Patch My PC Blog
Get expert insights, how-to guides, product updates, and best practices for streamlining patch management, improving endpoint security, and optimizing IT operations.
The Intune Management Extension kept disappearing, and the device’s MDM certificate wasn’t renewing either.
While looking into the renewal process, I came across a registry key called ValidNodePaths. It turns out Windows can receive a replacement certificate from Intune but still refuse to install it. Here’s why.
What happens after you create a STIG audit policy in Intune? Follow the policy to Windows, see how the Device Inventory Agent runs the checks, and trace the results back to Intune.
A look at how Intune EPM appears to be moving beyond file elevation with a System Settings experience for Network Settings and Time Sync.
Windows Update now has its own Group Policy bypass. On supported Windows 11 builds, IgnoreWindowsUpdateGroupPolicies can skip the Windows Update GPO reader and continue with eligible MDM and other supported sources.
This blog explores a new Windows Insider feature aimed at fixing the Autopilot BitLocker 256 bit issue. We show how it delays encryption during OOBE, allowing 256 bit policies to apply during Autopilot Device Preparation, and what broke when we tested it
Microsoft Intune is improving Win32 app delivery with push notifications. Changes made by administrators or the service can now prompt devices to check sooner, reducing delivery and refresh delays without changing how you manage apps. Win32_Pull_vs_Push_Illustrated_… This blog follows the tested IC3 notification into the IME, showing how intent 2 selects Win32AppWorkload and brings the normal app check forward.
Required Win32 apps sometimes waited 60 minutes after Autopilot ESP completed. IME 1.103.101.0 introduces a FirstSync registry watcher that detects ESP completion and immediately triggers another app workload check in.
Intune App Inventory no longer has to wait for the regular four hour collection cycle. A new app install can now trigger detection, validation, a fresh inventory run, and a small delta upload within about five minutes.
Defender was running. Windows said it was off. Intune could then mark the device noncompliant, and Conditional Access could block the user. Here is how the startup race happened, what our PowerShell workaround did, and what we found when testing Defender 4.18.26080.4