Event details
49 Comments
will there be a feature in the near future within Windows Autopatch to not just stop new driver enrollments, but also to uninstall them, after they have been deployed already?
- AriaUpdated
Microsoft
We are currently working to evolve our driver management capabilities in Autopatch. The ability to uninstall drivers is definitely something we are looking into.
- Heather_Poulsen
Community Manager
Welcome to Office Hours! We're answering the questions that have been posted thus far, but we're live for the full hour here in the comments so keep your questions coming.
Try this again... my first post was "Not Accepted"?
During a previous Secure Boot Office Hours session, I was told that the Secure Boot DBX update rollout was targeting only devices with a High Confidence readiness state.
However, what we're observing in our environment doesn't seem to align with that guidance. We have more than 14,000 devices that have already received the update, and approximately 49% of those devices were not in a High Confidence state at the time. Many were categorized as:
- Under Observation - More Data Needed
- No Data Observed - Action Required
- Temporarily Paused
Given the volume of devices involved, this does not appear to be a small anomaly.
Could you help explain:
- Is the DBX/Secure Boot update currently being offered to readiness states other than High Confidence?
- Does Windows Update use additional confidence or telemetry signals that are not exposed in the public readiness reporting?
- Is there documentation that explains how devices in states such as "Under Observation," "No Data Observed," or "Temporarily Paused" can still receive the update?
The only extra steps we took where making sure a correct BIOS Version is being deployed to the best of our ability and we set the RegKey “AvailableUpdates” to 0x5944 on all devices that did not have updated certs.
Prabhakar_MSFTHello Swartz99
Good Morning.. Are you referring to the DBXUpdate that got delivered in July Security update released on Tuesday? This is Security fix to revoke vulnerable third party boot loaders to protect windows from exploitation. This update does not follow high confidence based rollout and applied to all Secure Boot enabled systems immediately.
This default DBXUpdate had always been applied to all Windows systems immediately. So this is not new.
However, DBXUpdate2024.bin and DBXUpdateSVN.bin are not applied automatically and require enteprises to take action to apply this update as this impacts recovery media and network boot scenarios. So we have published detailed guidance to customers on how to safely apply these two DBX Updates. Guidance can be found at How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 | Microsoft Support
Let us know if you have more questions
Actually, i am talking about our chat from the OEM Secure Boot Office hours! I understood that only HC devices and devices with the Intune/GPO policy would get updated however we did not use the Policy and have 49% of our updated devices (49% of 30,000) updated and do not have High Conf listed.
Are you able to offer any guidance on Intune Unattended Remote Help?
We currently use MECM for Remote Takeover and one feature of that is to be able to remote to a device if it is locked or logged out - configurable in the Remote Tools client settings that get assigned to devices.
There was a private preview that ran earlier this year on Unattended Remote/Access, I wondered what the outcome of that was and what features/functionalities are due to be flighted into tenants as GA? And timescales associated with that.
We would require user acceptance of the connection when devices are logged in but we would need to have unattended access if the device was either locked or logged out. Not having this would be a major blocker for us transitioning from MECM Remote Takeover to Intune Remote Help.
Remote Takeover is the last MECM functionality that we are using, removing that would mean we could move our devices to becoming Intune managed and no longer co-managed.
This is on the roadmap for August.
https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=%5B%22Microsoft+Intune%22%5D#Roadmap
Yeah, thanks, I had come across that one. Assuming this will cover devices that are either locked or not logged in....would it cover being able to remote to a device that is logged in but we don't have a user to accept the connection? Thinking along the lines of public facing devices, kiosks etc etc.
Our default for Corporate devices would be for the user to have to accept the connection for obvious security reasons, but we would want to ring fence certain devices to not needing acceptance.
Does this mean that the fourth option here is kind of redundant at the moment within the Intune RBAC?
Is there any plans to bring back the "easy button" to convert Windows Firewall policy into configuration for Intune? I'm in the process of moving a lot of GPOs into Intune and the Windows Firewall Configuration Profiles look like they are going to take a whole lot of manual work.
- Joe_Lurie
Luke_Davidson There isn't a one-click firewall "convert" button, but a couple of things can cut down the manual effort:
- Use reusable settings groups(in public preview) for your firewall rules so you define IP ranges, ports, and apps once and reference them across many rules instead of re-entering them for each. This makes rebuilding a large GPO rule set far less tedious.
- Export your existing rules with Get-NetFirewallRule as a working inventory to build from, and you can fins a number of community PowerShell/Graph scripts can help bulk-create the Intune firewall rules from that export. Because these are community tools they are not officially supported, so test thoroughly.
For the "firewall migration easy button," please drop that request at https://aka.ms/IntuneFeedback it's a common ask (you'll likely see it there already, so you can just 👍🏻the existing feedback). Demand logged there directly helps the team prioritize it.
Joe_Lurie and Luke_Davidson For IPv6 it's actually more complicated than that – and may be out of scope for intune. (?)
IPv6 rules in Windows 11 are not "core services" anymore. So setting strict firewall rules in Intune such as "no merging" and "block all incoming" breaks IPv6. On Windows 10, IPv6 rules were "core", so they functioned even when you blocked all incoming.
It'd be AWESOME if the Intune team could work with the Windows team to bring firewall policies / presets / settings that manage IPv6, not break it.
On prem, you probably wouldn't even notice that happening. But in cloud-only environments, IPv6 matters. And you notice that certain apps and services don't work anymore.We needed to manually configure ~30 IPv6 "core" policies in Intune with a total of over 300 settings, so it'd work properly with strict firewall policies.
Maybe I'm just blind, but how can we configure update deferrals beyond 30 days in Autopatch?
We'd like a 90 day period for feature updates.- Heather_Poulsen
Hi Dom_Cote - To customize your feature update rollout schedule in Autopatch, you'll want to use a custom feature update release and deployment rings. That will enable you to choose how and when different deployment rings receive the update.
Actually, I'd like a "set and forget" feature update policy, that will apply to all future feature updates. It seems autopatch only applies to a specific feature update.
The old Intune WUfB policies let me simply say "defer feature updates by 90 days" and that works for all of them.Am I missing that option on Autopatch?
Third party vendors who provide drivers to autopatch constantly bundle in “management apps” that in some cases are not wanted in an enterprise setting. Are there any rules around what can be submitted and do Microsoft have a stance on what those updates can/should contain?
- Joe_Lurie
Mention-dan Partners publishing to Windows Update must follow the Windows Hardware/Partner Center publishing policies, and driver packages are expected to contain the driver itself, not additional bundled software. If you are seeing additional software installing with the drivers, you can run driver updates in manual-approval mode, so nothing is offered to your fleet until you've reviewed and approved each specific driver.
Also, let us know which ones are doing this by leaving that feedback in the Intune admin center or at https://aka.ms/IntuneFeedback with the vendor/driver details so the servicing team can follow up.
Would it be possible to mirror the process of adding a Desktop Shortcut via group policy to Intune as a CSP?
- Joe_Lurie
shin0933 There isn't a dedicated CSP for desktop shortcuts today, but you have two options:
- PowerShell script: deploy a script that creates the .lnk in the target location.
- Win32 app: If you want stronger delivery reporting and the ability to remove it later, package the shortcut as a Win32 (.intunewin) app.
Understandably, neither of these is a perfect solution. But both reproduce the GPP shortcut behavior cleanly on cloud-native devices.
How can a feature like this be requested?
