Hey everyone,

I shared Foundry OSD here a few months ago. It's my free and open-source Windows deployment project, and a lot has changed since, so this time I'd like feedback on the project as a whole.

It's a point-and-click workflow: you build an ISO or USB on your admin PC, boot the device into WinPE, check the network, and deploy Windows with the right drivers, firmware and configuration.

Since the last post, mostly thanks to your feedback, it now covers:

• Autopilot: JSON profile, zero-touch and interactive hardware hash upload (docs)
• Active Directory domain join (docs)
• Custom Windows images (.wim / .iso) (docs)
• Custom post-install: scripts, installers, restarts (docs)
• Windows customization: OOBE, AppX removal, driver pack and firmware handling (docs)

The latest releases also came with new features and bug fixes reported by users. It's getting more mature, and I've had very good feedback from enterprise environments.

So I'm curious: does this fit how you provision devices today? What would you still want from a tool like this?

I want to keep growing the project, so I'm also looking for contributors, and if you have ideas for improvements, I'd love to hear them too.

GitHub: https://github.com/foundry-osd/foundry

Docs: https://docs.foundryosd.com/

We enrolled 375 xcover 7 devices via Intune as managed kiosk devices. For all users it is working fine expect for 1 user. When the user picks up the sound is given via the device speaker each time. We enrolled a other device but the same happens: sound via speaker. Anybody has an Idea?

I tried searching the sub but I could not find anything related to my issue so I am posting this to see if anyone else has seen this.

Essentially. We have some apps that are only allowed to run if the device is in OOBE. The thing is these aren't apps they are just built as win32 apps. It's just scripts and stuff we want to run only during OOBE. We use the OOBE script check outlined here to perform the check its only in OOBE. This has been working fine for a long time. However, we started upgrading from 23H2 to 25H2 and noticed some devices are running this OOBE only script app during this feature upgrade.

We are using CM to handle updates/upgrades, and we are using the feature upgrade to 25H2 in CM to do this.

My question is, during 25H2 upgrade does the upgrade put the computer in a state that it thinks it's in OOBE? It's the only logical thing we can see at this point. Only some devices did this because the OOBE only app didn't have the DM satisfied. Device built through a different process and thats why the DM wasn't satisfied.

If this is the case, is there a more robust way of checking if a device is in OOBE?

I'm new to Intune but we're in the process of finally finalizing a co-managed environment with SCCM/MCM. The Intune environment was setup before I started here but was basically left dormant for a few years.

We have a pilot collection with ~150 devices that we have selected for Intune uploading. Out of those 150 though, about 30 are not showing up in Intune. I've tried a few things but feel like I don't know what I am doing. I could use some advice for other things to look for or troubleshooting steps to try.

The missing computers show up in Entra with

• Join Type - Microsoft Entra Hybrid Join
• MDM - Microsoft Configuration Manager

Which is the same settings as computers that are in Intune.

Running a dsregcmd /status showed

AzureAdJoined : YES

EnterpriseJoined : NO

DomainJoined : YES

I tried a dsregcmd /release and dsregcmd /join but that didn't seem to do anything besides change the settings to

AzureAdJoined : NO

EnterpriseJoined : NO

DomainJoined : YES

I have the CoManagementHandler.log but I don't really know what to look for. The only "errors" I see is

Could not find one of the mandatory rules

Failed to merge/resolve rules. Error 0x8000ffff

Failed to process GET for assignment (ScopeId_ED06A085-0019-4487-A03D-1FCA55DD1203/ConfigurationPolicy_50986354-296d-4e21-a2bb-af7459941ed4 : 2). Error 0x8000ffff

Any advice or recommendations for what to look for would be appreciated.
Thanks!

recently we changed from dell to hp. we are only using hp connect to manage bios and hpia to manage drivers.

i saw there are 3 other hp software, are these consider bloatware and to recommend remove? thanks

HP One Agent

HP Notifications

AD2F1837.HPSystemInformation

Hi guys,

Wondering if anyone is having any issues with SCEP profiles since approx end of last week? No errors in the portal (in fact when clicking profile then device name, no message at all), then via Autopilot it just hangs.

I'm digging further into logs but thought I'd ask if anyone is experiencing any issues with their setups?

SCEP Connector doesn't show any issues either.

Hi All!

We have a great local event coming up next month at the Microsoft campus in Burlington, MA you won't want to miss!

We have these 5 amazing sessions:

• Toolkit for Building Agents: M365 Copilot, Copilot Studio, SharePoint & Cowork by Manpreet Singh, Copilot MVP
• PSAppDeployToolkit 4.2: Smarter Deployments and Modern PowerShell UI by Dan Cunningham of Devicie, Co-creator of PSADT
• A Year of Workforce Passkeys in Entra ID: Lessons Learned and the Road Ahead by Eric Woodruff, CIDPRO of Semperis Entra MVP
• Debugging skills in Windows by Tim Mangan, Windows and Devices MVP
• Windows 11 in 2026: New Tricks, Hidden Gems, and the IT Pro Survival Guide by Harjit Dhaliwal of Robopack Windows Devices MVP

Outside of these 5 sessions, we will have a great catered hot buffet lunch, and a happy hour at Temazcal after the event.

We're also planning to raffle off one free pass to Workplace Ninjas US 2027 in Scottsdale, AZ in January. A great way to escape the already frigid temps we have in Massachusetts.

Hope to see some of you there, as we had 60 people last time around!

Sign up here: Workplace Ninjas US Boston Meetup Tickets, Thursday, November 12  •  10 AM - 4:15 PM | Eventbrite

--Jon

Has anyone seen or reported issues with PKCS certificates failing to deploy to iPads running 27.0.1? Everything was fine on 27.0.0 until this point update.

And just to narrow the impact, I re-enrolled an Android device that uses an identical certificate/Wi-Fi configuration, and I had no issues with that one.

Hey,

question: If you have 8 hours to improve something in an Intune environment for (virtual) windows systems (entra id only joined).

What would you do to get instant improvements? :)

some requested more information, so let's say: The intune environment is untouched for one year. So every cool feature since then is probably interesting.

Hi,

I hope someone might confirm my findings:

Normally I can obtain a passwordless onboarding with:
OOBE -> Login with TAP/passkey -> WHfB registration with TAP/passkey -> Passwordless onboarded.

But it seems that this (documented) ZDP patch is a mandatory install after OOBE but needs a reboot before the user can register for WHfB. This reboot does however present now a username and password prompt before the user can continue to register WHfB.

I use the september Windows 26H2 en-US ISO as base install. When logging on I already see the 'KB5128942' installed which confirms the install of this ZDP patch.

So, in essence this forced update seems to 'break' passwordless onboarding as the extra reboot doesnt let the user register for WHfB and so a username and password must be presented after the extra reboot to proceed then with registering for WHfB.

I tried Autopilot v1 with ESP -> Install Windows updates (might restart the device) | no -> As documented ZDP patches doesnt seem to honor this flag.
I tried Autopilot device preparation with device registration -> no option like Autopilot v1.

Although this ZDP patch may be integrated into the next ISO or installation media—temporarily mitigating the issue—the next OOBE ZDP patch could break passwordless onboarding again. Enabling WebSignin may offer a more stable workaround, but because Microsoft can push new OOBE ZDP patches at any time, the passwordless onboarding experience remains fragile and less reliable

Whenever I search for "intune" " entra login" or similar they never bloody appear in google.

Yes, i could type in the actual link, but when I tell someone to google it, they get sent to some random websites what google populates and seems that MS blocks from appearing.

Trying to set a 60/80 charge threshold on our ThinkPads (T14 Gen 6, Intel) through Intune so users never have to touch Commercial Vantage. It’s not working the way we expected and I’m not sure what we’re missing.

Here’s what we did:

1. Deployed Commercial Vantage 20.2608.13.0 as a Win32 app with VantageInstaller.exe Install -Vantage -SuHelper, system context.
2. Imported Lenovo’s CommercialVantage.admx/adml into Intune (had to upload the Windows ADMX first because of the NamespaceMissing error).
3. Created an Imported Administrative Templates profile and set “Turn off Battery Settings” to Enabled, ticked “Enable custom battery threshold settings”, Start 60, Stop 80, left “Automatically set start charging” unticked. Also enabled “Accept EULA automatically”.
4. Assigned it to a device group.

The values land fine in HKLM\SOFTWARE\Policies\Lenovo\Commercial Vantage (enabled = 1, start = 60, stop = 80) and LenovoVantageService is running. But the laptop kept charging past 80. Once someone opened Vantage, the limit started working right away and Windows started showing “Smart charging is on”.

Saw an old thread on the Lenovo forums with the same thing, policies only kicking in after Vantage was launched for the first time, but nothing about it in Lenovo’s docs.

So what’s the proper way to get this policy applied without anyone opening the app? Are we missing a setting, a step, or a component? We don’t have ImControllerService on these machines, not sure if that matters on newer builds.

Right now our fallback is a one-time script that opens Vantage for a couple of minutes and closes it, but that feels like a hack.

Nice to have additional Windows login MFA options beyond WHfB.

[Web sign-in] Web sign-in now works on Microsoft Entra hybrid joined devices. Before this update, it was only available on Microsoft Entra joined devices. You can sign in to Windows at the lock screen with a passwordless credential: a FIDO2 security key, a passkey on your phone, or a Temporary Access Pass (TAP). You don't need a password. Once you're signed in, Windows gets a Kerberos ticket, so on-premises file shares and internal sites keep working.

https://www.neowin.net/news/new-windows-11-build-improves-gaming-task-view-and-revamps-the-run-dialog/

We're deploying Yealink MP56 E2 and MP58 E2 Teams phones (Android AOSP 15) and running into an issue with Conditional Access during initial sign-in/enrollment.

Our phones use regular employee M365 accounts, not resource accounts. Some employees don't have MFA configured, which is fine for their normal workstation access, but we have a Conditional Access policy that requires MFA AND a compliant device for anyone accessing M365 from Android/iOS.

Obviously, the Yealink phones get caught by this policy since they're Android devices.

What I'm trying to accomplish:

• Allow employees to sign into new Yealink Teams phones using their M365 username/password without MFA.
• Keep MFA required for personal iOS/Android devices, even for those same employees.
• Keep the Yealink phones enrolled and compliant through Intune AOSP.
• Automatically identify and exempt Yealink phones without manually maintaining device IDs or excluding users every time we deploy one.
• Keep device code flow blocked. We're using direct sign-in on the phones.

The issue:

Once a phone is enrolled, this seems straightforward. Intune/Entra reports the manufacturer as Yealink, model as MP56 E2 or MP58 E2, and enrollment profile as AOSP - Teams Devices.

However, during the very first sign-in on a factory-new phone, none of those device attributes are available yet.

I tested this with a completely new M365 account that had never registered MFA. After entering the username/password on the phone, I immediately got the "Let's keep your account secure" prompt requiring Microsoft Authenticator.

The Entra sign-in logs show:

• Application: Microsoft Teams
• Resource: Device Management Service
• Authentication requirement: Multifactor authentication
• Error: 50079 (MFA registration required)
• Related event: 50097 (device authentication required)
• Device ID: Blank
• Device name: Blank
• Managed: No
• Compliant: No
• OS: Android

The sign-in user agent does identify the hardware:

Dalvik/2.1.0 (Linux; U; Android 15; MP56 E2 Build/AP4A.241205.013.C1) ;MP56 E2

But as far as I can tell, Conditional Access can't filter directly on the user agent.

Microsoft's Teams Android Conditional Access documentation mentions using device.displayName because manufacturer information is supposedly available early in the sign-in process, before Intune enrollment finishes.

However, the device display name is completely blank in my initial sign-in logs. After enrollment, the display name changes to something like Username_AndroidAOSP_Date, which doesn't contain Yealink either.

My questions:

1. How are you excluding Teams Android phones from MFA policies during their very first sign-in, before they have an Entra device identity?
2. Has anyone successfully used device.displayName filtering for initial enrollment on Yealink MP56 E2/MP58 E2 phones? If so, what exact filter are you using, and how did you verify the value?
3. Are you temporarily excluding users/groups from your mobile-device CA policies during enrollment, then removing the exclusions afterward?
4. Is there a better supported way to handle this without disabling MFA for personal mobile devices or enabling device code flow?

I understand I could temporarily exclude the user from the Android policy, enroll the phone, and then use manufacturer/model filters afterward. But I'd really prefer something scalable that doesn't require manual exceptions for every deployment.

Has anyone actually implemented this successfully with Yealink Teams phones and Intune AOSP? What does your Conditional Access configuration look like?

Curious to see if anyone is using the Edge management service to block other browsers. Initial deployment is being met with some intense pushback. Unreasonable as I've asked what Chrome can do that Edge can't and I get no logical responses.

We have on-prem AD synced to Entra ID, Microsoft 365 passkeys enabled, and Mac users accessing VPN and Windows SMB shares with AD credentials.
We’re planning to enroll Macs in Intune with Platform SSO and standard local accounts. The goal is fewer passwords and simple recovery.
For those with a similar setup:
Did you choose Password sync or Secure Enclave?
How do you handle VPN and SMB authentication?
How do users reset forgotten passwords, especially when locked out of the Mac?

I’m advovatimg or move file server to sharpoint still havmt. Convinced My Boss due to cost . I’m talking about 90Tera of data
I also old My network Guy to ensure vpn authenticates From extra instead of local AD. Pending more convincing.

Would appreciate hearing what works in practice.

Over the past few days, we identified an issue where some devices managed through Microsoft Intune and Windows Autopatch were unexpectedly upgraded to Windows 11 26H2, even though our Feature Update policies were explicitly configured to target Windows 11 25H2.

We opened a support case with Microsoft, and their official response confirmed that the issue originated from a service-side problem within Microsoft's infrastructure.

According to Microsoft:

• The issue has been identified and mitigated.
• The unexpected Windows 11 26H2 rollout has been stopped.
• Devices that had not yet restarted were removed from the 26H2 upgrade path.
• Microsoft has requested confirmation of the current upgrade status of affected devices.

Here's the important part:

The issue was not caused by an incorrect Intune or Autopatch configuration, but rather by a problem on Microsoft's service side.

However, Microsoft has not confirmed that devices which have already completed the upgrade to Windows 11 26H2 will automatically be rolled back to 25H2.

This incident highlights an important reality of cloud-managed update environments:

Even when Feature Update policies are correctly configured, the actual outcome may not always match the intended deployment configuration.

For organizations managing large Windows environments, continuously monitoring Feature Update policies, actual OS build versions, and unexpected upgrade activity is essential.

Has anyone else experienced unexpected Windows 11 26H2 upgrades in their Intune or Windows Autopatch environment?

I'm testing out administrator protection on my pc and I kinda like it, but I found a caveat:

I'm trying to deploy a shortcut in the start menu to the Papercut Hive client since it doesn't show when you look for it and you can bet your ass people will accidentally turn it off at startup or some shit. So I test it locally, works fine.

When I deploy it in Intune in User context, it uses the account that is used for Admin Protection (local account starting with ADMIN_userName). Not sure why since the script is set to not require admin:

    RequireAdmin                = $false

I'm not sure how to continue, to be honest. Anybody know how I can target my actual user appdata? Really don't want to do some heavy math just to find the fucking user.

Per MS doc: psso policy must be assigned to static user group and doesn’t work with device or dynamic groups.

Q: will it work with “All users”?

It’s mentioned that we should assign the psso, company portal and enrollment policy to this SAME user group as well otherwise “psso during enrollment fails”

So that makes me think “ all users” wouldn’t work.

Hi everyone,

We recently discovered an issue with our Intune Autopilot deployment.

We have Microsoft 365 E3 licenses, so our devices should be running Microsoft 365 Apps for Enterprise (O365ProPlusRetail).

Unfortunately, someone mistakenly configured our Autopilot deployment to install Microsoft 365 Apps for Business (O365BusinessRetail) instead.

As a result, we now have two scenarios across our environment:

• Devices with only O365BusinessRetail installed.
• Devices showing both O365BusinessRetail and O365ProPlusRetail in their Click-to-Run configuration.

I'm looking for advice and real-world experience on the best way to fix this.

1. Migrating from Business to Enterprise

Is there a supported way to switch from O365BusinessRetail to O365ProPlusRetail without completely uninstalling and reinstalling Office?

Could we simply deploy a new ODT configuration XML through Intune to change the product ID while keeping the existing installation?

Ideally, we'd like to make this change as silently and transparently as possible, without disrupting users or forcing them to close their Office applications.

2. Devices with both products installed

What's the safest way to remove O365BusinessRetail while keeping O365ProPlusRetail?

Has anyone successfully handled this using ODT or Intune Remediations?

3. Impact of running Business with E3 licenses

How problematic is it to have Microsoft 365 Apps for Business installed on devices where users have Microsoft 365 E3 licenses?

Apart from potentially missing Enterprise-specific features, are there any licensing, activation, security, or management implications?

Our main priority is to fix this across our existing devices with minimal user impact.

I'd really appreciate any recommendations, scripts, ODT XML examples, or lessons learned from anyone who has dealt with a similar situation.

Thanks!

Hey All,

We are currently having our IT techs use Intune Remote Help to assist users and to fix any issues on those workstations. I've noticed a couple of issues recently that I'm curious if anyone else is facing the same issues.

1. Connectivity issues with Attended Remote Help sessions. I've seen multiple reports, and witnessed a few of them myself, where the helper will start a session from the Intune Admin Center, the end user/sharer will click the Windows Notification, and start the session. However, both Remote Help clients will just sit there spinning for forever. At first, I was thinking it was a Hybrid Join issue, since that is how the vast majority of our devices are set up. But it also happens on our Entra Joined machines too.

2. Keyboard input on Unattended sessions sometimes does not type on remote workstation. On some remote machines, we've seen issues where trying to type on a remote workstation does not actually type anything on the remote machine. I think this is isolated to a couple applications, rather than a whole Remote Help service issue. At first, I was thinking if I turned off and on Advanced keyboard commands that it would start working, but it did not.

Also, I made sure that all clients for Remote Help, as well as the RD bootloader and RD infrastructure agents were on whatever the latest versions are (Thanks PatchMyPC, y'all are bros).

There also may be other weird issues that I'm not thinking of, but just curious if people are actually experiencing similar issues, or are actually happy with how the Remote Help features work as is.

I'm starting an effort to migrate local admin privileges to a managed tool. Since EPM is included, I'm obligated to try it out before saying CyberArk is the only way.

The environment is simple. You have you standard account and if you have local admin, you have an admin account.

So now that the audit policy has been running for a couple weeks, why do I have events like regular accounts running chrome.exe as an unmanaged elevation? Or cmd.exd having over 32k elevated events

And then I cant export the reports?

I feel like I have to be doing something wrong because this experience is just horrible.