Table of Contents
Introduction
Hello there!
Late September in Sweden means darker mornings, the first cold rain of the season, and the heating clicking on again. It is also conference season, and a good part of the community spent last week at Workplace Ninja Summit in Baden.
In October I will be at two events in Stockholm, and I hope to see some of you there:
- Truesec Cybersecurity Summit, 8 October, a full day of security talks at the Waterfront in central Stockholm. It can also be followed online.
- Experts Live Sweden, 13 October at House of People, with MVPs, Microsoft engineers and community speakers. One of the tracks is Workplace & Endpoint.
A quieter fortnight for announcements, but with a clear direction. Microsoft now recommends Autopilot device preparation for user-driven deployments, and much of the community content was about what that looks like in practice. The September Windows update also needed an out-of-band fix, and there is a domain trust issue to check if you have ever enabled Machine Identity Isolation.
Hope you have a good week.
/Daniel
Some highlights
- Autopilot device preparation is now the recommended solution for user-driven deployments, with a phased migration guide from Microsoft.
- The September Windows update (KB5124008) needed an out-of-band fix, and devices with Machine Identity Isolation enabled can lose their domain trust.
- Intune now supports client-driven compliance evaluation for Windows in preview.
- slmgr.vbs has a PowerShell replacement, and Microsoft published an FAQ on disabling NTLM by default.
Dates to plan around
- 13 October 2026 – Windows 11 version 24H2 reaches end of servicing for Home, Pro, Pro Education and Pro for Workstations.
- October 2026 – Year one of Windows 10 commercial Extended Security Updates ends.
- 10 November 2026 – Windows 11 version 23H2 reaches end of servicing for Enterprise, Education and IoT Enterprise.
- September 2026 – Configuration Manager 2609, the first release under the annual cadence, is scheduled for this month.
News from Microsoft
Moving from Windows Autopilot to Windows Autopilot device preparation Intune Customer Success
Microsoft now calls device preparation the recommended solution for user-driven scenarios, and future engineering investment goes there. Both can run in the same tenant, so the suggested approach is to move eligible user-driven Entra join populations in controlled waves while classic Autopilot keeps handling everything else.
September 2026 Windows update: out-of-band fix and a domain trust issue Windows release health
KB5124008 caused Remote Desktop Services instability, fixed by out-of-band update KB5129195 on 14 September. Windows 365 and Azure Virtual Desktop were not affected. Separately, the update makes Windows honour existing Machine Identity Isolation settings, which are only supported against a Windows Server 2025 domain functional level, so devices where it was enabled elsewhere can lose their trust relationship with the domain. The workaround is to disable it the same way it was turned on (Intune, Group Policy or registry), restart, and repair the secure channel with Test-ComputerSecureChannel -Repair.
Faster compliance updates for Windows devices (preview) Microsoft Learn
Supported Windows devices can now detect changes to signals like firewall, antivirus, BitLocker, Defender status and Secure Boot, and request a compliance re-evaluation themselves. That shortens the gap between a device drifting and Conditional Access noticing.
Keep Windows activation automation working with PowerShell Windows IT Pro Blog
slmgr.vbs has been part of Windows since Windows Vista and Windows Server 2008, and the OSLicense PowerShell module is now the recommended replacement, ahead of VBScript being disabled by default and eventually removed. On Windows 11 it ships with the August 27 preview update (KB5120998) or later, while Windows Server gets it in the next major version. Search scripts, task sequences and runbooks for slmgr, cscript and .vbs.
Retiring NTLM: Frequently asked questions Windows IT Pro Blog
NTLM will be disabled by default, not removed, and the current target is the next major release of Windows Server and client. The FAQ covers auditing, IAKerb and LocalKDC.
What’s new in Windows 365 Microsoft Learn
Admin Insights is now generally available, users can provision their own Windows 365 Reserve Cloud PC from Windows App once IT enables it, and Display Protection is in public preview.
Intune updates from the community
Windows Autopilot Device Preparation from Scratch – And the new Device Association Joery Van den Bosch · @joerieke
An end-to-end build of device preparation in an empty tenant, followed by the full device association flow. Two details stand out: the DeviceLink file can be collected remotely with Collect diagnostics from devices already enrolled through device preparation, and there is still one CSV per device.
Applying a Specific Hostname In Device Preparation Jóhannes Geir Kristjánsson
Device association brings %SERIAL% and %RAND:x% name templates, but not specific hostnames. Jóhannes solves it with a Win32 app that looks up the serial number in a bundled CSV and renames the device.
Is Autopilot Device Preparation it? Niklas Tinner · @NiklasTinner
A side-by-side of classic Autopilot and device preparation, and of corporate identifiers versus device association. His recommendation is device preparation wherever possible, with hybrid join and Windows 10 as the main reasons to stay on classic.
Using multiple managed accounts with app protection policies Peter van der Woude · @pvanderwoude
Users can now hold managed accounts from more than one organisation in the same app, currently Teams and Outlook on iOS/iPadOS. In the mixed view that Outlook uses, the most restrictive policy wins, and cut, copy and paste are blocked entirely.
Deploying the Global Secure Access Client with Microsoft 365 Business Premium Sascha Stumpler · @SasStu
The Microsoft 365 traffic profile in Global Secure Access is included in Business Premium, which gives you the Compliant Network signal for Conditional Access. Microsoft documents the client hardening as a Remediation, which Business Premium does not license, so Sascha delivers it as a Win32 app with a dependency on the client and covers the secure DNS and QUIC browser settings as well.
Token protection for Apple devices Jan Mulder
Token protection now works on iOS and iPadOS for a defined set of Microsoft apps. It needs MDM-managed devices, Microsoft Authenticator and the Enterprise SSO plug-in, and Apple Mail and Calendar will be blocked if the policy covers Exchange Online.
osVersion in assignment filters is dead. Here’s what replaces it. Jeroen Burgerhout
Existing osVersion filters keep working, but new ones should use operatingSystemVersion, which went GA in 2608.
Windows 11 Config Refresh in Intune: The Missing Piece for Consistent Device Management Erik Moreau · @ErikMoreau
Config Refresh reapplies cached MDM policy on a schedule between 30 minutes and 24 hours, without contacting Intune. Erik covers the settings catalog setup, checking it through event ID 4202, and pausing it while you troubleshoot.
Intune Debug Toolkit MSEndpointMgr · @MSEndpointMgr
Version 3.0, maintained by Mattias Melkersen, is a rewrite as a single tabbed launcher for community tools like SyncML Viewer, IME Diagnostics and CMTrace, with several log parsers rebuilt for current IME formats.
Registry Scripts Are Dead: Use This Intune Feature Instead Imran Awan · @imran76awan
A video on replacing registry scripts with built-in Intune functionality.
Windows updates from the community
VBscript deprecation: Replacement for slmgr.vbs Mads Johansen
A short mapping from the common slmgr.vbs commands to the OSLicense cmdlets, such as /ato to Invoke-OSLicense -ActivateOnline.
Seen on X
Arnab (@rnabmitra): a new Remote Help for Windows client is out, and you can roll it out by superseding the old version through Enterprise App Management. According to Microsoft, version 5.2.1040.0 only updates license metadata, so there are no functional changes.
Dan Felman (@dan_felman): HPIA 5.3.7 is released, with better handling of extension drivers and BIOS updates without a password on most G9 and newer systems.
Sven Riebe (@SvenRiebe): part 1 of a new series built on the Dell SupportAssist CLI, an Intune custom compliance script that detects missed critical driver updates. The code is on GitHub.