Microsoft Endpoint Manager: A LouMug Presentation

This past November, I got the opportunity to present at the Louisville Microsoft Users Group. The topic this time was Microsoft Endpoint Manager, where I discussed the components of Endpoint Manager and how we are using the platform at work. The interaction from the audience was fantastic, with several people asking great questions and giving comments. A recording of the talk has been uploaded to YouTube for anyone who wants to watch. The slide deck is also available below, with embedded links to several resources.

Have fun,
Tony

Microsoft has Mixed GPOs into their Device Profiles

Microsoft is about to make Windows 10 device configurations in Endpoint Manager/Intune way more powerful. While digging through Microsoft’s documentation about Windows MDM, I noticed a new list of CSP policies prefixed with “ADMX_”. GitHub commits indicate the documentation of these policies didn’t exist until late last year. That wouldn’t be much to talk about, except these new policies match Windows’ built-in group policies.

Take a moment to let that statement sink in. One of the biggest frustrations I’ve run into with Intune device profiles has been the lack of parity with group policies. Some settings, like configuring screensavers to be secure, aren’t available in Windows’ MDM. The only way I’ve managed to work around these device policy limitations has been to use PowerShell scripts.

The ADMX backed policies’ documentation all say they are available in the “latest Windows 10 Insider Preview Build”. And finally, Microsoft released the first Windows Insider Preview Build for 2021, which included the needed functionality. As it stands right now, the process of using the new ADMX backed policies isn’t easy. It requires creating custom device profiles, knowing the correct OMA-URI, and how to format the data. Getting the correct format involves looking at the corresponding .admx file built into Windows. My hope is Microsoft will add all of these policies to the “Administrative Template” based device profiles quickly. Some already exist, but it is a fraction of the settings available in GPOs.

I hope to share more info on using ADMX backed policies as Windows 10 21H1 becomes available.

As always, have fun
-Tony

Remove SCCM Old Computer Objects Based on SIDs

There are dozens of blog posts and instructions on how to remove computer objects from Configuration if the corresponding AD object no longer exists. I thought I would put my own spin on the idea since I haven’t seen it before. Many of the guides rely on matching the object’s names to each other. The problem you can run into with this method is reusing computer names. You can delete a computer in AD and add a new one with the same computer name. When Configuration Manager runs its next AD sync it will find the new AD computer object and add it to the inventory. Now Configuration Manager has two computer objects with the same name. As an administrator this can get confusing and if you try to clean up Configuration Manager based on name matching the old object won’t get removed.

Rather than match the objects on name you can use something more unique, like the SID. Configuration Manager capture the AD objects SID during the sync so you can use that to match objects and delete those that no longer exist. You can look at the code below or in github.

Find the PowerShell script at https://github.com/agizmo/SCCM_Computer_Removal_SID

$SiteCode = "<YOUR SITE CODE>" # Site code
$ProviderMachineName = "<YOUR CM SERVER>" # SMS Provider machine name

#Customizations
$initParams = @{}

#Import the ConfigurationManager.psd1 module
if((Get-Module ConfigurationManager) -eq $null) {
Import-Module "$($ENV:SMS_ADMIN_UI_PATH)..\ConfigurationManager.psd1" @initParams
}

#Connect to the site's drive if it is not already present
if((Get-PSDrive -Name $SiteCode -PSProvider CMSite -ErrorAction SilentlyContinue) -eq $null) {
New-PSDrive -Name $SiteCode -PSProvider CMSite -Root $ProviderMachineName @initParams
}

#Set the current location to be the site code.
Set-Location "$($SiteCode):\" @initParams

#As far as I can tell, this is the only way to get the SID for a computer object in SCCM. The prebuilt cmdlets will not return SID
$devices = Get-WmiObject -ComputerName $ProviderMachineName -Namespace "ROOT\SMS\Site_$SiteCode" -Class SMS_R_System
foreach ($device in $devices) {
try {
$sid = new-object System.Security.Principal.SecurityIdentifier($device.SID)
} catch {}
$ADcomputer = Get-ADComputer -Filter {SID -eq $sid} if ($ADcomputer) { #nothing } else { Remove-CMResource -ResourceId $device.ResourceId -Force } Remove-Variable sid Remove-Variable ADcomputer
}

Simple as that. Hope you found this article helpful. And play around with PowerShell. There is near infinite capabilities of the language.

Have fun.
-Tony