsoft Intune. During deployment, several endpoints failed to encrypt and displayed BitLocker error messages related to policy enforcement. After detailed troubleshooting, we discovered the problem is isolated to two specific **HP EliteBook models—830 G6 and 830 G5—**while other HP devices… [Read more: BitLocker : The encryption method of the OS volume doesn’t match the BitLocker policy](https://techuisitive.com/bitlocker-the-encryption-method-of-the-os-volume-doesnt-match-the-bitlocker-policy/) - [Windows Autopilot Device Preparation aka Autopilot v2 Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/)Windows Autopilot Device Preparation, also known as Autopilot v2, is Microsoft’s latest evolution in device provisioning. Unlike the traditional Autopilot process, this streamlined approach eliminates the need to import hardware hashes, relying instead on the device serial number to identify corporate devices. This guide walks you step‑by‑step through configuring Autopilot Device Preparation, helping IT admins… [Read more: Windows Autopilot Device Preparation aka Autopilot v2 Step-by-Step Guide](https://techuisitive.com/windows-autopilot-device-preparation-aka-autopilot-v2-step-by-step-guide/) - [Set Windows 11 Time Zone with Intune Device Configuration Profile](https://techuisitive.com/set-windows-11-time-zone-with-intune-device-configuration-profile/)You can configure the time zone automatically or manually on Windows 10 and Windows 11 devices. The setting can be configured from Settings > Time & Language. When you manage the devices through Microsoft Intune, you can leverage device catalog settings to configure the time zone. However, this method may not be suitable for the… [Read more: Set Windows 11 Time Zone with Intune Device Configuration Profile](https://techuisitive.com/set-windows-11-time-zone-with-intune-device-configuration-profile/) - [Bulk Update Autopilot Group Tag Using PowerShell](https://techuisitive.com/bulk-update-autopilot-group-tag-using-powershell/)Windows Autopilot group tags are used to categorize devices based on specific attributes. You can assign a group tag to a device during autopilot registration or hash import. When you create rules using Autopilot device attributes, Autopilot devices that meet the criteria are automatically added to the group. This simplifies the device grouping during Autopilot device… [Read more: Bulk Update Autopilot Group Tag Using PowerShell](https://techuisitive.com/bulk-update-autopilot-group-tag-using-powershell/) - [Create an offline domain join configuration profile in Intune](https://techuisitive.com/create-an-offline-domain-join-configuration-profile-in-intune/)The offline Domain join feature was introduced in Windows Server 2008 R2. A command line utility named Djoin.exe allow you to join a computer to a domain without physically contacting a domain controller while completing the domain join process. The Windows Autopilot hybrid join use this feature to join the device to on-premises domain during… [Read more: Create an offline domain join configuration profile in Intune](https://techuisitive.com/create-an-offline-domain-join-configuration-profile-in-intune/) - [Create Group Based on Windows Autopilot Group Tag](https://techuisitive.com/create-group-based-on-windows-autopilot-group-tag/)Windows Autopilot group tags make dynamic device management simple. By mapping group tags to Microsoft Entra ID attributes, IT admins can automatically organize devices into security groups during provisioning. This guide walks you step-by-step through creating dynamic groups in Intune using Autopilot group tags, ensuring streamlined enrollment and policy assignment. If you’re new to Windows… [Read more: Create Group Based on Windows Autopilot Group Tag](https://techuisitive.com/create-group-based-on-windows-autopilot-group-tag/) - [How to Block Built-in Apps on iOS Using Intune](https://techuisitive.com/how-to-block-built-in-apps-on-ios-using-intune/)Microsoft Intune includes built-in settings to configure different Apple features on iOS and iPadOS devices. One such configuration is to block built-in apps on iPhone & iPad. You can configure the policy to block built-in apps through the Microsoft Intune device restriction policy. This feature applies to iOS/iPadOS versions below. Most of these settings are available… [Read more: How to Block Built-in Apps on iOS Using Intune](https://techuisitive.com/how-to-block-built-in-apps-on-ios-using-intune/) - [How to Fix Autopilot Error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/)Windows Autopilot Error 80070002 typically occurs during Hybrid Azure AD Join deployments when the Offline Domain Join (ODJ) process fails. This error indicates that the Intune Connector was unable to apply the domain join blob correctly, often due to misconfigured OU permissions, trailing spaces in computer name prefixes, or connector communication issues. For IT administrators,… [Read more: How to Fix Autopilot Error 80070002](https://techuisitive.com/how-to-fix-autopilot-error-80070002/) - [How to Fix Intune Win32 App Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/)Deploying Win32 applications through Microsoft Intune can sometimes throw unexpected errors that block installations. One common issue administrators face is Intune Win32 App Error 0x87D30006, which occurs when detection rules are misconfigured or cannot be parsed. In this guide, we’ll explain the root cause of this error, walk through a real-world example, and show you… [Read more: How to Fix Intune Win32 App Error 0x87D30006](https://techuisitive.com/how-to-fix-intune-win32-app-error-0x87d30006/) - [Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/)Microsoft Intune includes some built-in settings to configure different Apple features on iOS/iPadOS devices. One such setting is to configure lock screen messages on iPhones & iPads. You can configure the lock screen message through Device feature profiles. This feature applies to below iOS/iPadOS versions. These settings are available for Automated Device Enrollment (Supervised) devices. Figure:… [Read more: Configure iOS Lock Screen Message through Intune](https://techuisitive.com/configure-ios-lock-screen-message-through-intune/) - [How to Fix Intune Enrollment Error 0x800705b4](https://techuisitive.com/how-to-fix-intune-enrollment-error-0x800705b4/)When enrolling Windows devices into Microsoft Intune, administrators may encounter the error code 0x800705b4, often during the Device Preparation stage. This error typically occurs when Bring Your Own Device (BYOD) enrollment is blocked by Intune’s platform restriction policies. While the message itself can be frustrating, the underlying cause is straightforward: Intune is preventing personal devices… [Read more: How to Fix Intune Enrollment Error 0x800705b4](https://techuisitive.com/how-to-fix-intune-enrollment-error-0x800705b4/) - [Create ADE Enrollment Profile in Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/)The corporate-owned devices purchased through Apple Business Manager or Apple School Manager can be enrolled in Microsoft Intune via Apple automated device enrollment. An ADE enrollment profile is required to enroll the device. A device enrollment profile defines the settings applied to a group of devices during enrollment. This article will demonstrate how to create… [Read more: Create ADE Enrollment Profile in Intune](https://techuisitive.com/create-ade-enrollment-profile-in-intune/) - [Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/)Microsoft Intune has built-in policies that can manage software updates on iOS/iPadOS supervised devices. It’s recommended to use these policies to manage software updates through Intune and not leave the responsibility to install software updates to the end users. Leaving iOS update responsibility to the end user may lead to different issues. Users can apply… [Read more: Manage iOS Updates on Supervised Devices through Intune](https://techuisitive.com/manage-ios-updates-on-supervised-devices-through-intune/) - [How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/)Microsoft Intune includes some built-in settings to configure different Apple features on iOS/iPadOS devices. One of such setting is to show or hide built-in (native) apps. You can configure the policy for visible or hidden apps through Intune device restriction profiles. This feature applies to below iOS/iPadOS versions. These settings are available for Automated Device Enrollment… [Read more: How to Show or Hide Native Apps on iOS via Intune](https://techuisitive.com/how-to-show-or-hide-native-apps-on-ios-via-intune/) - [Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/)Microsoft Intune includes some built-in settings to configure different Apple features on iOS/iPadOS devices. One of such setting is to customize dock and home screen layout. The home screen layout setting applied to: When you apply a home screen layout through Intune policy, it’s overwrites any user defined layouts. Hence, it’s recommended to use this… [Read more: Configure Home Screen Layout on iOS using Intune](https://techuisitive.com/configure-home-screen-layout-on-ios-using-intune/) - [Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/)When you try to sign in to any M365 apps on Microsoft Intune-managed iOS / iPadOS devices ( iPads / iPhones ), the message something went wrong – 2002 may appear. The issue happens to all Microsoft 365 / o365 apps which include MS Excel , Word, PowerPoint , OneDrive , Power BI, etc. There… [Read more: Fix Something went wrong – 2002 error on iOS | Intune](https://techuisitive.com/fix-something-went-wrong-2002-error-on-ios/) - [Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/)A dynamic group membership updates automatically based on defined rules. You can create attribute-based rules to update the group membership. You can create a dynamic group in Entra ID for users or devices. However, you can’t create rules that contain both the user and the device. You can add multiple membership rules in a dynamic… [Read more: Dynamic Group Based on Enrollment Profile in Intune](https://techuisitive.com/dynamic-group-based-on-enrollment-profile-in-intune/) - [How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/)The Apple Web Content Filter settings can be used to allow / restrict the website access on iOS / iPadOS ( iPhone & iPad ) devices. Microsoft Intune provide an option to configure web content filters on Intune managed iOS devices. These settings are available in device feature profile. These settings works for supervised device… [Read more: How to Restrict Website Access Using Web Content Filter | Intune](https://techuisitive.com/how-to-restrict-website-access-using-web-content-filter/) - [Deny M365 Apps access from Untrusted Locations | Intune](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/)Conditional Access is a feature of Microsoft Entra ID that helps organizations improve security and compliance. Conditional access policy includes sets of conditions which user or device must satisfy to access company resources. A conditional access policy can be used to allow or block access to company resources. In this blog post, we will demonstrate how to… [Read more: Deny M365 Apps access from Untrusted Locations | Intune](https://techuisitive.com/deny-m365-apps-access-from-untrusted-locations/) - [How to Export Endpoint Security Policies in Intune](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune/)Exporting and importing endpoint security policies in Microsoft Intune can save administrators significant time when migrating, testing, or replicating configurations across tenants. While the Intune admin center doesn’t yet provide a direct export option for endpoint security policies, PowerShell Intune Samples scripts offer a reliable workaround. In this guide, we’ll walk through the step-by-step process… [Read more: How to Export Endpoint Security Policies in Intune](https://techuisitive.com/how-to-export-endpoint-security-policies-in-intune/) - [How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/)You may have a requirement to export or import Microsoft Intune policies while working on Intune tenant to tenant migration as part of divestiture, merger or acquisition. It’s also required when you tested the policy in a test environment and later need to migrate the same to production environment. You can also have standard set… [Read more: How to Export Device Configuration Profiles in Intune](https://techuisitive.com/how-to-export-device-configuration-profiles-in-intune/) - [Export and Import Device Compliance Policies in Intune](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/)You may have a requirement to export or import Microsoft Intune policies while working on tenant migration or setting up a new environment. The export and import can save a lots of time when working on tenant migration or consolidation. You can also have standard set of policies in JSON to quickly import while working… [Read more: Export and Import Device Compliance Policies in Intune](https://techuisitive.com/export-and-import-device-compliance-policies-in-intune/) - [How to Export Settings Catalog Policy in Intune](https://techuisitive.com/export-settings-catalog-policy-in-intune/)Intune Settings catalog are new way of managing settings through Intune. Settings catalog lists all the settings you can configure, and all in one place. This feature simplifies how you create a policy, and how you see all the available settings. We can export Microsoft Intune policies using PowerShell scripts in JSON file. The exported… [Read more: How to Export Settings Catalog Policy in Intune](https://techuisitive.com/export-settings-catalog-policy-in-intune/) - [Export Device Configuration Profiles List in Intune](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/)While managing an Intune environment, the number of policies grows over time. At some point in time, you may need to review all existing policies to understand if they are still required, need to be consolidated, or need to be retired. A review may also be required if multiple tenants need to be consolidated or… [Read more: Export Device Configuration Profiles List in Intune](https://techuisitive.com/export-device-configuration-profiles-list-in-intune/) - [How to Create and Manage Microsoft Intune Device Categories](https://techuisitive.com/how-to-create-and-manage-microsoft-intune-device-categories/)Microsoft Intune device categories allow you to manage easily and group devices. Intune device category can be used to create Azure AD group and Assignment Filters to manage policy deployments. The devices can be automatically added into Azure AD (Entra ID) groups or Assignment Filters based on the device category assigned to a device. Device… [Read more: How to Create and Manage Microsoft Intune Device Categories](https://techuisitive.com/how-to-create-and-manage-microsoft-intune-device-categories/) - [Deploy Win32 App using Microsoft Store app (new) | Intune](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/)The new Microsoft Store app integration in Intune makes it easier than ever to deploy and manage Win32 applications across Windows 10 and Windows 11 devices. Instead of manually packaging installers, IT admins can leverage the Microsoft Store (new) and Winget to distribute apps directly through Intune, ensuring simplified deployment, automatic updates, and streamlined lifecycle… [Read more: Deploy Win32 App using Microsoft Store app (new) | Intune](https://techuisitive.com/deploy-win32-app-using-microsoft-store-app-new-intune/) - [How to Manage Local Administrators Group Membership on Microsoft Entra Joined Devices Using Intune](https://techuisitive.com/how-to-manage-the-local-administrators-group-on-azure-ad-joined-devices-intune/)Starting with Windows 10 version 20H2, you can use Azure AD groups to manage local administrators group privileges on Azure AD joined devices with the Local Users and Group MDM policy. Organizations can use Microsoft Intune to manage these policies using Custom OMA-URI Settings or Account protection policy. - [How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/)Windows Local Administrator Password Solution (LAPS) from Microsoft allows you to manage and rotate local administrator passwords on Windows devices. A custom RBAC role in Intune is required if you want to delegate password administration to help desk members. The password administration for Windows LAPS includes retrieving the password for a Windows device from the… [Read more: How to Create a Custom RBAC Role in Intune for LAPS Password Administrator](https://techuisitive.com/how-to-create-custom-rbac-role-in-intune-for-laps-password-administrator/) - [How to deploy Android .APK Apps in Microsoft Intune](https://techuisitive.com/how-to-deploy-android-apk-apps-in-microsoft-intune/)Use the Manage Google Play App option in Intune to deploy custom Android APK files. This allows you to add LOB apps by submitting just the app APK and a title, directly within Intune. This method does not require you to have a Google developer account and does not require you to pay the fee… [Read more: How to deploy Android .APK Apps in Microsoft Intune](https://techuisitive.com/how-to-deploy-android-apk-apps-in-microsoft-intune/) - [Intune Bulk Enrollment with Provisional Package failed with Error 0xCAA2000C](https://techuisitive.com/intune-bulk-enrollment-with-provisional-package-failed-error-0xcaa2000c/)Using provisioning package device failed to complete AAD Join with error 0xCAA2000C. The issue can also be tracked under Audit Logs in Azure. You will get entry of the device that you are trying to onboard , looking at the Azure audit logs it shows that the device gets added and then gets removed immediately. - [How to Manage Windows LAPS with Intune](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/)Windows LAPS (Local Administrator Password Solution) is now built directly into Windows and does not require installation of the legacy Microsoft LAPS. All modern features are available without referring back to the old solution, making deployment simpler and more secure. In this blog post, we’ll explore how to use Microsoft Intune together with Windows LAPS… [Read more: How to Manage Windows LAPS with Intune](https://techuisitive.com/manage-windows-local-administrator-password-with-intune-windows-laps/) - [Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/)Microsoft 365 Apps can be deployed using Intune and deployed as Microsoft 365 Apps Type. Making it available for self-service install in the Intune company portal, you may experience that Microsoft 365 Apps is stuck in a downloading status. We recommend that you use Microsoft documentation for troubleshooting, installation, or download failure. However, if it… [Read more: Deploying Microsoft 365 Apps Stuck in Downloading in Company Portal](https://techuisitive.com/deploying-microsoft-365-apps-stuck-in-downloading-in-company-portal/) - [Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/)Deploy Microsoft SQL Server Management Studio (SSMS) 20.x through Intune Microsoft SQL Server Management Studio (SSMS) continues to evolve, with SSMS 20.x now available as the latest release. If you are still using SSMS 19.0.2, it is recommended to upgrade to the current version for enhanced stability, performance, and feature updates. In this guide, we… [Read more: Deploy Microsoft SQL Server Management Studio 19.02 through Intune](https://techuisitive.com/deploy-microsoft-sql-server-management-studio-19-02-through-intune/) - [Organizing Laptops and Desktops in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/)Organizing laptops and desktops in device management has always been a challenge. In SCCM, we had to use Chassis type, and in Intune, we can’t use that anymore. Problem Organizations may require deploying apps or policies only to desktops or laptops. We have often found in various forum Dynamic Group should be used to create… [Read more: Organizing Laptops and Desktops in Intune Using Filters](https://techuisitive.com/organizing-laptop-and-desktop-in-intune-using-filters/) - [Get Hardware Hash for Windows Autopilot](https://techuisitive.com/how-to-obtain-hardware-hash-for-manually-registring-devices-with-windows-autopilot/)To identify a device with Windows Autopilot, the device’s unique hardware identify (hardware hash) must be captured and uploaded to the service. This is usually first step when you want to provision a machine using Windows Autopilot. The hardware hash can be uploaded by manufacturer / raeseller for new devices. However, hardware hash need to be collected manually for the devices which are already in corporate environment and not already enrolled into Microsoft Intune. - [How to Configure Windows Kiosk Using Microsoft Intune | Windows 10 / 11](https://techuisitive.com/configure-windows-10-11-device-as-kiosk-microsoft-intune/)Windows kiosk is a lockdown mechanism to restrict device access to pre-defined applications. The applications appears on the desktop and user can only use those applications. Kiosk are mostly placed in public area to allow access to specific applications to authorized users or guests. For example, a self check-in kiosk at airport. We can use Microsoft Intune to deploy a Device configuration profile to configure Windows Kiosk on Windows 10 / 11 device as single app or multi-app kiosk. - [SCCM Dynamic Collection for Windows 10 / 11 Devices | ConfigMgr](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/)In ConfigMgr , a dynamic collection membership is based on query rules. A dynamic or query based collection can have multiple query rules and collection membership updates at each collection evaluation cycle. In this blog post, we will discuss about collection queries for Windows 10 and later devices. What are Collection Queries The collection queries… [Read more: SCCM Dynamic Collection for Windows 10 / 11 Devices | ConfigMgr](https://techuisitive.com/sccm-dynamic-collection-for-windows-10-11-devices-configmgr/) - [Fix Windows 11 Intune Enrollment Error 0x800700b7 \[Step-by-Step Guide\]](https://techuisitive.com/windows-11-enrollment-failed-with-error-0x800700b7/)You may encounter below error when trying to enroll Windows 11 device to Intune with provisioning package. Provisioning failure , Installation of a provisioning package failed. Please work with the package author to diagnose the problem. Reported error code: 0x800700b7 - [Bulk Enrollment of Windows 10 / 11 Devices to Intune Using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/)Managing hundreds of corporate-owned Windows devices can be complex without automation. Bulk enrollment of Windows 10 and Windows 11 devices into Microsoft Intune offers IT admins a fast, scalable way to configure and secure endpoints. By using provisioning packages with Windows Configuration Designer, organizations can automatically join devices to Microsoft Entra ID (formerly Azure Active… [Read more: Bulk Enrollment of Windows 10 / 11 Devices to Intune Using Provisioning Package](https://techuisitive.com/bulk-enrollment-of-windows-10-11-devices-to-intune/) - [That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/)You may encounter the following error when trying to disconnect a Work or School account on Windows 10 / 11. The issue keeps happening with different local administrator accounts as well. Error: That account info didn’t work. Ensure you’re entering information for a local administrator account and try again. Cause: This issue may occur if the… [Read more: That account info didn’t work – error when disconnecting Windows 10 / 11 Work or School account](https://techuisitive.com/that-account-info-didnt-work-error-when-disconnecting-windows-10-11-work-or-school-account/) - [How to Enroll a Windows 11 Device in Intune Using Microsoft Entra Join](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/)Enrolling Windows 11 corporate devices into Microsoft Intune is a critical step for IT administrators to ensure secure management, compliance, and streamlined access. One of the most reliable methods is using Azure AD Join, now known as Microsoft Entra ID Join, which directly connects devices to the organization’s cloud directory. This guide provides a step‑by‑step… [Read more: How to Enroll a Windows 11 Device in Intune Using Microsoft Entra Join](https://techuisitive.com/enroll-windows-11-device-to-intune-through-azure-ad-join-method-corporate-devices/) - [How to Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/)Google Chrome remains one of the most widely used browsers in enterprise environments, and ensuring a consistent, secure deployment across managed devices is a key responsibility for IT admins. While SCCM traditionally handled browser deployments through packages and collections, Microsoft Intune offers a modern, cloud‑based approach using Win32 app deployment. In this guide, we’ll walk… [Read more: How to Deploy Google Chrome for Enterprise with Intune Win32 App](https://techuisitive.com/deploy-google-chrome-for-enterprise-with-intune-win32-app/) - [How to Prepare Win32 App Installation Source for Intune Using Intune WinAppUtil](https://techuisitive.com/how-to-prepare-win32-app-installation-source-for-microsoft-intune/)Win32 apps provide us greater control over the deployment of application. We can deploy 32 bit and 64 bit application through Microsoft Intune Win32 apps. The Win32 apps support deployment of multiple files via IntuneWin wrapper / Intune WinAppUtil (intuneWinAppUtil.exe). The IntuneWin Wrapper can be used to deploy multiple files such as MSI with transform (MST). The Win32 app also support the deployment of .EXE file by converting them to .intunewin format. IntuneWinAppUtil help you to prepare win32 app installation source for Microsoft Intune deployment. - [How to Configure Google Chrome settings using Administrative templates | Intune](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/)Managing browser settings across an enterprise can be challenging, especially when relying on custom OMA-URI configurations. With the release of Intune Administrative Templates for Google Chrome, IT admins can now configure policies quickly and consistently without complex scripting. In this guide, we’ll walk through how to use Intune Endpoint Manager to apply Chrome settings such… [Read more: How to Configure Google Chrome settings using Administrative templates | Intune](https://techuisitive.com/configure-google-chrome-settings-using-administrative-templates-intune-endpoint-manager/) - [How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/)The PowerShell SDK for Intune Graph API helps IT professionals automate and manage their Microsoft Intune environment through PowerShell without going to the Endpoint Manager Admin Center. In this article, we will see how to export the serial number for multiple devices using the PowerShell module for Intune Graph API. If you don’t have PowerShell… [Read more: How To Export Serial number of Multiple Devices using PowerShell SDK for Intune Graph API](https://techuisitive.com/how-to-export-serial-number-of-multiple-devices-using-powershell-sdk-for-intune-graph-api/) - [Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/)Microsoft Edge’s Sleeping Tabs feature is a smart way to optimize browser performance by reducing memory and CPU usage. While it’s enabled by default, IT admins can fine‑tune these settings for enterprise environments using Microsoft Intune. In this guide, we’ll walk through step‑by‑step instructions to configure Sleeping Tabs policies, ensuring better resource management, faster responsiveness,… [Read more: Configure Microsoft Edge Sleeping Tabs using Microsoft Intune](https://techuisitive.com/configure-microsoft-edge-sleeping-tabs-using-microsoft-intune/) - [How to Export Managed Device Details from Intune](https://techuisitive.com/how-to-export-managed-device-details-from-intune-using-mem-admin-center-powershell-sdk-for-intune/)Managed devices are devices that are under some sort of organization control. You administrator can setup or restrict some feature or control how device can be used. The devices managed by Microsoft Intune are called Intune Managed Devices. We can export managed device details from Microsoft Intune Admin Center. We can also use PowerShell SDK for Microsoft Intune Graph API to export the device details in CSV file. - [How to Get AAD Group Members Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/)We will use PowerShell module for Microsoft Intune Graph API to get Azure AD group members details. If you have not already installed PowerShell SDK for Microsoft Intune Graph API then follow the steps provided in this article to install the PowerShell module and connect with MSGraph API with admin consent for the first time.… [Read more: How to Get AAD Group Members Details Using PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/get-aad-group-members-details-using-powershell-sdk-for-microsoft-intune-graph-api/) - [SCCM Device Collection Equivalents in Microsoft Intune](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/)In SCCM, collections have always been the go‑to mechanism for targeting deployments. For example, if you needed to apply a patch to all Dell computers, the quickest way was to build a collection of Dell devices and deploy the fix directly to that group. The same approach worked for application upgrades in the legacy package… [Read more: SCCM Device Collection Equivalents in Microsoft Intune](https://techuisitive.com/sccm-device-collection-equivalents-in-microsoft-intune-for-app-deployment/) - [How to Install PowerShell SDK for Microsoft Intune Graph API](https://techuisitive.com/install-powershell-sdk-for-microsoft-intune-graph-api/)Microsoft is deprecating the Azure AD PowerShell Module and MS Online module in 2022. So, admin need to migrate to either PowerShell SDK for Microsoft Intune Graph API or Microsoft Graph API. Let’s see how we can install PowerShell SDK for Microsoft Intune Graph API from PowerShell Gallery. - [Deny Write Access to USB Devices Using Intune Settings Catalog](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/)USB devices are convenient for transferring files, but they pose a significant data security risk in enterprise environments. Using Microsoft Intune and Endpoint Manager, administrators can enforce policies that block or restrict USB usage to protect sensitive information. In this guide, we’ll walk through how to deny write access to USB devices using Intune Catalog… [Read more: Deny Write Access to USB Devices Using Intune Settings Catalog](https://techuisitive.com/deny-write-access-to-usb-devices-using-intune-catalog-settings/) - [Understanding Win32 App Requirements Rule in Microsoft Intune](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/)Deploying Win32 apps in Microsoft Intune isn’t just about packaging and pushing software—it’s about ensuring the right conditions are met before installation. Intune’s Requirements Rules give admins precise control, from verifying OS architecture to checking disk space, registry keys, or custom PowerShell scripts. In this guide, we’ll break down each requirement type, show real‑world examples,… [Read more: Understanding Win32 App Requirements Rule in Microsoft Intune](https://techuisitive.com/understanding-win32-app-requirements-rule-microsoft-intune/) - [How to Provision Windows 10 / 11 Device using Intune and Windows Autopilot](https://techuisitive.com/windows-10-autopilot-deployment-guide-microsoft-intune/)Windows Autopilot is a modern deployment solution from Microsoft that simplifies how IT teams provision, configure, and manage Windows 10/11 devices. By integrating with Microsoft Intune and Azure Active Directory (Entra ID), Autopilot enables zero‑touch setup, repurposing, and recovery of devices with minimal infrastructure. - [How to Configure Enrollment Status Page (ESP) in Microsoft Intune](https://techuisitive.com/configure-enrollment-status-page-esp-microsoft-intune/)The Enrollment Status Page (ESP) shows the progress of device provisioning when a new device enrolled to Intune or a new user sign in to the device. You can show ESP during the default out-of-box experience (OOBE) for Azure AD join, Windows Autopilot scenarios or when new user sign into the device for the first time. In this article, we will create a new Enrollment Status Page profile for Windows Autopilot devices. - [SCCM Client Installation Failed with error 0x87d0027e](https://techuisitive.com/sccm-client-installation-failed-with-error-0x87d0027e/)ConfigMgtr | SCCM client installation may fail with below error when management point is configured for HTTPS. [CCMHTTP] ERROR: URL=http://CMSRV01.techuisitive.local/ccm_system/request, Port=80, Options=1248, Code=0, Text=CCM_E_BAD_HTTP_STATUS_CODE Failed (0x87d0027e) to send location request to ‘CMSRV01.techuisitive.local’. StatusCode 403, StatusText ‘Forbidden’ GetDPLocations failed with error 0x87d0027e Failed to get DP locations as the expected version from MP ‘CMSRV01.techuisitive.local’. Error 0x87d0027e - [Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/)This post is a collection of Microsoft Endpoint Manager / Intune error codes and reference articles. Intune : Win32 App Deployment Intune : Win32 app deployment failed with error code 0x87D300C9 Error code : 0x87D300C9 Error Description: The unmonitored process is in progress, however it may timeout. Intune : Win32 app deployment failed with error… [Read more: Microsoft Endpoint Manager: Error Code Reference](https://techuisitive.com/microsoft-endpoint-manager-error-code-reference/) - [MDM Enroll: Device Credential, Failed (Unknown Win32 Error code: 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/)In a hybrid Azure AD setup, you may encounter situations where a workstation fails to enroll in Intune after completing the Hybrid Join process. When you check the Event Viewer under Applications and Services → Microsoft → Windows → DeviceManagement → Enterprise-Diagnostics-Provider → Operational, you might see the error: Unknown Win32 Error code: 0xcaa9001f Microsoft’s… [Read more: MDM Enroll: Device Credential, Failed (Unknown Win32 Error code: 0xcaa9001f](https://techuisitive.com/mdm-enroll-device-credential-failed-unknown-win32-error-code-0xcaa9001f/) - [Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive](https://techuisitive.com/intune-understanding-win32-app-detection-rules/)Win32 app detection rules in Microsoft Intune are critical for ensuring accurate application deployment and compliance. These rules determine whether an app is already installed, when it should be offered, and how uninstall actions are triggered. In this guide, we’ll break down the different detection methods—MSI, file, registry, and custom PowerShell scripts—along with practical examples… [Read more: Understanding Win32 App Detection Rules in Microsoft Intune – Deep Dive](https://techuisitive.com/intune-understanding-win32-app-detection-rules/) - [Intune – Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/)The Win32 app in Microsoft Intune offers enhanced control over application deployment. However, deployment failures can occur, and understanding the troubleshooting steps for Intune Win32 apps is essential. One common issue is the error code 0x80070643, which indicates a fatal error during installation. This error can stem from various causes—some are easy to identify, while… [Read more: Intune – Win32 App Deployment failed with error code 0x80070643](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-code-0x80070643/) - [Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/)Deploying Win32 applications with Microsoft Intune can sometimes fail with the error code 0x87D1041C, which translates to “The application was not detected after installation completed successfully.” This issue typically occurs when Intune detection rules (MSI, File, Registry, or custom script) are misconfigured or fail to validate the app’s presence after installation. In this guide, we’ll… [Read more: Win32 App Deployment Failed with Error 0x87D1041C](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d1041c/) - [Win32 App Deployment with Dependencies | Microsoft Intune](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/)Windows Apps (Win32) in Microsoft Intune / Endpoint Manager provide us with greater control over the deployment of applications. The Win32 apps allow us to configure additional parameters similar to Configuration Manager application model features such as Detection methods, Dependencies & Supersedence. In this blog post, we will understand what application dependencies are and how… [Read more: Win32 App Deployment with Dependencies | Microsoft Intune](https://techuisitive.com/win32-app-deployment-with-dependencies-microsoft-intune/) - [Fix Intune Win32 App Deployment Error 0x87d300c9 (Step‑by‑Step Guide)](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/)Deploying Win32 apps through Intune can sometimes throw unexpected errors that leave administrators puzzled. One common issue is error 0x87D300C9, which typically indicates that the installer failed to run silently or timed out during execution. In this guide, we’ll break down the root causes of this error, show you how to analyze logs, and walk… [Read more: Fix Intune Win32 App Deployment Error 0x87d300c9 (Step‑by‑Step Guide)](https://techuisitive.com/intune-win32-app-deployment-failed-with-error-0x87d300c9/) - [Intune Win32 App Deployment failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/)Deploying Win32 applications through Microsoft Intune can sometimes throw unexpected errors that leave administrators puzzled. One common issue is the failure with error code 0x80070653, which typically points to problems with the MSI installer package or detection rules. In this guide, we’ll break down what this error means, explore the most frequent causes, and walk… [Read more: Intune Win32 App Deployment failed with error code 0x80070653](https://techuisitive.com/intune-win32-app-failed-with-error-code-0x80070653/) - [Microsoft Intune LOB vs Win32 Apps: Which Application Type Should You Use?](https://techuisitive.com/intune-application-deployment-line-of-business-lob-vs-win32-apps/)Line of Business Application (LOB) is legacy application deployment method in Microsoft Intune. The LOB applications support single file format such as .msi, .msix, .appx etc. They only support simple installation. An MSI with a transform file (MST) cannot be deployed using this method. The LOB objects have limited capabilities and they don’t support few rich capabilities of Configuration Manager Application Model such as Detection methods & Dependencies. - [How to Join a Windows 10 Device to Entra ID](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/)Microsoft Entra ID (Formerly Azure Active Directory) is a cloud version of on-premises Active Directory. You have to join the machine to Azure Active Directory to manage it through Microsoft Intune. Here are the steps to join Windows 10 devices to Microsoft Entra ID. Go to Windows 10 Settings | Accounts | Access Work or… [Read more: How to Join a Windows 10 Device to Entra ID](https://techuisitive.com/join-windows-10-device-to-azure-active-directory/) - [Manage Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/)On Windows 10 and Windows 11 desktops, the wallpaper (background) is the image displayed behind icons, folders, and applications. Users can personalize this through Windows settings, choosing photos, solid colors, or even slideshows. In enterprise environments, however, IT administrators often need to enforce a standard wallpaper or lock screen for branding, compliance, or security. This… [Read more: Manage Desktop Wallpaper with Microsoft Intune](https://techuisitive.com/manage-windows-10-11-desktop-wallpaper-with-microsoft-intune/) - [How to Block USB Device Access with Exceptions using Microsoft Intune](https://techuisitive.com/block-usb-device-access-with-exceptions-microsoft-intune/)Microsoft Intune includes Endpoint security policies which you can use to secure your device and mitigate the risks. The Endpoint security blade list all the tools available through Endpoint Manager that you will use to keep devices secure. In this blog post, we will discuss how to block USB device access using Microsoft Intune Device Control settings. We will also discuss how to manage exceptions so user’s with genuine business need can still access USB media’s. - [Manage Microsoft Edge Favorites with Intune for Windows 10/11](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/)Managing browser favorites may seem minor, but for IT administrators, it’s a powerful way to streamline onboarding, enforce compliance, and boost productivity. With Microsoft Intune, you can centrally configure and deploy Edge Chromium favorites across all managed devices—ensuring employees always have quick access to the sites that matter most. In this guide, we’ll walk through… [Read more: Manage Microsoft Edge Favorites with Intune for Windows 10/11](https://techuisitive.com/manage-edge-chromium-favorites-with-endpoint-manager-intune/) - [Check OS Version Compliance with Intune Compliance Policy](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/)Microsoft Intune compliance policies can be used to check whether Windows devices are running a supported operating system version. By configuring a minimum OS version requirement, you can mark devices running older Windows versions as noncompliant and notify users so they can take corrective action. In this guide, we will create an Intune compliance policy… [Read more: Check OS Version Compliance with Intune Compliance Policy](https://techuisitive.com/check-os-version-compliance-with-device-compliance-policy-notify-user-microsoft-intune/) - [Configure Edge Homepage & Startup Page Using Intune Administrative Templates](https://techuisitive.com/intune-configure-edge-chromium-homepage-startup-page/)Microsoft Endpoint Manager (Intune) Device Configuration profiles allow you to add and configure settings, and then push these settings to devices in your organization. In this post, we will create a Device configuration profile in Microsoft Intune to set Home page and Startup page in Microsoft Edge. Before we go ahead, let’s understand the difference between Home page and Startup page. [View All Posts](https://techuisitive.com/category/intune/) --- ### [Contributor Guidelines](https://techuisitive.com/contributor-guidelines/) **Published:** April 15, 2026 **Author:** Equebal Ahmad **Content:** ## Contributor Guidelines for Techuisitive We welcome contributions from professionals and enthusiasts who want to share their expertise in cloud management, SCCM, Intune, PowerShell, AI/ML fundamentals, and related technologies. To maintain quality and relevance, please review the following guidelines before submitting your proposal. ## 🎯 What We’re Looking For - **Topics:** Endpoint management, SCCM, Intune, Windows Autopilot, PowerShell scripting, AI/ML fundamentals, cloud security, and troubleshooting workflows. - **Style:** Clear, stepwise guides, structured walkthroughs, annotated scripts, and practical examples. - **Audience:** IT administrators, learners, and professionals seeking actionable insights. ## ✍️ Submission Requirements - **Original Content:** Articles must be unique and not published elsewhere. - **Length:** Minimum 800–1000 words, well-structured with headings and subheadings. - **SEO-Friendly:** Use keywords naturally, include meta descriptions, and ensure accessibility. - **Visuals:** Diagrams, tables, or screenshots are encouraged for clarity. - **Bio:** Provide a short author bio (2–3 sentences) with optional LinkedIn or website link. ## 🚫 What We Don’t Accept - Promotional or sales-driven content. - Plagiarized or AI-generated articles without human editing. - Off-topic submissions unrelated to our focus areas. ## 📧 How to Contribute - Email your proposal to: **contactus@techuisitive.com** - Include: - Proposed title and outline - Short author bio - Any supporting visuals or diagrams ## 🤝 Collaboration Opportunities Beyond guest posts, we welcome: - Co-authoring technical guides - Sharing research insights - Community-driven projects ## ✅ Final Note We value quality, clarity, and actionable insights. By contributing, you join a growing community of professionals passionate about endpoint and cloud management. Together, we make technical knowledge more accessible and practical. --- ### [Products](https://techuisitive.com/products/) **Published:** January 18, 2026 **Author:** Equebal Ahmad **Content:** ### [PowerShell Script to Automate Intune Remediation Script Creation](https://techuisitive.com/downloads/powershell-script-to-automate-intune-remediation-script-creation/) The script can be used to automate Intune Remediation Script Creation with the Microsoft Graph API. Please check out the article below for a step-by-step guide to using this script. \[…\] Free Free – Purchase [Checkout](https://techuisitive.com/checkout/) Added to cart ### [Bulk Add Devices to Entra Group Script Download](https://techuisitive.com/downloads/bulk-add-devices-to-entra-group-script-download/) Use the PowerShell script below to seamlessly add devices to an Entra ID group by referencing their names from a CSV file. This approach eliminates the need to manually look \[…\] Free Free – Purchase [Checkout](https://techuisitive.com/checkout/) Added to cart ### [Bulk Export Entra ID Group Members Script Download](https://techuisitive.com/downloads/bulk-export-entra-id-group-members-script-download/) This PowerShell script leverages the Microsoft Graph PowerShell SDK to bulk export membership details for multiple Azure AD groups in one go. Designed for IT administrators, it reads group names \[…\] Free Free – Purchase [Checkout](https://techuisitive.com/checkout/) Added to cart ### [Intune Bulk Device Sync Script Download](https://techuisitive.com/downloads/intune-bulk-device-sync-script/) This PowerShell script leverages the Microsoft Graph PowerShell SDK to trigger sync requests for multiple Intune‑managed devices in one go. Designed for IT admins, it reads device names from a \[…\] Free Free – Purchase [Checkout](https://techuisitive.com/checkout/) Added to cart --- ### [Checkout](https://techuisitive.com/checkout/) **Published:** January 18, 2026 **Author:** Equebal Ahmad **Content:** Your cart is empty. --- ### [Receipt](https://techuisitive.com/checkout/receipt/) **Published:** January 18, 2026 **Author:** Equebal Ahmad **Content:** Sorry, trouble retrieving order receipt. --- ### [Transaction Failed](https://techuisitive.com/checkout/transaction-failed/) **Published:** January 18, 2026 **Author:** Equebal Ahmad **Content:** Your transaction failed; please try again or contact site support. --- ### [Order History](https://techuisitive.com/checkout/order-history/) **Published:** January 18, 2026 **Author:** Equebal Ahmad --- ### [Confirmation](https://techuisitive.com/checkout/confirmation/) **Published:** January 18, 2026 **Author:** Equebal Ahmad **Content:** Thank you for your purchase! Your purchase session could not be retrieved. --- ### [Techuisitive Apps](https://techuisitive.com/apps/) **Published:** December 7, 2025 **Author:** Equebal Ahmad **Content:** [![analysis, analytics, business, charts, computer, concept, data, desk, device, diagram, digital, documents, graphs, information, investment, job, management, marketing, modern, office, report, business, business, data, data, data, data, data, information, investment, investment, management, marketing, marketing, marketing, report, report, report](https://techuisitive.com/wp-content/uploads/2025/12/ge84995558c907e93fee22919363c67683d47df7d8e6f9a0402a2b7cb6eeadb9dcb0c0c9264fa8add0b4ee0aa5ff906fa221f9b9c28611a005a8a751a86a7e73b_1280-1841158-1024x682.jpg "ge84995558c907e93fee22919363c67683d47df7d8e6f9a0402a2b7cb6eeadb9dcb0c0c9264fa8add0b4ee0aa5ff906fa221f9b9c28611a005a8a751a86a7e73b_1280-1841158")](https://techuisitive.com/) [](https://techuisitive.com/)### Techuisitive Blog Learn the essentials of modern device management [![tasbeeh, counter, mosque, beeds, counting, faith, god, islam, muslim, moslem, prayer, praying, religion, sacred, tasbih, ramadan, religious, islamic, holy, worship, arabic, culture, beads, elegant, elegance, decoration, craft, handmade, tasbeeh, tasbeeh, tasbeeh, islam, tasbih, tasbih, ramadan, ramadan, ramadan, ramadan, islamic, islamic, islamic, islamic, islamic](https://techuisitive.com/wp-content/uploads/2025/12/g54f0b7de5b3a593b23d394c5ea3f7e03f8c008e22523681aa320adc3dd46378952a2360b3e6019c2842711274d1327f61e4b11817dbbfc75d6c5bce13d80823a_1280-2893840-1024x682.jpg "g54f0b7de5b3a593b23d394c5ea3f7e03f8c008e22523681aa320adc3dd46378952a2360b3e6019c2842711274d1327f61e4b11817dbbfc75d6c5bce13d80823a_1280-2893840")](https://tasbeeh-tally.lovable.app/) [](https://tasbeeh-tally.lovable.app/)### Tasbeeh Tally App Track collective spiritual progress with your community [![A child engages in a fun memory matching card game, showcasing focus and concentration.](https://techuisitive.com/wp-content/uploads/2025/12/pexels-photo-7943257-7943257-1024x683.jpg "pexels-photo-7943257-7943257")](https://ezebenterprise.com/memory-match/) [](https://ezebenterprise.com/memory-match/)### Memory Match Challenge This classic online challenge invites you to flip cards, remember their positions, and match pairs as quickly as possible [![Dynamic abstract composition of colorful overlapping rectangles with a modern design.](https://techuisitive.com/wp-content/uploads/2025/12/pexels-photo-4252891-4252891-1024x683.jpg "pexels-photo-4252891-4252891")](https://ezebenterprise.com/color-match-challenge/) [](https://ezebenterprise.com/color-match-challenge/)### Color Match Challenge Watch a sequence of glowing colors, then tap them back in the correct order to level up. With each round, the pattern grows longer and trickier. --- ### [Privacy Policy](https://techuisitive.com/privacy-policy/) **Published:** March 27, 2023 **Author:** Equebal Ahmad **Content:** At Techuisitive, accessible from one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collected and recorded by Techuisitive and how we use it. If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us. ## Log Files Techuisitive follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this and a part of hosting services’ analytics. The information collected by log files include internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any information that is personally identifiable. The purpose of the information is for analyzing trends, administering the site, tracking users’ movement on the website, and gathering demographic information. Our Privacy Policy was created with the help of the [Privacy Policy Generator](https://www.privacypolicyonline.com/privacy-policy-generator/) and the [Privacy Policy Generator](https://www.generateprivacypolicy.com/). ## ## Cookies and Web Beacons Like any other website, Techuisitive uses ‘cookies’. These cookies are used to store information including visitors’ preferences, and the pages on the website that the visitor accessed or visited. The information is used to optimize the users’ experience by customizing our web page content based on visitors’ browser type and/or other information. For more general information on cookies, please read the “What Are Cookies” article on [Cookie Consent website](https://www.cookieconsent.com/what-are-cookies/). ## ## Google DoubleClick DART Cookie Google is one of a third-party vendor on our site. It also uses cookies, known as DART cookies, to serve ads to our site visitors based upon their visit to [www.website.com](http://www.website.com/) and other sites on the internet. However, visitors may choose to decline the use of DART cookies by visiting the Google ad and content network Privacy Policy at the following URL – ## ## Privacy Policies You may consult this list to find the Privacy Policy for each of the advertising partners of Techuisitive. Third-party ad servers or ad networks uses technologies like cookies, JavaScript, or Web Beacons that are used in their respective advertisements and links that appear on Techuisitive, which are sent directly to users’ browser. They automatically receive your IP address when this occurs. These technologies are used to measure the effectiveness of their advertising campaigns and/or to personalize the advertising content that you see on websites that you visit. Note that Techuisitive has no access to or control over these cookies that are used by third-party advertisers. ## ## Third Party Privacy Policies Techuisitive’s Privacy Policy does not apply to other advertisers or websites. Thus, we are advising you to consult the respective Privacy Policies of these third-party ad servers for more detailed information. It may include their practices and instructions about how to opt-out of certain options. You can choose to disable cookies through your individual browser options. To know more detailed information about cookie management with specific web browsers, it can be found at the browsers’ respective websites. What Are Cookies? ## Children’s Information Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity. Techuisitive does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records. ## ## Online Privacy Policy Only This Privacy Policy applies only to our online activities and is valid for visitors to our website with regards to the information that they shared and/or collect in Techuisitive. This policy is not applicable to any information collected offline or via channels other than this website. ## ## Consent By using our website, you hereby consent to our Privacy Policy and agree to its Terms and Conditions. --- ## Downloads ### [PowerShell Script to Automate Intune Remediation Script Creation](https://techuisitive.com/downloads/powershell-script-to-automate-intune-remediation-script-creation/) **Published:** April 21, 2026 **Author:** Equebal Ahmad **Content:** The script can be used to automate Intune Remediation Script Creation with the Microsoft Graph API. Please check out the article below for a step-by-step guide to using this script. Free – Purchase [Checkout](https://techuisitive.com/checkout/) Added to cart --- ### [Bulk Add Devices to Entra Group Script Download](https://techuisitive.com/downloads/bulk-add-devices-to-entra-group-script-download/) **Published:** January 22, 2026 **Author:** Equebal Ahmad **Content:** **Use the PowerShell script below to seamlessly add devices to an Entra ID group by referencing their names from a CSV file.** This approach eliminates the need to manually look up and provide Object IDs, making bulk group assignments faster, more intuitive, and less error-prone. By preparing a simple CSV with device names, administrators can automate group membership updates and ensure consistent policy targeting across large environments. For a detailed walkthrough and explanation, see the full guide: **[Bulk Add Devices to Entra ID Group from CSV File](https://techuisitive.com/powershell-script-add-device-to-entra-id-group-from-csv-file/ "Bulk Add Devices to Entra ID Group from CSV File")** Get started by downloading the script below and make your **Azure AD group membership exports** faster and more reliable today. Free – Purchase [Checkout](https://techuisitive.com/checkout/) Added to cart **Download Categories:** Scripts --- ### [Bulk Export Entra ID Group Members Script Download](https://techuisitive.com/downloads/bulk-export-entra-id-group-members-script-download/) **Published:** January 19, 2026 **Author:** Equebal Ahmad **Content:** This PowerShell script leverages the **Microsoft Graph PowerShell SDK** to bulk export membership details for multiple **Azure AD groups** in one go. Designed for IT administrators, it reads group names from a CSV file, queries Graph for matching groups, and generates individual CSV reports containing member information such as DisplayName, UserPrincipalName, Id, and ObjectType. Each group’s data is saved as *GroupName.csv* in the script directory, with clear and consistent outputs for auditing and reporting. Use it to simplify **Azure Active Directory management**, streamline compliance checks, and save valuable time when handling large environments. For a detailed walkthrough and explanation, see the full guide: **How to Bulk Export Azure AD Group Members with Microsoft Graph**. 👉 Get started by downloading the script below and make your **Azure AD group membership exports** faster and more reliable today. Free – Purchase [Checkout](https://techuisitive.com/checkout/) Added to cart --- ### [Intune Bulk Device Sync Script Download](https://techuisitive.com/downloads/intune-bulk-device-sync-script/) **Published:** January 18, 2026 **Author:** Equebal Ahmad **Content:** This PowerShell script leverages the Microsoft Graph PowerShell SDK to trigger sync requests for multiple Intune‑managed devices in one go. Designed for IT admins, it reads device names from a CSV file, queries Graph for matching devices, and initiates sync operations with clear success or failure reporting. Use it to streamline endpoint management and save valuable time when handling large fleets For a detailed walkthrough and explanation, see the full guide: **[How to Bulk Sync Intune Devices with Microsoft Graph](https://techuisitive.com/how-to-bulk-sync-intune-devices-with-microsoft-graph/)**. 👉 Get started by downloading the script below and streamline your Intune device sync today. Free – Purchase [Checkout](https://techuisitive.com/checkout/) Added to cart --- ## Quizzes & Surveys ### [Mastering Windows Autopilot: Quick Quiz Challenge](https://techuisitive.com/qsm_quiz/mastering-windows-autopilot-quick-quiz-challenge/) **Published:** July 9, 2026 **Author:** Equebal Ahmad **Content:** **Welcome to Techuisitive Quiz!** Answer each question as you go. Once you reach the final page, click **‘Submit’** to view your overall score and detailed explanations. You can also enter your email if you’d like to receive your quiz results directly in your inbox. --- Name (Required) Email (Optional) 1. In user-driven Autopilot deployment, who completes the setup process? IT administrator End user OEM vendor Microsoft support None 2. Which Autopilot deployment mode allows devices to be pre-provisioned by IT before handing them to end users? User-driven mode Self-deploying mode Pre-provisioned deployment (formerly White Glove) Hybrid Azure AD Join None 3. What is the role of Intune in Autopilot deployments? Provides OS installation media Manages device policies, apps, and compliance after enrollment Acts as a replacement for Azure AD Handles BIOS updates None 4. Which of the following best describes Windows Autopilot? A tool for creating custom Windows images A cloud-based deployment service for provisioning new devices A virtualization platform for running Windows in the cloud A patch management solution None 5. Which Autopilot deployment mode is best suited for kiosks or shared devices? User-driven mode Self-deploying mode Pre-provisioned deployment Hybrid mode None 6. Which requirement is essential for Autopilot to function? Devices must have TPM 2.0 enabled Devices must be registered with Autopilot service using hardware IDs Devices must run Windows Server OS Devices must be joined to on-premises AD only None 7. What is the main benefit of using Autopilot compared to traditional imaging? Faster OS installation Eliminates the need for custom images by using OEM-provided Windows builds Provides offline deployment without internet Requires fewer licenses None 8. What happens when a device is reset using Autopilot Reset? The device is wiped and removed from Azure AD The device is reset but remains enrolled in Intune and Azure AD The device is downgraded to Windows 7 The device loses all management policies None 9. What is the primary identity service used with Autopilot? Active Directory (on-premises) Azure Active Directory (Azure AD) LDAP Directory Services Local SAM database None 10. Which deployment option allows Autopilot devices to join on-premises AD while also registering with Azure AD? Hybrid Azure AD Join Self-deploying mode Pre-provisioned deployment User-driven mode None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel --- ### [Modern Desktop Management : MD-101 Quiz - Set 01](https://techuisitive.com/qsm_quiz/modern-desktop-management-md-101/) **Published:** April 7, 2023 **Author:** Equebal Ahmad **Content:** **Welcome to Techuisitive Quiz. Please submit your response to see your score and explanations. Enter your email ID if you want to receive quiz result on your email.** --- Name (Required) Email (Optional) 1. You are Microsoft Endpoint Manager administrator at Techuisitive. You have Microsoft 365 tenant that uses Microsoft Intune for Windows 10 provisioning through Windows Autopilot. You need to provision a new laptop for recently joined employee through Windows Autopilot. You have exported hardware hash of laptop. What should you do next? Go to Devices > Windows Enrollment > Deployment Profiles and create deployment profile Go to Devices > Windows Enrollment > Windows Autopilot Deployment Program – Devices and upload CSV file containing hardware hash Create a Device configuration profile Configure Automatic Enrollment from Device > Windows Enrollment None 2. You are Microsoft Endpoint Manager administrator at Techuisitive. You manage Windows 10 computers which are enrolled to Intune. All Windows 10 computers are member of Entra ID Group "Windows 10 computers". The Device Category for all training room computers are set to "Trainings Computers". You need to deploy an application App1 to to all Windows 10 training devices. The solution must discourage creation of new Entra ID groups. Which of below option you will go for? Create Intune Filter for training devices and target app directly on Intune filter Create a new Entra ID Group for training devices and target the app on group. Create Intune Filter for training devices, Target app on Windows 10 computer Entra ID group and INCLUDE filter created for training devices Create Intune Filter for training devices, Target app on Windows 10 computer Entra ID group and EXCLUDE filter created for training devices None 3. You are Microsoft Endpoint Manager administrator at Techuisitive. You manage Windows 10 computers which are enrolled to Intune. You manage the servicing channel settings of the computers by using Intune. You need to review the servicing status of a computer. What should you do? From Software updates, view the Per update ring deployment state. From Software updates, view the audit logs. From Device compliance, view the device compliance. From Device configuration- Profiles, view the device status. None 4. You are working as Intune Admin at Techuisitive. A user who was using a Windows 10 computer recently left the company. You want to repurpose the computer and assign that to new user. You need to repurpose the computer using Windows AutoPilot. Which three actions should you perform in sequence? I)Generate a CSV file that contains computer hardware hash. II) Upload the file using azcopy.exe III) Reset the computer I)Generate a JSON file that contains the computer information II) Upload the file using Intune III) Reset the computer I)Generate a CSV file that contains computer hardware hash. II) Upload the file using Intune. III) Reset the computer None of these None 5. Question # 7 You are Microsoft Endpoint Manager administrator at Techuisitive. You have Microsoft 365 tenant that uses Microsoft Intune for mobile device management. You purchased an application named App1 from Microsoft store for business. You need to ensure that application can be deployed by Intune. What should you do? Assoicate Microsoft Store for Business account with Intune Sync purchased apps from the Microsoft store for business Create an app category in Intune Create an app category in Microsoft store for business 6. You are Microsoft Endpoint Manager administrator at Techuisitive. A remote user purchased a Windows 10 Professional laptop for company use. You need to configure the laptop to meet company standards: -> Upgrade Windows 10 to Windows 10 Enterprise edition -> Join the laptop to Techuisitive.com domain -> Remove pre-installed software’s The solution must minimize the configuration time. Which of below option you will go for? Use Windows AutoPilot to re-purpose device Create a provisioning package and share the file with user via email / Share drive Create a custom Windows image and upload to Microsoft Intune Create a Sysprep unattended file and email to user None 7. You are Microsoft Endpoint Manager administrator at Techuisitive. You are using Microsoft Endpoint Configuration Manager (MECM) to manage on-premises computers. You configure Techuisitive.com for co-management and deploy Windows 10 devices. The devices are joined to Azure AD and enrolled in Microsoft Intune. You need to ensure that devices are co-managed. What should you create in Intune first. A Device configuration profile An app configuration profile A device compliance policy An app for the Endpoint Configuration Manager client None 8. You have a Windows 10 computer that is joined to on-premise Active Directory Domain. You apply same setting in a GPO and in an Intune Device configuration policy. Which setting will take precedence? GPO Intune Most Restrictive Less Restrictive None 9. You are Intune administrator at Techuisitive. Your network contains Active Directory domain. You are managing Windows 10 devices with Microsoft Intune. Microsoft updates are deployed by Windows update for business. You need to ensure that updates are deployed on sales department computers between 1:00 AM to 5:00 AM any day. The computer must be rebooted after install. Which setting should you modify to achieve this? Servicing Channel Microsoft Product Updates Quality Update Deferral period Automatic update behavior None 10. You are managing Windows 10 computers which are joined to Azure AD and enrolled in Microsoft Intune. You need to configure the following device restrictions: -> Scan all scriptis loaded into Microsoft Edge. -> Block users from browsing to suspicious websites. Which two settings should you configure in Device restrictions? (Click on Show Image to see screenshot) Microsoft Edge Browser Windows Defender SmartScreen Windows Spotlight Windows Defender Antivirus ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel --- ### [Mastering Intune Configuration Profiles: Admin Essentials Quiz 01](https://techuisitive.com/qsm_quiz/mastering-intune-configuration-profiles-admin-essentials-quiz-01/) **Published:** December 30, 2025 **Author:** Equebal Ahmad **Content:** **Welcome to Techuisitive Quiz!** Answer each question as you go. Once you reach the final page, click **‘Submit’** to view your overall score and detailed explanations. You can also enter your email if you’d like to receive your quiz results directly in your inbox. --- Name (Required) Email (Optional) 1. Which profile type allows administrators to define custom OMA-URI settings? Settings Catalog Templates Custom Security Baseline None 2. How does Intune resolve conflicts between multiple configuration profiles? It applies the most recently created profile It ignores all conflicting settings It uses a priority-based system It applies the most restrictive setting None 3. What is the benefit of using the Settings Catalog in Intune? It allows importing third-party apps It provides granular access to individual settings It disables device compliance It removes all default policies None 4. What is the role of scope tags in Intune configuration profiles? To assign licenses To filter audit logs To control visibility and access for admins To block device enrollment None 5. How can configuration profiles be assigned in Intune? To individual users only To device groups or user groups To email addresses To IP ranges None 6. What does the 'Applicability Rules' feature in Intune profiles do? It blocks all non-compliant devices It defines conditions for profile deployment It deletes old profiles It resets device settings None 7. Which platforms are supported when creating configuration profiles in Intune? Windows, iOS/iPadOS, macOS, Android Linux only Windows only Android only None 8. What are security baselines in Intune used for? To configure Wi-Fi settings To apply recommended security settings To block app installations To manage user passwords None 9. What is the main purpose of creating a configuration profile in Microsoft Intune? To install applications To enforce device settings and policies To monitor user activity To manage licenses None 10. What is the first step when creating a configuration profile in Intune? Assigning groups Selecting platform and profile type Setting compliance rules Enabling audit logging None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel --- ### [Microsoft Intune - Application Quiz](https://techuisitive.com/qsm_quiz/microsoft-intune-application-quiz/) **Published:** June 21, 2023 **Author:** Equebal Ahmad **Content:** **Welcome to Microsoft Intune – Application Quiz** Name (Required) Email (Optional) 1. Which of below statements are true? (Select two) Win32 App is legacy method and LOB should be preferred for application deployment LOB is legacy method and Win32 App should be preferred for application deployment Win32 app provide supersednece rule to replace existing application with new version LOB uses detection rule to check application applicability 2. Which of below can be used as a detection method in Win32 App Deployment? Windows Installer Product Code File Registry PowerShell Script 3. When using custom detection script in Intune win32 apps, which of below Exit code & STDOUT stream will represent successful deployment? Exit code : 0 , STDOUT Stream : Not Empty Exit code : 0 , STDOUT Stream : Empty Exit code : Non ZERO , STDOUT Stream : Not Empty Exit code : Non ZERO , STDOUT Stream : Empty None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel --- ### [SCCM Quiz - Set 01](https://techuisitive.com/qsm_quiz/sccm-quiz-01/) **Published:** April 7, 2023 **Author:** Equebal Ahmad **Content:** **Welcome to Techuisitive Quiz. Please submit your response to see your score and explanations. Enter your email ID if you want to receive quiz result on your email.** Name (Required) Email (Optional) 1. You have to deploy App1 on Collection1 which includes all Windows 10 computers. You have another collection Sales1 and you need to exclude all computers in Sales1 collection from the deployment. Which of below is best option to achieve this. Add an Exclude Rule in collection1 for Sales1 Add an Include Rule in collection1 for Sales1 Create a static collection and exclude all computers in Sales1 Create a static collection and include all computers in Sales1 None 2. Which of below discovery method also called heartbeat discovery? Data Discovery Record Network Discovery AD User Discovery AD System Discovery None 3. For which purpose Update Group used in Configuration Manager? Client Upgrade Application Deployment Software update deployment Compliance Baseline None 4. Which log file record installation errors for ConfigMgr application deployment (Application model)? Execmgr.log Appdiscovery.log AppEnforce.log CAS.log None 5. Which one is top most site in Configuration Manager (SCCM) hierarchy? Primary Site Secondary Site CAS ConfigMgr have flat hierarchy None 6. You have to deploy an application App1 version 2.0 through application deployment in Microsoft Endpoint Configuration Manager. You need to ensure all previous version (if exists) are uninstalled. Which of below feature can be used for uninstallation of previous version? Requirements Dependencies Supersedence Uninstallation None 7. You are using Configuration Manager for Software Distribution and Patch Management. You have to install ConfigMgr client on 100+ geographically distributed workstations where you don't have admin rights. The site server Network access account also don't have admin perimission on those workstations. Which of below methods you can use for client installation. Client Push installation Group Policy based installation Software Update Point based installation Manual installation 8. Which log file will record details about software update deployment on ConfigMgr client? Execmgr.log UpdateDeployment.log WUAHandler.log ccmexec.log None 9. Which of below can be a detection method in application deployment? Windows Installer Product Code File Registry PowerShell Script 10. What is the purpose of Global condition in Configuration Manager? Global conditions are conditions used for dynamic collections Global conditions are used for maintenance windows Global conditions are used for Inventory Global conditions are use by requirement rules None 11. Which of below are type of Deployment in Configuration Manager? Available Required Both Available & Required None of these None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel --- ### [SCCM Quiz - Set 02](https://techuisitive.com/qsm_quiz/sccm-quiz-set-02/) **Published:** April 12, 2023 **Author:** Equebal Ahmad **Content:** **Welcome to Techuisitive Quiz. Please submit your response to see your score and explanations. Enter your email ID if you want to receive quiz result on your email.** --- Name (Required) Email (Optional) 1. Which port is used by SQL Service Broker? TCP Port 4022 UDP Port 4022 TCP Port 445 ICMP None 2. Which one of below cannot be a boundary in ConfigMgr? IP Subnets IP Range Active Directory Sites Active Directory OU’s None 3. You have Windows 10 64 bit and Windows 8 32-bit operating system in your organization. You need to install an application. **– The 64-bit version of application must be installed on Windows 10 machines** **– The 32-bit version of application must be installed on Windows 8 machines** **Select the best solution from below.** Create an application for 64-bit deployment. Deploy the application to query based collection which includes Windows 10 64-bit computers Create an application for 32-bit deployment. Deploy the application to query based collection which includes Windows 8 32-bit computers Create separate application for 32-bit and 64-bit with their own requirement rule Create one application with two deployment types. Configure a requirement rule for both deployment type. 4. You have created a deployment to install Microsoft Office 2016 on 1000+ clients. Few user reported that they are not seeing the application installed on their machine. You checked the issue for client1 in MECM report and found that installation was failed. You need to confirm if client1 started downloading the content. Which log file you will review? Contenttransfermanager.log Execmgr.log Locationservices.log Policy.log None 5. You are ConfigMgr administrator at techuisitive.com. You have to create an application. Which option you will select in ConfigMgr console. Software Library Asset and Compliance Administration Monitoring None 6. Which tool can you use to view ConfigMgr client logs in real time? Notepad ccmlog CMTrace CMTroubleshoot None 7. Which of the following are features of ConfigMgr? Collecting hardware and software inventory Deploying Applications Managing virtualization hosts and storage resource Deploying Software Updates 8. Global conditions are rules that represent business or technical conditions that you can use to specify how an application is provided and deployed to client devices. You are installing Microsoft Visio Viewer 2016 on 1000+ workstations. You need to create a requirement rule to ensure application install only on machines with > 5GB free space. Which tab (see image) you will go to create the requirement rule? Program Detection Method Requirements Dependencies None 9. Which site system role is used for client communication in ConfigMgr? Management Point Reporting Point Software Update Point Distribution Point None 10. You are ConfigMgr administrator at Techuisitive. The company purchased a new application named App1. The application need to be installed on the machines which met below criteria. OS – Windows 10 Enterprise Memory >= 8 GB Free Space >= 100 GB Select the appropriate option which you can use for Application Deployment? A query based collection A Requirement Rule Supersedence Relationship Dependencies ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel --- ### [Modern Desktop Management : MD-101 Quiz - Set 02](https://techuisitive.com/qsm_quiz/modern-desktop-management-md-101-quiz-set-02/) **Published:** April 12, 2023 **Author:** Equebal Ahmad **Content:** **Welcome to Techuisitive Quiz. Please submit your response to see your score and explanations. Enter your email ID if you want to receive quiz result on your email.** Name (Required) Email (Optional) 1. Intune is a component of which offering? Microsoft Managed Desktop Windows Autopilot Microsoft Visual Studio Microsoft Enterprise Mobility + Security None 2. You have a Windows 10 laptop enrolled in Intune. You apply the same setting in two device compliance policies targeted to same devices. Which policy wins? Most restrictive wins Least restrictive wins Last policy applied wins Neither wins None 3. You are working as Endpoint Manager admin at Techuisitive. The company has a Microsoft 365 subscription.You are using Microsoft Intune to manage devices. The company use conditional access to restrict access to Microsoft 365 services if devices do not comply with company security policies. You need to identify which devices will be prevented from accessing Microsoft 365 services. What should you use? Device > Desktop Analytics Windows Defender security center Report > Device Compliance Device > Compliance Policies None 4. You are Microsoft Endpoint Manager administrator at Techuisitive. You are managing Windows 10 devices enrolled to Microsoft Intune. There are hundreds of Windows 10 professional devices in organization. You have been asked to upgrade all Windows 10 Professional devices to Windows 10 Enterprise. What should you do? Create a device configuration profile Create a device compliance policy Create a provisioning package None of these None 5. You are Microsoft Endpoint Manager administrator at Techuisitive. The company has recently installed 5 computers in common area to allow employee to check their personal emails or access other websites which should not be accessed from secure networks. You have been asked to ensure employee can access Microsoft Edge browser without having to sign in. The employees should also prevented from accessing any other applications from these computers. Which device configuration profile type should be used? Device Restriction Administrative Templates Endpoint Protection Kiosk None 6. You have a Windows 10 laptop enrolled in Intune. You apply same setting in a Device Configuration policy and a Device compliance policy. Which setting will wins? Device Configuration Policy setting wins Device Compliance Policy setting wins Most restrictive setting wins Less restrictive setting wins None 7. You install a feature update on a computer that runs Windows 10. How many days do you have to roll back the update? 10 30 60 90 None 8. You are Microsoft Endpoint Manager admin at Techuisitive. You have been asked to configure AutoPilot deployment profile for all Windows 10 computers configured through AutoPilot. You need to assign the same policy to all computers. Which two action should you perform? Join the computers to Microsoft Azure Active Directory (Azure AD) Assign a Windows Autopilot deployment profile to a group Create a AAD group that has dynamic membership rules and uses the operatingSystem tag Create a AAD group that has dynamic membership rules and uses the ZTDID tag 9. You are managing Windows 10 devices enrolled to Microsoft Intune. You have been asked to ensure that Microsoft Exchange online can be access from known locations only. What should you configure to meet the requirement? A Device compliance policy A Conditional access policy A Device configuration policy A Device restriction policy None 10. What is the name of Microsoft API that helps Intune integrate with other management console? JSON API Windows API REST API Microsoft Graph API None ![clock.png](https://techuisitive.com/wp-content/plugins/quiz-master-next/assets/clock.png) Time’s up Cancel ---