Intune, SCCM, and the Intune client installer

Hello,
Was wondering if there is a way to prevent users from Installing the Windows Intune Client agent?
Scenario:
SCCM 2012 R2 with integrated Windows Intune subscription.  I have successfully enrolled an iPad and a Windows 8.1 computer.  I was then able to download and install the Windows Intune Client agent on my Windows 8.1 device which redirected my device
to being managed by Intune exclusively, and no longer via SCCM.  It also changed my System Center Endpoint Protection to Intune Endpoint protection.  The only way to get it back was to go to the Intune Management Console and retire the device, which
triggers an uninstall of the Intune client.  The good news is that it restored the previous information for the SCCM/Intune enrollment. However...
A significant and unfortunate side effect of this is that Endpoint protection was also removed as part of the Intune client uninstall leaving the computer without Anti-malware protection.
I would like to prevent this from happening for obvious reasons.  In a BYOD scenario the user will have the permissions locally to do this and given its the same subscription for Intune there doesn't appear to be a way to ensure they cannot.  
Am I missing something simple here?  
Thanks!

I guess a couple of data points:
- Enrolling a Win 8.1 system using OMA-DM for management by ConfigMgr via Intune does not provide additional anti-virus above or beyond the built-in Windows Defender
- Removing the Intune agent reverts the system back to using Windows Defender the same as it was before Intune was installed
So, I would say that first, this statement is inaccurate: "leaving the computer without Anti-malware protection". And, also, there's no difference between the two states of pre-Intune agent installation and post-Intune agent uninstallation from an AV perspective.
As for explicitly preventing the Intune agent installation, obscurity is probably the the only way to go at this point to my knowledge -- simply don't tell folks about it or how to find it.
Jason | http://blog.configmgrftw.com

Similar Messages

  • Why not jdeveloper creates the persistance unit and the session client and

    why you do not create the persistance unit (outside) and the session client and ...the interface and other required opjects automatically when I create the application or the project?
    why you are using symbols like AFD, JSF, JSP, JPA,.JEE...and tens more, why you do not use a meaningfull names of these process symbols.
    Thanks
    Ali

    Asalman,
    I'm quite happy the JDeveloper behaves the way it does. Why? Because in most of my scenarios I don't want to be driven in a particular direction of development. This my choice of development and I don't like tools that dictate this to me.
    --olaf                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

  • LogMeIn Deployment/Installer and the Persistent Client Install is Frustrating

    Every single time the installer runs, it installs the LogMeIn Client. This makes absolutely no sense at all. The Deployment/Installer is intended to be run on HOST systems. HOST systems -- by definition -- don't need the Client. You can suppress the display of the Client after the install by adding "FORCEDISPLAYCLIENT=0" to the command line for the MSI Installer (I use it in a batch file). The Client still installs, but it hides the install. That said,  so it's not really any use in solving the problem. What's even more firstrating is that if you manually remove the "LogMeIn Client" in the Start Menu (for All or individual users), it returns on the next reboot. Why install the Client and then persist in making sure it remains available to the HOST system users? This has been going on for at least two years, and so far nothing, nada, zilch, zip, bupkiss from LogMeIn on a solution. 

    One idea I had was to change the permission for the program so that even if a user clicked on it it wouldn't run, but that just produces another phone call, "Why can't I run this program? What's the password?". Come on, LMI! Do something about this!

  • SCCM and the Cloud

    Hello,
    I am reading several threads on SCCM
    in the cloud:
    intune:  http://www.microsoft.com/en-us/windows/windowsintune/pc-management.aspx
    Intune will not support that many devices and does not support server OSes at all. Also, ConfigMgr itself is not supported to run anywhere but on-premise.
    Several Customers and Consulting company have installed Intune:
    Aston Martin: 700 devices (including 180 Windows 8 Phones)
    Colliers : 1,400 employees
    It seems difficult for now to find customer which have a large environment…
    Our environment is 1000+ servers, 15000+ Desktops, 25000 employees...
    Any evolution within the last 6 months...
    Any MS document(s) stating something about the size of the environment to be supported with the cloud?
    Thanks,
    Dom
    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    Stand-alone Intune (according to marketing documentation) supports 7,000 devices and 5,000 users. It is not meant for large scale management and lacks many/most enterprise features included within ConfigMgr.
    ConfigMgr supports anywhere from 100 to 400,000+ devices.
    There is no cloud option for ConfigMgr and there is no public information on their plans to make such an option available in the future. IMO (and only MO), this will come soon but won't be cheap because of the back-end infrastructure required to support
    ConfigMgr: ConfigMgr is not a simple or small DB application (it's at the far opposite end of that spectrum) and it also pushes a lot of data around -- both the these are expensive in terms of cloud hosting.
    Thus, yes, there is somewhat of a gap for organizations looking for/needing the power of ConfigMgr but not wanting to host it on-prem.
    Jason | http://blog.configmgrftw.com

  • Sccm 2012 https workgroup client installation error

    Hello everyone,
    i got a problem workgroup client installation with PKI.
    My SCCM 2012 SP1 hierarchy is:
    sccm1.izmir.local = Primary Site Server, FSP, MP, SUP
    sccm2.izmir.local = MP,DP (internet FQDN is sccmextmp2.izmir.com)
    sccm3.izmir.local = MP,DP, Enrollment Point, Enrollment Proxy Point
    sccm4.izmir.local = Reporting Service Point, Application Catalog Web Service Point and Applicaiton Catalog Web Site Point
    All MP's and DP's IIS configured with Certificate and client has got certificate too.
    i'm using this parameters for installing workgroup client with PKI:
    ccmsetup.exe /source:D:\Client /UsePKICert /NoCRLCheck CCMHOSTNAME=sccmextmp2.izmir.com SMSSIGNCERT=D:\Client\sccm1.cert SMSSITECODE=TCP FSP=sccm1.izmir.local CCMALWAYSINF=1 CCMFIRSTCERT=1
    and my error is in the ccmsetup.log:
    <![LOG[MSI: Action 11:56:36: SmsSetClientConfig. Applies the configuration placed by SmsSetClientConfigInit and configures client framework.]LOG]!><time="11:56:36.673-120" date="02-11-2013" component="ccmsetup" context=""
    type="0" thread="5604" file="msiutil.cpp:314">
    <![LOG[MSI: Setup failed due to unexpected circumstances
    The error code is 80070002]LOG]!><time="11:56:36.719-120" date="02-11-2013" component="ccmsetup" context="" type="3" thread="5604" file="msiutil.cpp:300">
    <![LOG[MSI: Action 11:56:36: Rollback. Rolling back action:]LOG]!><time="11:56:36.907-120" date="02-11-2013" component="ccmsetup" context="" type="0" thread="5604" file="msiutil.cpp:314">
    <![LOG[File C:\Windows\ccmsetup\{59A0EA77-D28C-4286-83A6-04BB57B9CDD6}\client.msi installation failed. Error text: ExitCode: 1603
    Action: SmsSetClientConfig.
    ErrorMessages:
    Setup failed due to unexpected circumstances
    The error code is 80070002
    ]LOG]!><time="11:56:49.886-120" date="02-11-2013" component="ccmsetup" context="" type="3" thread="5604" file="msiutil.cpp:872">
    <![LOG[Next retry in 120 minute(s)...]LOG]!><time="11:56:49.948-120" date="02-11-2013" component="ccmsetup" context="" type="0" thread="5604" file="ccmsetup.cpp:8498">
    You got any idea?
    thanks..
    MCT

    Hi;
    yes i'm using last version of SP1 and applied that hotfix.
    By the way i fixed the problem but now i got anothers:) Now i have no errorst in ccmsetup.log. Client agent installed but in Configuration Manager Agent Client certificate:None and Connection Type: Unknown
    CertificateMaintenance.log
    MCT

  • SCCM and Windows Update Client Configuration

    Hello,
    I am in the process of migrating SCCM 2007 client over to a new SCCM 2012 R2 site.
    I deleted the AD site from 2007 and added it to 2012 and the client is pushed via Client Push. The client upgrades fine and things go well but
    I run into a little problem after the client is installed.
    Basically it seems to be an issue with how SCCM interacts with and controls Windows Update settings on the SCCM client.  I ran into a somewhat of a major issue that caused
    all (or many) of the newly upgraded clients to go the internet to download updates from Microsoft shortly after the move from the 2007 site and client upgrade to 2012. This was because the client (or at least the ones I checked) had their WU settings to “Always
    download and install” (or something similar). Obviously, expected  behavior with this setting, but the question is how did it get this way?
    Does SCCM control any of these settings?  I know it take over the WSUS settings, etc, but I didn’t think it does anything with the WU client itself.
    From my understanding the WU client settings are done via GPO (local or domain) or WU setting and SCCM does not control these settings.
    I’m not looking for you to solve the problem, because it’s quite tedious, I’m just hoping that someone can lead me in the right direction to find out what if any WU settings
    are controlled or changed by SCCM 2007 or 2012.
    Thanks
    Angelo
    Angelo

    Thanks for the extra info, Idan.  I should probably admit that I am an AD admin and SCCM is handled by someone else in my department.  My main issue with the LocalGPO is the Event 1096 corruption that causes all admin template settings to revert
    to defaults - currently happening on over 100 workstations in our environment.  100% of these problems are caused by LocalGPO corruption and nothing else.  And we will pursue resolution of this issue with Microsoft because we agree that resolving
    this problem is the primary goal.
    But for the sake of understanding:  We don't have any non-domain members that need to be managed by SCCM.  If we had a policy stating "no SCCM client configurations resulting in a LocalGPO file are to be implemented in production - all are
    to be done via Domain Group Policy," is it possible to eliminate the LocalGPO entirely?  Or will there always be a LocalGPO file regardless of whether or not there are settings visible from it in a gpresult report?  We would not need to match
    SCCM configurations in Domain Group Policy because we would not make any changes to the SCCM client resulting in a LocalGPO file at all.  The slow link detection is not of concern to us because none of these settings that would not apply in this case
    are SCCM-managed via LocalGPO (as far as I know): 
    http://blogs.technet.com/b/musings_of_a_technical_tam/archive/2012/02/27/gpos-and-slow-link-detection.aspx
    Another reason why I would prefer to do these settings in Domain Group Policy is that we have Advanced Group Policy Management installed in our environment, which is subject to our Change/Release process.  We can track the changes being made to clients
    much more easily when they are done via AGPM.  Any changes that we want to make via SCCM client could be tested first to see how LocalGPO is effected, and then those changes could be made via Domain Group Policy instead in production.
    Given this info, I'm still struggling to understand why it is recommended to implement anything via SCCM client configurations resulting in a LocalGPO file.  So far, the only compelling reason is that management of non-domain members is not possible
    via Domain Group Policy, but that doesn't apply to our environment.  Is it recommended mostly for ease of administration, so that an SCCM admin doesn't need to work with another tool (Domain Group Policy)?  Any extra reasoning for this recommendation
    that anyone can provide is much appreciated!

  • Net8 and Oracle8i PE Clients installation and docs

    I downloaded the O8iPE-Win98 package and can't find all the necessary docs like "Oracle8i Client Installation Guide" - not on Oracle websites, either, although references to it are found, even 404 hyperlinks.
    Do I need to order a CD? Pay a price? Been working on home network for 6 months getting nowhere. Please help, I am a starving mainframer trying to break in.

    I downloaded the O8iPE-Win98 package and can't find all the necessary docs like "Oracle8i Client Installation Guide" - not on Oracle websites, either, although references to it are found, even 404 hyperlinks.
    Do I need to order a CD? Pay a price? Been working on home network for 6 months getting nowhere. Please help, I am a starving mainframer trying to break in.

  • Performance Monitoring and the Web Client

    I am a project manager managing a large infrastructure upgrade with a migration of existing VMs.
    I want to understand how my current VM are performing and the tool I have is the vSphere Web Client 5.1.
    I want to get more trending data on disk I/O and Network use.....I cannot get this data with this tool.
    I do not have access to the host to run the command line tools.  What can I do?  I also do not want to buy VCOPs either.

    Hello dfery123,
    Have you tried Monitoring Inventory Objects with Performance Charts (vSphere 5.5 Documentation Center - Monitoring Inventory Objects with Performance Charts)?
    Regards,
    Todor

  • Where do I find the Oracle Client installation for HPUX

    I thought I could install the Oracle Client on my HPUX Itanium server from these zipfiles:
    hpia64_11gR2_database_1of2.zip
    hpia64_11gR2_database_2of2.zip
    But, after unzipping them, I'm not locating "clientadmin.rsp" which I was expecting to find in the binary distribution.
    The only .rsp files I'm finding are these:
    ./database/response/dbca.rsp
    ./database/response/netca.rsp
    ./database/response/db_install.rsp
    Is the install media for Oracle Client going to found somewhere else? I'm having quite some difficulty locating it.
    Locating the "Instant Client" was easy, but that's not what we're trying to accomplish here. We want to run the "Administrator installation of Oracle Client".
    Any help is, of course, greatly appreciated.
    Thanks!
    ...Chuck...

    It seems that my concern is that I haven't got the correct binary (zip) files yet. After extracting BOTH files I'm left with the following, top-level structure:
    $ pwd
    /home/szpqw7/11gR2Client/database
    $ ll
    total 80
    drwxr-xr-x 12 root sys 8192 Dec 16 09:41 doc
    drwxr-xr-x 4 root sys 8192 Dec 16 09:41 install
    drwxr-xr-x 2 root sys 96 Dec 16 09:41 response
    drwxr-xr-x 2 root sys 96 Dec 16 09:41 rpm
    -rw-r--r-- 1 root sys 7046 Dec 16 09:41 runInstaller
    drwxr-xr-x 2 root sys 96 Dec 16 09:41 sshsetup
    drwxr-xr-x 14 root sys 8192 Dec 16 09:41 stage
    -rw-r--r-- 1 root sys 5386 Dec 16 09:41 welcome.html
    $
    As you can see, there is no "client" directory there. What binary should I be looking for that would contain the folder you are suggesting??

  • CSA: How to properly backup the CSA Client Installation on a user pc?

    Hi,
    coming from the backup side of things my question is: "How to successfully backup the csa client files on a pc?"
    Currently when running the nightly backup i am running into the problem that access to certain csa files is denied.
    E.g.:
    11/11/2008 03:01:04 ANS1228E Sending of object '\\pc06\c$\Programme\Cisco Systems\CSAgent\cfg\agent-api.orl' failed
    11/11/2008 03:01:04 ANS4007E Error processing '\\pc06\c$\Programme\Cisco Systems\CSAgent\cfg\agent-api.orl': access to the object is denied
    11/11/2008 03:01:04 ANS1228E Sending of object '\\pc06\c$\Programme\Cisco Systems\CSAgent\cfg\agent-com.orl' failed
    11/11/2008 03:01:04 ANS4007E Error processing '\\pc06\c$\Programme\Cisco Systems\CSAgent\cfg\agent-com.orl': access to the object is denied
    and like 20 more files.
    Whats the proper way to backup a client including csa. Obviously i can't make my TSM client shutdown the service and then fill out the captcha which protects it.
    What would be the correct way to configure CSA properly to allow us to make a backup of the full machine. I guess we are not the only ones backing up full systems. ;)
    Thanks in advance for any hints.
    Best regards,
    Eike

    I would start by looking at your policy/rule modules to see what is blocking the backup process to "backup" those files.
    If your CSA policy is actually doing the blocking, you should be able to create the exception(s) to give the process/user/etc. the ability to access the CSA agent files for backup.
    Depending on the CSA policy you are running, the CSA agent protects itself from attack.

  • Radius and the Novell Client

    Is there any capability for the Novell Client to use radius authentication.
    We're putting in Cisco Clean Access and we'd like a pass through
    authentication. Clean Access already uses LDAP/eDirectory for
    authentication. We're not crazy about using Secure Login as that has seen
    more than afew issues for us.
    Any ideas? Perhaps a BorderManager widget somewhere?

    > Is there any capability for the Novell Client to use radius authentication.
    >
    And what has thid got to do with Queue-based printing?? ;)
    Try the client forum.
    - Anders Gustafsson, Engineer, CNE6, ASE
    NSC Volunteer Sysop
    Pedago, The Aaland Islands (N60 E20)
    Novell does not monitor these forums officially.
    Enhancement requests for all Novell products may be made at
    http://support.novell.com/enhancement
    Using VA 5.51 build 315 on Windows 2000 build 2195

  • Troubleshooting InTune, SCCM, and Windows 8.1 Phones

    Howdy...
    I've setup various components but when I use my Windows 8.1 Samsung phone "Workplace Account" feature, the phone gets stuck on "We're looking for your settings...", it will stay on this for 15+mins if I let it.
    What can I do for further troubleshooting?
    Here are my components used:
    InTune Trail Subscription
    Verified to use my public domain via the custom TXT DNS record
    UPN settings configured (UPN = public email format = [email protected])
    Single Sign On into InTune admin console and user portal configured via ADFS
    Logon tests from a PC are successful internally and externally into the admin console and user portal
    Used DirSync on Win2012r2 to sync my AD to the Azure cloud - works fine
    ADFS servers (and DirSync) on 2012r2
    ADFS Web Application Servers on 2012r2
    System Center Configuration Manager has Intune Subscription configured
    System Center Configuration Manager ha the trail certificate, InTunes role installed, and distro.point set to manage.microsoft.com, and trail apps that came with trail certificate
    ...note sure if I've forgotten anything - definitely not the easiest thing to get working!!
    I've also done a packet capture from the firewall - they (firewall company) have ruled out their device as the problem.
    I've been using a few URLs to help,
    this is one of them

    The Microsoft Intune team has confirmed this was an issue.  The temp solution was to disable a checkbox in my ADFS server...  In a few weeks I will call back on my ticket and see if there is a better solution, otherwise this is the only thing I
    could do.
    ADFS Server > ADFS Console > Authentication Policies
    Global Settings > Edit
    Primary Tab > Uncheck "Enable Device Authentication"
    Microsoft Tech Support Comment:
    I am confirming the only known solution, which is a short term workaround being suggested by the PG/engineering, which is to Disable device auth properties check box on ADFS side.
    The long term solution is already well underway and in testing by the Product team and should be released in the upcoming weeks. 
    Public facing documentation for this issue should be available soon but we do not have a specific date.

  • APP V 5.0 configuration with SCCM and APP V Client Settings

    Hi All
    If some one is already worked on APP V 5.0 server and client setup kindly  provide me complete details of APP V 5,0 sp2 installation instructions of client and management server, publishing and SQL server. I have a requirement of to publish the application
    through APP V 5.0  management server to citrix server. Our envrionment is based on citrix. So I need a clear information of setting up the server and publishing the app v client on citrix server.
    End to End details. We have 140 citrix servers in future mode here is the requirement. In the current environment we have 80 citrix server and we have one admin security group and another one is user security group. In the User security group we had added all
    the domain users and publishing to the citrix servers.
    Can we configure SCCM with citrix server?
    Example : We need to publish one single application (APP v 5.0) in All the citrix servers in single instance.
    If yes possible then what would be procedure to configure and what would be app v client settings.
    Regards,
    Deepak Kumar

    Google or Bing is your friend in this situation. What version of XenDesktop\XenApp?
    You should be able to figure it out with these resources and more. There's many blog posts too..
    Deploying App-V 5.0 with XenDesktop 7 and XenApp 6.5
    http://blogs.citrix.com/2013/10/31/guide-for-deploying-app-v-5-on-xendesktop-7-and-xenapp-6-5/
    An hour long step by step video:
    https://www.youtube.com/watch?v=q_JpUP_fqYQ
    SCCM 2012 Citrix Connector
    http://www.citrix.com/content/dam/citrix/en_us/documents/partner-documents/citrix-xenapp-65-sccm-2012-connector-sp1.pdf
    PLEASE MARK ANY ANSWERS TO HELP OTHERS Blog:
    rorymon.com Twitter: @Rorymon

  • JCA and the common client interface

    Hi.
    (I may have posted this question in the wrong forum but, this seems to be the most active and more likely to atract the opinion of a few experienced developers)
    I wanted to ask the opinion of some of the more experienced developers... preferably those who have had experience integrating heterogeneous EIS/data sources into a common portal.
    This concerns Sun's JCA specification (available at: http://java.sun.com/j2ee/connector/index.jsp), particularly the CCI (common client interface) - chapter 15 - which defines a set of interfaces which EIS providers should support.
    Has anyone made any effort to upcast SAP interfaces to these 'standardised' interfaces?
    If so... are there any limitations/additional complication which other developers need to consider if they wish to employ this practice?
    If Not... Does this not defeat the objective of the JCA?

    Asalman,
    I'm quite happy the JDeveloper behaves the way it does. Why? Because in most of my scenarios I don't want to be driven in a particular direction of development. This my choice of development and I don't like tools that dictate this to me.
    --olaf                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

  • Pressed 'Install Lion' on existing copy of lion and the new Lion Installation started. I have cancelled it. Now, will it reformat (and so remove) all the files or will it replace the lion files only, leaving my files alone if I continue?

    Hi
    I wanted to reinstall the existing copy of lion on my Macbook Pro, leaving my files alone. So I started the Lion Installation and I thought that after the mac reboots, the window will pop-out asking what I want to do. It didn't however and it started new lion installation after which I immediately aborted it. My question is: Will my files stay untouched if I carry on installing?
    Thanks for the answers in advance.

    The Lion installer won't ask you if you want to repair. If you boot into the Recovery HD you can then select to reinstall Lion, which willl reinstall the Lion files but leave your Home folder alone. If you want a clean install, then from the Recovery you can open Disk Utility to wipe the Lion partition and then use the transfer function to retrieve your data from your Time Machine backup.

Maybe you are looking for