Microsoft Endpoint Manager Archives

Intune Win32 Packaging

July 27, 2025

A feature of Microsoft Intune is the ability to package and distribute applications to users. Before you can distribute applications to users, you need to package them.

In this post, I will show you step-by-step how to package an application as a Win32 application that can be used with Intune.

The Process

Before we can start with packaging an application, we need the Microsoft Win32 content prep tool, which can be obtained from the official Microsoft GitHub repository. https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool

Download the Microsoft Win32 Content Prep Tool.
Extract the Win32 Content Prep Tool.

When you run the Win32 Content Prep Tool, you will need to provide a directory that contains your install file and/or install script. The Win32 Content Prep Tool will effectively zip up everything in the folder that you provide it with and will create an .intunewin file that can be used with Intune.

Due to the way the Win32 Content Prep Tool functions, I create an input directory and a separate folder for each application to keep things organized.

Create a folder for your installation files.

In my example, I will be creating a Win32 package for GlobalProtect. I have created a folder named DXT-GlobalProtect-Install-v1.0.0, and I placed my installation script in it.

Create a folder for the Win32 package output.

I will create a folder named output.

…

Read More Read More

Company Portal Theme

August 18, 2024

The default theme for Company Portal is fine, but it always looks better when you customize it to match your origination’s theme.

In this post, I will show you step-by-step how to set a theme for Company Portal.

The Process

Login to Microsoft Intune admin center
Click on Tenant administration

Under the End user experiences section, click on Customization.

Click on Edit beside settings.

Enter your Organization name.
Select a Theme color.

The default color for Company Portal is blue.

The default Company Portal Header and color.

Select what you would like to see in the header.

I will be selecting Organization logo only as my logo has the organization name in it already.

Select a logo for the color-themed background and the white background.

I will be using the same logo for each of them.

Company Portal themed with a logo-only header.

…

Read More Read More

Intune Deploy Windows 11 Default Start Menu

August 17, 2024

With Windows 11, many visual elements have changed, and one of the most noticeable ones is the Start Menu. With a new star menu comes a new way to manage it. With Windows 10, you can control the start menu with an XML file. Now, with Windows 11, you can control it with a JSON file.

What’s extra interesting is that you still control the taskbar with an XML file. If you want to know how to deploy a default taskbar, my blog post, Intune Deploy Default Taskbar, covers how to do that.

There are a few pitfalls when you control the Windows 11 Start Menu. The first one is that users will no longer be able to pin anything extra to the Start Menu.

The option to Pin to Start is no longer available

Another pitfall is that users can technically reorder the applications you pin in the start menu but the next time they log in, it is reset to the layout you defined.

In this post, I will show you step-by-step how to deploy a Windows 11 default Start Menu layout using Microsoft Intune.

Building the Start Layout

On a source system, pin the applications to the start menu in the order you want.

Export the Start Menu layout by running the following PowerShell command Export-StartLayout -path C:\temp\Win11-Start.json

…

Read More Read More

Intune Deploy Company Portal for Windows

August 13, 2024

The Company Portal application is a wonderful tool for Microsoft Intune. If you come from the world of ConfigMgr (Microsoft Configuration Manager aka SCCM (System Center Configuration Manager)), it is the Intune version of Software Center.

Company Portal allows users to install programs you publish on the Company Portal. My favorite part is that the users don’t need local admin to install the applications you make available to them.

You can also make Company Portal do more than just install applications for users on demand. For example, it can allow users to factory reset their devices or retrieve their own BitLocker keys.

There are three main ways to deploy the Company Portal on Windows.

Online Company Portal as System-based
Online Company Portal as User-based
Offline Company Portal

The original method for deploying Company Portal was to use the Microsoft Store for Business. At the time two options existed: the Offline Company Portal and the Online Company Portal. The main difference between the two was that the Offline Company Portal could use device-based licensing and could be installed system-based, while the Online Company Portal was user-based.

With the deprecation of the Microsoft Store for Business, the current Microsoft Store was updated with a new method for deploying the Online Company Portal. This method includes system and user based deployments, allowing us to achieve the same results as the old Microsoft Store for Business.

System vs User

A system-based Company Portal deployment makes the most sense when the organization fully owns the device or when items like Windows Autopilot are used.

A user-based Company Portal deployment makes sense when the device is a BYOD setup.

The difference between the two is that the system-based deployment of Company Portal only needs to be done once per system, which can help speed up login times. The user-based deployment needs to install Company Portal for each user that uses the system, which can result in users waiting for Company Portal to install, which can be a pain for shared devices like meeting rooms.

Offline Company Portal

The need for the Offline Company Portal is rare but can still be useful in some situations. Typically the Offline Company Portal is used in situations where the Microsoft Store is disabled or can not be used for various reasons.

What sets the Offline Company Portal apart from the Online Company Portal is that it does not use the Microsoft Store to install itself. Instead, it uses the Microsoft Intune Management Extension. The Offline Company Portal will require manual updates when new versions are released.

In this post, I will show you step-by-step how to deploy the Company Portal for Windows using Microsoft Intune.

The Process

Log in to the Microsoft Intune admin center.
Click on Apps.

Click on All Apps.

Click on Add.

…

Read More Read More

Intune Deploy Windows 10 Default Start Menu

April 20, 2024

I recently discovered that I caused an unintended side effect on Windows 10 when deploying a default taskbar for all users.

In my post Intune Deploy Default Taskbar I inadvertently introduced a bug to the Windows 10 Start Menu making it so users can’t customize anything.

The bug is that users can pin programs to the taskbar but they can’t pin anything to the Start Menu and they also can’t change anything in the Start Menu.

Can’t pin Microsoft Access to the Start Menu on Windows 10

The issue does not impact Windows 11 as the way the Windows 11 Start Menu layout uses JSON and the Windows 10 Start Menu layout uses XML, the same XML file that is used for the default taskbar.

I am happy to allow users to customize their Start Menu as much as they want but I do want a consistent user experience for all. Most users likely won’t change anything, but the ones that do want to customize their Start Menu would be blocked.

In this post, I will show you step-by-step how to fix the bug and how to deploy a partial custom Start Menu for Windows 10 using Microsoft Intune.

The Process

On a source system configure an application group in your start menu and pin the applications in the order you want.

The application group name will also be deployed. I named my application group Company Name for this example but you can make it whatever you want.

I don’t want the custom Start Menu application group to be very intrusive so I will use 1×1 icons for all the common Microsoft applications and I will use 2×2 icon for Company Portal as Company Portal is still new for a lot of people.

Source Windows 10 Start Menu application group

Export the Start Menu layout by running the following PowerShell command Export-StartLayout -UseDesktopApplicationID -path C:\temp\start-menu.xml

Open the Start Menu XML file as we will need to make changes to it.

…

Read More Read More

Intune Device Filters

April 6, 2024

As the end of Windows 10 starts creeping up we have to adapt some of our methods to support mixed environments with Windows 10 and Windows 11.

Most settings in Microsoft Intune aren’t specific to Windows 10 or Windows 11 some settings are specific to the version. For example, one of them is the Windows Start Menu. Windows 10 uses an XML file and Windows 11 uses a JSON file. Technically there’s no impact if you deploy those settings to either version of Windows but that might not always be the case. It’s a better idea to only target the intended version of Windows.

A way that I like to handle this is with Intune Device Filters. In this post, I’ll show you step-by-step how to create Device Filters for Windows 10 and Windows 11 in Microsoft Intune.

The Process

Login to Microsoft Intune admin center
Click on Devices

Click on Filters

Click on Create > Managed devices

Give your Filter a name. Like Windows 10 or Windows 11.
Set the Platform as Windows 10 and later

…

Read More Read More

Intune Deploy Default Taskbar

September 30, 2023

Update

The process detailed below works perfectly on Windows 11 however, on Windows 10 the process below will lock the Start Menu layout preventing users from being able to pin anything to the Windows 10 Start Menu or change anything in the Start Menu. The process to fix this is to also deploy a default Windows 10 Start Menu the process for the fix is detailed in my post Intune Deploy Windows 10 Default Start Menu.

Deploying the same taskbar to all users is a very nice quality of life improvement, as it can help eliminate the problems of users using Windows Mail instead of the already installed Microsoft Outlook.

I opted to deploy a standard default taskbar using Microsoft Intune as Microsoft Office is a required application on all Intune systems in my setup so I didn’t need to worry about a system trying to pin Microsoft Outlook when it wasn’t installed.

In this post, I’ll show you step-by-step how to create the taskbar XML file and how to deploy it to Windows 10 and Windows 11 using Microsoft Intune.

Create the XML

Copy the example taskbar XML below or copy it from Microsoft here.

<?xml version="1.0" encoding="utf-8"?>
<LayoutModificationTemplate
    xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
    xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
    xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
    xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"
    Version="1">
  <CustomTaskbarLayoutCollection>
    <defaultlayout:TaskbarLayout>
      <taskbar:TaskbarPinList>
        <taskbar:UWA AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
        <taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk" />
      </taskbar:TaskbarPinList>
    </defaultlayout:TaskbarLayout>
 </CustomTaskbarLayoutCollection>
</LayoutModificationTemplate>
Code language: HTML, XML (xml)

We will need to make some changes as it isn’t perfect. We will start by telling Windows to unpin all the default pinned apps.

To remove all the default pinned apps we need to change <CustomTaskbarLayoutCollection> to be <CustomTaskbarLayoutCollection PinListPlacement="Replace">

Even though we configure the taskbar XML to replace the default pinned apps this has no impact on the apps the user has pinned, it may move the items to the start of the taskbar if they have them pinned further down but that’s it.

Now we can start adding the pinned apps we want. I like to have Edge, File Explorer, and Outlook pinned.

…

Read More Read More

Intune Silently Enable BitLocker

May 27, 2023

When you are managing devices with Microsoft Intune aka Microsoft Endpoint Manager it’s great to control BitLocker but silently enabling BitLocker for all devices is even better.

Here is everything you need to know to silently enable BitLocker with Intune.

Disk Encryption Policy Profile

First up we need to create a disk encryption policy profile that we can use later on with our configuration profile. The Disk Encryption Policy Profile by itself really does nothing other than defining the settings that will apply when referenced by a configuration profile.

Click on Endpoint Security

Click on Disk encryption

Click on Create Policy

…

Read More Read More

Intune Dynamic Device Groups

April 30, 2023

Intune aka Microsoft Endpoint Manager can be extremely powerful but as it always goes with great power comes great responsibility.

To make sure I’m only targeting the devices I want, I like to make a few dynamic device groups that I’ll use for various Intune policy targeting.

The dynamic device groups I create are:

Windows AAD Joined for all the Windows devices joined to Azure AD.
Windows Hybrid AAD Joined for all the Windows devices that are hybrid joined to Azure AD.
Windows AAD Registered for all the Windows devices that are registered to Azure AD this is typically BYOD (Bring Your Own Device).
Windows Personal for all the personal Windows devices.

By creating these groups I can correctly target my Intune policies to always have the intended outcome.

Here are the dynamic membership rules I use for the dynamic device groups.

…

Read More Read More