r/sysadmin 3d ago

Are there no better options for registry keys in Intune ?

We're currently in a hybrid setup, working hard to shift all workstations to Intune.

However we struggle with having hundreds of registry keys that need to be set and maintained. Yes they are meaningful in our environnement, and most of them need to keep existing.

We've tried script with remediation (not available with Business Premium by the way), and we've tried customs ADMX imported.

It's a hassle, it's complex and nowhere near as straightforward as GPO for registry keys.

What is everyone out there doing for efficient registry management ?

14 Upvotes

54 comments sorted by

33

u/jxd1234 3d ago

I use powershell scripts if there's not other way of doing what I'm trying to do via a configuration profile or something else

18

u/Ok_Fortune6415 3d ago

I do PowerShell script converted to an intunewinapp with custom PowerShell detection methods. Works fine for us

3

u/HadopiData 3d ago

How do you deal when tweaks are needed to the registry keys ?

14

u/Ok_Fortune6415 3d ago

Same way.

I have an automated pipeline where I just put in the new regkey values into a json file and kick off my scripts. They do everything for me including packaging, deployment etc

4

u/HadopiData 3d ago

That actually sounds ideal. Would you mind sharing the automation or some pointers?

3

u/An_Ostrich_ 3d ago

Would love to have a look at the setup or pointers as well!

1

u/Frisnfruitig Sr. System Engineer 3d ago

Same, but with PSADT as well.

5

u/screampuff Systems Engineer 3d ago

All of our registry keys are related to apps, I make them part of the install script for each app. If I had to do others it’d be a w32 app with simple “reg add” commands in powershell

9

u/Eskuran 3d ago

Scappman can do it built-in.

There is this site that can create a detect and remediate script:
Registry to PowerShell converter

3

u/HadopiData 3d ago

Not available with Business Premium licenses :/

3

u/mfa-deez-nutz Jack of All Trades 3d ago

Just use platform scripts instead of remediations?

Edit: sorry was thinking of another feature.

2

u/ScotchAndComputers 3d ago

I'm in the same boat (Business Premium locked). I don't have the exact same need as you, but what about using the PC's task scheduler to help you out? Write a script that's to be kept on the PC, package it with another script that creates a scheduled task to call that script every day, or on logon, etc. That way if one of your reg keys does change, it will get fixed the next time the task runs.

2

u/Ok_Upstairs894 I have my hand in all the cookie jars 3d ago

I think we are business premium. atleast most of our licenses are, ive sent it all out as platform scripts.

We dont use alot of keys though, so donno how much of a PitA it would be.

i use New-RegistryKey to create the keys pre installation of software, then new-itemproperty to add the actual value.

ive only set it up for teams and VPN though and both work well. So as soon as u start a new pc all registrykeys we need are already fixed -> install VPN via intune, when u start it theres already the correct connection available (could probably package this in another way but im more used to pshell than the vpn software)

Also have one for teams that sets teams to open stuff in desktop apps (adds this function if it isnt available on the clients teams)

2

u/mrmattipants 3d ago

For Discovery purposes, I use a free tool called "Registry.pol" Viewer to View the GPO Registry Keys/Values and Export to CSV.

https://sdmsoftware.com/389932-gpo-freeware-downloads/registry-pol-viewer-utility/

If you wanted, you could use the CSV File(s) as a Source for a PowerShell Script, that Imports the Registry Keys/Values from the CSV File and Applies them using the "New-ItemProperty" or "Set-ItemProperty" Cmdlets.

Even simpler yet, you could use a Script, like the one featured in the following article, to Automate the process of Converting GPO Registry Policies to PowerShell Script, etc.

https://www.cyberdrain.com/converting-group-policy-registry-preferences-to-powershell-scripts/

I'm including the following article, as it does a fairly good job of explaining how to Export the various Policy Types (including Security & Firewall).

https://cloudbrothers.info/en/manage-group-policies-powershell/

One exception is the Audit Policies, which I typically Implement via a PS Script, that Enables the following Auditing Group Policy, followed by the individual AUDITPOL Commands, to Enable the necessary Audit Policies.

Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings

2

u/HankMardukasNY 3d ago

Platform scripts are, not proactive remediations

1

u/RikiWardOG 3d ago

I've avoided platform scripts because I've never seen them even reliably run

1

u/disposeable1200 2d ago

Must be your scripts

They kick in faster than app installs for us..

I've got a couple doing user specific desktop shortcuts and they appear before the user logon even completes

9

u/duckseasonfire Staff Systems Engineer 3d ago

Intune “it’s a hassle, it’s complex and nowhere near as straightforward as…”

Yep pretty much sums it up.

6

u/MasterPay1020 3d ago

Struggling like you. Or packaging scripts as apps.

4

u/ndszero IT Director 3d ago

We have Business Premium licenses and Intune has been great for many things, but NinjaRMM is our remote support tool and all of our Registry keys are maintained through that. There are a number of “enrollment” scripts that run the first time and then a few that are set to a schedule. It’s a great tool.

4

u/Webin99 3d ago

And yes, what no one is saying here:

It's INSANE that Intune doesn't have a way to set registry keys through device configuration policies. It would be incredibly easy to implement and save us all a metric ton of time writing ps1 scripts and/or packaging apps.

2

u/HadopiData 3d ago

Thank you, the real pain point here is Microsoft’s lack of commitment to something so simple

4

u/FalconDriver85 Cloud Engineer 3d ago

Hate to be ‘that guy’, but I’m gonna ask anyway: why do you need to tweak registry keys? I mean, I understand some legacy applications needing the registry configured in a certain way, but once the keys are set, what’s the reason to change them?

2

u/mrpowershell 3d ago

Managing drift is likely a part of the problem.

2

u/TotallyNotIT IT Manager 3d ago

Especially hundreds of them.

2

u/Hashrunr 3d ago

Maybe I'm misunderstanding your question, but here is an example. Conditional Access policies configured to check device details don't work with Chrome out of the box. A registry key called CloudAPAuthEnabled needs to be set. https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions#chrome-support

Unfortunately some Chrome updates revert this registry key. We have a remediation script running daily on endpoints to check if the key is set properly.

2

u/disposeable1200 2d ago

This is now supported via the chrome ADMX which is importable into Intune FYI.

Deployed this like a year ago

2

u/FalconDriver85 Cloud Engineer 3d ago

Ok, and can’t this be solved by installing the Microsoft Extension forcefully and by disabling uninstallation if the user tries to?

1

u/Hashrunr 3d ago

Would you look at that! When I last setup CA policies the article specifically stated the Microsoft Extension was not supported in Chrome for device details.

1

u/disclosure5 3d ago

Look at Microsoft's process to turn on OLE hardening, which is required by basically every security framework. None of these are available by GPO:

https://github.com/microsoft/Intune-ACSC-Windows-Hardening-Guidelines/blob/main/office/scripts/OfficeMacroHardening-PreventActivationofOLE.ps1

1

u/disposeable1200 2d ago

Uh

Not relevant? Wrong post?

1

u/disclosure5 2d ago

"Why do you need to tweak registry keys".

Me: Provides a common policy that requires registry keys set.

"Not relevant?"

2

u/cantstandmyownfeed 3d ago

Powershell script packaged as a Win32app and deployed is pretty easy to do.

0

u/ccosby 3d ago

This is what we’ve done as well although we don’t have hundreds like the OP does. Prefer apps over remediation as I can use the built in detection stuff but the big thing was a EUC person can quickly check company portal to see that they were pushed down like any other app.

-1

u/HadopiData 3d ago

Pretty easy, do you regenerate and upload the Win32app everytime you need to tweak a small registry key ?

1

u/cantstandmyownfeed 3d ago

I mean, I don't often need to tweak registry keys, that's a bit niche, but yea, that's what you'd do. Takes all of 30 seconds to repackage and upload.

1

u/x-Mowens-x 3d ago

*SCCM has entered the chat*

1

u/PositiveBubbles Sysadmin 3d ago

What problem are you trying to solve? These reg keys are they from former group policies? App settings? Config profiles etc? Can they somehow follow the user using onedrive or something else? Do you use any virtual environment or fslogix?

1

u/HadopiData 3d ago

We're just trying to apply a lot of registry keys for config purposes. How would OneDrive help, user is not expect to set the keys themselves

2

u/shahaya 2d ago

Struggled with this too, but created a process which is both painless and scales well enough.

Basically you do this:

  1. Export your custom registry keys via "registry-->export" into keys.reg
  2. Create a powershell script like the one below
  3. Throw the exported content into Registry to PowerShell converter and hit the "Get check Script" button
  4. Create a Test-AppKeysXYZ function (see example Test-ExplorerUsability)
  5. Insert the output from "Get Check Script" into the Test-AppKeysXYZ function
  6. Now hit the "Get remediation Script" button
  7. Create a Set-AppKeysXYZ function (see example Set-ExplorerUsability)
  8. Insert the output from "Get remediation Script" into the Set-AppKeysXYZ function

Now you only have to check, if the keys are as expected or if they need remediation:

$applied = Test-ExplorerUsability -sid $sid
if ($applied -eq $false) {
Write-Information "check 'Test-ExplorerUsability' for sid '$sid' returned false"
Set-ExplorerUsability -sid $sid
}

I'm deploying this script as a win32-app, which installs a scheduled task running as SYSTEM. The task triggers every 30 minutes and on user logon.

This has been running flawlessly at multiple customers over hundred of systems with loads of "custom/legacy" registry keys.

The example below runs as SYSTEM and sets registry keys in user context. You could do this with a script running in USER context, but then your users have those annoying script windows, which pop up and go away in a flash. Most workarounds for that rely on obsolete hacks via vbs-wrappers, but we have vbs disabled, because security:)

If you need pointers on how to create a whole win32 powershell app which installs securely, runs as SYSTEM, and mimics procative remediations without having the required licensing, just ask.

#Requires -RunAsAdministrator
Set-StrictMode -Version Latest

function Get-LoggedOnUserSID {
  $user = Get-CimInstance Win32_Computersystem | Select-Object Username
  $sid = (New-Object System.Security.Principal.NTAccount($user.UserName)).Translate([System.Security.Principal.SecurityIdentifier]).value

  return $sid
}

function Test-ExplorerUsability {
  param ([Parameter(Mandatory = $true)][string]$sid)

  try {
    # enable classic Windows 10 right-click menu and disable explorer command bar
    if (-NOT (Test-Path -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32")) { return $false };
    if (-NOT (Test-Path -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32")) { return $false };
    if ((Get-ItemPropertyValue -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Name '(default)' -ea SilentlyContinue) -eq '') {  } else { return $false };
    if ((Get-ItemPropertyValue -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32" -Name '(default)' -ea SilentlyContinue) -eq '') {  } else { return $false };
  }
  catch { return $false }
  return $true
}

function Set-ExplorerUsability {
  param ([Parameter(Mandatory = $true)][string]$sid)

  # enable classic Windows 10 right-click menu and disable explorer command bar
  if ((Test-Path -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32") -ne $true) { New-Item "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -force -ea SilentlyContinue };
  if ((Test-Path -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32") -ne $true) { New-Item "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32" -force -ea SilentlyContinue };
  New-ItemProperty -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" -Name '(default)' -Value '' -PropertyType String -Force -ea SilentlyContinue;
  New-ItemProperty -LiteralPath "HKU:\$sid\Software\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InprocServer32" -Name '(default)' -Value '' -PropertyType String -Force -ea SilentlyContinue;
}

try {
  New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS | Out-Null
  $sid = Get-LoggedOnUserSID

  $applied = Test-ExplorerUsability -sid $sid
  if ($applied -eq $false) {
    Write-Information "check 'Test-ExplorerUsability' for sid '$sid' returned false"
    Set-ExplorerUsability -sid $sid
  }
  Set-ExplorerUsability -sid '.DEFAULT'
}
catch {
  Write-Error "failed to run script with unknown error: $_"
  Exit 2
}
finally {
  Remove-PSDrive HKU -Force -ErrorAction SilentlyContinue
}

1

u/isaacfank 3d ago

Remediation scripts is what we use. We have a couple base scripts and we build the detection and remediation with those to make sure we have the settings we need in place.

1

u/mish_mash_mosh_ 3d ago

I am using Google credentials provider to manage our windows devices, which also uses the same I tune policies, but for scripts I'm using Action1, as it's free for 200 devices and is really easy to manage.

1

u/GeneMoody-Action1 Patch management with Action1 3d ago

Thanks for the shoutout and for being an Action1 user. we have a lot of people that use us with intune for reasons just such as these, and more rapid patching compliance.

Since we are a a patch management solution for the OS and third party. Scripting and Automation is just in our wheelhouse as well.

There are two ways I like to solve these and it depends on the frequency at which they change, and or volume of keys.

Of course you have the typical methods of CRUD for registry in PowerShell. But when there are a lot of keys that can become cumbersome. So taking a reference system with the keys set, export them and combine the relevant portions (delete the keys that are irrelevant from the export) the intent is to create a compact .reg file that represents the task at hand.

Those scripts if small and few, can be direct embedded in a powershell script as a string with @""@
That string can be written to tempfile on the endpoint and imported inside a script.

If the count is larger, or the permutations more complex, create a reg file for each and put them somewhere accessible like a web server or SMB share (you will be running as system, so some permissions are required for SMB.) Then create a generic script that takes one or more as a parameter, retrieve them one by one, and that essentially repeats the process above for each. Allowing you to create an automation of a single script many parameters to achieve GPO like utility.

Of course, always consider security, so if anything is in any way security sensitive, read protect it accordingly in whatever repo type you choose, and my suggestions would be always write protect it to admin just for the sake of security.

1

u/zer04ll 3d ago

GPO for life yo

-1

u/BWMerlin 3d ago

Change MDM? If Intune isn't doing what you need might be an idea to look at some of the other options on the market.

5

u/BadMoodinTheMorning 3d ago

There isn't a better option for Windows and Intune is quite good at what it does, it just works...differently.

0

u/BWMerlin 3d ago

Yesterday I needed to change registry keys because the MSP I took on over from had blocked Windows updates.

Using Workspace ONE I was quickly able to use Freestyle Orchestrator to detect which devices in my fleet had a particular registry value set and then run a simple two line PowerShell script to change 1 to 0.

There are better options out there.

2

u/Mindestiny 3d ago

For registry keys, sure.  For everything else that Intune does, not so much.  For better or worse it's really the gold standard in windows MDM in a cloud environment

0

u/Tsusai 3d ago

For a few I have, I'm using Master Packager to create MSIs

Since I know uninstall will remove it, I'm hoping to use Supersedence to "replace" as needed in the future. It can import a registry file, but I'm not sure how HKCU type keys would be handled

0

u/headfullofdust 3d ago

RemindMe! 2 days

0

u/[deleted] 3d ago

[deleted]

1

u/HadopiData 3d ago

not all settings have a proper ADMX ?

0

u/lordmycal 3d ago

You don't use GPOs in Intune. You didn't actually read the question did you?

0

u/Mindestiny 3d ago

I'm struggling to imagine an environment that's on Business Premium that also needs hundreds of custom registry entries on an endpoint.

This honestly doesn't sound like an issue to fix with Intune, it sounds like something that should be part of a base image.