Hi everyone it's Florian from IT-Connect, today we are going to continue to discover
Microsoft Intune since we'll see How do you run a PowerShell script on
Windows 10 or Windows 11 devices. We are going take a real case and maybe
that the script that I'm going to show you today, you are going to reuse it on your end since
Let's see how to set up an image of wallpaper and a lock image
using a PowerShell script on a machine Who uses Windows 10 Pro since like us
We saw it in the previous video, if we uses native policy settings
In Intune, we can't define these lock images and wallpaper on
machines with a Pro edition but only on Enterprise and Education editions. Grace
In PowerShell we will be able to bypass this limitation by going directly to modify the
Windows registry. Let's start by talking about script execution prerequisites
PowerShell via Intune while knowing that there is two types of scripts at the Intune level. There is
The ones we are going to see today, we really can Do all the actions we want and he
There are the so-called correction scripts, patches, that we will see in another video and who are
adapted to more specific scenarios. Now we are really going to use the script function
PowerShell in the sense that we can put behind in our script all the actions
that we want according to our needs, if Do you just have to have a code that has been tested
upstream. As for the prerequisites and the limitations, you should already know that you
You must have at least Windows 10 version 1709 or Windows 11, so in Pro, Education version
Enterprise, what you want except the edition family. Then you're going to need the
Microsoft Intune Management Extension, it's a component that will be installed on the devices
This installation is done automatically when you deploy your first application
via Intune or your first script. It is at know, but you don't have to do anything because
It will happen automatically the first time. Then you need devices registered in Intune.
and which are attached in Entra ID, i.e. devices directly registered in the
cloud or who are in hybrid mode one or the other. In any case, you need devices whose company
is owner. With regard to execution PowerShell scripts themselves, you have to
Know that the weight of the script should not exceed 200 kilo bytes, which the execution of the script will be
done automatically from the moment where the instruction will be retrieved by the Intune
extension. You don't need to log in at the machine, you don't necessarily need
Not restarting it either. Then with regard to The execution of the scripts, we have a timeout of 30
minutes. You should also know that if you deploy Win32 applications and scripts on a
same machine, Windows will first run the PowerShell scripts before installing
applications, which may be important in some cases. So much for the presentation
Overall, I encourage you to go for a walk also on Microsoft documentation, since
All of this is possible to evolve over time. At the level of Intune and Microsoft 365 services
In general, everything is going very fast and everything may change from month to month. Now
we are going to move on to the demo phase. First of all I'm going to start by showing you the script that
we are going to run on Windows devices. It's a PowerShell script that's been coded
We're going to say as if he were going to be executed via a GPO or manually on a machine. There is no
not necessarily any particularity related to Intune. The code behind, we're really going to put what
We want. In this case, we are going to do in How to configure the wallpaper image
the lock image of the Windows machine. For this, what we are going to do is already
define a wallpaper image URL, a URL Lock image, let's look for the images
on the web and we're going to store these images in the local directory that is here. Once we
will have copied these images, what we are going to do is go and edit the Windows registry. We go everything
first create this key in the Windows registry, We define the path of the key and then we go
create it here. We have a set of values at Define, we have three values for the wallpaper
three values for the lock screen. Each time, in the image pass and image URL
And we have the same for both types of background On the screen, we will use the correct variable for
refer to the image that is here. So much for Explain to you a little bit about the mechanics and they are
already known registry keys that we can exploit different methods and which will
allow you to configure the wallpaper. Once That the script has been created, we will be able to switch
on the Intune portal where we go Go to the device part then we will go down
in script and correction. Here we are going to switch to The platform script tab is a change
which was carried out quite recently by Microsoft. We are going to have it added and we are going to click
on Windows 10 and later. After we meet again A little bit as usual with a strategy
an application, we have an assistant, you go see that there are certain steps like the name
the description and then we see assignment here, these are the usual steps. We're going to start
by giving this script a name, for example Windows Pro, PS Script, Wallpaper and Screen of
lock, you can also put a description. On Then do next, you will have to select
The location of the script, let's go find On our PC the PowerShell script, I take
The one I just showed you and then we have several options at our disposal. The first
Option is to execute this script using the user identification information
connected, in other words do you want whether it is the user with their own rights
Who is running the script or is it at machine level. There we are going to put no since he
It has to be at the machine level since you have to have enough rights to go and write in
the destination directory for our images of wallpaper, but also to go and change the
register. Apply signature verification of the script, we are also going to put no since
our script has not been signed, a certificate code signing, there are a number of
prerequisites related to this function. Then we go Do next, you must assign this script to a
device group, we're going to add groups, I don't I'm not going to target all my devices, but only
The Win Pro PC group I assigned to My device that is on Windows 11 Pro
I have had it selected and I will go as far as At the end, we have checked and added, we check
That everything is ok, knowing that we can go back to all this configuration later, we can
even update the script if you want without touching the rest of the settings. We are going to do
add, the script does appear here in The script and correction part of my tenant
Intune. Once we've done that, he's going to You have to switch to the famous PC under
Windows 11 Pro to test the setup. Me Here is connected on the Windows 11 Pro machine
So what I'm already going to show you is that on this machine, I don't have the images of
Wallpaper I'm waiting for, so I'm going to go in these two points Windows, Web, Wallpaper
And here I have two new images that are coming When my PowerShell script has been run
In the same way, if we register it here in RegEdit, in CSP Customization
we see that it already exists, it will not necessarily be the case on all machines. I have already two registers that are there, but a certain number are missing, especially those that go
specify the path to the images to be used. This part should also change when
the script will have been executed. Starting from settings, what I'm going to be able to do is
Here go to Accounts, in Professional Access or school, and then I will be able to launch a
Synchronization to earn a bit of time. I'm going to sync, that's it
Now we are going to wait and without needing to restart from the moment when the
Synchronization will be done, we have Intune Management Extension that is present on the machine that will
Go get the script, put it on and run it locally with system rights and do all
the instructions that are present in my script. What is interesting to follow this
What happens live is to open the application CM Trace to read Intune Management logs
Expansion. We are going to open the log file which is present in the log folder, and we will be able to
see in real time what is going to happen. We're going see that at some point, Intune Management
Extension will fetch our script and execute it. All of this may take a while, this
sync story. In any case, we can Track exactly what happened from
this log that is updated in real time. Si we look at the logs, we can see
That we have the executor.exe agent that launched PowerShell and who initiated the execution of our script
PowerShell. We have all the traceability here. If I go into my PC, into the Windows disk
in the web folder, I should find my images. They are good here. Now
What I'm going to do is go do a little Turn on my register to see if there were any
changes. I do have the values that were added. Here, the URL to my wallpaper and
Here is the URL to my lock image. The status was set to 0, but this value is not
very important, it's more than consultation. Once this has happened, we can see
despite everything that the wallpaper was not modified. What I noticed is that he
The machine had to be restarted for it to be taken into account. So I'm going to restart this
Windows 11 machine and in principle, after reboot, I should have my new screen
lock and my new wallpaper. Already, we have the lock screen which is good
appeared. I didn't necessarily show you the image I planned to define, but I have
Repeated the same image as in the previous tutorial, in the Intune strategy. The image
that is hosted on blob storage at the of Azure. At the office level, I also have my
custom IT-connect wallpaper. We can see that our PowerShell script is not
executed. Subsequently, when the information will be raised, to Intune, when we go
click on our script, we can also follow up on the execution level. Like
We have for strategies and applications, we will have information on the status of the device
Here is this video just to show you How to run a PowerShell script in Intune
At the same time, we saw how set up a lock image or
wallpaper on Windows 10 or Windows 11 Pro, by setting up a few registry keys. Je
Put you in the description of the video the link for the complete tutorial on IT-connect.fr
but also the link to retrieve the script PowerShell for those who want to put it in
production or even test it. That's simply To do what I just showed you
So feel free to like this video, at Share it and I'll see you soon! Ciao