Table of Contents
Introduction
Hello there!
Early September in Sweden is the cosy stretch. You start spending a bit more time indoors again, but a light jacket is still all you need to be comfortable outside. The calendar has filled up and the projects that were parked in July are all back on the desk at once.
A busy fortnight for announcements. Autopilot device preparation got device association, Remote Help on Windows learned to sign in without a user present, and there is a Configuration Manager security update to get into your next maintenance window. WMIC is also gone from Windows 11 24H2 and later. Four servicing and licensing dates land before mid-November.
Hope you have a good week.
/Daniel
Some highlights
- Device association for Windows Autopilot device preparation. A TPM-backed tenant marker written into UEFI before enrollment, which allows device-targeted preparation policies and name templates.
- Unattended Remote Help with remote sign-in, on physical corporate-owned Windows devices. Scope the permission carefully.
- Security update KB38982839 for the ConfigMgr SMS Provider and administration service. Site reset required, and the secondary sites need doing separately.
- WMIC has been removed from Windows 11 24H2 and later. WMI itself is unaffected.
News from Microsoft
Security update for the SMS Provider and administration service (KB38982839) Microsoft Learn
Fixes a security vulnerability in the SMS Provider and adds a defense-in-depth fix in the administration service related to the Windows SMB Server issue tracked as CVE-2026-26128. It applies to version 2603, to 2509 with rollup KB37864969, and to 2503 with rollup KB32851084, where it also carries KB37447175 for Network Access Account hardening. No reboot, but a site reset is required, and secondary sites need Recover Secondary Site run against each one. Verify with select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode'), where 1 means current.
What’s new in Microsoft Intune – August Microsoft Intune Blog
Covers service releases 2607 and 2608. Among them: registry data collection in the properties catalog, operatingSystemVersion in assignment filters going GA, Controlled Configuration for Defender antivirus in preview, custom compliance for macOS, and a substantial Android Enterprise release with eSIM management and separate work profile locks.
Introducing device association for Windows Autopilot device preparation Intune Customer Success
Device association writes a TPM-backed tenant affinity marker into the device UEFI before MDM enrollment, so you can target preparation policies at devices rather than user groups, apply a name template with %SERIAL% or %RAND:x%, and have devices marked corporate-owned without a separate identifier upload. You cannot remove an association from the Intune console, only on the device itself, and Windows 365 is out of scope.
Remote Help on Windows: unattended support with remote sign-in is here Intune Customer Success
A helper can now sign in to a physical, corporate-owned, Entra joined Windows device with their own credentials, with nobody present. It needs the Intune Management Extension current and Remote Desktop enabled, and the helper needs the Windows unattended control remote sign-in permission. Build a dedicated custom role for it, scope it to a device group instead of all devices, and put Conditional Access on the helper accounts.
WMIC has been removed from Windows 11, version 24H2 and later Microsoft Learn
As of August 2026 the WMIC command line utility is gone and is no longer available as a Feature on Demand. WMI itself is unaffected. Search your script libraries, ConfigMgr applications and task sequences for wmic and move to Get-CimInstance. One exception: wmic product get should be replaced with something else entirely rather than translated, since it triggers a consistency check on every installed MSI.
The new device page is now the default view Microsoft Learn
The redesigned single device page is on by default for all customers across all platforms. The Preview new device view toggle still lets you go back for now. Actions are grouped under Remote actions, Secure and Remove data, so click-by-click service desk documentation will need a pass.
Dates to plan around
- 13 October 2026 – Windows 11 version 24H2 reaches end of servicing for Home, Pro, Pro Education and Pro for Workstations. Enterprise and Education run to 12 October 2027.
- October 2026 – Year one of Windows 10 commercial Extended Security Updates ends. Year two costs double, and ESU is cumulative, so skipping year one does not avoid the cost.
- 10 November 2026 – Windows 11 version 23H2 reaches end of servicing for Enterprise, Education and IoT Enterprise.
- Ongoing – Configuration Manager moves to an annual release cadence starting with version 2609. This changes the planning if you have been working to the three-times-a-year rhythm.
- Deprecated – Microsoft Connected Cache integration in Configuration Manager was deprecated in June 2026 with end of support still to be announced. The standalone version is where development continues.
Intune updates from the community
The Poor Man’s Remediation: Win32 Apps for Tenants Without Remediation Licenses Sascha Stumpler · @SasStu
A Win32 app runs the same detect, fix, re-detect loop as a remediation, so you can get most of the behaviour under Intune Plan 1. Detection scripts must write to STDOUT and exit 0. What you give up is scheduling, since you only get the 24-hour re-evaluation.
Part 3: Packaging a Drive and Printer Mapping Script with PSAppDeployToolkit and Deploying It with Intune Sascha Stumpler · @SasStu
Bundles the mapping script, a scheduled task XML and a Start Menu shortcut into one Win32 app. Export the task XML with -Encoding Unicode, since Task Scheduler writes UTF-16, and point the shortcut icon at the install directory and not the temporary deployment folder.
Remove Microsoft Store Apps with Intune Settings Catalog Florian Salzmann · @FlorianSLZ
The Remove default Microsoft Store packages policy now takes a dynamic list of Package Family Names, one per line, which retires the old XML and registry approach entirely. Windows 11 Enterprise and Education only, 24H2 and 25H2, April 2026 updates or later, and the app data removal is not reversible.
Bulk Enrollment for Windows 11 Devices in Intune using Provisioning Package Prajwal Desai · @PrajwalDesai
A full walkthrough of mass enrolling into Entra ID and Intune with a .ppkg from Windows Configuration Designer, including how to apply it via USB, Settings, OOBE or PowerShell. Note his caveat that provisioning is designed for new devices and a failed run can mean rebuilding from a boot image.
Autopilot Device Preparation Device Association Automated Rudy Ooms · @Mister_MDM
Rudy automates the new device association flow, CSV exports and all.
How to Set Up Intune Remote Help Unattended Support with Remote Sign In Chander Mani Pandey · @Mani_CMPandey
A hands-on walkthrough of the unattended Remote Help configuration, useful for seeing the RBAC and Remote Desktop prerequisites in the console before you build your own custom role.
What’s New for Android Enterprise in Microsoft Intune 2608: August 2026 Highlights Nicky De Westelinck · @NDeWestelinck
Nicky’s regular Android roundup, and 2608 was a substantial release on that side.
ConfigMgr updates from the community
Moving a Software Update Point in Configuration Manager Chris Dalton
Chris documents the full procedure for moving a SUP to a remote server and then argues you probably should not, because it adds complexity without fixing the underlying WSUS performance problem. He also warns against removing the WSUS management tools from the primary site afterwards, since that breaks the Management Point.
Windows updates from the community
Configuring Point-in-time restore in Windows Peter van der Woude · @pvanderwoude
Windows keeps local VSS-based restore points for up to 72 hours, and the controls sit in the Recovery CSP under PointInTimeRestore. Not in the settings catalog yet, so Peter walks through the custom OMA-URI profile with the exact paths for enabling it, disk usage, frequency and retention.
Windows 365 updates from the community
Windows 365 – Placing a Cloud PC Under Review Jörgen Nilsson · @ccmexec
Place Cloud PC under review takes a point-in-time snapshot and exports it as a VHD to an Azure Storage Account for forensic analysis, optionally blocking user access. Needs Windows 365 Enterprise and the service principal granted Storage Account Contributor and Storage Blob Data Contributor, with a limit of 10 Cloud PCs under review at once. Jörgen’s argument is that this belongs in place before an incident rather than being sorted out during one.
Final thoughts on Windows 365 Reserve Niall C. Brady · @ncbrady
Reserve gives designated users 10 days of Cloud PC access per year for business continuity, and Niall’s conclusion is that the days go unused because nobody deprovisions once their real device is back. There are no admin alerts, so the deprovisioning step belongs in your incident closure checklist.
Other updates from the community
The Exploit Clock Doesn’t Wait: What’s New in Patch My PC Patch My PC · @PatchMyPC
A webinar held on 2 September, now available as a recording.
Seen on X
Jörgen Nilsson (@ccmexec): flagged that the new device view in Intune becomes the default in September and the legacy view is going away, referencing the Plan for Change message.
SoyITPro (@SoyITPro): Intune can now inventory registry keys on Windows as of 2607, with paths and values defined in the properties catalog and data collected automatically from devices.
Mattias Melkersen (@MMelkersen): released a tool for Microsoft EPM that makes it easier to build rules based on certificates and internal name, with a better overview of the full rule set.
Per Larsen (@PerLarsen1975): you can restore a Windows 365 device to a previous known good state directly from the Intune admin center, which is related to the point-in-time restore work above.
SystemCenterDudes (@scdudes): Windows 11 taskbar customization is improving, with top, bottom, left and right placement plus a smaller taskbar option.
SystemCenterDudes (@scdudes): a reminder that WMIC is being removed from Windows 11 24H2 and 25H2 while WMI itself remains supported, with the advice to go find your old scripts now.
Laura Rogers (@WonderLaura): shared a Copilot prompt for SharePoint that builds an interactive dashboard of all lists and libraries on a site. Outside the usual endpoint scope, but useful for anyone documenting a tenant.