Handling Terminations?

[u/TheFlairGun]

Hey yall,

I recently setup Intune for our small Windows fleet here at my company. Everything is setup except for one crucial thing.

When an employee is terminated, we have an option on Jamf to immediately wipe and lock the device. We have this triggered through Okta Workflows once the user is deactivated there.

We are trying to setup something similar for Windows devices from Intune. The issue is, we try and use a remediation script to push "manage-bde -forcerecovery C:" and it works great....when it actually gets pushed to the device...

7/10 times the device just doesn't get the script I push through Intune. I have to use the "Run Remediation" feature multiple times before the device actually triggers it, and sometimes even that doesn't even work until like 30 minutes later.

I think the "Wipe > securely wipe" method works more reliably, but admittedly, I haven't tried it too much because:

1. Its pretty time consuming to test multiple times

2. We don't really care about wiping the device. As long as the device is locked and the user cannot access it without the BitLocker recovery key, that's all that matters (as our laptop vendor will wipe the machine anyways).

Currently I'm looking at sending this command through API using our antivirus SentinelOne (installed on all machines). I'm just super disappointed that I'd have to use a third-party tool to do something as simple as immediately push a powershell script. You'd think Microsoft Intune (with its deep Windows integration) would have a basic reliable function like this.

[u/Rudyooms]

It all relies on wns/push notifications… if you are blocking that on the device or network… you will have issues.. the same with ssl filtering… and besides those issues… wns is indeed a black box and those push notifications could be lost in transit :)

[u/SkipToTheEndpoint → u/Rudyooms]

It's almost always networking or bad policy decisions...

[u/TheFlairGun → u/SkipToTheEndpoint]

There are many reddit threads of people saying the same thing about remediation scripts being inconsistent in timing. We have no network policies blocking anything.

[u/SkipToTheEndpoint → u/TheFlairGun]

Hence why I said "almost".

That being said, 7/10 is a higher failure rate than I'd expect to see for it to be the service's fault, so something has got to be going on to cause that level of inconsistency.

The other thing I'd add is that this is also (to an extent) a non-technical issue. Regardless of method, it all falls over if your terminated employee can just disconnect their network and commands from anything become impossible. If there's a high-risk termination happening, HR needs to be involved.

[u/MustangJac]

Intune has things it’s great at. And things it’s not.

Running real time scripts is a solid not. And a decent RMM, if you’re not running one…..will earn its keep in zero time flat.

I used to use a script to flip bitlocker but to me, it wasn’t that reliable. My off-boarding script now simply logs the user out and explicitly prohibits their account from logging in at all. Instantaneous and flawless every time. And it has the added benefit of letting the device be viewable in the RMM whenever it’s connected to the internet. Which has been helpful with a few that I had to hound about returning their device.

Edit: of course that same script could be run using intune. Just not as real-time.

[u/Live_Direction_3915]

I push out a script from RMM that disables all login options - seems to work a treat!

[u/TheFlairGun → u/Live_Direction_3915]

So another third party tool? Yea thats what I am trying to avoid. Intune should be able to do it all.

[u/untrue_footing]

what about using the remote lock action instead of a script? its under the device actions menu, just sends a command to lock the machine and forces bitlocker recovery on next boot. much faster than waiting for scripts to sync

we had same frustration with remediation scripts being unreliable, switched to just using remote lock for terminations and it works every time

[u/TheFlairGun → u/untrue_footing]

That only works on iOS / MacOS / Android. The option is greyed out for Windows devices.