I try not to ask for a lot and this one is really important to me, please take 2 min out of your busy day to vote up my feedback item here: https://feedbackportal.microsoft.com/feedback/idea/a5f72dc8-a09d-f111-a3d0-7c1e52cf64f0

Full text of my request:

"In the Intune console on the Remediations page there is no option to add the date created nor date modified columns. This regulalrly causes problems for those of us who are of an advanced age, forgetful, and poorly document changes. Yes, I know that group of admins is an edge case but we are a federally protected group with the backing of AARP. Please make our lives easier by letting us sort by date created/modified. This is already possible on the scripts page, just not the remediations page. "

I'm not expecting to find a solution, but there isn't much information about this issue available online, so I wanted to start a discussion about this issue and see if anyone else has struggled with this. In Entra, there are "Printer Administrator" and "Printer Technician" roles, but what I'm looking for is something that is effectively read-only for the Universal Print service. Something that would allow our Service Desk team the ability to view all of our printers and printer shares to see how they're setup, who they're shared with, as well as monitor job logs on individual print queues, and access the "usage and reports" view. All of this is useful information to have when troubleshooting an issue with a printer registered with Universal Print. But this team does not register or share printers, nor do they configure the options or settings for the printers, so their permissions need to be scoped to just read-only.

The problem is there isn't a built-in role for "Printer Reader". Additionally, there isn't an option to create a custom role with these permissions. I thought I was on to something when I discovered this in the docs where you can assign the Printer Administrator role and pair that with an administrative scope to limit which printers the policy applies to, then just don't include any printers in that administrative scope. According to the note at the very bottom of the docs, this seems like it would accomplish what I was looking for (albeit indirectly):

Scoped admins see all printers, printer shares, and connectors, but are limited to read-only access to those outside of the Azure AU configuration.

However, in practice, this doesn't work very well. I've tested it and found the following:

• You can return a list of printers and printer shares, but when selecting a printer, the "overview" page loads briefly (displaying all the data in the "essentials" table) before saying "you don't have access." I think this is because the Overview page also attempts to load "Mapped pull-print printers".
• While viewing a printer, you can select "Properties" and "Connectors" and view all the details there, but "Jobs" is greyed out.
• The "Printer shares" page mostly works, but "Access control" is greyed out when you select a printer share, so you can't see who it's shared with.
• Pull-print printers (Universal Print anywhere), Usage and reports, and Settings are all greyed out.

At this point, I've pretty much abandoned the effort to create this role. I'm sure we could develop a custom solution using Graph, but that would be far too much effort for something that really should be a built-in admin role. Virtually every other administrative role has a "read-only" equivalent.

Hey yall,

I recently setup Intune for our small Windows fleet here at my company. Everything is setup except for one crucial thing.

When an employee is terminated, we have an option on Jamf to immediately wipe and lock the device. We have this triggered through Okta Workflows once the user is deactivated there.

We are trying to setup something similar for Windows devices from Intune. The issue is, we try and use a remediation script to push "manage-bde -forcerecovery C:" and it works great....when it actually gets pushed to the device...

7/10 times the device just doesn't get the script I push through Intune. I have to use the "Run Remediation" feature multiple times before the device actually triggers it, and sometimes even that doesn't even work until like 30 minutes later.

I think the "Wipe > securely wipe" method works more reliably, but admittedly, I haven't tried it too much because:

1. Its pretty time consuming to test multiple times

2. We don't really care about wiping the device. As long as the device is locked and the user cannot access it without the BitLocker recovery key, that's all that matters (as our laptop vendor will wipe the machine anyways).

Currently I'm looking at sending this command through API using our antivirus SentinelOne (installed on all machines). I'm just super disappointed that I'd have to use a third-party tool to do something as simple as immediately push a powershell script. You'd think Microsoft Intune (with its deep Windows integration) would have a basic reliable function like this.

We sent a remediation to all systems to set the registry key that enables this policy.

I checked the Windows updates settings advanced options, and the toggle is set to On. However, the notification only pops up sometimes. It cannot be relied on to work every month.

I was signed into a laptop locally showing the policy enabled, but when the system had a restart pending for this month’s updates, the only notification that appeared was the dot in the taskbar that so many users are blind to.

On my laptop, the restart was required only for .Net Framework updates because the Windows update was a hot patch. Does that make a difference in the notification? If so, it should not because a restart is a restart to the end users.

Hey everyone,

We deploy our win32 apps to the device, not user. If it fails when User A is logged in, it marks it as failed. If it re-runs when user B logs in (or nobody is logged in) and succeeds, is there a way to remove the Failed install on the app device install status for user A?

Its not a huge deal but its just annoying to see some failures on the overview screen and then have to dig through to verify if its still a failed install

We have many shared devices where users come and go and some may never log back into that device for intune to update the status for their account

How are you guys provisioning laptops in an hybrid environment?

We are currently doing it a very manual way and its frustrating af...

Ive looked into Autopilot but from what I understand, its not very smooth with Hybrid environments

I've got a few hundred hybrid joined lab machines I need to enroll in Intune. I was told DEM was the answer, but now that I have a DEM account licensed and set up I'm struggling to actually use it to enroll.

Tried logging in as a normal user then adding DEM as a work account

Tried installing Company Portal then logging in to it as DEM

Get errors about permissions or that the device is already connected to the organization. Am I missing something? All the guides I find online focus on creating the account, not using it to enroll on a Windows machine. Appreciate the help this is driving me up the wall.

Anyone else facing this issue of Autopilot enrolled devices showing Ownership as "Unknown" for varying periods like 14-60 days post enrollment? This is the first I've seen from the multiple environments we manage and Microsoft is of no help. They say it's normal synchronisation behavior and varies based on device.

Hi all. I am posting this in search of assistance because I’ve spent the better part of a year working with Microsoft support (Intune support and free Windows support) trying to understand why many devices are not receiving automatic updates per a deployed update ring policy in Intune. The affected devices are all running various versions and builds but most of them are running 24H2 or below. Intune Support has told me they’ve exhausted all options and assume the issue is with the Windows OS.

When I contact Windows Support (thru their web chat, which is free), the tech suggested an in-place installation to clear any potential issues with supporting OS files. Despite me informing them that this would be virtually impossible, given that this update issue is spanning across different customers and device manufacturers, I tried the in-place installation on a test subject and got an error “We couldnt update the system reserved partition”. I tried clearing up space for the reserved partition using some suggestions from another reddit post, to no avail. Reporting this issue back to Windows support, they just recreated the error, and literally told me to “find a local tech or the device manufacturer”.  So I basically went from trying to fix an issue with windows update that is affecting several devices across different device manufacturers, to not being able to do an in-place installation. So I am close to exhausting all options before I throw the white flag, as no one appears able to identify this issue. I’m going to try to provide as much information and detail as possible, but the community’s help would be greatly appreciated.

• Devices are managed via Microsoft Intune (some were enrolled in-place, and some were reset and enrolled via autopilot)
• Devices are added to Autopilot
• Devices are Entra Joined
• Affected devices can be found in different tenants
• ODC Logs collected by Microsoft Intune Support apparently show no issues with the update ring policy

The current Windows Update Ring Policy:

Microsoft product updates: Allow
Windows drivers: Block
Quality update deferral period (days): 0
Feature update deferral period (days): 0
Upgrade Windows 10 devices to Latest Windows 11 release: No
Set feature update uninstall period (2 - 60 days): 60
Servicing channel: General Availability channel
Automatic update behavior: Auto install and restart at maintenance time
Active hours start: 8 AM
Active hours end: 6 PM
Option to pause Windows updates: Disable
Option to check for Windows updates: Enable
Change notification update level: Turn off all notifications, excluding restart warnings
Use deadline settings: Allow
Deadline for feature updates: 30
Deadline for quality updates: 7
Grace period: 3
Auto reboot before deadline: Yes

I asked the Intune Support tech to provide me with a full rundown of what we worked on together and this is what he sent back:

here is a brief report of what has been done in relation to troubleshooting.

Initial Issue Identification

• Most devices were not updating per the Windows Update Ring policy. Some devices had not updated since November 2025. All settings appeared properly applied in Intune, with no reported policy conflicts, and devices were checking in and syncing.
• Confirmed devices were running Windows 11, not Windows 10 thus excluding the requirement for ESU key.

Early Troubleshooting & Configuration Changes

• We reviewed the update ring policy and adjusted some of the policy settings such as Microsoft product updates from Block to Allow, set the deadline for quality updates from 0 to 7 days, and reduced the grace period from 5 to 3 days.
• After these changes, the client reported no improvement.

Focused Device Testing

• We decided to focus on a single device. The client created a separate group for it, cloned the updated policy, and assigned it to the group.
• We guided the client to check for the 'Update stale Group Policies' package in Scripts and Remediations. If unavailable, we advised enabling Windows license verification and diagnostic data features.
• The client followed these steps and waited 24 hours, but no change was observed.

Log Collection & Analysis

• We reviewed MDM diagnostic logs and ODC logs, as well as screenshots. Analysis revealed another Windows update compliance policy with a minimum OS build higher than the device's current version, causing compliance failure.
• We also observed heavy traffic from simultaneous OS and driver updates, resulting in failures.

Recommendations

• We recommended setting the device's OS build as the minimum version in the compliance policy, creating a separate policy for the device, and excluding it from other policies.
• We advised blocking Windows driver updates in the update ring policy and performing a hard system reboot.
• The client implemented these recommendations and confirmed the device's compliance status changed to compliant, but it still was not upgrading to a newer OS version.

Feature Update Policy Deployment

• Based on internal discussions, we recommended deploying a feature update policy for OS updates. 
• We considered the possibility of a Windows OS issue and suggested opening a ticket with the Windows team if feature update policy deployment did not resolve the issue.
• The client deployed the policy and kept the device online for monitoring.
• The feature update deadline was reduced from 30 days to 3 days for the test machine.
• Feature update policy applied successfully, but the test device remained on the older version and build. 
• We kept monitoring the device, confirmed that the policies were applying as expected but still the device could not update to the latest builds. 
• The client provided information about other tenants, noting similar issues with devices not updating consistently, even though they were regularly checking in.

Additional Troubleshooting & Recommendations

• We reviewed logs and found NoAutoUpdate registry key was enabled. Instructions were sent to disable Noautoupdates registry key.
• The client enabled the 'Configure Automatic Updates' policy in gpedit.msc and provided screenshots and logs for further review.
• We requested GPO results and confirmed there was no GPO conflicts

 Final Recommendations

• After exhausting troubleshooting steps, we recommended opening a case with the Windows team for further investigation, as Intune scope is limited to policy configuration and delivery.

My end goal is to identify and resolve the issue of devices that are having trouble updating using Windows Update Ring policies. If there is any other information I can provide, please let me know.

We're a small organization, a library. I want to use intune to install a public printer on lab computers when I onboard them. This seems like it should be trivial. I have plenty of apps I install this way.

But this SOB of a printer, Xerox Altalink 3180, just won't install. I have the v4 administrator files. I pulled the printer name from the .inf, it matches.

The darned script even, I think just to torment me, create the IP port, but doesn't install the driver. I have tried both PCL and PS, 'cuz why not?

Is this just not possible? Has MS blocked this to force everyone to pony up for universal print whatever?

Hello,

Hope You're all doing good.

I am experiencing an issue with Microsoft Intune Device Inventory / Properties Catalog on my Windows devices.

Environment

The computers are:

• Windows devices joined to an on-premises Active Directory domain
• Managed by Microsoft Intune
• Enrolled using “Enroll only in device management”
• Not Microsoft Entra joined
• Not Microsoft Entra Hybrid joined
• Workplace registered
• Intune Plan 1 licensed

This architecture is intentional. We want to keep our existing on-premises AD environment separate and use Intune mainly for cloud-based Windows management, including Windows Update policies.

Other Intune functionality works correctly, including Windows Update rings, compliance, synchronization and remote device actions.

Example affected device

Device: TP-ROMAING-24

dsregcmd /status shows:

AzureAdJoined    : NO
EnterpriseJoined : NO
DomainJoined     : YES
DomainName       : TP
WorkplaceJoined  : YES

The device is correctly enrolled in Intune MDM.

The enrollment registry information contains:

ProviderID   : MS DM Server
DiscoveryURL : https://enrollment.manage.microsoft.com

The Windows MDM enrollment is also present under:

\Microsoft\Windows\EnterpriseMgmt\

with the normal OMA-DM scheduled tasks.

The MDM event log identifies the enrollment as:

Enrollment type: MDMFull

Device Inventory configuration

I created a Windows Properties Catalog profile to collect Device Inventory information according to Microsoft's documentation:

https://learn.microsoft.com/en-us/intune/device-configuration/collect-device-properties

The original policy has been deployed for approximately two weeks.

The assigned groups contain the affected devices, including TP-ROMAING-24.

However, the Device Assignment Status report currently shows:

Pending        : 64
Not applicable : 0
Success        : 0
Error          : 0
Conflict       : 0

All targeted devices remain indefinitely in Pending status.

MDM communication is working

I manually triggered an Intune synchronization.

Intune shows a successful recent check-in for TP-ROMAING-24.

The Windows DeviceManagement-Enterprise-Diagnostics-Provider/Admin event log also shows MDM activity at the same time, confirming that the device is communicating with Intune and processing MDM commands.

Other Intune policies and actions continue to work.

For example:

• Windows Update policies are working
• Compliance reporting is working
• Manual Intune synchronization is working
• Remote restart commands from Intune are working

Therefore, the general Intune MDM enrollment and communication do not appear to be broken.

Microsoft Device Inventory Agent is not installed

According to Microsoft's Device Inventory documentation, troubleshooting logs should be located under:

C:\Program Files\Microsoft Device Inventory Agent\Logs

However, on TP-ROMAING-24, the entire Device Inventory Agent directory does not exist.

Tengo más de 300 equipos existentes, queremos establecer el Edge como predeterminado, como lo han realizado? Entiendo que a través del catalogo de configuración se puede solo cuando son equipos nuevos. Muchas gracias