Autopilot Hybrid Azure AD Join with Customised First Login Status

By -

Introduction

This is my flavour of deploying a customised HAADJ progress status, building on work by Joymalya Basu Roy's detailed article - https://joymalya.com/autopilot-hybrid-azure-ad-join-reworked-with-joy/.
The differences in my version are:
  • Not using Active Setup to run the HAADJ retry process or Splash Screen as I found this didn't work as expected and I didn't want to add a registry item to affect all future logins with a reboot from the HAADJ process.
  • Running the processes under the context of the SYSTEM account, but displaying status to the interactive user.
  • Avoid the HAADJ process running again after the initial success.
This provides a customised first login status which prevents the user from using the devices until Hybrid Azure AD Join from the Autopilot process. It's use is primarily for when the User ESP is configured to be skipped.

Files

This is my version of customised HAADJ which is built on work and guidance in blogs/articles from Michael Niehaus, Steve Prentice and Joymalya Basu Roy. You can use the files in the repository to create an Intune package for deployment as part of a HAADJ Autopilot Build
Files
You can download the files from here - https://github.com/benjaminjamesowens/AutopilotHAADJCustomUI

Things to Prep

How to Build

  • Amend the files as required
  • Run the makeapp.cmd to package files
  • Follow the instructions to in the Intune_Install_Commands.txt on how to configure the Win32 package in Intune/MEM
  • Target the package to be deployed to new device builds (note, I saw a good recommendation in Joy's blog from Tommy Nielsen saying "If you would like to exclude all the devices already deployed do the following. Go to the dynamic Autopilot group. Export members to csv. Create new group called “Autopilot devices until (enter your date)”. Import the members csv file. Then add this group to excluded on the win32 app package.)
  • Configure the app to be required during ESP in your deployment profile
How it Works
  • Deploys the package during device ESP which is essentially running the Deploy-HAADJOOBE.ps1 script which:
    • Copies the source files to the c:\ProgramData\HAADJOOBE\ directory
    • Creates a scheduled task called "Hybrid Azure AD Join Retry" which is set to run WaitForUserDeviceRegistration.ps1 (a modified version of Steve Prentice's script) which will:
      • Displays the Hybrid Azure AD Join Splash Screen by running the script Invoke-AADHybridLockOOBE.ps1 using ServiceUI.exe from MDT (credit to Joymalya Basu Roy on his script here). Using ServiceUI.exe means the process runs under the context of the SYSTEM account, but the splash screen is presented to the logged in user.
    • Keeps retrying the Automatic-Device-Join scheduled task until it's completed
    • Once successful, it deletes it's own scheduled task "Hybrid Azure AD Join Retry" so it doesn't run at every login
    • Determines the interactively logged in user and adds the toast notification to be displayed/run at their next login using the HKCU RunOnce key
    • Reboots the workstation





Comments

  1. obbysysadmin5 January 2022 at 17:00

    Hi Ben, thanks for your post. Do you know if this works with the Whiteglove approach? Thanks in advance.

    ReplyDelete
    Replies
    1. Ben Owens12 January 2022 at 14:14

      Hi, I haven't tried, but I imagine it will work. Microsoft state the device is re-sealed before the point at which domain controller connectivity is required. From my understanding, that means the HAADJ splash screen and background HAADJ process would occur when the user first connects to the corp network and logs in with their AD credentials.

      Can you please drop a comment with how it works out for you using the pre provisioned route?

      Reference - https://docs.microsoft.com/en-us/mem/autopilot/pre-provision#prerequisites

      "The device is resealed before the time when connectivity to a domain controller is expected, and the domain network is contacted when the device is unboxed on-prem by the end-user"

      Delete
  2. Brian C7 December 2022 at 14:54

    Windows 10 this works perfect, for Windows 11 it installs, the "pause" screen does not load, but the device reboots, and the toast notification triggers as expected. Have you seen this? Windows 11 21H2 is on my test device

    ReplyDelete
    Replies
    1. Ben Owens14 December 2022 at 09:03

      Yes, I have come across the same issue, but haven't spent time looking into it yet. I'm not sure what is happening there. May be a case of outputting a log file to see and what point is failing, and also trying to trigger the pause screen to see if it functions properly on Windows 11 anyway.

      Delete
    2. shocko19 February 2024 at 13:00

      I cam accross this and in my case the reason was as follows:

      ServiceUI.exe is looking for explorer.exe to inject into that session (i.e. the session that is hosting explorer.exe). In my case when the script runs from the TaskScheduler at user logon explorer.exe did not exist and was delayed most likely by the 1st sigin in animation that runs. I simply added retry/wait logic to the script that launches ServiceUI.exe to wait for explorer.

      Delete
    3. Ben Owens21 February 2024 at 21:50

      Interesting. So the modification resolve the issue for you. Would you mind sharing the modification you made? Thanks for your comment.

      Delete
  3. shocko25 January 2024 at 07:27

    I came accross this blog and it excited me. I'm getting mixed results though on Windows 10 21 and 22H2. The issue seems to be on some of my systems MahApps.Metro.dll will not load. Is this some dependancy that's missing? I have .NET framework 4.6.2 installed:

    C:\ProgramData\HAADJOOBE\bin> Add-Type -Path .\MahApps.Metro.dll
    Add-Type : Could not load file or assembly
    'file:///C:\ProgramData\HAADJOOBE\bin\MahApps.Metro.dll' or one of its dependencies. Operation is
    not supported. (Exception from HRESULT: 0x80131515)
    At line:1 char:1
    Add-Type -Path .\MahApps.Metro.dll
    + CategoryInfo : NotSpecified: (:) [Add-Type], FileLoadException
    + FullyQualifiedErrorId : System.IO.FileLoadException,Microsoft.PowerShell.Commands.AddTypeCo

    ReplyDelete
    Replies
    1. Ben Owens25 January 2024 at 23:12

      Interested to know more.

      You mention mixed results. Does it work on some Windows 10 21 and 22H2 but not others?

      Have you had it working in any? If so, which winver?

      Delete
    2. shocko26 January 2024 at 00:05

      So I have Windows [21|22] H2 [PRO|Ent] and some work fine and some throw that error. Pretty standard builds with .NET 4.6.2 on them. Can't figure out what's causing it.

      PS: This is great work. It's a shame MS would not take this idea and run with it and back in a cusotm OMA-URI capbilty to configure it

      Delete

Post a Comment

Popular posts from this blog

Assigning Windows 10/11 Enterprise Subscription Activation Licences to Hybrid Azure AD Joined Devices

By -
Image
Introduction Starting with Windows 10, version 1703, Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro to Windows 10 Enterprise automatically if they are subscribed to Windows 10 Enterprise E3 or E5. The Subscription Activation feature eliminates the need to manually deploy Windows 10 Enterprise or Education images on each target device, then later standing up on-prem key management services such as KMS or MAK based activation, entering GVLKs, and subsequently rebooting client devices. It’s important to note that the Windows 10 Enterprise subscription activation is designed to “step-up” a device from Windows 10 Pro to Windows 10 Enterprise. Therefore, your device is required to have a Windows 10 Pro license activated as a baseline. For Windows 10 Enterprise Subscription Activation to function, there a several prerequisites which need to be in place. This blog is aimed for organisations which have Active Directory on premises an...
Read more

Power Automate: Get first item in output

By -
Image
One of the most annoying things about Power Automate for me is when I am trying to use the output of a previous action and as soon as I click that dynamic content button, it pops my new action into a For Each loop. It does this because the previous action could have more than 1 item returned and this would clearly fail unless it was in a loop. But if you have used the Row Count or Top option in the proceeding action, or you know full well that only 1 item will return, it is nice to avoid bloating the flow with an unnecessary loop. There are a couple of way to do this: First function You can craft your filter expression so that the output is wrapped in the First function. This will tell Power Automate to only look at the first item. First(variables('Array')) Calling Index You can edit your filter expression to tell it which item from the source you want. Zero being the first item e.g. variables('Array')[0] Which one to use? I use the index and the main reason is due to...
Read more

De-selectable radio buttons - Power Apps

By -
Image
Introduction When creating a Canvas Power App you can choose from a large number of controls and specifically input controls designed to get information from the user. One of these controls is the humble radio button. This is a good control which provides possible options without requiring a user action. In comparison a dropdown would require the user to click to expand all of the possible options. Example radio button input One of problems with this control is the fact you cannot de-select it. Once an option has been chosen, you can change it but you cannot undo it. The post shows a way to make de-selecting possible in a Canvas Power App. One simple way to achieve this is to have a button or icon next to the radio button and its OnSelect property to be Reset(rdoButton). This is easy, but if there are many radio button controls, it could result in lots more controls on a screen or in an app. Power Apps recommends keeping under 500 for an app and 300 maximum per page. The followi...
Read more