CCM LAB

 In this article, I’ll walk you through step-by-step creation of query-based device collections , along with ready-to-use queries for: Windows Server 2016 / 2019 / 2022 / 2025 All Servers Windows 11 (latest builds) Windows 10 versions Step-by-Step: Create Query-Based Device Collection Follow these steps in Microsoft Endpoint Configuration Manager console: 1. Open SCCM Console Go to Assets and Compliance Click on Device Collections 2. Create New Collection Right-click Device Collections Select Create Device Collection 3. General Settings Name : Enter collection name (e.g., Windows Server 2025 ) Limiting Collection :  use All Systems 4. Add Membership Rule Click Add Rule → Query Rule Provide: Name : e.g., Server 2025 Query Click Edit Query Statement 5. Add Query Go to Show Query Language Paste your query (from below sections) 6. Complete Wizard Click OK → Next → Close 7. Update Collection Right-click collect...

Recently, we needed to add some applications as Startup apps using Intune. In this article, I will show two approaches: Deploy normal applications using a shortcut Deploy Microsoft Store applications as startup apps using App ID 1. Deploy normal applications using a shortcut I'll take Google Chrome as an example. First, we need to identify where the Google Chrome application shortcut is located. For startup applications, the shortcut needs to be placed in the following path: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Script

Recently, I deployed a few accounts to the Local Administrators group on end-user devices through Intune . The path I used was: Endpoint Security → Account Protection → Local User Group Membership Since I only needed to add specific accounts without removing existing ones, I chose the “Add (Update)” option under Group and user action . However, on all  Hybrid Azure AD Joined  devices, the policy failed with  error code 65000 . Here’s why it happened—and how to fix it. 👇 Why Does the Error Happen When selecting users or groups directly from Intune’s "Select users/groups" option, the system maps them in the following format: AzureAD\test2@ccmlab.space, AzureAD\admin@ccmlab.space This format doesn’t establish a proper mapping between the user accounts and their security identifiers (SIDs) on hybrid-joined devices, causing the policy to fail. You can check the event logs end user device Event Viewer → Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provid...

During the SCCM Management Point installation, you may encounter the error that the SMS Notification Server is not installed. In this scenario, client's status will appear with a question mark. You may also try adding below lines to regsvcs.exe and InstallUtil.exe with their .config files by adding the following: <runtime>     <loadFromRemoteSources enabled="true"/> </runtime> However, this did not resolve the issue.  In the Component Status within the SCCM console, the SMS Notification Server status will appear as Critical and display a message similar to the one below. In the BgbSetup.log, you will see entries similar to the following.  Fatal MSI Error - bgbisapi.msi could not be installed In the BgbisapiMSI.log, you can see the following details. Product: BGB http proxy -- Installation operation failed  Windows Installer installed the product. Product Name: BGB http proxy. Product Version: 5.00.9128.1000. Product Language: 1033. Manufacturer...

When attempting to install Windows 11 feature upgrade via SCCM, you might notice that the update fails quickly, and under the “More Information” section, it shows the error code 0xC1900200 (-1047526912) . Additionally, you may observe that the update content is not downloading properly, and within a few minutes, the installation fails. I encountered this issue on several HP laptops and was able to identify the root cause and solution. The first step in troubleshooting should be reviewing the Panther logs , which can help pinpoint the exact blocker. You can find the Panther logs at the following location: C:\$WINDOWS.~BT\Sources\Panther Next, you need to check the XML files located in the Panther folder, as shown in the screenshot above. Look for the most recently created CompatData.xml file. This file corresponds to the latest SCCM feature update attempt that failed. Open this file using CMTrace , which makes it easier to read and highlight error codes or issues in a structured form...

How to Deploy Feature Updates Using Intune: A Step-by-Step Guide Microsoft Intune provides a streamlined method for managing Windows feature updates across your organization. In this guide, I'll walk through the essential prerequisites, policy creation steps, deployment, and monitoring process to ensure a smooth rollout of feature updates using Intune. 1. Verify Prerequisites Before you create a feature update policy, ensure the following prerequisites are met on the target devices: Device Enrollment : Devices must be enrolled in Intune, either as Microsoft Entra hybrid joined or Microsoft Entra joined . Supported OS : Devices must be running a supported version of Windows 10 or Windows 11 . Telemetry Settings : Devices must have the telemetry level set to Required . You can configure this via Devices > Windows> Configuration > Create Policy > Templates>  Device Restrictions > Reporting and Telemetry > Share Usage Data >Set as Required...

Can Intune Deploy Shell Scripts to Linux Devices? Yes! Just like deploying PowerShell scripts to Windows, Intune can also deploy shell scripts to Linux devices. In this blog, I'll walk you through the process of deploying shell scripts to Linux using Intune, making it easier to automate tasks and manage Linux endpoints efficiently. Prerequisites Before deploying a shell script via Intune, ensure the following requirements are met: 1. Intune and Microsoft Entra ID Your environment must have Microsoft Intune configured for device management. This setup enables secure enrollment and policy enforcement on Linux devices. 2. Linux Device Enrollment The Linux PC must be properly enrolled in Intune to receive policies and scripts. If the device is not enrolled, follow Microsoft's documentation on Linux enrollment in Intune. Deploying the Shell Script Once the prerequisites are met, follow these steps to deploy your shell script through Intune: Access Microsoft Intune Sign in to the ht...