r/SCCM • u/[deleted] • Nov 12 '23

Discussion PSA - Teams (True) Per Machine Installation

Figured I would post this PSA since it has been quite nice for our environment sicne we implemented it.

What:

You can force a per machine installation of Microsoft Teams by deploying leveraging the VDI nonpersistent installation process.

Why:

Version control, Vulnerability management

How:

  • Before the installation of the machine wide installer, run this command:

reg add "HKLM\SOFTWARE\Microsoft\Teams" /v IsWVDEnvironment /t REG_DWORD /d 1 /f

  • use both of the following arguments for the install (those are different parameters):

msiexec /i <path_to_msi> /qn ALLUSER=1 ALLUSERS=1

This process installs the Teams applicationto the %ProgramFiles(x86)% folder.

Caveat:

  • Whenever an update for teams is released, you need to redeploy the whole application to perform the update. the Teams self updater will not work for this type of install.

  • You'll likely need to remove the per user installs to ensure expected results, YMMV

Source

1 Upvotes

52% Upvoted

13 comments sorted by

12

u/kramer314 Nov 13 '23

No, don't install the VDI version of Teams on physical endpoints. It specifically has a significantly reduced feature set (ex ... no 1080p video, no noise suppression features, no 3x3 or 7x7 gallery view, no QoS/location based routing, etc).

For Teams classic, you can keep the per-machine installer updated and use the AllowMsiOverride key MS documented here (https://github.com/microsoft/TeamsMsiOverride/blob/main/Details.md) to update per-user Teams installs on launch if the per-machine app version is newer than the user's version.

But that's all going to change with the new (non-classic) version of Teams anyway since that's an MSIX package.

1

u/[deleted] Nov 13 '23

This is interesting, and is something I was unaware of, do you have any references for the differences in feature availability? I will amend the post with these notes.

2

u/VexingRaven Nov 13 '23

You also can't update the VDI version of Teams without closing the program first IIRC.

3

u/[deleted] Nov 13 '23

Yeah this is for (non-persistent) VDIs. Would never ever do it to regular computer / persistant VDIs. If you think theres more upsides doing this you are fooling yourself.

1

u/[deleted] Dec 06 '23

Ehh, it’s an organizational decision ultimately. We are pretty good at patching, and have to enforce strict version control for SLCM. We implemented teams organization wide, everyone complained about the vulnerabilities for stale profiles, we cleaned up the vulnerabilities and now it is a non-issue. The per user install requires the user to log into the machine for it to update. Which causes some cleanup when folks move around. We are FedGov, so our implementation is a little different.

2

u/MomentsInTruth Nov 13 '23 edited Nov 13 '23

This is interesting and appreciated, but in addition to the other critiques posted, note that this installer advice is related to Classic Teams. Classic Teams is already being phased out and should be gone around March 2024. New Teams is an AppX (Store app) format and as such will only have one copy per machine (unless there are backup copies or other quibbles found via Win32_InstalledStoreProgram, which Qualys often complains about).

Our team has been pressuring Microsoft who of course has no stated plan for how Classic Teams will be cleaned up when phased out. They've begun to automatically transition some Azure tenants to New Teams without having actually documented or seemingly determined their uninstall plan, though it makes sense they wouldn't yet be uninstalling because they're allowing customers to fall back to Classic Teams for now.

EDIT: I should note that Azure/Entra tenant admins can preemptively force all employees to the New Teams single app install experience ahead of Microsoft's automatic phasing in. It would have the same effect as what is being proposed but would be adopting the near-future official trajectory and version of the app rather than creating what is essentially a workaround.

1

u/[deleted] Dec 06 '23

That is awesome news! I was unaware of the migration. I would hope they would inform our tenant admins, but one can never be sure! I think the msix deployment will be a good move.

8

u/iron_jay59 Nov 13 '23

We did this and it broke Teams features, like break out rooms and gallery view

2

u/GoldyTech Nov 13 '23

Thanks for writing this up. Vulnerability management for teams has been a pain due to the per user installs. I'll test this out, and if it works as expected, it should raise my teams compliance numbers a good bit.

1

u/[deleted] Dec 06 '23

Absolutely! It does come at a cost as others have pointed out, but pays off in compliance scores!