May 24 2019 06:24 AM
I have question about your best practices for organizations.
Scenario:
You have only Azure AD joined - Windows 10 computers, with Intune MDM management. Only one user is using Windows 10 PC device, and has local admin rights. Additional Azure AD users are deployed as local administrators to the device. There is also Bitlocker encryption and secure boot implemented.
Challenge:
What if user forgets the password (or user is no longer active in organization), and device goes offline (example network card driver issue), how can other users / Azure AD users, login to the device, to fix the issue on local windows?
Possible solution would be to deploy always additional local windows account, with admin rights, but this always has sign-in disabled (since Intune enforces this).
What do you recommend?
Jun 12 2019 10:39 PM
@hkusulja When a device gets transferred from one user to another I reccomend you do a wipe/reset of the device. That way the new user will become the primary user of the device.
For the password issue, add a password reset option to the logon screen by adding the following custom policy:
Name: Windows 10 Password Reset
Description: Add Password Reset to Windows 10 Logon
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Authentication/AllowAadPasswordReset
Data Type: Integer
Value: 1
In my opinion a local account isn't needed. I use Intune a lot of years now and never had to cope with an issue where users couldn't logon to their devices.
Jun 12 2019 11:46 PM
@RobdeRoos I do have enable this CSP Policy, but it does not have nothing with this question.
Example scenario:
- intune user is using windows 10 device, everything works, the user is only local user with local admin rights
- device is updated and network card driver is broken
- user and user-admin can not login with their intune accounts, since there is no network connectivity...
May 22 2020 08:47 AM
@hkusulja Did you ever get this figured out? I am in the same situation. Since we have alot of remote users.
May 22 2020 04:11 PM
Create local accounts in all your PCs, you can login anytime you don't need network connection.
Here how to create Local Admin and push it using Intune:
https://www.inthecloud247.com/create-a-local-user-account-on-windows-10-with-microsoft-intune/
Hope this helps!
Moe
May 22 2020 04:15 PM
Hey Moe, yup I know about this as per the above comments.. I actually have this setup, the only issue is this only creates new local user, but how do you update existing local User accounts?
May 22 2020 06:35 PM
May 26 2020 09:27 AM
so i tried it, and i can manually run the ps1 on my computer, and it works, but when i try to run that as a script in Azure AD intunes, i get a error. What am i missing?
May 26 2020 09:35 AM
This is the powershell i did
$NewPassword = ConvertTo-SecureString "PasswordHere" -AsPlainText -Force
Set-LocalUser -Name AdminUser -Password $NewPassword -Description "Backup User 2020-05-26"
May 28 2020 09:07 PM