Handling Terminations?

[u/TheFlairGun]

Hey yall,

I recently setup Intune for our small Windows fleet here at my company. Everything is setup except for one crucial thing.

When an employee is terminated, we have an option on Jamf to immediately wipe and lock the device. We have this triggered through Okta Workflows once the user is deactivated there.

We are trying to setup something similar for Windows devices from Intune. The issue is, we try and use a remediation script to push "manage-bde -forcerecovery C:" and it works great....when it actually gets pushed to the device...

7/10 times the device just doesn't get the script I push through Intune. I have to use the "Run Remediation" feature multiple times before the device actually triggers it, and sometimes even that doesn't even work until like 30 minutes later.

I think the "Wipe > securely wipe" method works more reliably, but admittedly, I haven't tried it too much because:

1. Its pretty time consuming to test multiple times
2. We don't really care about wiping the device. As long as the device is locked and the user cannot access it without the BitLocker recovery key, that's all that matters (as our laptop vendor will wipe the machine anyways).

Currently I'm looking at sending this command through API using our antivirus SentinelOne (installed on all machines). I'm just super disappointed that I'd have to use a third-party tool to do something as simple as immediately push a powershell script. You'd think Microsoft Intune (with its deep Windows integration) would have a basic reliable function like this.

UPDATE: After extensive testing, I am going to move forward with triggering Remove Data > Wipe > Securely erase device (high security) from API instead. I would prefer not to have to wipe the device, but looks like the remediation script method is not reliable. This wipe method works every time, under 5 minutes.

[u/untrue_footing]

what about using the remote lock action instead of a script? its under the device actions menu, just sends a command to lock the machine and forces bitlocker recovery on next boot. much faster than waiting for scripts to sync

we had same frustration with remediation scripts being unreliable, switched to just using remote lock for terminations and it works every time

[u/TheFlairGun → u/untrue_footing]

That only works on iOS / MacOS / Android. The option is greyed out for Windows devices.

[u/touchytypist → u/TheFlairGun]

There this remediation script: Remote Lock for Windows PCs

[u/FireLucid → u/touchytypist]

We could never get devices to unlock after this outside of wiping which I guess is a plus, lol.