When you decide to use Modern Client Management with Intune you have to do some things differently than in the classic onprem world. One key consideration regarding Windows Devices in a modern management scenario is the handling of drivers and BIOS updates.

You have four valid options:

• Do not update drivers (not a good idea)
• Create your own packages and deploy them as Application or Script
• Let Windows Update for Business handle it
• Use the hardware vendor tool

I would recommend to useone of the last two options or both in combination. I have been using the combination of Lenovo Vantage (f.k.a. System Updater) and Windows Update for several years and have gainedgood experiences with that.

Each major vendor of Business PCs provides such a tool and some are better than others. If you want to use the tool of the hardware vendor you have to be clear about the fact that this can be a security risk as Dell has shown here and here.

In this article I want you to show how to deploy and configure the Lenovo Vantage with Intune to your Windows 10 Lenovo devices using Microsoft Store for Business, Win32 applications, ADMX ingesting and Azure AD dynamic group memberships.

Create a dynamic group of Lenovo devices in Azure AD

In order to deploy Lenovo Vantage to all managed Lenovo Windows 10 devices create a new group in your Azure AD. Go to groups in the Device Management Portal or the Azure AD Portal and click on New Group.

Choose Group Type Security and a distinct Group name. The membership type should be dynamic (requires Azure AD Premium P1 or higher).

Then select Dynamic device members, switch the slider to Advanced rule and insert the following

After a while all MDM Lenovo Windows 10 devices will show up in the group.

Add Lenovo Vantage to the Microsoft Store for Business and sync it to Intune

The Lenovo Vantage app can be deployed with Intune as Microsoft Store for Business (MSfB) App.

If not already in place you have to enable the sync between MSfB and Intune. How to do that is not part of this post but it is described here or here.

After you have done that go to the Microsoft Store for Business (MSfB) and search for the Lenovo Vantage app and click on the Get the App Button to add it to your company store.

After that head back to the Intune console and check if you can find it in Client apps – Apps. (If not select Client apps – Microsoft Store for Business and click on the Sync button and it should appear shortly afterwards.)

Click on the app, select Assignments and press the Add group button. Select the Assignment type Required and add the group you have created in the first part to the Included Groups. Click on the save button to assign the Lenovo Vantage app to all Lenovo devices enrolled in Intune.

Create and deploy a Win32 app for Lenovo System Interface Foundation in Intune

The Lenovo Vantage software consists of two parts. The first one is the App-X app deployed in the last section. The second part is the SystemInterfaceFoundation.exe which installs the Win32 software needed to interact with Windows on a system level.

First of all, you have to download the Lenovo Vantage sources for Large Enterprises and the Intune Microsoft Win32 Content Prep Tool.

Extract the SystemInterfaceFoundation.exe in a directory of its own from the ZIP file. Then start the IntuneWinAppUtil.exe.

In the window which opens insert the path to the folder containing the SystemInterfaceFoundation.exe as source folder. After that put in SystemInterfaceFoundation.exe setup file. The last value should be the directory where you want the output to be saved. This will create a SystemInterfaceFoundation.intunewin file in the output directory.

Now we have the source file for the Win32 app in Intune. Head back to the Intune portal and open Client apps – Apps and click on the Add button. Select Windows app (Win32) as App type and then click on App package file and upload the intunewin file created in the last step.

Enter a value for every field marked with a red asterisk in the App information menu.

In the Program menu enter the following install and uninstall command and select System for install behavior:

Choose both OS architectures and Windows 10 1607 as minimum OS under Requirements.

Add a Registry detection for the following key and choose Yes for the 32-bit application setting.

Then press the Add button at the bottom to save the application.

After the app is ready (this can take a while) click on Assignments and Add group. Select Required and the group from the first part and Save.

Ingest the Lenovo Vantage ADMX

Intune allows you to deploy and configure settings with custom ADMX files. As a first step we have to ingest the ADMX file so that the local configuration service provider recognizes the settings. If you want to learn more about ADMX ingesting check these articles out: TechCommunity, Blogs Technet or Peter van der Woude

In Intune go to Device Configuration – Profiles – Create Profile.

Give it a name like Lenovo Vantage ADMX select Windows 10 as platform and Custom as profile type. Then click Add button and insert the following values:

(The last three parts of the OMA-URI can be changed if liked.)

Select String as data type and copy the complete content of LenovoCompanion.admx (part of the Lenovo Vantage sources for Large Enterprises) to the value field.

After that press OK and Save the profile. Click on Assignments and then on Select groups to include and choose the group with the Lenovo devices.

Configure Lenovo Vantage ADMX settings

After the deployment of the ADMX ingestion we are ready to configure the Lenovo Vantage software.

The last part of this article is to find the settings you want to set and insert them as a custom OMA-URI setting. This part is the hardest. You can use the policy console locally or in a domain to verify the settings by copying the ADMX and ADML file to the local (%windir%\PolicyDefinitions) or the central policy store (\<sysvol>\policies\PolicyDefinitions). Alternatively, you can use getadmx.com.

The custom OMA-URI must have the following format:

./Device/Vendor/MSFT/Policy/Config/{AppName}~{SettingType}~{CategoryPathFromADMX}/{SettingFromADMX}

I will give you an example: I would like to enable Critical Updates. The {AppName} and {SettingType} are already defined by the OMA-URI value used by ingesting the ADMX. In the configuration from above {AppName} = LenovoVantage and {SettingType} = Policy.

In order to get the {CategoryPathFromADMX} we have to find the setting ID. The easiest way is to search in the ADML

The ID of the setting is 70E80D9F_37C7_4C93_8C68_3EB61E57D2EE and now we have to search the parent category in the ADMX file.

The parent category is CAT_180BD888-5525-4C12-82CC-85AB86885844 and now we have to check if it itself has a parent category.

Apparently, the category has another parent category, CAT_BEA4CF23_6B19_4DC7_9F10_2DDE18EA21B5 for which we have to search again

This one does not have a parent and we finally have all data for the URI, which looks as follows:

./Device/Vendor/MSFT/Policy/Config/LenovoVantage~Policy~CAT_BEA4CF23_6B19_4DC7_9F10_2DDE18EA21B5~CAT_180BD888-5525-4C12-82CC-85AB86885844/70E80D9F_37C7_4C93_8C68_3EB61E57D2EE

After that we are able to configure the setting. In Intune open Device configuration – Profiles and select Create profile.

Give it a name like Lenovo Vantage ADMX select Windows 10 as platform and Custom as profile type. Then click the Add button and insert the following values (Data type String):

Press OK and Create to save the changes and then select Assignments to deploy it to the group we have created at the beginning.

If you open Lenovo Vantage on a managed device you should now see the Critical Updates option enabled and greyed out.

A Deployment Guide is included in the Lenovo Vantage sources for Large Enterprises. It has a section explaining which settings to disable in an enterprise environment and I used this as a baseline. I added two settings to enable Critical Updates and Recommended Updates and exported the configuration. I am using the scripts from @vanvfields to export and import the configuration to Intune.

Just download the Import-DeviceConfig.ps1 and save my configuration below as JSON file.

Then run the Import-DeviceConfig.ps1. It will ask you for your Intune Admin credentials in first step and then to grant permissions for the Graph API to Intune if not already present. Afterwards, you just need to insert the path of the JSON file and it will create the configuration profile in Intune for you.

Conclusion

This article shows how to deploy the Lenovo Vantage App event to Windows Autopilot devices and how to enforce its configuration on modern managed clients.

This information is provided “AS IS” with no warranties, confers no rights and is not supported by the authors.