IT Consultant Everyday Notes

Just some problems/solutions storage

Category Archives: Autopilot

Intune: Remove Microsoft Teams shortcut

I am in the middle of Windows Autopilot project. The Customer wants Microsoft Teams be a part of an Application set we install.

We are also implementing One Drive Known folder Move  (KFM) to redirect desktop to One Drive for Business.

The problem is related to Teams behaviour – it installs its shortcut on a user desktop every time it is installed. As a result we do have multiple Teams shortcuts after each device wipe – Teams creates a shortcut and after that another shortcut is synchronized by KFM from One Drive.

I spent a while, trying to find a solution to disable Teams shortcut creation; but it looks like at that time Microsoft does not provide any policy/registry settings to prohibit that.

So, I decided to delete the excessive shortcut using PowerShell script.   The problem with that is Intune behaviour – it runs a script only once Smile. From my experience KFM kicks on quite a while after the user logon, so PowerShell script being added to the process will just miss it.

After all I decided to create a Win32 application in Intune and set up a detection rule to be sure the App will run (and re-run) when it is required.

Here is the removeshortcut.ps1 script to delete the excessive shortcuts

$DesktopPath = [Environment]::GetFolderPath(“Desktop”)
remove-item -path $DesktopPath\* -filter “Microsoft Teams (*.lnk”

Here is install.cmd acting as “Install” in win32 app

powershell.exe -ExecutionPolicy Bypass -command “& ‘.\removeshortcut.ps1′”

Here is detection.ps1 script for win32 application

$DesktopPath = [Environment]::GetFolderPath(“Desktop”)
if (-Not (Test-Path -Path “$desktoppath\Microsoft Teams (*.lnk”)) {write-host “missing”}

After that I packaged the “application” using IntuneWinAppUtil.exe tool and created a Win32 Application in Intune (it must be run in User context) and assigned it to a group of Users.

On the first run it successfully removed the shortcuts. I put them back to see when Intune realizes the “application” is not installed and run the command again Smile . Unfortunately, according MS dock re-evaluation will happen in 24 hours… Sad smile   https://docs.microsoft.com/en-us/intune/apps-add

Advertisements

Intune: Configure Intune NDES Connector to get User certificates from Digicert (Symantec) Web Services

One of my Customers moving everything to Azure decided to replace internal Microsoft PKI with a managed solution from Digicert (Digicert bought Symantec certificate business recently).

At the present time Microsoft has an article describing Intune Configuration with Symantec PKI Manager Web Service: https://docs.microsoft.com/en-us/intune/certificates-symantec-configure

Unfortunately, it is not very clear what needs to be configured on Symantec (sorry, Digicert) side and I spent some time to get it working.

So, first of you need to talk to Digicert and get a Managed PKI environment.

After that, as per the article, generate a managed certificate and deploy your Managed PKI environment Root cert using Intune. It should be easy.

I took this certificate:

image

image

After that you need to add  a certificate profile on Symantec side (MS article does not provide any details on it):

image

image

I select Client Authentication (User)

image

Give your template a friendly name, select a PKI Web Services as Enrollment method and click Advanced Options:

image

Now we need to do an interesting trick. It is in “Troubleshooting” section of Microsoft article and apparently is required if your UPN have a special characters. I need it even though my UPN did not have them… So:

– Click Add field and select Common Name (CN) and Webservice Request. That will create a new Common Name tab at the bottom. DO NOT click Save

– Delete the old Common Name (CN) at the top of the list.

image

– You can customize other parameters. For example, I added an email as a Subject Alternative Name

image

– Now you can save

Copy Certificate Template OID, you will need it for Intune:

image

At this point you can Download/Install Intune Connector. The procedure is described well in the Microsoft article.

When the connector is up:

image

you can create an Intune PKSC 10 profile (I also added EKU even though it is not in the doc):

image

Save the settings, click Create the profile and assign it to a group of users.

After Intune policy update the certificate should be requested by Intune on a Client behalf and deployed to your device:

image

Azure: Deploy One Drive Known Folder Move with Intune

I am preparing for an Autopilot project for one of my Customers. Microsoft recommends to use One Drive for Business for User data migration.

I tried a couple off approaches how it can be achieved with Intune:

1. Using OMA-DM as per Deploy OneDrive KFM with Microsoft Intune OMA-URI

2. Using Powershell Management Extension: How to deploy OneDrive Known Folder Move with Intune

Both approaches are working; personally I prefer OMA-DM hoping Microsoft will add this option to a standard profile options.