Forum Discussion
Windows Compliance
Your follow-up confirms both policies already target device groups, which Intune supports. Moving compliance to user groups is not required merely because shift workers share a PC. Shared PC configuration manages account access, cleanup and power behavior; it does not itself resolve a failed BitLocker check.
First compare the failing setting, error code, associated user and last check-in on one affected device. Microsoft documents that shared-device reports can reflect the previous user's state and contain separate user and system records, so compare equivalent, recent evaluations.
For Require BitLocker, distinguish completed disk encryption from Device Health Attestation. Microsoft documents that a restart may be necessary before the encrypted device becomes compliant. After confirming encryption, restart, sync and review the refreshed setting result.
The E3/F3 labels alone cannot identify this failure. If the discrepancy persists, give support the per-setting errors and paired check-in timestamps before changing targeting or weakening compliance requirements.
Hi Buddy
Many thanks for your reply
OK, let me clarify a few things before we start misdiagnosing the problem:
- Yes these Windows devices are shared between E3 / F3 users however a Shared PC config has not been deployed
- This is a Compliance issue and not restricted to BitLocker
- This is not a request for info on how to " resolve a failed BitLocker check"
A little context again:
- E3 / F3 users logging onto Windows devices
- Compliance policy deployed to device groups
- Some Conditional Policies that restrict access to SharePoint Online etc (printing / downloading) from unmanaged / non compliant devices as per below:
- We are seeing various Compliant and Non Compliant results per managed (Intune enrolled) devices
What I suspect is causing the problems is related to the "Primary User" but the info available online doesn't 100% clarify anything. See below Google AI search result:
There are lot of other search results hinting at Intune only processing Compliance for the Primary user. I also think there is similar info stating that the Intune Company Portal app can only be assigned to and then used to fix Compliance by the Primary User.
Finally, some of our IT Support tech have "fixed" non compliance by Changing the Primary User.
It's this Primary User thing that led me thinking Shared PCs might help with our constant Compliance iisues, as well as some of the info on the guide below:
https://www.burgerhout.org/p/mastering-windows-shared-pcs-with-microsoft-intune
I just need a concrete answer.
Stuart