UserRights Policy Deployment Using Intune | Group Policy Replacement

5
UserRights Policies Intune

You can use Intune to deploy security policies using out of box templates or Windows 10 custom policy CSP (UserRights Policy). In this post, you shall learn how to successfully deploy UserRights policies. Thanks to my colleague Mark Thomas to help me in fixing the issue.

Introduction

I checked Intune Administrative templates, Security baselines, and out of box Device restriction policies to find out options to deploy Windows 10 UserRights settings. I couldn’t find any out of box policies related to UserRights settings.

Administrative templates - Intune UserRights - UserRights Policy
Administrative templatesIntune UserRightsUserRights Policy

I have two options to deploy UserRights settings:

  • Group Policy if the device is domain joined or Hybrid Azure AD Joined
    • Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment. More details here.
  • Custom Windows 10 policy CSP using Intune for Azure AD joined devices. More details here.
Altaro Office 365 Backup
Advertisement Altaro Office 365 Backup

Custom Windows 10 Policy CSP

In this post, you shall take example of the specific policy CSP called:

  • “./Device/Vendor/MSFT/Policy/Config/UserRights/AccessFromNetwork

I’m trying to provide “access from network” access to two user groups called “Administrators” and “Remote Desktop Users“.

XML Format – First Try

I tried custom policy CSP using the Microsoft document recommendation here.

  • Created custom Intune policy CSP using – Data Type -> String (XML File)
UserRights -  String (XML File) - UserRights Policy
UserRights – String (XML File) – UserRights Policy
  • Sample XML for UserRights/AccessFromNetwork settings to add Remote Desktop UsersAdministrators ( note this symbol) groups
  <SyncML xmlns="SYNCML:SYNCML1.2">
<SyncBody>

    <Replace>
      <CmdID>2</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/
Policy/Config/UserRights/AccessFromNetwork</LocURI>
        </Target>
        <![CDATA[Remote Desktop UsersAdministrators]]>
      </Item>
    </Replace>
  <Final/>
  </SyncBody>
</SyncML> 

The Data Type string (xml file) policy CSP settings failed with following error:

Error Code - 0x87d101f4
Syncml(500). The recipient encountered an unexpected condition which prevented it from fulfilling the request 
UserRights Policy - Error 0x87d101f4
UserRights Policy – Error 0x87d101f4

String Option – UserRight/AccessFromNetwork

String XML file option to deploy policy CSP failed as you saw above. The next option is to try Data Type -> String with Windows 10 policy CSP.

I tried to look at GitHub thread here and use the following settings to deploy UserRight/ AccessFromNetwork policy CSP.

String Option - UserRight/AccessFromNetwork - UserRights Policy
String Option – UserRight/AccessFromNetwork – UserRights Policy

The above setting got successfully applied on the Windows 10 device but Intune shows an error -2016281112 (Remediation failed). This error details also explained in the above GitHub thread.

ASCII Value ( ) Issues with UserRights CSP

This is the option where my colleague Mark Thomas came to rescue. Mark helped me to FIX the Windows 10 custom policy CSP ASCII character related issue.

NOTE – This ASCII value ( ) mismatch is also discussed in GitHub thread here.

String Value to provide “UserRight/AccessFromNetwork” access to following groups:

  • Administrators
  • Remote Desktop Users

The following is the third and final options which was successful.

UserRights Policy OMA-URI Settings
UserRights Policy OMA-URI Settings

Policy CSP Settings Intune:

Name - UserRights/AccessFromNetwork
Description - User Rights
OMA-URI - ./Device/Vendor/MSFT/Policy/Config/UserRights/AccessFromNetwork
Data Type - String
Value - Remote Desktop UsersAdministrators

Results – UserRights Policy

The Windows 10 custom policy CSP successfully deployed without using group policy settings. Happy modern management!

UserRights Policy OMA-URI Settings - Results
UserRights Policy OMA-URI Settings – Results

Resources

5 COMMENTS

  1. Hi,
    where and how do I find the endpoint settings defined from Intune?
    For GPO, were the tools gpresults and rsop? Is there something similar for Intune?
    Thanks
    David

  2. Hi Anoop,
    I am trying to restrict few user groups from interactive login to AzureAd joined devices and was exploring UserRights/DenyLocalLogOn. I did give the objectID of the azure ad group in the string but it didn’t work. Have you tried this? Also, is there any other better way to handle this?

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.