You can know if your device is registered in Intune by checking if you have the program Company Portal.

You can check this by clicking on the Windows home button. At the letter 'C' you can look for the program Company Portal.

If you have Company Portal on your device, then your device is registered in Intune. When you don't have this program, then your device isn't registered in Intune.

---

Microsoft Intune is a cloud-based service for mobile device management (MDM) and mobile application management (MAM). Specifically, this means that:

• devices registered in Intune can be easily and remotely managed by DICT.
• it ensures a necessary inventory of all active devices, which helps secure the UGentNet.
• Intune makes it easier to keep the operating system up-to-date, activate additional security and install certain apps by default.
• you can log in faster when working outside UGentNet.

---

DICT is fully committed to Microsoft Intune to start managing all professional laptops and desktops centrally and flexibly. This way, these devices - and the UGentNet - will be extra secure.

The existing system for installing Windows PCs is gradually being phased out. A small impact for you, a big improvement for the security of the devices at UGent.

---

Apart from the additional security of the UGentNet, Intune management does have other benefits for end users such as:

• it is easier to keep the operating system up-to-date via Intune.
• certain apps are installed by default.
• easily install additional software via the company portal.
• easier backup and restore when upgrading to a new device.
• faster login when working outside UGentNet.
• additional and more secure login options via Windows Hello.
• encryption of the local disk with Bitlocker is activated by default.

---

The registration in Intune of devices already in use is done via the local system administrators. Initially, this is done when such a device is brought in for repair or upgrade.

Thanks to Intune, "zero-touch delivery" is now possible for the purchase of new devices. Your new laptop is then "UGent-ready" and ready to use upon delivery. 

For some organizational units, there is no local IT administrator, or the on-site IT administrator could use additional assistance. In such cases, the ICT Department is happy to help you as much as possible under the formula 'SOS Intune'. If an additional SOS Intune intervention is planned, you will be informed by your organizational unit. More info: https://helpdesk.ugent.be/intune/en/intune-faq.php#SOS-Intune--objectivesroadmapbenefits 

---

Thanks to Intune, "zero-touch delivery" is now possible for the purchase of new devices. Your new laptop will then be "UGent-ready" and ready to use upon delivery. Anyone ordering a new laptop or desktop with standard configuration today via the Dell Premier catalogue will therefore automatically receive Windows Autopilot and Windows 10 Pro, at no extra cost.

Those not opting for a standard configuration and putting together their own Windows device should select Windows Autopilot and Windows Pro when ordering, so that such a device can also be registered in Intune. This way, your device will also be assured of the security that Intune offers.

Under "Windows AutoPilot", choose "AutoPilot" and also enter the UGent "Tenant ID" and "Domain":

Tenant ID:
d7811cde-ecef-496c-8f91-a1786241b99c

Domain
ugentbe.onmicrosoft.com


 

---

A new device purchased from Dell with Windows Autopilot and Windows Pro can be installed and set up as required yourself without intervention from DICT or your local system administrator.

To do this, you first go through a short wizard and then log in with your UGent e-mail address. Intune immediately goes to work configuring your device and installing the necessary software. In principle, you can start working with your device right away, although it is advisable to wait until Intune is completely ready (usually takes an hour). After that, you can use the Company Portal to install additional software yourself.

---

For the software that is installed by default on Intune-registered devices, we apply the As Default As Possible (ADAP) principle. Thus, no laundry list of modules, plug-ins, backgrounds and fonts are installed. The user does not have to make any (or as few as possible) choices beforehand. The name of the device is chosen automatically and by default the language is set to English (this can of course be changed afterwards).

Software is divided into the following categories:

• Basic (Windows and standard office software such as browser, Office 365 package and Adobe Acrobat Reader DC)
• Company Portal (collection of all UGent-licensed software and other commonly used packages)
• Free (own installation, for which end-user/department has a licence or free software)

---

Or will I then always have to ask permission from my system administrator for that?

The policy on this does not change with the introduction of Intune. So end users will still be able to install software themselves on their devices. Intune makes this even easier, as end users will have default administrator rights on their own device.

So installing software of your own choice remains possible, but as before, DICT cannot offer any support or guarantees for this. Software considered suspicious or malicious by security software cannot be installed. Moreover, end users must make sure they are in order with any licence terms.

 

---

I also use my laptop at home for non-work related things. Do system administrators get visibility into my private files and apps after registering my laptop in Intune?

With Intune, there is no way to get visibility into the data stored on the device. 

Some system administrators at DICT (systems management and security teams) will be able to get visibility into what applications are installed on a device via the Intune dashboards (namely those of Defender ATP). This will be used exclusively to ensure proper operation, security and compliance with device licensing policies.

To provide support, tools such as AnyDesk will allow DICT to take over systems remotely, but always only after the end user has given explicit permission via the tool and only for the duration of the session.

---

Intune provides automatic backup of files in the Desktop, Documents and Pictures folders to OneDrive-for-Business. But what about my private files, for example when I leave UGent?

That automatic backup is recommended by Microsoft as a best practice and has a number of advantages for end users. As an end user, you yourself are responsible for good data management, both on the device and on the (cloud) storage offered by DICT. In the interest of end-user privacy, DICT recommends keeping professional and private data clearly separated.

To make that distinction unambiguous and crystal clear, it is best for end users to store private data on, for example, a personal OneDrive account, rather than on the OneDrive-for-Business account provided by UGent.

---

Contact your local system administrator. If your device has become completely unusable, for example because it has been infected with malware, they will contact the DICT service desk for advice and/or further investigation, recovery and registration in Intune. 

---

Adding the Ricoh printer
More info on: Copiers and Printers: Ricoh (ugent.be)
Direct link for Intune devices: Microsoft Word - Printers_Ricoh.docx (ugent.be)

---

Adding the network drives
More info on: Mounting network drives (ugent.be)
Direct link for Intune devices: Microsoft Word - Intune_Netwerkschijven.docx (ugent.be)

---

The list of device platforms with Intune support is increasing day by day. The types of device platforms which can be enrolled are as follows:

1. Windows
2. Android
3. iOS/iPadOS
4. macOS
5. Linux

---

If any data still needs to be backed up, because your device will be wiped for first Intune registration, you can do so in accordance with these instructions:

https://helpdesk.ugent.be/intune/backup_EN.pdf

---

For an instruction regarding first use of Intune registration of your device please refer to this page:

https://helpdesk.ugent.be/intune/en/intune-ootb.php

---

There are 2 methods to keep your bookmarks/ favourites. You could export them to an HTML file and import that file after the registration in Intune. You could also login to your web browser and sync your bookmarks/ favourites to your profile.

Google Chrome

• Export and import an HTML file
• Login and sync
• PDF guide Chrome

Mozilla Firefox

• Export to an HTML file
• Import from an HTML file
• Login and sync
• PDF guide Firefox

Microsoft Edge

• Export and import an HTML file
• Login and sync
• PDF guide Edge

 

---

Windows Hello sign-in options (PIN, face recognition, fingerprint) are more secure and thus the recommended sign-in method. An added benefit here is that you will have to authenticate less with your mobile device when logging in via a Windows Hello sign-in.

Windows Hello sign-in : a more advanced authentication method introduced by Microsoft. It uses biometrics or a PIN to verify a user's identity. Windows Hello supports several biometric options such as facial recognition, fingerprint scanning or iris scanning. Instead of relying solely on a password, Windows Hello generates a unique token that represents the user's identity and can be used for authentication.

Passwords : a traditional authentication method in which the user enters a secret combination of characters to gain access to a system or account. It usually consists of a username or email address and an associated password that the user must remember and enter correctly.

Advantages of Windows Hello and biometric authentication include:

Convenience: With Windows Hello, you no longer have to remember complicated passwords or worry about password management. Users can simply authenticate using their biometrics or a PIN, which is often faster and more convenient.

Enhanced Security: Biometric authentication adds another layer of security because it is unique to each individual and difficult to fake. This reduces the risk of password attacks such as "brute forcing." 

Resistance to password-related problems: Windows Hello reduces the risk associated with common password-related problems, such as password reuse or weak passwords. Biometric data is specific to the user and cannot be easily shared or guessed.

For these reasons, we recommend using Windows Hello sign-in methods.

---

Thanks to Intune, "zero-touch delivery" is now possible for the purchase of new devices. Your new laptop will be "UGent-ready" and ready for use upon delivery. If you order a new laptop or desktop with the standard configuration through the Dell Premier catalog today, you will automatically receive Windows Autopilot and Windows 10 Pro at no additional cost.

If you choose a non-standard configuration and assemble your own Windows device, you will need to select Windows Autopilot and Windows Pro during the order process, so that such a device can also be registered in Intune. This way, your device will also benefit from the security provided by Intune.

To do this, under "Windows Autopilot," select "Autopilot" and enter the UGent "Tenant ID" and "Domain":

Tenant ID: d7811cde-ecef-496c-8f91-a1786241b99c

Domain: ugentbe.onmicrosoft.com

---

If you purchased a new device from Dell with Windows Autopilot and Windows Pro, you can set it up and customize it without the need for intervention from DICT or your local system administrator.

Follow these steps:

1. First, go through a brief wizard setup process.
2. Log in with your UGent email address.
3. Intune will immediately begin configuring your device and installing the necessary software.
4. You should be able to start using your device right away, but it's recommended to wait until Intune completes the configuration (usually takes about an hour).
5. After that, you can use the Company Portal to install additional software as needed.

With these steps completed, your device will be ready for use with all the necessary configurations and software from UGent.

---

Thanks to Intune, "zero-touch delivery" is now possible for the purchase of new devices.  Your new laptop is then "UGent-ready" and ready to use upon delivery. Therefore, anyone who orders a new laptop or desktop with standard configuration through the Dell Premier catalog today will automatically receive Windows Autopilot and Windows 10 Pro at no extra charge.

Those who do not choose a standard configuration and put together their own Windows device must select Windows Autopilot and Windows Pro when ordering, so that such a device can also be registered in Intune. This way, your device is also assured of the security that Intune provides.

Under "Windows AutoPilot," select "AutoPilot" and also enter the UGent "Tenant ID" and "Domain."

Tenant ID:
d7811cde-ecef-496c-8f91-a1786241b99c

Domain
ugentbe.onmicrosoft.com

---

If the computer was purchased with Windows Pro, Intune will upgrade Windows to Enterprise level and activate it against the cloud, the so-called "digital licence".

If the computer was purchased with Windows Home, it will need to be activated and remain activated against UGent's Key Management Services (KMS) server. The computer must be in contact with the KMS server every 6 months to remain activated.

---

From mid-January 2024, DICT is taking technical measures to make it more difficult to use professional Windows devices that must be registered in Intune, according to data known to DICT.

Initially, the time you can stay logged in on your device will be limited 1 hour.

---

 Open a command window as administrator 



make sure you are connected with the UGent network or VPN 

type following commands in the dos box 

cscript %windir%\system32\slmgr.vbs -skms licwindows.ugent.be
cscript %windir%\system32\slmgr.vbs -ato
 

---

Earlier this week, an upgrade to Windows 11 was inadvertently triggered on a number of devices managed with ECM. This has since been rectified and the cause is under further investigation.

For reasons still unknown earlier this week, the upgrade to Windows 11 triggered the deployment of a mandatory security patch. As soon as this was identified, it was successfully prevented for the other clients. 
 
How that Windows 11 upgrade got into the deployment is still being investigated further so that we can take the necessary steps to avoid this in the future. 
 
Most clients were safeguarded in time, although it cannot be ruled out that cases may still crop up where the download happened earlier. This is being closely monitored.

If it turns out that a PC that has now been upgraded to Windows 11 can no longer run certain software, the following procedure can be followed to restore the PC to Windows 10: Downgrade from Windows 11 to Windows 10 - Microsoft Community. This procedure must be done within 10 days of the upgrade, otherwise it will no longer be possible.

---