Intune

Customizing wallpapers and lock screens on company devices can significantly enhance your brand presence and ensure a consistent visual experience across your organization. For enterprises with Windows Enterprise licenses, this customization is straightforward using Intune’s Settings Catalog or local Group Policy Objects (GPOs). However, companies using Microsoft 365 Business Premium licenses face some limitations as these customizations aren’t directly available. Thankfully, there’s an effective workaround: deploying wallpapers using Win32 packages with Intune. This guide will walk you through the process of deploying custom wallpapers on Windows 10 and 11 devices using Intune and a prepared Win32 package. Why Use a Win32 Package? Using a Win32 package to set wallpapers offers several advantages: No Web Server Required: You can include your image files directly within the package, eliminating the need for external hosting. Flexibility: Easily update or change wallpapers by modifying the package. Control: Ensure that the wallpapers cannot be changed by end-users once deployed. Prerequisites Windows 10/11 Enterprise License: While this method can work on devices without Enterprise licenses, advanced customization through Intune’s Settings Catalog requires Enterprise. Admin Access: To deploy apps via Intune, you need administrative privileges within your Microsoft Intune portal. Step-by-Step Guide 1. Prepare Your Wallpaper Package I’ve created a PowerShell script to automate wallpaper deployment. You can find the script in my GitHub repository. Here’s how to customize it: Include Your Images: Add your desired image files (JPG or PNG) to the package. Ensure they are named appropriately and placed in the “Wallpaper” folder. Modify the Script: Open Install.ps1 and update line 5 with the correct name of your wallpaper image. Follow the structure shown in the example folder images: Image-1: Folder structure Image-2: Data Folder Image-3: Install script Image-4: Uninstall script Image-1: Folder structure Image-2: Data Folder Change the install script wallpaper image name as your retirements Image-3: Install script Change the uninstall script wallpaper image name as your retirements Image-4: Uninstall script 2. Convert the Package to a Win32 App To deploy via Intune, you need to convert your package into an Intunewin file using the Microsoft Win32 Content Prep Tool. Follow these steps: Download the Tool: Obtain the latest Microsoft Win32 Content Prep Tool. Run the Tool: Open IntuneWinAppUtil.exe. Provide Paths: Source Folder: Point to your package folder. Setup File: Specify install.ps1. Output Folder: Choose where the .intunewin file will be saved. Command: IntuneWinAppUtil.exe -c “Source file” -s “install.ps1” -o “Output-Destination” Image-5 3. Upload the Win32 App to Intune Now, upload the generated .intunewin file to Intune: Navigate in Intune: Go to Intune > Apps > Windows apps > +Add. Configure Basic Information: Enter the app name, description, and publisher. These are mandatory fields. Program Settings: Installation Command: %SystemRoot%sysnativeWindowsPowerShellv1.0powershell.exe -executionpolicy bypass -command .install.ps1 Uninstallation Command: %SystemRoot%sysnativeWindowsPowerShellv1.0powershell.exe -executionpolicy bypass -command .uninstall.ps1 Set the installation behavior to “System”. 4. Define Requirements and Detection Rules Requirements: Ensure all target devices are compatible. Detection Rules: Upload the script install.ps1 to verify if the wallpaper is correctly applied. 5. Assign the App Skip dependencies and supersedence configurations. Assign the app to the desired groups in your organization. Further Steps Follow the Images below Action Command Install Command  %SystemRoot%sysnativeWindowsPowerShellv1.0powershell.exe -executionpolicy bypass -command .install.ps1 Uninstall Command %SystemRoot%sysnativeWindowsPowerShellv1.0powershell.exe -executionpolicy bypass -command .uninstall.ps1 Successfully Implemented!!!  Result in Windows 10 Result in Windows 11 Thumbs up and follow my Linkedin: https://www.linkedin.com/in/nnifan/

Today, I faced a request involving a policy that was applied broadly across the organization to all devices. One user needed to be excluded from this policy. In this post, I’ll walk you through how I resolved the issue. The initial request was regarding a user who was unable to change the screen sleep settings, which were managed by an Intune policy. Because of this policy, users were unable to make any changes to the power management settings on their devices (refer to Image-1). Image-1: Screen Sleep Settings Managed by Intune Policy This policy controls power management settings, preventing users from changing computer and display settings on their own (refer to Image-2). Image-2: Power Management Settings We can’t simply edit this policy to exclude a device; instead, we need to use a feature called Filters. Filters allow us to target specific devices or exclude them from certain policies (refer to Image-3). Image-3: Using Filters in Intune Steps to Exclude a Device from an Intune Policy Using Filters Create a filter Sign in to the Intune admin center. Select Tenant administration > Filters > Create. Select Managed devices Image-4 Image-4: Creating a Filter in Intune 2. Define Filter Properties In the Basics section, enter the following details: – Filter name: Enter a descriptive name for the filter. For example, “Windows OS Version Filter”. – Description: Enter a description for the filter. This step is optional but recommended. – Platform: Choose the appropriate platform, such as Windows 10 and later (refer to Image-5). Image-5: Selecting the Platform 3. Create a Rule for the Filter In the Rules section, you can create a rule using the rule builder or manually entering the rule syntax. Using the Rule Builder: – And/Or: After adding an expression, you can expand it using “and” or “or”. – Property: Select a property for your rule, such as device or operating system SKU. – Operator: Choose an operator, like “equals” or “contains”. – Value: Enter the value for the expression. For example, enter 10.0.18362 for the OS version or “Microsoft” for the manufacturer. – Click Add expression after setting the property, operator, and value (refer to Image-6). Image-6: Rule Builder in Intune Using Rule Syntax: – You can also manually enter the rule expression in the rule syntax editor. Select Edit in the Rule Syntax section (refer to Image-7). Image-7: Rule Syntax Editor – The expression builder will open. Manually enter expressions, such as (device.osVersion -eq “10.0.18362”) and (device.manufacturer -eq “Microsoft”) (refer to Image-8). Image-8: Manual Rule Expression Image-9 4. Apply the Filter to the Policy After creating the filter, go to the Power Management Policy and edit it to include the newly created filter (refer to Image-10). Image-10: Adding the Filter to the Policy 5. Sync the Policy on the Device Go back to the device and sync the policy to apply the changes (refer to Image-11). Image-11: Syncing the Policy on the Device 6. Verify the Policy Update After the policy update, verify that the exclusion has been successfully applied (refer to Image-12). Image-12: Policy Update Verification I hope this guide helps you understand the process of excluding a device from an Intune policy using filters. Let me know if you have any questions 🙂