May 10 2023 02:38 PM
Is it really not possible to force an Intune sync on a client computer from the command line? It seems like such a simple thing to do. Rather than make me dig 3 subpages deep to click a button, just let me fire off a DOS command and get on with my day.
I'm familiar with the MS-Graph method, but honestly, clicking a "Sync" button should never be as complicated as that.
I'm also familiar with Michael Neihaus' method...
Get-ScheduledTask | ? {$_.TaskName -eq 'PushLaunch'} | Start-ScheduledTask
That has never worked, but don't tell anyone because there are a lot of admins out there who think it does, and I'd hate to spoil their day.
Am I just too dim to figure this out or is there really no way to sync from a CLI?
Thanks,
May 16 2023 03:04 AM
May 16 2023 03:28 AM
MANAGING INTUNE WITH POWERSHELL - TFTD I've used his cmdlets in powershell and it works
May 18 2023 11:19 AM
May 19 2023 02:08 AM
May 19 2023 02:44 AM
May 19 2023 08:31 AM
May 21 2023 06:40 PM
May 24 2023 11:53 AM
I think I'm going to tackle this a different way. Since the only reliable method to force an Intune sync is with a reboot, I'll just make that part of my process now. It's easy to force a reboot in the CLI (shutdown /r, or Restart-Computer). The problem comes with logging back in. That still requires the GUI. However, you can leverage the Windows Logon Options section of local Group Policy to automatically log in and lock a computer following a reboot or power-on event. There isn't a way to modify local Group Policy settings via Intune or even PowerShell (that I've yet found) for cloud-only shops, so this is a one-by-one modification using the GUI. Of course, every log in after a reboot is a one-by-one affair using the GUI as well, so this change is well worth the frustration. I'll test out my hypothesis on some devices and see how it goes.
Thanks everyone.
May 31 2023 09:06 AM
Jun 06 2023 10:23 AM - edited Jun 06 2023 10:28 AM
I think I figured it out. For future Bing searchers, the feature is called Windows Automatic Restart Sign On (ARSO). It works as you might expect. Make your Intune policy changes, then fire off a restart command to the endpoint(s) using your RMM, PowerShell or whatever CLI you use. After the login screen comes up, the computer quietly logs in, behind the scenes, using the last logged-in user's credentials. Intune policies sync, Windows Updates finish, Teams launches, startup apps load, etc. The user comes in the next morning and logs in instantaneously to a fully loaded Windows desktop, as if the computer had been locked all along.
ARSO is set by either a Local Group Policy, a Domain Group Policy or a registry hack. All can be accomplished via Intune. There is a mix of various requirements that need to be met before it will truly work, however. These include Bitlocker and/or TPM 2.0.
This link explains ARSO, its requirements, and how to set it up: Winlogon automatic restart sign-on (ARSO) | Microsoft Learn. It excludes any discussion of ARSO via Intune, however.
This link shows how to enable ARSO via Intune (kinda): Winlogon automatic restart sign-on (ARSO) | Microsoft Learn. The link actually shows how to disable ARSO, but you can use the same policy to enable it. The policy changes a Local Group Policy setting on each device that enables ARSO if the other requirements (Bitlocker, TPM 2.0, etc.) are met. (I was wrong about not being able to set Local Group Policy via Intune. This link shows where in Intune those settings are hiding. Yay!)
So the answer is that you CAN force an Intune sync exclusively via CLI, if you stand back a few paces, squint your eyes and fiddle around some.
Hope that helps someone.
Nov 06 2023 03:25 PM - edited Nov 06 2023 03:26 PM
I found out a way to do it. Triggering the ‘PushLaunch’ scheduled task doesn’t seem to actually perform a MDM sync like when the user selects ‘Sync’ in Company Portal settings or the ‘Access Work or School’ page in settings, as you’ve said. At least not when the user is only a standard user (ie, not an admin).
After some digging, I found that performing the command found in the actions part of the ‘Schedule #3’ Intune scheduled task. This seemed to be the only way I could get a proper MDM sync to work in a way that can be run as an administrator (ie, via PDQ or RMM) with the signed in and licenced user being a standard user.
Because the enrollment ID is different per machine, I added a one-liner to pull the ID from the Scheduled Task path on the machine and then use it in the deviceenroller.exe command.
The script:
$EnrollmentID = Get-ScheduledTask | Where-Object { $_.TaskPath -like "*Microsoft*Windows*EnterpriseMgmt\*" } | Select-Object -ExpandProperty TaskPath -Unique | Where-Object { $_ -like "*-*-*" } | Split-Path -Leaf
Start-Process -FilePath "C:\Windows\system32\deviceenroller.exe" -Wait -ArgumentList "/o $EnrollmentID /c /b"
I hope it helps someone else out.
To confirm this, run the script against a machine with task manager open and you can see the omadmclient.exe process running, just as it does when using the ‘Sync’ GUI button. This doesn’t happen when restarting IME or triggering the ‘PushLaunch’ task (not when the user is a standard user anyway).
Dec 21 2023 07:56 AM
May 15 2024 08:17 PM
May 15 2024 08:18 PM