Login to Intune Portal and navigate to: Devices > Windows > Configuration Profiles.

Hit the Create button and Select New policy

From the Create a profile menu, select Windows 10 and later for Platform , Templates for Profile type. Select Administrative templates and click Create.

Give the profile desired name and click Next.

In Configurations settings, select Computer Configuration and search for keyword “Site to Zone“, Site to Zone Assignment List setting will be listed under search results. Go ahead click on it to Select it.

Once selected, a Site to Zone Assignment List page will appear on right side explaining different zones and values required for these zone for setup. Since this profile is being used for trusted sites, we will use the Value “2” . Go ahead and select Enabled button and start entering the trusted sites as required. please ensure to set each value to “2”. See example below:

Once done adding the list of sites, click OK to close it and Hit Next on Configuration settings page.

Add Scope tags if needed.

Under Assignments, Click Add groups to target the policy deployment to specific group of devices/users. You can also select Add all users / All all devices.

Hit Next. Then Hit Review + Save button to save.

The post Deploy Trusted sites zone assignment using Intune appeared first on SuperUserTips.

Check out below trick to download the older build of Zoom Desktop client for both MacOS and Windows directly from Zoom links

First step is to identify which build version of zoom are you looking to download. You can browse through the release notes links below to check:

Windows release notes:
https://support.zoom.us/hc/en-us/articles/201361953-Release-notes-for-Windows
MacOS release notes:
https://support.zoom.us/hc/en-us/articles/201361963-Release-notes-for-macOS

Once you know which exact version are you looking to download, use the below URL format to create download links and then copy paste them in your browser to download the desired build version.

Windows:

Windows format (x64 EXE Installer) link format :
https://zoom.us/client/version#/ZoomInstaller.exe?archType=x64
Example link:
https://zoom.us/client/5.16.2.22807/ZoomInstaller.exe?archType=x64

Windows (x64 MSI Installer) link format :
https://zoom.us/client/version#/ZoomInstallerFull.msi?archType=x64
Example link:
https://zoom.us/client/5.16.2.22807/ZoomInstallerFull.msi?archType=x64

MacOS

MacOS (PKG Installer) link format:
https://zoom.us/client/version#/zoomusInstallerFull.pkg
Example link:
https://zoom.us/client/5.9.3.4239/zoomusInstallerFull.pkg

The post Zoom Desktop Client – Download older build versions from Zoom appeared first on SuperUserTips.

Use the methods below on how to uninstall and disable the built-in chat app using Intune.

Step 1: Use a Proactive Remediation script

Proactive remediation script package will detect uninstall the Teams chat app if it exists and also configure the registry to disable auto-install of chat app in future.

For this, you’ll need to create two powershell script files, one for detecting the issue and another for remediation:

1. Detect_TeamsChatApp.ps1
2. Remediate_TeamsChatApp.ps1

You can download both files in zip format here:
TeamsChatApp_ProactiveRemediation_Files.zip

OR

Copy paste contents of each file below to create your own files

Detect_TeamsChatApp.ps1

$OSversion = (Get-WmiObject -class Win32_OperatingSystem).Buildnumber
If ($OSversion -like "2*") {
    try {

        # check the reg key for teams chat app autoinstall
        If (((Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Communications').PSObject.Properties.Name -contains 'ConfigureChatAutoInstall') -eq $true) {
            if ( (Get-ItemPropertyValue -LiteralPath 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Communications' -Name 'ConfigureChatAutoInstall' -ErrorAction Stop ) -eq 0 ) {
                $RegCompliance = $true 
            }
            else { 
                $RegCompliance = $false 
            } 
        }
        else { $RegCompliance = $true }

        # check if the teams app is installed
        if ($null -eq (Get-AppxPackage -Name MicrosoftTeams) ) { $AppCompliance = $true }
        else { $AppCompliance = $false }
    
        # evaluate the compliance
        if ($RegCompliance -and $AppCompliance -eq $true) {

            Write-Host "Success, app/reg in Compliance"
            exit 0
        }
        else {
            Write-Host "Failure, app/reg detected"
            exit 1
        }
   
    
    }
    catch {
        $errMsg = $_.Exception.Message
        Write-Host $errMsg
        exit 1
    }
}
else {
    Write-Output "OS is not windows 11. Exiting"
    Exit 0
}

Remediate_TeamsChatApp.ps1

# Give "Administrators" group full ownership of HKLM:\Software\Microsoft\Windows\CurrentVersion\Communications.
function enable-privilege {
    param(
        ## The privilege to adjust. This set is taken from
        ## http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx
        [ValidateSet(
            "SeAssignPrimaryTokenPrivilege", "SeAuditPrivilege", "SeBackupPrivilege",
            "SeChangeNotifyPrivilege", "SeCreateGlobalPrivilege", "SeCreatePagefilePrivilege",
            "SeCreatePermanentPrivilege", "SeCreateSymbolicLinkPrivilege", "SeCreateTokenPrivilege",
            "SeDebugPrivilege", "SeEnableDelegationPrivilege", "SeImpersonatePrivilege", "SeIncreaseBasePriorityPrivilege",
            "SeIncreaseQuotaPrivilege", "SeIncreaseWorkingSetPrivilege", "SeLoadDriverPrivilege",
            "SeLockMemoryPrivilege", "SeMachineAccountPrivilege", "SeManageVolumePrivilege",
            "SeProfileSingleProcessPrivilege", "SeRelabelPrivilege", "SeRemoteShutdownPrivilege",
            "SeRestorePrivilege", "SeSecurityPrivilege", "SeShutdownPrivilege", "SeSyncAgentPrivilege",
            "SeSystemEnvironmentPrivilege", "SeSystemProfilePrivilege", "SeSystemtimePrivilege",
            "SeTakeOwnershipPrivilege", "SeTcbPrivilege", "SeTimeZonePrivilege", "SeTrustedCredManAccessPrivilege",
            "SeUndockPrivilege", "SeUnsolicitedInputPrivilege")]
        $Privilege,
        ## The process on which to adjust the privilege. Defaults to the current process.
        $ProcessId = $pid,
        ## Switch to disable the privilege, rather than enable it.
        [Switch] $Disable
    )

    ## Taken from P/Invoke.NET with minor adjustments.
    $definition = @'
 using System;
 using System.Runtime.InteropServices;
  
 public class AdjPriv
 {
  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall,
   ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen);
  
  [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)]
  internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok);
  [DllImport("advapi32.dll", SetLastError = true)]
  internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid);
  [StructLayout(LayoutKind.Sequential, Pack = 1)]
  internal struct TokPriv1Luid
  {
   public int Count;
   public long Luid;
   public int Attr;
  }
  
  internal const int SE_PRIVILEGE_ENABLED = 0x00000002;
  internal const int SE_PRIVILEGE_DISABLED = 0x00000000;
  internal const int TOKEN_QUERY = 0x00000008;
  internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
  public static bool EnablePrivilege(long processHandle, string privilege, bool disable)
  {
   bool retVal;
   TokPriv1Luid tp;
   IntPtr hproc = new IntPtr(processHandle);
   IntPtr htok = IntPtr.Zero;
   retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok);
   tp.Count = 1;
   tp.Luid = 0;
   if(disable)
   {
    tp.Attr = SE_PRIVILEGE_DISABLED;
   }
   else
   {
    tp.Attr = SE_PRIVILEGE_ENABLED;
   }
   retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid);
   retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
   return retVal;
  }
 }
'@

    $processHandle = (Get-Process -id $ProcessId).Handle
    $type = Add-Type $definition -PassThru
    $type[0]::EnablePrivilege($processHandle, $Privilege, $Disable)
}

enable-privilege SeTakeOwnershipPrivilege 
$key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Communications", [Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree, [System.Security.AccessControl.RegistryRights]::takeownership)
# You must get a blank acl for the key b/c you do not currently have access
$acl = $key.GetAccessControl([System.Security.AccessControl.AccessControlSections]::None)
$me = [System.Security.Principal.NTAccount]"Administrators"
$acl.SetOwner($me)
$key.SetAccessControl($acl)

# After you have set owner you need to get the acl with the perms so you can modify it.
$acl = $key.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule ("Administrators", "FullControl", "Allow")
$acl.SetAccessRule($rule)
$key.SetAccessControl($acl)

$key.Close()

# Remediation
try {
    #Disable Auto Install registry for Teams chat app
    if (((Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Communications').PSObject.Properties.Name -contains 'ConfigureChatAutoInstall') -eq $true) {
        Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Communications' -Name 'ConfigureChatAutoInstall' -Value 0 -Type "Dword"
    }
    else {
        Write-Output "Registry value ConfigureChatAutoInstall not found"
    }

    # uninstall the teams consumer app
    Get-AppxPackage -Name MicrosoftTeams | Remove-AppxPackage -ErrorAction stop

    # as nothing errored out, we will report success
    Write-Output "Success, regkey set and app uninstalled"
    exit 0
}

catch {
    $errMsg = $_.Exception.Message
    Write-Host $errMsg
    exit 1
}

Once you have both a detection and a remediation script file:
Launch Intune portal and navigate to Devices > Remediations > Create script package

Type in a Name for your script and hit Next button

On the Settings page, upload the Detection and the Remediation scripts created in earlier steps and hit Next

In the next step, Select any Scope tags as needed and Hit Next

Under Assignments, select your Device or User groups you would like to apply this remediation scripts and also select your preferred Schedule and interval time. I recommend running this with daily schedule repeating everyday once every morning.

Finally, under Review + create hit Create button after reviewing all settings.

After the proactive remediation implemenation you can always head to Devices > Remediations and click on the script package name you created to check the device status report

Step 2: Hide the chat icon from taskbar

The above proactive remediation script will uninstall the app but users may still see the Teams chat app icon in the taskbar which upon click can reinstall itself. Create a configuration profile in Intune to disable the Teams Chat app icon from taskbar as shown below:

Navigate to Devices > Windows > Configuration profiles and Hit Create profile button

Select Windows 10 or later for Platform and Setting Catalog for Profile type in next step and hit Create button

Next, give your profile a name and hit Next button

On Configuration settings page, click Add settings and search for “Configure Chat” in the settings picker search box on the right and press Enter. You will see category “Experience” loaded under the search. Click on Experience category and check the box next to Configure Chat Icon setting.

This will add the Configure Chat Icon setting to your Configuration settings. Select Disabled from the drop down menu next to Configure Chat Icon setting as shown below and Hit Next.

You can also set it to Hide but this will allow users to show or hide in local taskbar settings. Read more

Apply Scope tags and required and hit Next.

Under Assignments, add your desired device or user groups to apply this policy to and Hit Next.

At last, hit the Create button to finish creating and applying this Configuration profile.

Congratulations, you have now created a proactive remediation and a configuration profile to disable and block Teams home Chat app from installing

The post Uninstall Teams chat app using remediation script and a configuration profile in Intune appeared first on SuperUserTips.

Ultimately, it all came down to one of the windows service that was not running or in disabed state.

DmWapPushService : (“Device Management Wireless Application Protocol (WAP) Push message Routing Service”) , a required service for Intune to properly communicate with clients

Resolution:

Check and enable the DmWapPushService service:

• Openservices.msc console
  
  
• Under services list, Right-click service name “Device Management Wireless Application Protocol (WAP) Push message Routing Service” and select Properties. In the General tab of properties dialog box, select Automatic (Delayed Start) as startup type.
  
  
  
• Hit OK
  

• Verify that another required service “Microsoft Intune Management Extension” is enabled with startup type as “Automatic (Delayed Start)” as well and in running state.
  

• Once the above services are in desired state, Reboot and initiate a check-in with Intune. After 5-10 mins, the last check-in time should be updating with no issues

Microsoft reference:
https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-management/cannot-sync-windows-10-devices?id=5004252

The post Intune Last Check-in date not updating for Windows device appeared first on SuperUserTips.

How to use Event Viewer?

Since it continuously captures logs for all system events, you can create a custom view to find out what Critical/Error events occurred when BSOD appeared. (Yes! keep a note of time when BSOD occurs)

Step 1:

Press Windows + X key to open Quick launch menu and select Event Viewer

Or

Simply type in “Event Viewer” in Start search box and hit Enter key to open

Step 2:

Once in Event Viewer window click on Open the “System” logs under “Windows Logs” from left menu.

Now on right side navigation, click on “Create Custom View…”

Step 3:

In the Create Custom View window, select “Custom range…” from the drop down menu under Logged and pick the custom date and time interval BSOD occurred and click OK

Step 4:

Still in Create Custom View window, Check Critical, Warning and Error box and pick System under Event Level as shown below and click OK

Now name the view to whatever name you want and click OK

Step 5:

It will now list all the Critical, Warning and Error events occurred during the time interval your picked.

Look at error events around the time of the BSoD. To further examine an event log, double-click on it and click the “Details” tab.

If you don’t understand the event description, you can always google the Event ID and get more information.

The post How to use Event Viewer to check cause of Blue screen of Death (BSOD) appeared first on SuperUserTips.

Note: this only works on laptop built-in screens, not external monitors

Part 1: Create brightness.ps1 powershell file

1. Open Notepad
2. Copy paste the code from snippet below and change “95” to whatever desired level percentage you want to set it to between ( 0 – 100)

# Setting brightness to 95 in 1 Sec. Change 95 to your desired level (0-100)
(Get-WmiObject -Namespace root/WMI -Class WmiMonitorBrightnessMethods).WmiSetBrightness(1,95)

3. Save the file as brightness.ps1 under C:\ or your desired location as shows in below screenshot (remember this location as you will need it again task scheduler)

Part 2:  Setup Task Scheduler

Now, setup a task in Task Scheduler to run the previously created brightness.ps1. This scheduled task will run brightness.ps1 script file everytime we logon.

Open Task Scheduler application by typing “Task Scheduler” in Start Menu

In Task Scheduler window, click on Create Task… on the right Actions menu

This will open a new Create Task window

On the General Tab make changes as below:

1. Name: Brightness or whatever you want
2. Descrition: Whatever you want to call it
3. Change User to your current user (User account has to be administrator account)
4. Check “Run Whether user is logged on or not”
5. Check “Run with highest privileges” (important)”
6. Configure for: Windows 10

Now move to Triggers tab and Click New… to create a trigger:

On New… Trigger Window make the changes below

1. Begin the task: At log on
2. Select “Specific user”
3. Click Change User… to pick your account
4. Check “Enabled”
5. Click  OK

Now back to Create Task Window, Click on Actions tab and then click New… to create new action

On New Action window make the changes below:

1. Action: Start a program
2. Program/script: type powershell
3. Add arguments: -noprofile -executionpolicy bypass -file c:\brightness.ps1
(change c:\brightness.ps1 to specify your location path if you saved your brightness.ps1 to different location)
4. Click OK

You will be taken back to Create Task window after clicking OK. Now, move to Conditions tab and make changes below:

1. Uncheck “Start the task only if the computer is on AC power”
2. Click OK

After hitting final OK, it will prompt for your username password. Go ahead enter your account information and hit OK.

You are now done!
There should be task named “Brightness” generated under your task lists now:

Now to test it, change your brightness level to different than setup in brightness.ps1 and restart your laptop. Once logged back in, it should automatically run the task and change the brightness level to desired percetage set in brightness.ps1

The post Set your laptop screen’s brightness level to desired percentage every time you logon appeared first on SuperUserTips.

Adobe Flash Player is reached its end of life on December 31, 2020. It will not receive any important security updates leaving computers vulnerable to attacks. If you still have it installed on your computer, you can use this powershell script below to completely uninstall Flash from your computer.
It runs Adobe Uninstaller and removes all other plug-ins/files that may be lingering even after uninstaller run. In short, running this script removes all signs of flash player from Windows 10 machine

How it works

This script:

1. Downloads and runs Adobe Flash removal tool
2. Uninstalls any Flash ActiveX or NPAPI plugins
3. Removes below files and folder:

C:\Windows\system32\Macromed\Flash
C:\Windows\SysWow64\Macromed\Flash
%appdata%\Adobe\Flash Player
%appdata%\Macromedia\Flash Player
C:\Windows\SysWOW64\FlashPlayerApp.exe
C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

Installation

1. Download flashremoval.zip and extract flashremoval.ps1 file inside to desired location, preferably C:\temp
2. Open Windows Powershell as administrator. (its needs to run as administrator or script will error out)
3. Run flashremoval.ps1 using the relative path where its downloaded. Ex:

C:\temp\flashremoval.ps1

Script will run and remove all flash player existense

It is also recommended to install standalone Windows update KB4577586 that microsoft released to get rid of Flash.

The post [Windows 10] How to completely uninstall Flash player appeared first on SuperUserTips.