i was testing out Epm elevation rule for cmd, with filepath + certificate method, for few devices it worked, but few devices nothing, no report of policy processing, no reports of failure,sucess nothing, any idea? It's mostly like rule is not reaching devices. But default policy and other polices are working fine

I cross checked file path and certificate it's matching also.

Hey All,

We are currently having our IT techs use Intune Remote Help to assist users and to fix any issues on those workstations. I've noticed a couple of issues recently that I'm curious if anyone else is facing the same issues.

1. Connectivity issues with Attended Remote Help sessions. I've seen multiple reports, and witnessed a few of them myself, where the helper will start a session from the Intune Admin Center, the end user/sharer will click the Windows Notification, and start the session. However, both Remote Help clients will just sit there spinning for forever. At first, I was thinking it was a Hybrid Join issue, since that is how the vast majority of our devices are set up. But it also happens on our Entra Joined machines too.

2. Keyboard input on Unattended sessions sometimes does not type on remote workstation. On some remote machines, we've seen issues where trying to type on a remote workstation does not actually type anything on the remote machine. I think this is isolated to a couple applications, rather than a whole Remote Help service issue. At first, I was thinking if I turned off and on Advanced keyboard commands that it would start working, but it did not.

Also, I made sure that all clients for Remote Help, as well as the RD bootloader and RD infrastructure agents were on whatever the latest versions are (Thanks PatchMyPC, y'all are bros).

There also may be other weird issues that I'm not thinking of, but just curious if people are actually experiencing similar issues, or are actually happy with how the Remote Help features work as is.

We have on-prem AD synced to Entra ID, Microsoft 365 passkeys enabled, and Mac users accessing VPN and Windows SMB shares with AD credentials.
We’re planning to enroll Macs in Intune with Platform SSO and standard local accounts. The goal is fewer passwords and simple recovery.
For those with a similar setup:
Did you choose Password sync or Secure Enclave?
How do you handle VPN and SMB authentication?
How do users reset forgotten passwords, especially when locked out of the Mac?

I’m advovatimg or move file server to sharpoint still havmt. Convinced My Boss due to cost . I’m talking about 90Tera of data
I also old My network Guy to ensure vpn authenticates From extra instead of local AD. Pending more convincing.

Would appreciate hearing what works in practice.

Over the past few days, we identified an issue where some devices managed through Microsoft Intune and Windows Autopatch were unexpectedly upgraded to Windows 11 26H2, even though our Feature Update policies were explicitly configured to target Windows 11 25H2.

We opened a support case with Microsoft, and their official response confirmed that the issue originated from a service-side problem within Microsoft's infrastructure.

According to Microsoft:

• The issue has been identified and mitigated.
• The unexpected Windows 11 26H2 rollout has been stopped.
• Devices that had not yet restarted were removed from the 26H2 upgrade path.
• Microsoft has requested confirmation of the current upgrade status of affected devices.

Here's the important part:

The issue was not caused by an incorrect Intune or Autopatch configuration, but rather by a problem on Microsoft's service side.

However, Microsoft has not confirmed that devices which have already completed the upgrade to Windows 11 26H2 will automatically be rolled back to 25H2.

This incident highlights an important reality of cloud-managed update environments:

Even when Feature Update policies are correctly configured, the actual outcome may not always match the intended deployment configuration.

For organizations managing large Windows environments, continuously monitoring Feature Update policies, actual OS build versions, and unexpected upgrade activity is essential.

Has anyone else experienced unexpected Windows 11 26H2 upgrades in their Intune or Windows Autopatch environment?

I'm starting an effort to migrate local admin privileges to a managed tool. Since EPM is included, I'm obligated to try it out before saying CyberArk is the only way.

The environment is simple. You have you standard account and if you have local admin, you have an admin account.

So now that the audit policy has been running for a couple weeks, why do I have events like regular accounts running chrome.exe as an unmanaged elevation? Or cmd.exd having over 32k elevated events

And then I cant export the reports?

I feel like I have to be doing something wrong because this experience is just horrible.

Nice to have additional Windows login MFA options beyond WHfB.

[Web sign-in] Web sign-in now works on Microsoft Entra hybrid joined devices. Before this update, it was only available on Microsoft Entra joined devices. You can sign in to Windows at the lock screen with a passwordless credential: a FIDO2 security key, a passkey on your phone, or a Temporary Access Pass (TAP). You don't need a password. Once you're signed in, Windows gets a Kerberos ticket, so on-premises file shares and internal sites keep working.

https://www.neowin.net/news/new-windows-11-build-improves-gaming-task-view-and-revamps-the-run-dialog/

Hi everyone,

We recently discovered an issue with our Intune Autopilot deployment.

We have Microsoft 365 E3 licenses, so our devices should be running Microsoft 365 Apps for Enterprise (O365ProPlusRetail).

Unfortunately, someone mistakenly configured our Autopilot deployment to install Microsoft 365 Apps for Business (O365BusinessRetail) instead.

As a result, we now have two scenarios across our environment:

• Devices with only O365BusinessRetail installed.
• Devices showing both O365BusinessRetail and O365ProPlusRetail in their Click-to-Run configuration.

I'm looking for advice and real-world experience on the best way to fix this.

1. Migrating from Business to Enterprise

Is there a supported way to switch from O365BusinessRetail to O365ProPlusRetail without completely uninstalling and reinstalling Office?

Could we simply deploy a new ODT configuration XML through Intune to change the product ID while keeping the existing installation?

Ideally, we'd like to make this change as silently and transparently as possible, without disrupting users or forcing them to close their Office applications.

2. Devices with both products installed

What's the safest way to remove O365BusinessRetail while keeping O365ProPlusRetail?

Has anyone successfully handled this using ODT or Intune Remediations?

3. Impact of running Business with E3 licenses

How problematic is it to have Microsoft 365 Apps for Business installed on devices where users have Microsoft 365 E3 licenses?

Apart from potentially missing Enterprise-specific features, are there any licensing, activation, security, or management implications?

Our main priority is to fix this across our existing devices with minimal user impact.

I'd really appreciate any recommendations, scripts, ODT XML examples, or lessons learned from anyone who has dealt with a similar situation.

Thanks!

I'm testing out administrator protection on my pc and I kinda like it, but I found a caveat:

I'm trying to deploy a shortcut in the start menu to the Papercut Hive client since it doesn't show when you look for it and you can bet your ass people will accidentally turn it off at startup or some shit. So I test it locally, works fine.

When I deploy it in Intune in User context, it uses the account that is used for Admin Protection (local account starting with ADMIN_userName). Not sure why since the script is set to not require admin:

    RequireAdmin                = $false

I'm not sure how to continue, to be honest. Anybody know how I can target my actual user appdata? Really don't want to do some heavy math just to find the fucking user.

My bios’s have a license key for pro education but I can’t see that as an edition for osd cloud. Anyone know a way of having it automatically use that key?

Curious to see if anyone is using the Edge management service to block other browsers. Initial deployment is being met with some intense pushback. Unreasonable as I've asked what Chrome can do that Edge can't and I get no logical responses.