OMA-URI – All about Microsoft Intune (2024)

This week a short blog post about a small new setting that became available within Windows 11. That setting is the ability to configure search on the taskbar. With the latest version of Windows 11, Microsoft added a search box to the taskbar that enables users to easily find almost anything. It searches across Windows, OneDrive, SharePoint, and more. And it can find apps, files, settings, help, people ,and more. That makes it a very versatile search option for daily Windows users. Very powerful. The new setting enables users to configure the availability of search on the Windows 11 taskbar. From hidden till icon and label. That new setting can also be configured by the administrator, to enforce specific behavior. It could, for example, be …

Read more

This week another short blog post about another nice configuration addition to Windows. This time it’s about configuring additional Local Security Authority (LSA) protection for credentials. LSA, which includes the Local Security Authority Server Service (LSASS) process, validates users for local and remote sign-ins and enforces local security policies. Starting with Windows 8.1 and later, additional protection is provided for the LSA, to prevent reading memory and code injection by non-protected processes. That provides added security for the credentials that LSA stores and manages. Not really something new, but it’s good to know that something has changed from a configuration perspective. The protected process setting for LSA can also be configured in Windows 8.1 and later.That would, however, always require the manual creation of a …

Read more

This week a short blog post to address a scenario that’s been challenging for a while. That scenario is around removable USB-drives and automatic encryption. When organizations have configured that removable drives require encryption, that introduces challenges with storage built into specialized devices like video cameras, voice recorders, conferencing systems, medical devices and many more. That would also require that type of storage to be required, when read access wasn’t sufficient. That, however, would often cause more problems than solutions. To address that challenge, Microsoft has introduced a new policy. That policy can be used to create an exclusion list of devices for which the user will not be prompted for encryption. Even when encryption of removable drives is required. This post will introduce that …

Read more

This week is another follow-up on the posts of the last weeks about customizing Windows 11 devices. This week, however, is focused on customizing the default app accosiations on Windows 11 devices. Customizing the default app associations enables organizations to associate specific apps with file and link types, for their users. Besides that, this post is also an updated version of this post of over four years ago. Even though not a lot has changed, the configuration did become easier. This post goes through the creation of the required app assocations file, folowed with applying that file on Windows 11 devices. This post ends with showing the user experience with the customized app assoications. Important: My personal opinion is that – as with every other …

Read more

This week is a follow-up on last weeks post about customizing the Start menu layout on Windows 11 devices. This week, however, is focused on customizing the Taskbar layout on Windows 11 devices. Customizing the Taskbar layout enables organizations to create a standardized layout for their users. With the arrival of Windows 11, the configuration options for customizing the Taskbar layout have changed. Especially from a setting-by-setting perspective the options are now rather limited. This post does a quick breakdown of the Taskbar layout in Windows 11 and the different configurations that are available, per section. That breakdown is followed with a zoom-in on the actual configuration for creating the standardized layout. This post ends with showing the user experience with a customized Taskbar layout. …

Read more

This week is all about customizing the Start menu layout on Windows 11. Customizing the Start menu layout enables organizations to create a standardized layout for theirs users by pinning apps, removing default apps, ordering apps and more. The configuration of such a standardized layout has changed from Windows 10 to Windows 11. To create a standardized layout for Windows 11, the IT administrator must use a JSON-file. In previous versions of Windows, that required a XML-file. That configuration change, justifies an explanation about the Start menu layout in Windows 11 and the different configuration options. This post breaks down the new Start menu layout in Windows 11 and the different configuration options that are available, per section. That breakdown is followed with a zoom-in …

Read more

The last few weeks – before my vacation – were all around Windows Hello for Business. And especially around unlocking devices by using Windows Hello for Business functionalities. This week, however, is a little different. This week is around the automatic lock functionality of Windows Hello for Business. That functionality is Windows Hello for Business dynamic lock. Dynamic lock enables organizations to automatically lock devices when users step away from their device. That automatic lock can be achieved by using the bluetooth signal of a paired phone. The device will automatically lock when the signal of that paired phone falls below the configured minimum value. Of course, automatically locking the device doesn’t prevent users from forgetting to lock their device, but it does prevent the …

Read more

This week is all about Windows Sandbox. About two years ago I wrote a post about simply enabling Windows Sandbox, by using a simple PowerShell script and distributing that script by using Microsoft Intune. Windows Sandbox is a really nice feature for running applications in an isolated environment. That isolated environment supports simple configuration files, which provide a minimal set of customization parameters. With the latest version of Windows 10, the administrator receives some controls for enforcing specific customization parameters. That won’t prevent the user from creating a configuration file, but that does prevent specific customization parameters from applying to the Windows Sandbox. In this post I’ll briefly go through the currently available policies, followed with the steps of configuring those policies. I’ll end this …

Read more

This week back to the Windows platform. This week is again about managing local administrators on Windows 10 devices. Even in a modern world, there can still be a need for managing the local administrators on a Windows 10 devices and often that still requires more flexibility than provided with the default Azure AD functionality. I’ve also discussed managing local administrators already multiple times – either by using a Windows 10 MDM policy setting or by using proactive remediations – and this time it’s about a new method that became available in Windows 10, version 20H2 and later. That method is a new Windows 10 MDM policy setting. In this post, I’ll provide an introduction to that new policy setting and I’ll show how to …

Read more

This week a quick extra blog post, just before the start of my vacation, about an easy method for construction settings of ingested ADMX-files. A few years ago I did a post about a deep dive for ingesting third-party ADMX-files and until today I still receive questions on that post that are related to constructing settings of ingested ADMX-files. Even though the described method is still available, there is an easier method for constructing the settings of ingested ADMX-files. A method that is less sensitive to errors. The following four steps walk through that easy method by again using chrome.admx as an example. The first step is ingesting the ADMX-file. That can be achieved by following the same steps as provided in my earlier post. …

Read more