Event banner
Event details
30 Comments
A large percentage of our devices show as non-compliant because they are failing the Windows built-in policy named "Is active". This is supposed to ensure our devices are reporting in at least every 30 days (default). Like nearly everything else in Intune, this built-in policy is being evaluated per device AND per user. I have found that this behavior is causing devices we would consider "active" to be marked as inactive, once someone who had logged in at one time has not been seen again for 30 or more days. Should I submit this as a bug? If it is working as designed, is there a workaround? We haven't enabled Conditional Access because of these.
Recently discussed this with Intune Support on Twitter.
The user evaluations seen in Intune reports, what do they represent?
- An evaluation that happens when the user logs on.
- Or, an evaluation per user profile.
- Or, an evaluation per logged on user.
If it is testing per logged on user, maybe these devices only need to be rebooted to become compliant.
- A reboot and overnight wait did not resolve the problem. I am now trying the "change the shorten the expiration, then change it back" trick.
- reading the twitter message now 🙂
- Intune Support, on Twiter, says they are looking into this behavior. https://twitter.com/IntuneSuppTeam/status/1586011352681824262
- Heather_Poulsen
Community Manager
Welcome to the Device Health Attestation AMA. Let's get started! Post your questions in the Comments. We will be answering questions in the live stream—and others will be answering here in the chat.
- Heather_Poulsen
The Device Health Attestation AMA starts soon. Post your questions in the Comments now.
- Are there any plans on adding additional capability to Intune to resolve various device health configuration issues? Understandably detecting changes is important, but it seems quite tedious right now to actually bring machines up to a state where measuring those changes becomes important. As a more concrete example, Intune's Device Health report saying that a machine has Early-Launch AntiMalware or Data Execution Prevention disabled is good, but are there plans on adding a way to trivially these machines into the correct state? Security Baselines can't even configure all ASR rules, so those are out of the question.
- Hello, Since this explicitly mentions preboot, will there be support for bitlocker tpm and pin in intune? Microsoft's own recommendation is if an attacker has access to the device it should be protected in this way. The TPM attack can now be done in 15 minutes. How can device attestation prevent such an attack if it happens at a level it can't block? Personal data encryption is a possible fix here but even then it is not suitable for use right now as it's known issues prevent it being used in any real meaningful context in the enterprise.
- Agreed, BitLocker with PIN is a feature available in MDOP MBAM that sorely needs native support in Intune.
