Hello everyone, today we have a great article from Intune Technical Advisor Mohammed Abudayyeh. In this article, Mohammed walks through the process of ingesting Office ADMX files and creating ADMX-ba...
Updated Nov 24, 2020
Version 6.0
Blog Post
So yesterday in trying all these out, in turns out that "naviely" ingesting the stock office16.admx has some seriously insidious effect on the whole Intune-Windows MDM environment.
The ADMX-ingestion config profile is perpetually stuck in pending status. The custom Office OMA-URI policies config profile also stuck pending. Not only that, it seems all computers affected won't respond to other types of config profiles too. Intune and the Windows computers all seem stuck in some state of limbo and not sure how to resuscitate them all.
Doesn't appear we're the only organisation to be struck by such a show-stopper.
https://social.technet.microsoft.com/Forums/en-US/c87e8844-1c3e-4494-b311-070244c6dc27/issue-with-admx-deployment?forum=microsoftintuneprod
UPDATE
So while Intune tech support refuse to take responsibility or any action or even any hint on how to actually clear this Windows-Intune sync coma situation, I tried a theory and it has proven to get the affected Windows computers to "snap out of it".
Manually delete off from Registry
- Every HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\AdmxDefault\<PROVIDER ID>\Office16~Poilcy~ key
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\AdmxInstalled\<PROVIDER ID>\Office16
Trigger a sync with MDM, and Intune should now be able to push down - using the correct built-in AT configuration profile - the policies will re-populate under app namespace of HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\AdmxDefault\<PROVIDER ID>\office16v2~Poilcy~
CONCLUSION
This article is not just out-dated and incompatible, but also downright dangerous and presents a show-stopper since computers begin ignoring MDM directives/commands. The techniques mentioned here must be ignored.