Windows 11

Configuring the visibility of the Settings pages

by

This week is not about something new, this week is about configuring the visibility of the different Settings pages. The Settings app is the Windows application that provides a unified interface to manage the different system settings. Almost everything that was configurable in the old days via Control Panel, is now configurable via the Settings app. With some exceptions of course. The main reasons to make adjustments to the visibility of the different Settings pages, are to create a more controlled and secure environment. That can be especially useful for specific types of devices, such as kiosk devices and student devices. In those cases, limiting the access to different Settings pages can help with preventing unauthorized changes and maintaining a consistent user experience. The good …

Read more

Removing preinstalled Microsoft Store apps using native functionality

by

This week is all about the native functionality to remove preinstalled Microsoft Store apps. Very useful. When working with Windows devices in an enterprise environment, a common request is to control the preinstalled Microsoft Store apps. These default apps, which ship as part of the Windows image, often include consumer-oriented or redundant functionality that does not align with corporate standards. Removing these apps often requires custom scripting, or other creative solutions. Starting with Windows 11 version 25H2, however, there will be native functionality available to facilitate the removal of most preinstalled Microsoft Store apps. That enables the IT administrator to easily remove those preinstalled Microsoft Store apps. Those configurations are available via Group Policy and via Configuration Service Provider (CSP), enabling basically any deployment scenario. …

Read more

Easily getting started with Intune Management Extension as managed installer

by

This week is all about the latest addition to the ability to easily configure the Intune Management Extension as a managed installer on Windows devices. That addition is the ability to easily configure the Intune Management Extension as a managed installer for a specific group of Windows devices. Before it was already really easy to get started with the Intune Management Extension as a managed installer, but that was a tenant-wide configuration, meaning that it was immediately applicable to all Windows devices within the environment. And that now changed. That configuration can now be assigned to specific group of Windows devices. That assignment provides a lot more flexibility with introducing and testing the Intune Management Extension as managed installer. Eventually, that will make the introduction …

Read more

Installing Windows security updates during the Windows out-of-box-experience

by

Important: While writing this post the news came that this capability got delayed again to help ensure delivery of the best possible experience. As the configuration is still available in Microsoft Intune, this post can still provide value. This week is all about the new functionality to install Windows security updates during the Windows out-of-box-experience (OOBE). That functionality is focused on making sure that Windows devices are secure and up-to-date at the moment that the user will actually start using the device. At this moment, one of the main challenges is that organizations have to rely on the preinstalled Windows version on the device. That might not – and often does not – include the latest Windows security updates. This new functionality can help with …

Read more

Getting started with Windows Backup for Organizations

by

This week is all about the new Windows Backup for Organizations feature that has become available. The Windows Backup for Organizations feature is initially aimed at making it easier to transition from Windows 10 to Windows 11. Besides that, it also makes it easier to switch towards new Windows 11 devices and versions. At this point in time Windows Backup for Organizations can be used to preserve user settings and Microsoft Store app configurations. Especially the first part seems to have a lot of similarities with the already existing Enterprise State Roaming functionality. One might consider Windows Backup for Organizations as the on steroids version of Enterprise State Roaming. Where Enterprise State Roaming is really focused on the basics of the user experience, Windows Backup …

Read more

Managing the usage of personal Microsoft accounts in the OneDrive app

by

This week is all around managing and containing the usage of personal accounts with the OneDrive app on managed Windows devices. That is definitely not something new, but a recent change in notifications did trigger this post around the usage of personal accounts. Actually, it all started with an item on the public roadmap (490064). That roadmap item is about a new feature that will prompt users for using their personal Microsoft accounts with the OneDrive app, but only when a personal account is already signed in on the device. Of course, one might wonder if that’s a really good approach, but especially the latter part is important; the user will only be prompted when a personal account is already signed in on the device. …

Read more

Excluding specific files from being uploaded to OneDrive

by

This week is another relatively short blog post, again somewhat related to Microsoft Edge. This week, however, is about configuring some specific OneDrive configurations. More specifically, the focus will be on excluding specific files from being uploaded to OneDrive. Not something really new, but the importance became clear again this week. There can be many reasons why organizations might want to exclude specific files from being uploaded to OneDrive, but there are also some generic reasons that are applicable to most organizations. An often heard reason is related to desktop shortcuts. Synchronizing desktop shortcuts (or even shortcuts in general) often results in either duplicate shortcuts or shortcuts to missing applications. Another reason is related to organizational branding in Microsoft Edge. Customizing organizational branding relies on …

Read more

Protecting against typosquatting with website typo protection in Microsoft Edge

by

This week is a short post about website typo protection in Microsoft Edge. That subject was briefly mentioned earlier when discussing Enhanced Security Mode in this blog post about tightening browser security in Microsoft Edge. This week is mainly focused on awareness for website typo protection. Website typo protection is aimed at protecting users against typosquatting. Typosquatting is intended to hijack traffic of users that meant to visit well-known sites, but that made a spelling mistake. That hijacking is achieved by using addresses with common misspellings or typographical errors of those well-known sites. Often that is used as prank, ad, or (friendly) competition, but more and more often that is also being used for phishing and malware. In the latter cases, users will get to …

Read more

Getting started with Quick Machine Recovery

by

This week is all about a relatively new recovery functionality in Windows. And that functionality is Quick Machine Recovery, which is also known as Cloud Remediation. Quick Machine Recovery is focused on the recovery of Windows devices when encountering critical errors that prevent the device from booting. A huge strength of Quick Machine Recovery is that it can automatically search for remediations online and use that to recover from widespread boot failures. In practice that means that Quick Machine Recovery helps with addressing the most severe failures within the environment. The type of system failures that gets devices stuck in the Windows Recovery Environment (WinRE). The type of system failures that require significant troubleshooting time. And that’s especially challenging when it’s a widespread outage. Quick …

Read more

Blocking other browsers with policies for Microsoft Edge (be careful)

by

This week is all about creating awareness. Creating awareness for the configuration options that are available for Microsoft Edge via the Microsoft 365 admin center, also known as the Microsoft Edge management service. The Microsoft Edge management service is an alternative method, besides Microsoft Intune, for configuring the Microsoft Edge browser via the Cloud. The configurations are stored in the Cloud and the settings can be applied through a group assignment. The user must be signed into the browser to receive those settings, and the browser must be restarted to make new settings applicable. So, pretty similar to the capabilities within Microsoft Intune. Besides that, the Microsoft Edge management service also provides access to additional settings, such as organization branding, AI, and specific security settings. …

Read more