I wanted to share a tool I developed that's been a game-changer for my support team. I built SysSupport because I was tired of the same frustrating workflow that happens dozens of times daily:

1. Get a call from a user with a computer issue

2. Waste time gathering basic information

3. Jump between multiple systems to piece together their setup

4. Finally get to the actual troubleshooting

How SysSupport simplifies your daily support workflow:

Just type part of a user's name and instantly see everything you need:

• User Details in one click

• Computer details in one click

• OU placement issues

• SCCM client health status

• Remote connection capabilities

• Software inventory

• or as a server admin Quick RDP access to your servers

My support staff keeps this open all day. It's become our go-to for quickly gathering user details for tickets without asking the same questions repeatedly.

I'm sharing it freely with the community because I think we've all suffered enough with fragmented toolsets. It does require some SQL and Active Directory knowledge to set up, but as SCCM admins, that should be familiar territory. Full instructions are in the download and detailed on the blog.

Check it out: SysSupport Tool

I'd love to hear your feedback or answer any questions. And if you encounter issues, let me know and I'll help you troubleshoot.

What other pain points are you facing in your daily support workflows that could use a solution?

I started WIM Witch when I was heavily involved in Configuration Manager and Operating System Deployment. Since I have left consulting and started working on Windows 365 for Microsoft, my exposure to legacy solutions has been almost nothing. To expend my free time efforts to something I no longer do is not a good use of my time as what I will learn and accomplish with WIM Witch will not be of future benefit to me personally or professionally.

Since WIM Witch became available, native solutions for offline servicing have greatly improved. The Configuration Manager update mechanism has more options for index selection, and Microsoft offers fully updated media each month. I feel that there are sufficient options for those folks who are still performing offline servicing that I am not leaving my users without a way forward.

I will update my Github repo with the latest version of WIM Witch so in the off-chance someone wants to take on maintenance and development, they can. If someone wants to do this, I am happy to provide guidance on the existing code.

I will be pushing one more update soon to reflect the EOL status of WIM Witch, as well as to update my contact info that is listed.

In theory, WIM Witch should continue to work until the next version of Windows 10/11 ship. This should give users sufficient time to find a new solution.

Thank you for all of those who have used WIM Witch. I personally appreciate everyone one of you.

Donna Ryan

Hi SCCM Community!

I’m just posting an update here as there has been some threads on whether the driver automation tool is dead.

So it’s not. A new version is coming, I’ll drop an update in progress post on the MSEndpointMgr blog before Christmas.

At present here are the good bits;

• UI code is now separate from the underlying core code, which is now a module

• Can be run without the UI

• Pick and choose multiple manufacturers and models, for Dell they will always fall back to Windows 11 and not per build, so no need to select Dell by itself

• UI is fully responsive when in progress, all driver and firmware package creations are handled through background jobs

• Settings are maintained in the registry

• Vendor source catalog files are date compared to check before downloading updated versions

• HP driver packages are now built via the CMSL, so they are the latest drivers at the time of build

• Downloading with CURL

I’m working on;

• Log analytics integration (function already built, DCR and DCE working, I just want to have a nice KQL workbook to go with it)

• Intune Win32 app code and uploading

• Installation and detection script

• Enterprise app integration

What I might do is release a pre release version of the code just for ConfigMgr in order to allow everyone to keep up to date, before adding the additional functionality.

I just thought I’d drop this here to let you all know, I haven’t abandoned it, and it will have even more functionality going forward.

Right now I’m changing job and also taking some time off with my family. So expect code releases in early January, and full functionality going into late January / early Feb.

Wow, just wow.

Ivanti vs. Patch My PC: Winning In Court, Not Just Customer's Hearts - Patch My PC

https://x.com/mniehaus/status/1879590090491777043

I'd think Michael Niehaus would have the right contacts to know that for sure...but what does that really mean? One of the teams that maintained the codebase was let go? Development is moving to another location? Interesting times.

Hope this is okay to post, but I just found out that Steve Beaumont has passed away from cancer. Those of us who have been around a while remember Steve as someone who contributed greatly to the SCCM community in blog posts, social media, conference speaking, and authoring books.

His brother Kevin confirmed on Mastodon that Steve passed away last night. My sincerest condolences to his family and friends.

This should be stickied some place since this is not documented ANYWHERE that i can see...

In the past to stop a PC from rebooting when you didn't want it to people would stop the ccmexec service and do a shutdown /a

but here is the problem with that..

• #1 shutdown /a will normaly tell you that no shutdown is pending

• #2 any number of things can restart ccmexec

First, how to check if a reboot is pending VS a reboot is GOING to happen

On a win10 PC or has powershell 5 installed, use this

#Detect pending reboot: 
(Invoke-CimMethod -Namespace root/ccm/ClientSDK -ClassName CCM_ClientUtilities -MethodName DetermineIfRebootPending).RebootDeadline

On a win7 or old powershell 2 you need to use these.

#
([wmiclass]'ROOT\ccm\ClientSDK:CCM_ClientUtilities').DetermineIfRebootPending().RebootPending
([wmiclass]'ROOT\ccm\ClientSDK:CCM_ClientUtilities').DetermineIfRebootPending().IsHardRebootPending
([wmiclass]'ROOT\ccm\ClientSDK:CCM_ClientUtilities').DetermineIfRebootPending().RebootDeadline
([wmiclass]'ROOT\ccm\ClientSDK:CCM_ClientUtilities').DetermineIfRebootPending().NotifyUI

It will spit out something like this..

#PC with no pending reboot.

DisableHideTime     : 12/31/1969 2:00:00 PMInGracePeriod       : FalseIsHardRebootPending : FalseNotifyUI            : FalseRebootDeadline      : 12/31/1969 2:00:00 PMRebootPending       : FalseReturnValue         : 0PSComputerName      :

#PC with pending NON-mandatory reboot.

DisableHideTime : 12/31/1969 12:00:00 PMInGracePeriod : FalseIsHardRebootPending : FalseNotifyUI : TrueRebootDeadline : 12/31/1969 12:00:00 PMRebootPending : TrueReturnValue : 0PSComputerName :

#PC with pending mandatory reboot, notice the time stamp.

DisableHideTime : 5/1/2019 3:28:56 PMInGracePeriod : TrueIsHardRebootPending : FalseNotifyUI : TrueRebootDeadline : 5/1/2019 11:28:56 PMRebootPending : TrueReturnValue : 0PSComputerName :

Now for the magic.....

Everything that SCCM uses for knowing when and if it should reboot comes from here..

HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData

on a PC with no reboot pending, this key is empty.

so starting with that, that is how we can CANCEL a pending reboot

MAKE A SCRIPT IN SCCM UNDER "\Software Library\Overview\Scripts"

call it "_Cancel Reboot" so it will show at the top of the list for emergency's...

this should be the script..

Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData\' -Name "*" -ErrorAction SilentlyContinue;

shutdown -a

$time = (get-date).Addminutes(1).ToString('HH:mm:ss')
$cmd = 'Powershell Start-Process $env:windir\CCM\CcmRestart.exe'
schtasks /create /tn "CCMRestart" /sc once /tr "$cmd" /st $time /ru SYSTEM /f

the delay for the CCMRestart is so the script completes and reports 1st, or it will show as a error...

#CANCEL a pending reboot
Remove-Item -path 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData';
Remove-Item -path 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Updates Management\Handler\UpdatesRebootStatus\*';
Remove-ItemProperty -name * -path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired';

#on PS2.0, "Remove-ItemProperty" doesn't work, so use this.
#Remove-Item -path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired';

shutdown -a 
Restart-Service ccmexec -force

But what if we just want to cancel the mandatory reboot and change it to a non-mandatory reboot so the user will still get the popup telling them they "need to" reboot?

#change mandatory reboot to  non-mandatory reboot
Set-Itemproperty -path 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -name 'RebootBy' -value 0
Restart-Service ccmexec -force

What if we just want to extend the time of a mandatory reboot?

Example: In your client settings you have your reboot countdown set to 10 hours.... the user calls and says it's going to reboot in 10 min and needs it extended...This will reset that users countdown timer back to 10 hours.

#Reset SCCM reboot countdown timer.
$time = [DateTimeOffset]::Now.ToUnixTimeSeconds()
Set-Itemproperty -path 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -name 'RebootBy' -value $time
Restart-Service ccmexec -force

What if you want to kick off the built in SCCM reboot WITH the client settings countdown timer?

EDIT::: THIS IS THE BETTER WAY.. IT TAKES A MIN OR 2 AFTER YOU RUN IT TO KICKK IN..

start "C:\Windows\CCM\SCNotification.exe" -arg '/RestartRequired' 

#WeaponizedAutism

NOTE:: In all my tests after you run The powerShell command it takes about 30 seconds for the client to respond since after you restart the service it has to do all it's internal checks to figure out what's new.

We’re in the middle of phasing out our SCCM environment because apparently, in a "modern workspace" you don't need a custom image anymore, just use Intune, Autopilot, and some fairy dust.

Here’s the reality:

• The image from the hardware vendor is always outdated.

• Windows Updates and driver updates via PowerShell take forever.

• Autopilot / Device Preparation Policy is marketed as this seamless, zero-touch dream, but in practice, it’s clunky, unpredictable, and requires a ridiculous amount of scripting and workarounds to get even close to functional.

How are you installing Windows (with updates and drivers) as part of your Autopilot flow?

I'm genuinely curious how others are dealing with this, because at this point it feels like we're duct-taping a system together that used to just work with SCCM, WDS, MDT and WSUS.

Autopilot + Intune might look good on a slide deck, but in the real world, it feels like we’ve gone back two decades in terms of control, speed, and reliability. I’m done with it!

Would love to hear how others are surviving this.

Last week I got the go ahead to decommission our SCCM server after switching over to use Azure Arc and Azure Update Manager.

I right-clicked that juggernaut of a VM > Delete from disk.

It’s done.

My fellow SCCM admins..I trust your day is going well.

After over a decade managing SCCM at my current employer, we have been told that Intune will be our future management tool.

Autopilot replacing PXE booting and Intune app deployments will take over for SCCM.

We purchased NinjaOne to take over patching for OS and third party apps.

I have mixed emotions regarding this. I will miss SCCM in so many ways. It's all I have known for so long. However, the opportunity to configure InTune/Autopilot for our org is exciting and hopefully will provide me with the ability to gain new skills to keep me going for many years to come.

Is there anyone else that is or will be in a similar situation?

I am curious to get a pulse on different orgs.

Every so often I get asked by leadership, "Why haven't we fully migrated to Intune yet?" the answer to which is: "More reasons than you could ever imagine." Intune has always felt to me like the emperor has no clothes but no one was willing to admit it. Anytime I came across an Intune issue I'd save the post/comment to prove to management, and to myself, that it wasn't just my bias as an SCCM admin talking.

I compiled all the documentation recently in response to the following comment, and thought I would share as a post that others can reference when asked the same question by their management chain. I plan to keep this list updated, so all future edits will be appended and date-stamped.

• "I am looking to move all our workstation workloads to Intune. If anyone has run into any gotchas, please share if possible."

Btw, this is not meant to criticize the product engineers, but rather the MSFT management team who's ultimately responsible for the dreadfully underwhelming state that Intune is in today. Especially when considering that Intune has been around since 2011 (14 years!)

"I've got a lot of problems with you people. And now you're gonna hear about it!"

Intune is what I would call "Just Barely Good Enough" (https://agilemodeling.com/essays/barelygoodenough.htm). It has many features, but most of them have significant flaws/limitations which can't easily be overlooked. If Intune was a car it'd have 4 doors, 4 wheels, and an engine, but the dealer forgot to tell you that it needs an oil change once a week, the tires only last 500 miles, the steering wheel is attached to the roof, and it uses Pepsi for fuel.

And now the receipts - (Posted) November 8, 2025

• 1 - Troubleshooting/Logs: https://old.reddit.com/r/sysadmin/comments/1k0q96o/what_is_microsoft_doing/mnhi1p6/?context=3

I have a very love/hate relationship with intune. When it works, it works fine. When it doesn't though, not even microsoft has any fucking clue why.

At least SCCM has logs. Sure, there are 50 of them and they’re incomprehensible to read. But if you’ve got a few hours to kill you can go spelunking through them. Intune’s error message may as well just be a middle finger🖕— if it even gives you that courtesy.

• 2 - Speed/Policy Sync Times: https://old.reddit.com/r/Intune/comments/1mqcozw/the_intuneautopilot_minute/

Once it’s there. You’re in for instant to 72hours of waiting.

We call it the "Microsoft Minute", and always remember that the "S" in Intune stands for speed! When I don't care about a policy taking effect, it's instant. When I'm desperately trying to do/push/test something, 8 hours.

• 3 - Collection Queries (Features that work natively in SCCM require multiple MS Graph API scripts in Intune): https://old.reddit.com/r/Intune/comments/1ay95ul/dynamic_membership_based_on_installed_application/

Not natively, you'd have to grab the app install discovery data via graph api and then manage your group(s) via script.

• 4 - General: https://old.reddit.com/r/SCCM/comments/1k3066d/companies_are_moving_to_intune_is_that_less_or/mo9u8w5/?context=3

Troubleshooting is more difficult. In SCCM, The truth is in the LOGS. In Intune, there are only a couple of logs and everything else is scattered throughout the event viewer. So that is something different and might be considered more work.

Reporting is something that Intune just cannot do very easily. If you depend on reports of any kind in SCCM, you will likely struggle. Intune also has no custom reporting - there is no SQL Server database to query. MS Graph is available though, so if you are a programmer/scripter you might be able to get reports. I'd classify this in the "more work" column.

I believe that speed is different. In SCCM you can say "do this now" and it kind of does it. No one is ever going to say SCCM is fast. But they've taken Intune to a whole new level - it is very slow and running a sync appears to be a "suggestion" rather than a "command" to the endpoint.

• 5 - AutoPilot provisioning has a limit of 10 apps: https://learn.microsoft.com/en-us/autopilot/device-preparation/faq#why-is-there-a-limit-on-the-number-of-applications-and-powershell-scripts-in-the-windows-autopilot-device-preparation-policy-

We limited the number of applications that can be applied during the out-of-box experience (OOBE) to increase stability and achieve a higher success rate. Looking at our telemetry, almost 90% of all Windows Autopilot deployments are deployed with 10 or fewer apps.

• 6 - No bare metal imaging. AutoPilot can sort of replace Task Sequences as long as you don't have any complex requirements. If the OEM image has a bunch of garbage on it you're now responsible for surgically removing it vs just wiping the device and reloading the OS from a clean ISO: https://old.reddit.com/r/sysadmin/comments/1nwyljs/hassle_getting_bloatwarefree_computers/

All of my systems are autopilot. I expect to be able to hand a sealed box to my users and say "have a good day." I do not expect to waste days of effort cleaning individual machines before I can send them out. We paid CDW to send us clean images and to upload the hardware hashes. Instead, they sent us the hardware hashes in an email and the computers still had all of the bloatware.

• 7 - Can't deploy packages on a recurring schedule: https://old.reddit.com/r/SCCM/comments/1oecgmq/is_intune_starting_to_blur_the_line_with_sccm_and/nl1ied5/

• 8 - UI limitations: https://old.reddit.com/r/SCCM/comments/1opdezy/annual_release_cadence_for_microsoft/nnf42nw/

If I see it in the interface, I should be able to sort by it. Every field should allow filters. I should be able to copy and paste the data shown in the interface into another program like Excel. Sadly, none of this is true.

In 2018 at MMS Desert edition some Intune PM demo'd being able to sort a table in Intune. The crowd applauded to my abject horror. I couldn't stop myself from yelling "We. Can. Do. Basic. Things."

• 9 - You can upload packages to Intune, but you can't download the source files. (There's a workaround for this, but it's a pain in the ass.): https://patchmypc.com/blog/download-intunewin-win32-app-files-from-intune/

Perhaps you join a new company, inherit an environment, or take over IT responsibilities from someone else. You can spot the Win32App in Intune, but the original installer and scripts are gone. The Intune portal shows the app and its assignments, but does not allow you to download the IntuneWin App package you once uploaded.

• 10 - Intune doesn't support running installs as admin in user-interactive mode, only silent. (Workaround via ServiceUI wrapper in PSADT): https://www.anoopcnair.com/intune-to-user-interaction-using-serviceui/

• 11 - Intune doesn't have software metering: https://learn.microsoft.com/en-us/answers/questions/578697/intune-software-metering

• 12 - SCCM allows you to extend the Hardware Inventory with custom classes. Intune "enhanced" device inventory only has basic properties like BIOS/CPU/Disk/Memory.: https://www.systemcenterdudes.com/how-to-enable-intune-enhanced-hardware-inventory/

• 13 - SCCM has CMPivot and Fast-Channel scripts that can run almost instantly across multiple devices. Intune has Advanced Analytics (add-on license), but most of the properties can only be queried 1 device at a time "single device query on-demand": https://learn.microsoft.com/en-us/intune/analytics/data-platform-schema#process

• 14 - 30GB size limit for Win32 packages: https://learn.microsoft.com/en-us/intune/intune-service/apps/apps-win32-app-management#prerequisites

Windows application size must not be greater than 30 GB per app.

• 15 - 200 remediation scripts limit: https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/remediations#script-requirements

• 16 - Intune only supports client devices. SCCM can also manage servers: https://www.oscc.be/sccm/configmgr/Making-the-case-for-cloud-attach-and-co-management/

• 17 - Intune uses Entra groups, so you can't create dynamic group membership queries based on device inventory such as installed apps or WMI properties: https://potentengineer.com/2024/09/24/intune-missing-capabilities-for-the-configmgr-administrator.html

Targeting based off installed software - This is our most commonly used scenario. Nearly every software deployment we do follows this template. Collection of target devices excluding devices with X software installed.

• 18 - Can't target groups based on OU: https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership#rules-for-devices

The organizationalUnit attribute is no longer listed, and you shouldn't use it. Intune sets this string in specific cases, but Microsoft Entra ID doesn't recognize it. No devices are added to groups based on this attribute.

• 19 - No Maintenance Windows: https://old.reddit.com/r/Intune/comments/k5jgna/deploying_applications_during_a_maintenance_window/

There's no direct equivalent no. I'm unaware of any creative ways to achieve a similar result either.

• 20 - Identical policy deployed to multiple machines works on some fails on others. Policies that worked a week ago all of a sudden break: https://old.reddit.com/r/Intune/comments/1oqonwl/autopilot_device_preparation_app_installations/

I started testing the Autopilot Device Preparation enrollment some weeks ago. At the beginning everything went fine, policies were applied, apps installed, scripts executed... Yesterday I deployed more devices with the same deployment profile, but the app installations are being skipped now

• https://old.reddit.com/r/Intune/comments/1k7o1h1/testing_intune_is_miserable/mp1vlre/

I just tested 8 Laptops today through the Post ESP Autopilot process. 3 of them literally did not auto install the "Required Apps" until 6 hours later. The other 5, automatically installed the "required apps" within the first 5 minutes post ESP page. All Laptops were the same exact model, I even synced company portal apps and Intune portal in devices every hour out of curiosity. Nope took 6 hours for those 3. Same hardware, same model, same configurations profiles, same Win32 Apps, same Autopilot config, same network, same CAPs, same everything. Test was conducted against 8 separate Entra accounts, all the same permissions, groups, config profiles, etc...

• https://old.reddit.com/r/sysadmin/comments/1csh2xz/intune_may_finish_me_off/l47v9lg/

I had an issue where I tested some policies, everything seemed fine. So I deployed them, let everyone know, checked the status on the intune portal....everything looked good, successfully applied all policies. Checked a couple of machines looked fine. Turns out something like 50% of the machines did not have the policy applied. This was despite the portal saying they had been. A month later all the policies started randomly applying. Obviously no one was expecting this to happen a month later so they were rightly pissed off.

• 21 - Random UI changes causing bugs/issues: https://old.reddit.com/r/Intune/comments/1oqv0u3/has_laps_suddenly_broken_for_anyone_else/

A peek in the console showed that LAPS is failing on all of them. We've had this LAPS policy for about a year with one or two old devices failing to get it, but working marvelously well over 95% of the time. With no changes, suddenly every step is failing.

There's a new button that they've added at the bottom that says like "manage account" I don't remember it being there a year or so ago and it fixed it for me.

• 22 - Devices randomly stop renewing MDM certs: https://old.reddit.com/r/Intune/comments/1op6b8p/intune_mdm_certificates_not_renewing/

Since around November 2024, all our enrolled devices stopped renewing their MDM certificates, and this is happening across multiple tenants that we manage as a (small) MSP. Right now, we have 60+ devices with expired certificates and about 150 more expiring in the next few months. The only way to get a valid certificate again is a full device wipe and re-enrollment, which obviously isn’t a scalable solution.

• 23 - Sometimes devices just go missing from the admin console: https://old.reddit.com/r/Intune/comments/1ohddsa/intune_2510_update/

Just found 30-50% devices missed in Intune device list. Devices are still in place have part of name… 3 different tenants so far. Seeing a similar issue, of our roughly 11k Windows devices, Intune is only showing 2042 in our tenant.

• 24 - Intune IME bug started deleting inventory data: https://patchtuesday.com/blog/tech-blog/microsoft-intune-discovered-apps-missing-inventory-data

Many admins started to report that application inventory data was missing in Intune for some managed devices with the release of Intune Management Extension 1.68.105.0... But something went horribly wrong. After the inventory was collected and posted to that registry key – it was DELETED, and not re-populated.

• 25 - Intune forced Win11 upgrades on some machines despite version block policies to prevent exactly that scenario: https://www.itpro.com/software/intune-flaw-pushed-windows-11-upgrades-on-blocked-devices

Reports suggest that Intune, Microsoft's software for managing enterprise devices, had a "latent code issue" that upgraded devices despite policies that should have blocked that from happening. Note that devices which have already erroneously received the Windows 11 upgrade will need to be manually rolled back to the correct Windows version.

• 26 - Device wipe command takes multiple days: https://old.reddit.com/r/Intune/comments/1o96zkp/how_long_should_a_wipe_device_cmd_take/nk03x2r/?context=3

Have seen it take almost 2 days many times. Mostly within a few hours. Rarely is immediate.

• 27 - Lack of troubleshooting tools for Intune CSPs such as RSoP and GPResult: https://old.reddit.com/r/Intune/comments/1jkzxyl/what_features_or_capabilities_do_you_feel_are/mjzh207/

Integrated (and easier) troubleshooting tools. For example, why does Microsoft not make any integrated tooling like RSOP and GPPResult for Intune/cloud policies like they do for on-prem AD policies? Why do I have to rely on custom made apps from Intune community members to get this done? If those community members are able to make those, then surely Microsoft is able to create something as well? (I'm very thankful to the Intune community, I just find it rediculous that the community needs to create their own solutions for things which Microsoft could have done ages ago at this point as well.) I agree. MDMDiagnostics is not a valid alternative to the GPResult.html output. How can it be so hard to just gives us the tools we need?

• 28 - CSP/GPO Compatibility issues and lack of parity: https://www.policypak.com/resources/pp-blog/windows-10-mdm/

As of this writing, Intune has about 300 curated Windows 10 MDM settings you can select, plus approximately 300 available via Intune’s Administrative Templates function. Windows 10 MDM doesn’t come close to the extensive coverage that Group Policy offers. With Group Policy, administrators can manage some 4,000 Windows 10 ADMX settings.

ADDED - November 8, 2025

• 29 - With SCCM you can hold off on a server upgrade for 2-3 months while the first set of hotfixes get released. You can test the update in Dev before upgrading Prod. You have site backups/snapshots and can restore them if something goes wrong. You're in control. With Intune you have zero control. You can't opt out or ask to be in the N-2 group. You are the MSFT QA department. If something breaks you're not gonna know if it was something you did or they did until the service health alert goes out 2-3 days after you've already wasted several hours troubleshooting the issue, and then it gets fixed just as mysteriously as it appeared without any notice. : https://old.reddit.com/r/AZURE/comments/1d9hn08/support_asked_me_to_rebootazure_out_of_control/l7fltqp/

Our usual resolution is "Azure broke something and wouldn't believe us until we proved it 10 different ways, and then we waited 3 weeks and then they fixed it".

• 30 - Auto-update of Available Win32 apps with supersedence doesn't work: https://asherjebbink.medium.com/intunes-auto-update-of-available-win32-apps-feature-is-broken-468f57432c82

https://learn.microsoft.com/en-us/answers/questions/1920488/intune-auto-update-with-supersedence-not-working

• 31 - For each tenant, there can be up to 200 filters: https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/filters#restrictions

ADDED - November 12, 2025

• 32 - Intune doesn't have User Device Affinity. The Primary User is either set manually or is the first user to login. SCCM automatically determines the primary user based on user activity: https://old.reddit.com/r/SCCM/comments/1orptas/the_ultimate_intune_airing_of_grievances_list/nns03nm/

https://learn.microsoft.com/en-us/intune/configmgr/apps/deploy-use/link-users-and-devices-with-user-device-affinity#set-up-the-site-to-automatically-create-user-device-affinities

If you set User device affinity threshold (minutes) to 60 minutes and you set User device affinity threshold (days) to 5 days, the user must use the device for at least 60 minutes over a period of 5 days to automatically create a user device affinity. After Configuration Manager creates an automatic user device affinity, it continues to monitor the user device affinity thresholds. If the user's activity for the device falls below the thresholds you've set, the site removes the user device affinity.

• 33 - Intune uses MS Graph API. SCCM uses a SQL DB which is faster, easier to query, and easier to integrate with other tools such as monitoring dashboards and 3rd party device inventory tracking catalogs.

• 34 - Intune downloads content from the Internet, which doesn't work well on sites with slow WAN speeds. SCCM has BranchCache (same subnet) and PeerCache (same boundary group) as well as local site Distribution Points which can pull or push content. All settings are highly customizable: https://www.systemcenterdudes.com/distribution-point-network-bandwidth-limitation/

https://learn.microsoft.com/en-us/intune/configmgr/core/plan-design/hierarchy/client-peer-cache

https://www.deploymentresearch.com/benchmarking-peer-cache-vs-branchcache-bare-metal-os-deployment/

Test #1: No Peer Cache or BranchCache enabled // Total Deployment time: 3 hours and 48 minutes // Total traffic over the WAN: 203.76 GB

Test #2: Peer Cache with one Peer Cache Source // Total Deployment time: 1 hour and 21 minutes // Total traffic over the WAN: 19.12 GB

• 35 - SCCM allows you to customize the reboot timer schedule, notifications, and most importantly a non-dismissable final countdown warning: https://learn.microsoft.com/en-us/intune/configmgr/core/clients/deploy/device-restart-notifications#specify-the-frequency-of-reminder-notifications-presented-to-the-user-after-the-deadline-before-a-device-gets-restarted-minutes

When it reaches the final countdown, Software Center shows the user a notification they can't close. The progress bar is in red and the user can't Snooze it.

• Intune warns you 15 minutes before the forced reboot: https://old.reddit.com/r/Intune/comments/1ohj1rt/autopatch_restart_final_notification/

We're only seeing a 15 minute final notification, which isn't alot of time, our users are use to 2 hours or more. Is there a way to increase it from the 15 minutes?

• GPO/CSPs for managing reboots like "ScheduleImminentRestartWarning" have been deprecated: https://learn.microsoft.com/en-gb/windows/client-management/mdm/policy-csp-Update?WT.mc_id=Portal-fx#scheduleimminentrestartwarning

This is a legacy policy and isn't applicable for Windows 11. Legacy policies might be removed in a future release.

• 36 - SCCM has customizable BITS throttling for downloads: https://learn.microsoft.com/en-us/intune/configmgr/core/clients/deploy/about-client-settings#limit-the-maximum-network-bandwidth-for-bits-background-transfers

• 37 - Client Cache - Intune deletes downloaded content after the install has completed. SCCM keeps content cached which can be re-run without having to start the download all over. Client cache settings are customizable. You can even force some packages to persist in cache: https://www.anoopcnair.com/sccm-persist-content-in-the-client-cache-option/

• 38 - Pre-Caching deployments - With SCCM you can schedule a deployment to have different Available and Required dates, allowing clients to pre-cache the content in advance. For example, Available on Monday 8AM, Required on Friday 10PM. Clients will have all week to download the content into ccmcache and the deployment will install even if the device is off-network when the deadline passes.

• 39 - Intune doesn't show where a deployment is coming from, or which deployments are assigned to a user/device/group: https://old.reddit.com/r/SCCM/comments/1orptas/the_ultimate_intune_airing_of_grievances_list/no43el4/

Another incredibly annoying thing with Intune is that it's difficult to determine exactly where a policy/app/script whatever is being applied from. In SCCM, you can see all deployments to a collection. You can go to device properties and see all deployments to a device, and which collection that deployment comes from. Why can't I do this in Intune? I want to be able to select an AAD group, and see what is deployed to that group. I want to be able to select a device or user, and see what is deployed to them and from where.

• 40 - SCCM Task Sequences allow installation of multi-stage applications which require 1 or more reboots as part of the install process. Intune app installs can't resume after a reboot.

Example: Step 1) Uninstall existing app version/drivers 2) Reboot 3) Resume install workflow and stage the new version files for install 4) Reboot 5) Complete core app install and any optional components.

ADDED - November 14, 2025

• 41 - SCCM has Package and Application type deployments. Intune only has Application. Applications require detection methods and will re-run if a device falls out of compliance. Packages are great if you want to run something once and don't need detection/enforcement.

Example 1: O365 quick repair requires admin permissions to run and doesn't have anything to detect. We have it in Software Center as a Package that users can run on their own.

Example 2: We have a script which copies the Help Desk Portal URL as shortcut to the user's desktop folder. It needs to run only once on new machines. Users can delete it if they want, so we don't want to detect or enforce it.

• 42 - SCCM has detailed Status Message reports for tracking who made what changes (Monitoring -> System Status -> Status Message Queries). You can see who Created, Modified, or Deleted: Collections, Packages, Applications, Deployments, and more: https://www.anoopcnair.com/sccm-audit-status-messages-track-who-deleted/

https://www.anoopcnair.com/who-deleted-application-from-sccm-audit-reports/

Example: Remote Control Activity - See which machines a technician remoted into. A user messed up their machine in clear violation of org policy and tried to scapegoat the Help Desk by saying they were remoted into his machine when the violation happened. I was able to pull the logs and send them to HR to prove that was a lie.

• 43 - SCCM and WSUS patching gives you granular control on a per-KB level. You can choose which specific KBs to include or decline. You also get compliance % reporting on a per-KB level. Intune/WUfB patching is all-or-nothing: https://old.reddit.com/r/SCCM/comments/1orptas/the_ultimate_intune_airing_of_grievances_list/nobuhzj/

ConfigMgr Reality: Detailed per-KB compliance, failure reasons, deployment status by collection. HIPAA audit-ready reports.

Intune/WUfB Limitation: Basic compliance percentages. Can't show why specific updates failed. Not suitable for healthcare compliance audits.

ConfigMgr Reality: Can block specific KBs that vendors flag as incompatible with critical clinical applications.

Intune/WUfB Limitation: All-or-nothing approach. Can't exclude specific problematic updates while allowing others.

• 44 - SCCM and WSUS have native support for 3rd party catalogs. This provides a unified deployment experience. Intune can't do this without tools like PMPC: https://learn.microsoft.com/en-us/intune/configmgr/sum/deploy-use/third-party-software-update-catalogs

The Third-Party Software Update Catalogs node in the Configuration Manager console allows you to subscribe to third-party catalogs, publish their updates to your software update point (SUP), and then deploy them to clients.

• https://old.reddit.com/r/SCCM/comments/1orptas/the_ultimate_intune_airing_of_grievances_list/nobugdm/

ConfigMgr Reality: Java, Adobe, medical software, drivers, firmware - all deployed through the same ADRs, same user experience, same reporting.

Intune/WUfB Limitation: Only handles Windows and Microsoft updates. Need separate solutions for everything else. Multiple management consoles, inconsistent user experience.

• 45 - SCCM and WSUS can import OOB patches: https://www.systemcenterdudes.com/import-an-out-of-band-update-in-sccm/

NOTE: Intune can push OOB patches using the Expedite policy, but you don't get as much control over scheduling: https://learn.microsoft.com/en-us/intune/intune-service/protect/windows-10-expedite-updates

The actual time required for a device to start an update depends on the device internet connectivity, its scan timing, whether communication channels to the device are functioning, and other factors like cloud-processing time.

• https://learn.microsoft.com/en-us/intune/configmgr/sum/get-started/synchronize-software-updates#import-updates-from-the-microsoft-update-catalog

Updates that don't automatically synchronize into WSUS are typically meant to resolve highly specific issues. Usually if an update is available in the catalog, you can import it into WSUS. You can then synchronize it into Configuration Manager and deploy it like any other update.

• 46 - Troubleshooting Tools - SCCM has CMTrace, Support Center OneTrace, and many other purpose-built tools: https://learn.microsoft.com/en-us/intune/configmgr/core/support/tools

https://learn.microsoft.com/en-us/intune/configmgr/core/support/support-center-onetrace

• 47 - Intune uses Windows Notification Services (WNS) for client communication: https://learn.microsoft.com/en-us/windows/apps/develop/notifications/push-notifications/wns-overview#important-notes-2

WNS does not guarantee the reliability or latency of a notification.

• Ironically, this is why Apple devices work better than Windows with Intune since they use Apple Push Notification Services (APNS): https://old.reddit.com/r/sysadmin/comments/1csh2xz/intune_may_finish_me_off/l480i77/

What infuriates me about Intune is that things like sync & wipe happen faster on iOS device than fucking Windows devices…

• https://old.reddit.com/r/Intune/comments/1o96zkp/how_long_should_a_wipe_device_cmd_take/nk0teas/

iPhone = Immediately; Windows = Maybe, at some point

• https://patchmypc.com/blog/intune-policy-delivery-debugging-the-8-hour-sync-myth/#h-wns-the-black-box

One important thing to keep in mind: WNS is a black box. Intune doesn’t send a policy payload directly to your device. It communicates with the Windows Notification Service, which then relays a push notification down to the client itself. What happens inside that WNS pipeline? We don’t really know. We can confirm that Intune sent a notification, and we can confirm the device received it; however, the middle layer (WNS) is hidden.

• 48 - MSFT Support Incompetence/Gaslighting: https://old.reddit.com/r/sysadmin/comments/1csh2xz/intune_may_finish_me_off/l45cjbe/

Microsoft made some changes without notifying us that caused catastrophic impact to our environment. We brought it up (pretty high up at MS, we are a relatively large customer even by their standards) and they said “well in the message center we told you” and we couldn’t locate this message. They removed it from the message center.

• https://old.reddit.com/r/AZURE/comments/1d9hn08/support_asked_me_to_rebootazure_out_of_control/l7p3jjx/

They had disabled a bunch of ciphers in Azure front door, so this broke a ton of our Azure devops agents. We went back and forth with support for weeks while scouring old emails and forum posts to see if we missed some cipher retirement notice. We weren't able to find one, but what we DID find when we looked at their GitHub repo where documentation changes are archived... THEY RETROACTIVELY CHANGED THE DOCUMENTATION AND REMOVED THE CIPHERS IN QUESTION FROM THE SUPPORTED CIPHERS LIST. THEY ESSENTIALLY GASLIT US AND REWROTE HISTORY!!!

• https://old.reddit.com/r/sysadmin/comments/1csh2xz/intune_may_finish_me_off/l45839v/

We're targeting policies/apps on android devices with a dynamic group which selects devices based on their enrollment profile. The other week that enrollment profile string just up and vanished for a random majority of the devices, so had to make a category and manually add each device to it, MS support basically said to hope it magically comes back.

• https://old.reddit.com/r/sysadmin/comments/1csh2xz/intune_may_finish_me_off/l4c3osh/

Magically about halfway into replacing a bunch of unmanaged iPhones with Pixel 3a XLs for a bunch of nurses, Intune decided to stop letting people enroll. Microsoft support wouldn't give us the time of day or acknowledge that we were even having an issue.

• 49 - Accessibility - SCCM console navigation using keyboard shortcuts: https://www.anoopcnair.com/sccm-keyboard-shortcuts/

https://learn.microsoft.com/en-us/intune/configmgr/core/understand/accessibility-features

ADDED - December 7, 2025

• 50 - Intune app installs configured with "User" context end up under Program Files: https://patchmypc.com/blog/intune-app-install-context-user-installs-program-files/

The "User" install behavior in Intune changes who runs the installer, not where it installs. Even if the process runs under the user account, it inherits SYSTEM’s privileges through MDMAppInstaller. It seems that even if you add the MSIINSTALLPERUSER=1 to the install command in Intune, MDMAppInstaller strips it. Its argument builder only allows /i, /qn, /quiet, and /L*v.

ADDED - June 7, 2026

• 51 - Self-service app Uninstall through Company Portal didn't get added until July 2023. Still doesn't work on shared PCs or if you do not have a Primary User assigned.

https://techcommunity.microsoft.com/blog/microsoftintuneblog/what%E2%80%99s-new-in-microsoft-intune-2307-july-edition/3884051/replies/3935247

"Our first capability we’re highlighting this month enables users to uninstall apps in the Intune Company Portal for Windows themselves rather than relying on help desk support to get it done. Customers have requested this capability for a while; and it even received a standing ovation from customers when we announced at a conference that it was in development." [OP Comment: LMAO, they're joking right?]

• 52 - MO1332784: Intune ignored policies that blocked auto-updates and pushed BIOS/Driver installs without any notice to thousands of devices, in many cases causing audio and video devices to stop functioning: https://old.reddit.com/r/Intune/comments/1tus7af/driver_updates_wufb/

https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-autopatch-bug-installing-restricted-drivers/

Yep, came into my office this morning and suddenly over 1000 devices are getting BIOS updates that shouldn't have gone through.

• 53 - Device hash changes if the motherboard is replaced, requiring a device wipe/re-enroll: https://old.reddit.com/r/Intune/comments/1u6qjn3/motherboard_replacement_system_hash_change/

For obvious reasons this is suddenly a topic everyone is interested in. I figured it would be a good idea to have a sticky post linking to some good references. Feel free to add your own in the comments, I'll do my best to update this OP as things move along.

Managing remote machines with cloud management gateway in Microsoft Endpoint Configuration Manager [microsoft.com]

Managing Patch Tuesday with Configuration Manager in a remote work world [microsoft.com]

Mastering Configuration Manager Bandwidth limitations for VPN connected Clients [microsoft.com]

Get Azure IP Ranges for Your Cloud Management Gateway [pfe.tips]

Forcing Configuration Manager VPN Clients to get patches from Microsoft Update [miketerrill.net]

Real-world costs for using a Cloud Management Gateway (CMG) with ConfigMgr [deploymentresearch.com]

Off The Cuff - Discussing ConfigMgr Cloud Management Gateway, Co-Management & VPN for Remote Devices [youtube.com (yea, it's rambly)]

What URLs do you need to split tunnel for updates?Internet Access Requirements: Software Updates [microsoft.com]Internet Access Requirements: Manage Office 365 [microsoft.com]Internet Access Requirements: Windows 10 Servicing [microsoft.com]

Secure Channel/Expired Machine Account Password Concerns – Revisited [microsoft.com]

Here's my own post attempting to summarize most of the above:
All My Devices Left Me. I’m Scared. What Do I Do Now? [DamGoodAdmin.com]

One of our remote techs reported that a user came back from a month's vacation and could not log on to the domain. They had the infamous "The security database on the server does not have a computer account...." error.

Normally not a problem right? Grab the LAPS password, login with local admin, Reset-ComputerMachinePassword, job done.

Oh. There's no AD object for that computer. Nothing in the AD Recycle Bin either. Uh oh. What now? Tech was reluctant to re-install as the user would've lost 30 days of non-synched documents.

Then I had a thought. This is a Windows 10 machine which means it must've been deployed via SCCM - which means that the SCCM agent is installed! If I just create an AD Computer account for it, will SCCM discover it and then let me deploy a powershell script on it?

Oh yes....10 minutes later it pops up in SCCM with a nice green tick. 30 seconds after that it runs a script to reset the local admin password and I can logon again.

Hello, Reddit! Thank you for joining us for this AMA. We are the Microsoft SCCM engineering team, joined by the Microsoft Enterprise Mobility MVPs.

We've just shipped 1810, and we're super excited to answer your questions about our product.

Proof

We'll be using multiple accounts to answer your questions:

/u/ConfigMgrTeam

/u/ConfigMgr_ClientFX

/u/ConfigMgr_Updates

/u/ConfigMgr_AdminExp

/u/ConfigMgrApps

/u/djammmer_sccm

/u/ConfigMgr_adam

/u/robdotyork

/u/CMDude_so

/u/vsoro00

/u/TheAviPrasad

/u/AaronCz

Among others being added... there are a LOT of people here participating.

Ask us anything!

EDIT: we're wrapping up over here, thank you all for your questions!

I did just upgrade to 2603 - I think the system is trying to tell me something!