stephannn
commented
7 months ago the only current way seems to be OMA-URI: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-desktopappinstaller
Open Exordian opened 2 years ago
stephannn
commented
7 months ago the only current way seems to be OMA-URI: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-desktopappinstaller
Karl-WE
commented
2 months ago Good news. Winget ADMX backed policies made into Intune settings catalog. Can confirm that using OMA-URI or manual upload of the winget ADMX might fail. this issue is also covered here: https://andrewstaylor.com/2022/10/26/managing-winget-using-intune-and-admx-import/
Description of the new feature / enhancement
ADMX Ingestion [1] of the provided ADMX file fails due to constrains of Endpoint ADMX ingestion [2]
Registry keys within
Software\Policies\Microsoft\Windows\AppInstallerare not writeable. Therefore, the ADMX ingestion does not work.As we're going AADJ only and the MS Store does not really work with business accounts and is still enabled by default, we need to implement a cumbersome workaround.
[1] https://docs.microsoft.com/en-us/archive/blogs/ukplatforms/google-chrome-gpo-via-intune [2] https://docs.microsoft.com/en-us/windows/client-management/mdm/win32-and-centennial-app-policy-configuration
Proposed technical implementation details
Direct Endpoint integration would be the best option i guess. Add a new exception of a writeable registry key location to ADMX ingestion would be the second best option, but still requires the involvement of Microsoft outside the winget team.
Watching a second registry key location would be another (quite unclean) option.
Eventlog
Eventlog Errors
``` Log Name: Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin Source: Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider Date: 01/02/2022 14:01:33 Event ID: 404 Task Category: None Level: Error Keywords: User: SYSTEM Description: MDM ConfigurationManager: Command failure status. Configuration Source ID: (2FD40D97-DEA2-463C-918D-EE910BADD8E3), Enrollment Name: (MDMDeviceWithAAD), Provider Name: (Policy), Command Type: (Add: from Replace or Add), CSP URI: (./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/Microsoft/Policy/DesktopAppInstaller), Result: (Access is denied.). Event Xml: