Windows 10 11 Enterprise Restrict access to MS Store via group policy
Issue presented: Multiple users are downloading and installing Remote Access tools that are deemed not supported as well as other applications in the environment. We want to restrict access to the MS Store to Administrators or a specific AD group without using AppLocker or InTune. I have seen various threads in multiple sources that are conflicting about disabling the store or setting to the Company Portal for Windows 10/11. If you set the MS Store to Company Portal, in Windows 11 it disables the store. Turn off the Store application GPO: Denies or allows access to the Store application. If you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates. Other threads as well as the gpo verbiage itself indicate that if you disable the store, all installed applications will no longer update. There are some threads that state the opposite. https://learn.microsoft.com/en-us/windows/configuration/store/?tabs=gpo Has anyone configured a way to restrict users or a specific group of users from using the MS Store while allowing existing applications the ability to update?
Unable to install Windows 10 ESU due to unknown MDM
I have been trying to get the Windows 10 ESU program enrollment done, but an unable to. It appears that I am connected to some MDM, but I have never to my knowledge done so. Also, there are no options listed in "Accounts-> Work or School." I ran the following in Powershell and got outputs 0 True 0 2, indicating the MDM registration. $t = [AppDomain]::CurrentDomain.DefineDynamicAssembly((Get-Random), 1).DefineDynamicModule((Get-Random), $False).DefineType((Get-Random)) $t.DefinePInvokeMethod('IsDeviceRegisteredWithManagement', 'mdmregistration.dll', 22, 1, [Int32], @([Boolean].MakeByRefType(), [IntPtr], [IntPtr]), 1, 3).SetImplementationFlags(128) $t.DefinePInvokeMethod('NetGetJoinInformation', 'wkscli.dll', 22, 1, [Int32], @([IntPtr], [IntPtr].MakeByRefType(), [UInt32].MakeByRefType()), 1, 3).SetImplementationFlags(128) $Win32 = $t.CreateType() $JoinedMDM = $False; $Win32::IsDeviceRegisteredWithManagement([ref]$JoinedMDM, 0, 0); $JoinedMDM $JoinedDomain = 0; $Buf = 0; $Win32::NetGetJoinInformation(0, [ref]$Buf, [ref]$JoinedDomain); $JoinedDomain Thanks for any ideas, Tom
Moved 2.5"ssd from old Intel NUC to new Intel Nuc, can't find docs/pics
So not sure if this is the right place after wading through all the options so here goes: I moved a ssd from my old NUC that was on it's last legs (pwr supply). It was windows 10 and I needed a new system as the hardware was too old to upgrade to WN11 and the pwr supply was on the blink anyways. I installed two brand new SSD's in the new NUC and installed a new version of WN11 on one (Linux mint on the other). I got the new system up running both OS's w/o much trouble (other than my old HP laser printer which is so old that HP doesn't support it anymore). I took the old 2.5" ssd out of the failing nuc and connected it to the new system via usb-c. wn11 recognizes it as drive F but show two identical F drives...? why two F's? I can open it via File explorer but I can't find any of my word docs. Doing a search in the search box with drive F selected, all wn11 does is state : "working on it" and never finds anything (the little spinning circle spins itself senseless) and I finally give up and end the task :) If I boot my Linux ssd, I can find the docs and also pics too. What am I doing wrong? I can find docs using the linux OS but I can't in the OS that they originally were created in (windows/word)Windows 10 21H2 and Windows 11 21H2 both show up as "2009" release
I'm not real sure where to post this, so will try here. I have noticed that for both Windows 10 - 21H2 and Windows 11 - 21H2, the "ReleaseID" value in the Registry is incorrectly shown as "2009". (We are using Windows 10/11 Enterprise.) This is located at this key in the registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion We rely on inventorying this value to determine which computers have which "Feature Update" installed, and therefore, which computers we still need to update. Has Microsoft migrated away from using this value to indicate which Feature Update is installed? Do we need to change our approach to look at the "DisplayVersion" instead of the "ReleaseID"? Or some other value in the registry? Also, Windows 11 has another issue. In the same registry key location, the "ProductName" value is listed as "Windows 10 Enterprise", which of course is incorrect. Are others seeing these same results with these items? Anyone heard if Microsoft has plans to fix these issues?GPO stettings for Privacy Windows 10 and Windows 11
Hello, I have set a security policy in GPO for some privacy & security settings. But I cannot find these settings in GPO. I don't want to edit this using the Windows registry, does anyone perhaps know where these settings are available? Let apps show me personalized ads by using my advertising ID Let websites show me locally relevant content by accessing my language list Let windows improve start and search results by tracking app launches Show me suggested content in the Settings appHow do I verify network endpoint connectivity.
Hi, Is there an easy way to verify internet endpoint connectivity. I come across this regularly where a product documents that I need to verify internet endpoint connectivity to various url's and ports. For example, for windows update: - this page https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-troubleshooting has this entry - Ensure that devices can reach necessary Windows Update endpoints through the firewall. For example, for Windows 10, version 2004, the following protocols must be able to reach these respective endpoints: Protocol Endpoint URL TLS 1.2 *.prod.do.dsp.mp.microsoft.com HTTP emdl.ws.microsoft.com HTTP *.dl.delivery.mp.microsoft.com HTTP *.windowsupdate.com HTTPS *.delivery.mp.microsoft.com TLS 1.2 *.update.microsoft.com TLS 1.2 tsfe.trafficshaping.dsp.mp.microsoft.com How do I test that. obviously using ICMP is no test for verifying http, https or TLS connectivity. What is the process? I haven't found anything powershell to do it as everything seems to rely on ping. i figure for the standard addresses, I could do something like this for http Telnet address1.microsoft.com 80 but I figure Telnet is old school, there should be something newer around these days and also how do I test the entries with * on the front of the name how do I test TLS 1.2 I'm sure there are hundreds of tech support people out there doing this currently, somebody should be able to point me in the right direction.OMA-URI Lockscreen
Recently our Organization started to migrate our client infrastructure to Microsoft Intune. Windows 10 OMA-URI Lockscreen Timeout: To personalize a timer of inactivity to lock Windows 10 you will have to create a custom device configuration profile with an OMA-URI path. I will now explain you which settings you have to set to get it working: How-to The OMA-URI Path is: To define a time of inactivity create the Data type Integer. Use your preferenced amount in seconds. (for exampe: 900 for 15 minutes.) Take a look to the image attachment for exact configuration. Now assign this device configuration profile to your device group. Make sure you also sync it to the client from the web portal of Intune, but also on the client in the company portal. Perfect, the assigned devices will now lock after a user inactivity time which you defined.
Prevent Windows 11 upgrade, but allow Windows 10 feature packs
I am looking for a Script, GPO, or Registry key that will prevent Windows 10 from upgrading to Windows 11, but still allow the endpoint to upgrade to the latest feature pack. I have already investigated using the 'select target feature pack' GPO or registry key, but management doesn't want us to have to manually maintain the version. We currently do not use WSUS or another management software. Any suggestions are appreciated ThanksChanging MAC address without using third-party app.
Hi, For changing MAC address without using third-party app, following options I found in most articles: A. Using Device Manager B. Using Random Hardware Addresses in Windows 10 and Windows 11 There are multiple queries and doubts related to changing MAC address as below: 1. I know, MAC address is a 48-bit hardware address in 12-digit format of hexadecimal number. How can I calculate random number for the value of Locally Administered Address, if we want to change the MAC address using Device Manager? 2. In case of Random Hardware Addresses in Windows 10 and Windows 11, Windows 10 and Windows 11 have different options as below; Windows 10 Windows 11 Like Windows 10, can I setup Change daily in Windows 11? 3. Random Hardware Addresses option is available only, if system is connected with Wi-Fi. The option is not available, if system is connected with an Ethernet cable. Can I enable Random Hardware Addresses option, if system is connected with an Ethernet cable? 4. After changing the MAC address, how do I know the actual MAC address which is engraved on the network adapter? Please resolved queries. I'll be thankful for your assistance. With Regards NndnGAsk the Experts LIVE: Securing Windows Devices with Microsoft Endpoint Manager
Save the date and get answers to any questions you have around securing Windows devices with Microsoft Endpoint Manager in this special Ask the Experts event! This event will take place on Teams Live Events. At (or just before) 9:00 a.m. Pacific Time on Tuesday, October 27, 2020, visit https://aka.ms/MEMATE/SecWin to join the meeting. We'll have members of the engineering and product teams on camera and on chat to help answer your questions large and small, including: Matt Shadbolt Mike Danoski Laura Arrizza Tyler Castaldo Aasawari Navathe Lance Crandall Dave Randall Dilip Radhakrishnan Mahyar Ghadiali Sameer Yadav Shiv Patel Matt Call We hope you can join us for a great discussion!
