master-client(-management)

Take Windows Up to 11

Category: Windows 10

Deploy and configure Lenovo Vantage with Microsoft Intune

When you decide to use Modern Client Management with Intune you have to do some things differently than in the classic onprem world. One key consideration regarding Windows Devices in a modern management scenario is the handling of drivers and BIOS updates.

You have four valid options:

  • Do not update drivers (not a good idea)
  • Create your own packages and deploy them as Application or Script
  • Let Windows Update for Business handle it
  • Use the hardware vendor tool

I would recommend to useone of the last two options or both in combination. I have been using the combination of Lenovo Vantage (f.k.a. System Updater) and Windows Update for several years and have gainedgood experiences with that.

Each major vendor of Business PCs provides such a tool and some are better than others. If you want to use the tool of the hardware vendor you have to be clear about the fact that this can be a security risk as Dell has shown here and here.

In this article I want you to show how to deploy and configure the Lenovo Vantage with Intune to your Windows 10 Lenovo devices using Microsoft Store for Business, Win32 applications, ADMX ingesting and Azure AD dynamic group memberships.

Create a dynamic group of Lenovo devices in Azure AD

In order to deploy Lenovo Vantage to all managed Lenovo Windows 10 devices create a new group in your Azure AD. Go to groups in the Device Management Portal or the Azure AD Portal and click on New Group.

Choose Group Type Security and a distinct Group name. The membership type should be dynamic (requires Azure AD Premium P1 or higher).

Azure AD create Dynamic group

Then select Dynamic device members, switch the slider to Advanced rule and insert the following

After a while all MDM Lenovo Windows 10 devices will show up in the group.

Add Lenovo Vantage to the Microsoft Store for Business and sync it to Intune

The Lenovo Vantage app can be deployed with Intune as Microsoft Store for Business (MSfB) App.

If not already in place you have to enable the sync between MSfB and Intune. How to do that is not part of this post but it is described here or here.

After you have done that go to the Microsoft Store for Business (MSfB) and search for the Lenovo Vantage app and click on the Get the App Button to add it to your company store.

MSfb Lenovo Vantage

After that head back to the Intune console and check if you can find it in Client apps – Apps. (If not select Client apps – Microsoft Store for Business and click on the Sync button and it should appear shortly afterwards.)

Intune Apps Lenovo Vantage

Click on the app, select Assignments and press the Add group button. Select the Assignment type Required and add the group you have created in the first part to the Included Groups. Click on the save button to assign the Lenovo Vantage app to all Lenovo devices enrolled in Intune.

Intune Apps Lenovo Vantage Assignment

Create and deploy a Win32 app for Lenovo System Interface Foundation in Intune

The Lenovo Vantage software consists of two parts. The first one is the App-X app deployed in the last section. The second part is the SystemInterfaceFoundation.exe which installs the Win32 software needed to interact with Windows on a system level.

First of all, you have to download the Lenovo Vantage sources for Large Enterprises and the Intune Microsoft Win32 Content Prep Tool.

Extract the SystemInterfaceFoundation.exe in a directory of its own from the ZIP file. Then start the IntuneWinAppUtil.exe.

In the window which opens insert the path to the folder containing the SystemInterfaceFoundation.exe as source folder. After that put in SystemInterfaceFoundation.exe setup file. The last value should be the directory where you want the output to be saved. This will create a SystemInterfaceFoundation.intunewin file in the output directory.

IntuneWinAppUtil

Now we have the source file for the Win32 app in Intune. Head back to the Intune portal and open Client apps – Apps and click on the Add button. Select Windows app (Win32) as App type and then click on App package file and upload the intunewin file created in the last step.

Add-App-IntuneWin

Enter a value for every field marked with a red asterisk in the App information menu.

Add-App-IntuneWin-Configure

In the Program menu enter the following install and uninstall command and select System for install behavior:

Add-App-IntuneWin-Program

Choose both OS architectures and Windows 10 1607 as minimum OS under Requirements.

Add-App-IntuneWin-Requirements

Add a Registry detection for the following key and choose Yes for the 32-bit application setting.

Add-App-IntuneWin-Detection

Then press the Add button at the bottom to save the application.

After the app is ready (this can take a while) click on Assignments and Add group. Select Required and the group from the first part and Save.

Ingest the Lenovo Vantage ADMX

Intune allows you to deploy and configure settings with custom ADMX files. As a first step we have to ingest the ADMX file so that the local configuration service provider recognizes the settings. If you want to learn more about ADMX ingesting check these articles out: TechCommunity, Blogs Technet or Peter van der Woude

In Intune go to Device Configuration – Profiles – Create Profile.

Intune-DevCon-Profile-Add

Give it a name like Lenovo Vantage ADMX select Windows 10 as platform and Custom as profile type. Then click Add button and insert the following values:

(The last three parts of the OMA-URI can be changed if liked.)

Select String as data type and copy the complete content of LenovoCompanion.admx (part of the Lenovo Vantage sources for Large Enterprises) to the value field.

Intune-DevCon-Profile-Admx-Ingestion

After that press OK and Save the profile. Click on Assignments and then on Select groups to include and choose the group with the Lenovo devices.

Configure Lenovo Vantage ADMX settings

After the deployment of the ADMX ingestion we are ready to configure the Lenovo Vantage software.

The last part of this article is to find the settings you want to set and insert them as a custom OMA-URI setting. This part is the hardest. You can use the policy console locally or in a domain to verify the settings by copying the ADMX and ADML file to the local (%windir%\PolicyDefinitions) or the central policy store (\<sysvol>\policies\PolicyDefinitions). Alternatively, you can use getadmx.com.

The custom OMA-URI must have the following format:

./Device/Vendor/MSFT/Policy/Config/{AppName}\~{SettingType}\~{CategoryPathFromADMX}/{SettingFromADMX}

I will give you an example: I would like to enable Critical Updates. The {AppName} and {SettingType} are already defined by the OMA-URI value used by ingesting the ADMX. In the configuration from above {AppName} = LenovoVantage and {SettingType} = Policy.

In order to get the {CategoryPathFromADMX} we have to find the setting ID. The easiest way is to search in the ADML

GPO-Find-setting-IN-ADML

The ID of the setting is 70E80D9F_37C7_4C93_8C68_3EB61E57D2EE and now we have to search the parent category in the ADMX file.

GPO-FindINADMX

The parent category is CAT_180BD888-5525-4C12-82CC-85AB86885844 and now we have to check if it itself has a parent category.

GPO-Find-category-IN-ADMX

Apparently, the category has another parent category, CAT_BEA4CF23_6B19_4DC7_9F10_2DDE18EA21B5 for which we have to search again

GPO-Find-Category-IN-ADMX2

This one does not have a parent and we finally have all data for the URI, which looks as follows:

./Device/Vendor/MSFT/Policy/Config/LenovoVantage\~Policy\~CAT_BEA4CF23_6B19_4DC7_9F10_2DDE18EA21B5\~CAT_180BD888-5525-4C12-82CC-85AB86885844/70E80D9F_37C7_4C93_8C68_3EB61E57D2EE

After that we are able to configure the setting. In Intune open Device configuration – Profiles and select Create profile.

Intune-DevCon-Profile-Add

Give it a name like Lenovo Vantage ADMX select Windows 10 as platform and Custom as profile type. Then click the Add button and insert the following values (Data type String):

Intune-Set-Admx-Setting

Press OK and Create to save the changes and then select Assignments to deploy it to the group we have created at the beginning.

If you open Lenovo Vantage on a managed device you should now see the Critical Updates option enabled and greyed out.

Vantage Updates

A Deployment Guide is included in the Lenovo Vantage sources for Large Enterprises. It has a section explaining which settings to disable in an enterprise environment and I used this as a baseline. I added two settings to enable Critical Updates and Recommended Updates and exported the configuration. I am using the scripts from @vanvfields to export and import the configuration to Intune.

Just download the Import-DeviceConfig.ps1 and save my configuration below as JSON file.

Then run the Import-DeviceConfig.ps1. It will ask you for your Intune Admin credentials in first step and then to grant permissions for the Graph API to Intune if not already present. Afterwards, you just need to insert the path of the JSON file and it will create the configuration profile in Intune for you.

Conclusion

This article shows how to deploy the Lenovo Vantage App event to Windows Autopilot devices and how to enforce its configuration on modern managed clients.

This information is provided “AS IS” with no warranties, confers no rights and is not supported by the authors.

Windows 10 1903 nice to know for IT Pros and Enterprise admins (curated link list)

Last Update: July 30, 2019

With the release of Windows 10 1903 I want to start a curated link list for every Windows 10 release. A place where I can store interesting articles about new features, settings or bugs. I plan to update with new content as soon as I find it.
If you find something new before me or if I missed anything important please write a comment or send me a message via Twitter.

General

Topic Description Source
What’s new for IT Pros New and Updated Features of interest to IT Pros Link
What’s new in WUfB What’s new in Windows Update for Business in Windows 10 Link
Release Status Known issues and notifications Link

Group Policies

Topic Description Source
New GPOs Group Policy Changes in Windows 10 1903 Preview Link
New GPOs New GPO settings in Windows 10 1903: enforce updates, Storage Sense, and logon Link
Security Baseline (Final) Security Baseline (Final) for Windows 10 1903 Link
Security Baseline 1903 Security Compliance Toolkit Link
WMI Filter Select Version,ProductType from Win32_OperatingSystem WHERE Version LIKE "10.0.18362%" and ProductType = "1" Link
ADMX Download of 1903 ADMX files Link
Start Menu crash Continue experiences on this device Group Policy setting kills the Start Menu Link

Autopilot, OSD, SCCM and MDT

Topic Description Source
WSUS category Windows 10 1903 has ist own WSUS product category, SCCM 1902 required to manage 1903 Link1 Link2
What’s new in ADK Changes to the ADK especially the known issues Windows SIM x64 error Link
Autopilot The latest news on Windows Autopilot Link
Autopilot Companion Example Companion App to change settings during White Glove deployments Link
Autopilot White Glove Windows Autopilot for white glove deployment Link
High CPU SCCM WoL Proxy High CPU consumption of SCCM wake-up proxy due to DHCP data storage changes Link

Apps

Topic Description Source
Apps, AppX Windows 10 1903 Built-In Apps: What to Keep Link
Builtin AppX Understand the different apps included in Windows 10 Link

MDM

Topic Description Source
What’s new in MDM What’s new in MDM for Windows 10, version 1903 Link
MSfB Apps not deployed Take Action to Ensure MSfB Apps deployed through Intune Install on Windows 10 1903 Link

Misc

Topic Description Source
Sandbox Enable Windows Sandbox on 1903 with and without PowerShell Link
Sandbox Configuration How to configure Windows Sandbox Link
Sandbox Mapped Folder If you use mapped folder in Windows Sandbox, note that the ReadOnly value should be in lowecase like “true” and not “True” Link
Run in Sandbox Run file in Windows Sandbox from right-click and Context menu Link
Reserved Storage Windows 10 and reserved storage Link
WSL What’s new for WSL in Windows 10 version 1903? Link
Provisioning error on Wi-Fi for AAD Known issue: Provisioning error on Wi-Fi for Azure AD joined Windows 10 version 1903 Link
HV DHCP Default Switch Hyper-V Default Switch not handing out DHCP addresses for VMs or Mobile Hotspot Link
SBS Essentials connector broken Windows 10 1903 feature update breaks the SBS, Essentials client connector Link
Always On VPN RASMAN service issue The Remote Access Connection Manager (RASMAN) service may stop with error “0xc0000005” Link

“Something went wrong” error when enabling Windows 10 facial authentication

Problem

When I was at a customer’s site lately and tried to enable the Windows Hello face recognition feature I encountered an error. After pressing the Get started button on the Windows Hello setup page Sorry, something went wrong was displayed without further explanations.

Windows Hello Setup
Windows Hello Setup Error

When I checked the Windows Event Log I could find a DistributedCOM error with the EventID 10016 which stated that the application did not have the local activation permission for the COM application.

Windows eventlog error DCOM

After that I looked up the APPID from the event in the Component Services and found out that it was the RuntimeBroker which controls the execution of the AppX(Universial)-Apps. Thinking about that I remembered that we had limited the access to the camera to certain AppX-Apps via Group Policy.

Component Services

I opened regedit as an Administrator and removed the value

HKLM:\Software\Policies\Microsoft\Windows\AppPrivacy!LetAppsAccessCamera

and tested again. Then it worked! So I just needed to find out which AppX needs access to the camera. I looked up the installed AppX with the PowerShell command:

Get-AppxPackage | select Name | sort

There it was the Microsoft.BioEnrollment_cw5n1h2txyewy AppX which looked like the app I was searching for. I reset my registry changes with a Group Policy update and added the AppX name to the value of:

HKLM:\Software\Policies\Microsoft\Windows\AppPrivacy!LetAppsAccessCamera_UserInControlOfTheseApps

Registry privacy camera

After that I tested again and it still worked to setup the facial recognition.

Camera working

Solution

Adding the AppX Microsoft.BioEnrollment_cw5n1h2txyewy to the Put user in control of these specific apps or the Force allow these specific apps fields of the Let Windows apps access the camera setting in the GPO under Computer Settings\Administrative Templates\Windows Components\App Privacy resolved the issue and users are able to use their face to authenticate on Windows.

GPO settings camera privacy

Windows 10 1803 ADMX Files SearchOCR error $(string.Win7Only) not found

Problem

Update 2: On 7/13/2018 Microsoft released Version 2.0 of the 1803 ADMX files without the issue
Update: Included feedback from @Jtracy_ItPro regarding multiple orphaned ADML files.

I just updated the Windows 10 ADMX files in the Central Policy Store of my lab domain with the Windows 10 1803 ADMX files. After that I got the error that the resource $(string.Win7Only) referenced in attribute displayName could not be found when accessing the Administrative Templates with the Group Policy Editor.

ADMX Error

I checked the mentioned searchocr.admx and the corresponding searchocr.adml file and found out that the modified dates differed by around three years (2015 and 2018).
Looking at the extracted 1803 ADMX files from the download revealed that they only include the SearchOcr.ADML files not the corresponding ADMX.

ADMX 1803

The c:\Windows\PolicyDefinitions folder of a running instance of Windows 10 1803 does not contain the two files.

Solution

Update 2: On 7/13/2018 Microsoft released Version 2.0 of the 1803 ADMX files without the issue

As long as I cannot find the 1803 version of the SearchOcr.admx I restored the old SearchOcr.adml file(s) from my backup and the error went away. Or even better remove the SearchOcr.ADML from every language that you want to import to the Central Policy Store.

@Jtracy_ItPro pointed out to me that the SearchOcr.adml is not the only orphaned ADML in the ADMX pack. The following list ADML files are orphaned in the 1803 ADMX pack as well

  • fileservervssagent.adml
  • microsoft-windows-geolocation-wlpadm.adml
  • microsoft-windows-messaging-grouppolicy.adml
  • searchocr.adml
  • terminalserver-winip.adml
  • userdatabackup.adml
  • wwansvc-admin-group-policy-data.adml

Any of these files can cause similar errors if you already have an older version of the ADMX and ADML in your Central Policy Store.

Therefore I wrote a small PowerShell function to find any orphaned ADMLs in a PolicyDefinitions folder.

You can use this function to find and remove any orphaned ADML before importing the files to the Central Policy Store