Comments on: Manage the local administrators group with Microsoft Intune – Azure AD joined Windows 10 devices

By: Ronald

Ronald — Fri, 16 Oct 2020 10:59:11 +0000

Another comment is to use a Self Deploying autopilot profile. With this the connection is set at a device level to Intune so sync with Intune is not reliable on the user which you will have with a user drive autopilot profile. Be aware that tasks like Powershell scripts which are set to run in the users content will never run for the local kiosk user so make sure everything is set to the device level.
Talking about Powershell, I did some actions based on a Powershell scripts which creates a scheduled task to make it run at the defined triggers moments. To make this work, make sure you add Powershell.exe 64bit and/or 32bit to be allowed with Kiosk. Else does Powershell tasks will never run because they will be blocked.
Hopefully this helps.

By: Ronald

Ronald — Fri, 16 Oct 2020 10:54:09 +0000

Hello all.
I would not advise to just allow local users to login to the kiosk device. Make sure you also add for example global admins and devices admins. This way you can login with an account for troubleshooting. When login in with a Global Admin account, the kiosk policy is not active and you can do all kind of management and troubleshooting tasks. For example see the AppLocker eventlog to see which apps are being blocked.

You can add the global admin and device admin with their id. I did this by checking the local administrators group on the device to get the id’s.

By: Jose

Jose — Tue, 13 Oct 2020 22:20:16 +0000

In reply to Pablo. Si esta en ingles

By: Pablo

Pablo — Wed, 07 Oct 2020 01:11:05 +0000

In reply to Francisco Matos. Hola Francisco, creo que hablas español, queria hacerte una consulta. Cuando aplicaste la politica agregaste el nombre del grupo de administradores local en español o en ingles??? administradores o Administrators???? accessgroup y groupmembership si es en inlges, cierto?

By: Peter Klapwijk

Peter Klapwijk — Wed, 02 Sep 2020 05:50:41 +0000

In reply to Herman ohlsson.

Have a look at the follow-up article on that topic https://inthecloud247.com/add-an-azure-ad-group-to-the-local-administrators-group-with-microsoft-intune/

By: Herman ohlsson

Herman ohlsson — Tue, 01 Sep 2020 21:42:11 +0000

hi. How do I use it to add an Azre Ad group. With SID or groupname? And how to specify it?

By: Francisco Matos

Francisco Matos — Fri, 31 Jul 2020 17:41:14 +0000

I did post in Manage the local administrators group with Microsoft Intune – Hybrid AAD joined Windows 10 devices.This CSP Policy is OS language dependent.
It works fine with english operative system.
I´ve been 3 days working on it and it did only worked when I used the spanish name of administrators group and local administrator user
Administradores and Administrador.
404 event id

By: Ryan Bach

Ryan Bach — Thu, 23 Jul 2020 18:43:41 +0000

In reply to Peter Klapwijk. Thank you Peter- this worked just fine :D

By: Peter Klapwijk

Peter Klapwijk — Sun, 05 Jul 2020 11:44:28 +0000

In reply to Ryan Bach.

This setting is added in 1803, reference https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-restrictedgroups
The follow-up article is about using groups, indeed supported since 2004.

Make sure the OMA-URI and value are correct. Don`t just copy/ paste from the article as WordPress replaces the correct double quotes with different quotes, which causes issues.

By: Ryan Bach

Ryan Bach — Thu, 02 Jul 2020 18:43:10 +0000

I tried this, and i am getting a ‘Remediation failed’ error when i assign to my Windows 10 device. End result is that user still does not have admin rights. I am running version 1903… what version is this compatible with? I see that the follow-up article (group assignment) is only version 2004..