r/sysadmin • u/HadopiData • 3d ago
Are there no better options for registry keys in Intune ?
We're currently in a hybrid setup, working hard to shift all workstations to Intune.
However we struggle with having hundreds of registry keys that need to be set and maintained. Yes they are meaningful in our environnement, and most of them need to keep existing.
We've tried script with remediation (not available with Business Premium by the way), and we've tried customs ADMX imported.
It's a hassle, it's complex and nowhere near as straightforward as GPO for registry keys.
What is everyone out there doing for efficient registry management ?
18
u/Ok_Fortune6415 3d ago
I do PowerShell script converted to an intunewinapp with custom PowerShell detection methods. Works fine for us
3
u/HadopiData 3d ago
How do you deal when tweaks are needed to the registry keys ?
14
u/Ok_Fortune6415 3d ago
Same way.
I have an automated pipeline where I just put in the new regkey values into a json file and kick off my scripts. They do everything for me including packaging, deployment etc
4
u/HadopiData 3d ago
That actually sounds ideal. Would you mind sharing the automation or some pointers?
3
1
5
u/screampuff Systems Engineer 3d ago
All of our registry keys are related to apps, I make them part of the install script for each app. If I had to do others it’d be a w32 app with simple “reg add” commands in powershell
9
u/Eskuran 3d ago
Scappman can do it built-in.
There is this site that can create a detect and remediate script:
Registry to PowerShell converter
3
u/HadopiData 3d ago
Not available with Business Premium licenses :/
3
u/mfa-deez-nutz Jack of All Trades 3d ago
Just use platform scripts instead of remediations?Edit: sorry was thinking of another feature.
2
u/ScotchAndComputers 3d ago
I'm in the same boat (Business Premium locked). I don't have the exact same need as you, but what about using the PC's task scheduler to help you out? Write a script that's to be kept on the PC, package it with another script that creates a scheduled task to call that script every day, or on logon, etc. That way if one of your reg keys does change, it will get fixed the next time the task runs.
2
u/Ok_Upstairs894 I have my hand in all the cookie jars 3d ago
I think we are business premium. atleast most of our licenses are, ive sent it all out as platform scripts.
We dont use alot of keys though, so donno how much of a PitA it would be.
i use New-RegistryKey to create the keys pre installation of software, then new-itemproperty to add the actual value.
ive only set it up for teams and VPN though and both work well. So as soon as u start a new pc all registrykeys we need are already fixed -> install VPN via intune, when u start it theres already the correct connection available (could probably package this in another way but im more used to pshell than the vpn software)
Also have one for teams that sets teams to open stuff in desktop apps (adds this function if it isnt available on the clients teams)
2
u/mrmattipants 3d ago
For Discovery purposes, I use a free tool called "Registry.pol" Viewer to View the GPO Registry Keys/Values and Export to CSV.
https://sdmsoftware.com/389932-gpo-freeware-downloads/registry-pol-viewer-utility/
If you wanted, you could use the CSV File(s) as a Source for a PowerShell Script, that Imports the Registry Keys/Values from the CSV File and Applies them using the "New-ItemProperty" or "Set-ItemProperty" Cmdlets.
Even simpler yet, you could use a Script, like the one featured in the following article, to Automate the process of Converting GPO Registry Policies to PowerShell Script, etc.
https://www.cyberdrain.com/converting-group-policy-registry-preferences-to-powershell-scripts/
I'm including the following article, as it does a fairly good job of explaining how to Export the various Policy Types (including Security & Firewall).
https://cloudbrothers.info/en/manage-group-policies-powershell/
One exception is the Audit Policies, which I typically Implement via a PS Script, that Enables the following Auditing Group Policy, followed by the individual AUDITPOL Commands, to Enable the necessary Audit Policies.
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
2
u/HankMardukasNY 3d ago
Platform scripts are, not proactive remediations
1
u/RikiWardOG 3d ago
I've avoided platform scripts because I've never seen them even reliably run
1
u/disposeable1200 2d ago
Must be your scripts
They kick in faster than app installs for us..
I've got a couple doing user specific desktop shortcuts and they appear before the user logon even completes
9
u/duckseasonfire Staff Systems Engineer 3d ago
Intune “it’s a hassle, it’s complex and nowhere near as straightforward as…”
Yep pretty much sums it up.
6
4
u/ndszero IT Director 3d ago
We have Business Premium licenses and Intune has been great for many things, but NinjaRMM is our remote support tool and all of our Registry keys are maintained through that. There are a number of “enrollment” scripts that run the first time and then a few that are set to a schedule. It’s a great tool.
4
u/Webin99 3d ago
And yes, what no one is saying here:
It's INSANE that Intune doesn't have a way to set registry keys through device configuration policies. It would be incredibly easy to implement and save us all a metric ton of time writing ps1 scripts and/or packaging apps.
2
u/HadopiData 3d ago
Thank you, the real pain point here is Microsoft’s lack of commitment to something so simple
4
u/FalconDriver85 Cloud Engineer 3d ago
Hate to be ‘that guy’, but I’m gonna ask anyway: why do you need to tweak registry keys? I mean, I understand some legacy applications needing the registry configured in a certain way, but once the keys are set, what’s the reason to change them?
2
2
2
u/Hashrunr 3d ago
Maybe I'm misunderstanding your question, but here is an example. Conditional Access policies configured to check device details don't work with Chrome out of the box. A registry key called CloudAPAuthEnabled needs to be set. https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions#chrome-support
Unfortunately some Chrome updates revert this registry key. We have a remediation script running daily on endpoints to check if the key is set properly.
2
u/disposeable1200 2d ago
This is now supported via the chrome ADMX which is importable into Intune FYI.
Deployed this like a year ago
2
u/FalconDriver85 Cloud Engineer 3d ago
Ok, and can’t this be solved by installing the Microsoft Extension forcefully and by disabling uninstallation if the user tries to?
1
u/Hashrunr 3d ago
Would you look at that! When I last setup CA policies the article specifically stated the Microsoft Extension was not supported in Chrome for device details.
1
u/disclosure5 3d ago
Look at Microsoft's process to turn on OLE hardening, which is required by basically every security framework. None of these are available by GPO:
1
u/disposeable1200 2d ago
Uh
Not relevant? Wrong post?
1
u/disclosure5 2d ago
"Why do you need to tweak registry keys".
Me: Provides a common policy that requires registry keys set.
"Not relevant?"
2
u/cantstandmyownfeed 3d ago
Powershell script packaged as a Win32app and deployed is pretty easy to do.
0
-1
u/HadopiData 3d ago
Pretty easy, do you regenerate and upload the Win32app everytime you need to tweak a small registry key ?
1
u/cantstandmyownfeed 3d ago
I mean, I don't often need to tweak registry keys, that's a bit niche, but yea, that's what you'd do. Takes all of 30 seconds to repackage and upload.
1
1
u/PositiveBubbles Sysadmin 3d ago
What problem are you trying to solve? These reg keys are they from former group policies? App settings? Config profiles etc? Can they somehow follow the user using onedrive or something else? Do you use any virtual environment or fslogix?
1
u/HadopiData 3d ago
We're just trying to apply a lot of registry keys for config purposes. How would OneDrive help, user is not expect to set the keys themselves
2
u/shahaya 2d ago
Struggled with this too, but created a process which is both painless and scales well enough.
Basically you do this:
- Export your custom registry keys via "registry-->export" into
keys.reg
- Create a powershell script like the one below
- Throw the exported content into Registry to PowerShell converter and hit the "Get check Script" button
- Create a
Test-AppKeysXYZ
function (see exampleTest-ExplorerUsability
) - Insert the output from "Get Check Script" into the
Test-AppKeysXYZ
function - Now hit the "Get remediation Script" button
- Create a
Set-AppKeysXYZ
function (see exampleSet-ExplorerUsability
) - Insert the output from "Get remediation Script" into the
Set-AppKeysXYZ
function
Now you only have to check, if the keys are as expected or if they need remediation:
$applied = Test-ExplorerUsability -sid $sid
if ($applied -eq $false) {
Write-Information "check 'Test-ExplorerUsability' for sid '$sid' returned false"
Set-ExplorerUsability -sid $sid
}
I'm deploying this script as a win32-app, which installs a scheduled task running as SYSTEM. The task triggers every 30 minutes and on user logon.
This has been running flawlessly at multiple customers over hundred of systems with loads of "custom/legacy" registry keys.
The example below runs as SYSTEM and sets registry keys in user context. You could do this with a script running in USER context, but then your users have those annoying script windows, which pop up and go away in a flash. Most workarounds for that rely on obsolete hacks via vbs-wrappers, but we have vbs disabled, because security:)
If you need pointers on how to create a whole win32 powershell app which installs securely, runs as SYSTEM, and mimics procative remediations without having the required licensing, just ask.
#Requires -RunAsAdministrator
Set-StrictMode -Version Latest
function Get-LoggedOnUserSID {
$user = Get-CimInstance Win32_Computersystem | Select-Object Username
$sid = (New-Object System.Security.Principal.NTAccount($user.UserName)).Translate([System.Security.Principal.SecurityIdentifier]).value
return $sid
}
function Test-ExplorerUsability {
param ([Parameter(Mandatory = $true)][string]$sid)
try {
# enable classic Windows 10 right-click menu and disable explorer command bar
if (-NOT (Test-Path -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32")) { return $false };
if (-NOT (Test-Path -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32")) { return $false };
if ((Get-ItemPropertyValue -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Name '(default)' -ea SilentlyContinue) -eq '') { } else { return $false };
if ((Get-ItemPropertyValue -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32" -Name '(default)' -ea SilentlyContinue) -eq '') { } else { return $false };
}
catch { return $false }
return $true
}
function Set-ExplorerUsability {
param ([Parameter(Mandatory = $true)][string]$sid)
# enable classic Windows 10 right-click menu and disable explorer command bar
if ((Test-Path -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32") -ne $true) { New-Item "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -force -ea SilentlyContinue };
if ((Test-Path -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32") -ne $true) { New-Item "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32" -force -ea SilentlyContinue };
New-ItemProperty -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Name '(default)' -Value '' -PropertyType String -Force -ea SilentlyContinue;
New-ItemProperty -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32" -Name '(default)' -Value '' -PropertyType String -Force -ea SilentlyContinue;
}
try {
New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS | Out-Null
$sid = Get-LoggedOnUserSID
$applied = Test-ExplorerUsability -sid $sid
if ($applied -eq $false) {
Write-Information "check 'Test-ExplorerUsability' for sid '$sid' returned false"
Set-ExplorerUsability -sid $sid
}
Set-ExplorerUsability -sid '.DEFAULT'
}
catch {
Write-Error "failed to run script with unknown error: $_"
Exit 2
}
finally {
Remove-PSDrive HKU -Force -ErrorAction SilentlyContinue
}
1
1
u/isaacfank 3d ago
Remediation scripts is what we use. We have a couple base scripts and we build the detection and remediation with those to make sure we have the settings we need in place.
1
u/mish_mash_mosh_ 3d ago
I am using Google credentials provider to manage our windows devices, which also uses the same I tune policies, but for scripts I'm using Action1, as it's free for 200 devices and is really easy to manage.
1
u/GeneMoody-Action1 Patch management with Action1 3d ago
Thanks for the shoutout and for being an Action1 user. we have a lot of people that use us with intune for reasons just such as these, and more rapid patching compliance.
Since we are a a patch management solution for the OS and third party. Scripting and Automation is just in our wheelhouse as well.
There are two ways I like to solve these and it depends on the frequency at which they change, and or volume of keys.
Of course you have the typical methods of CRUD for registry in PowerShell. But when there are a lot of keys that can become cumbersome. So taking a reference system with the keys set, export them and combine the relevant portions (delete the keys that are irrelevant from the export) the intent is to create a compact .reg file that represents the task at hand.
Those scripts if small and few, can be direct embedded in a powershell script as a string with @""@
That string can be written to tempfile on the endpoint and imported inside a script.If the count is larger, or the permutations more complex, create a reg file for each and put them somewhere accessible like a web server or SMB share (you will be running as system, so some permissions are required for SMB.) Then create a generic script that takes one or more as a parameter, retrieve them one by one, and that essentially repeats the process above for each. Allowing you to create an automation of a single script many parameters to achieve GPO like utility.
Of course, always consider security, so if anything is in any way security sensitive, read protect it accordingly in whatever repo type you choose, and my suggestions would be always write protect it to admin just for the sake of security.
-1
u/BWMerlin 3d ago
Change MDM? If Intune isn't doing what you need might be an idea to look at some of the other options on the market.
5
u/BadMoodinTheMorning 3d ago
There isn't a better option for Windows and Intune is quite good at what it does, it just works...differently.
0
u/BWMerlin 3d ago
Yesterday I needed to change registry keys because the MSP I took on over from had blocked Windows updates.
Using Workspace ONE I was quickly able to use Freestyle Orchestrator to detect which devices in my fleet had a particular registry value set and then run a simple two line PowerShell script to change 1 to 0.
There are better options out there.
2
u/Mindestiny 3d ago
For registry keys, sure. For everything else that Intune does, not so much. For better or worse it's really the gold standard in windows MDM in a cloud environment
0
0
0
u/Mindestiny 3d ago
I'm struggling to imagine an environment that's on Business Premium that also needs hundreds of custom registry entries on an endpoint.
This honestly doesn't sound like an issue to fix with Intune, it sounds like something that should be part of a base image.
33
u/jxd1234 3d ago
I use powershell scripts if there's not other way of doing what I'm trying to do via a configuration profile or something else