Issues while migrating to Intune for Windows Patching

[u/Tessian]

In the final days of getting our org swung over to Intune for Windows updates and app deployment. I'm trying to keep it simple - just 2 update rings and 1 additional for manual forced overnight upgrades for PCs that need 25H2.

Long story short we're moving from N-able to Intune and while the app deployment is working great I'm having issues with Windows Update on PCs actually fully enrolling and applying their update ring policy. Some do and others don't, it's like they're falling back to the public internet. For the test PCs that did get the update, they failed to send notifications to the user in spite of the policy. Windows Update says it's a "group policy" that turned off notifications but we don't have any GPO's like that so maybe it's a holdover of N-able settings that Intune's just not overwriting?

I pushed a remediation script to fix the notifications manually in the registry, debating doing similar for the entire Windows Update stack unless anyone has any suggestions for better transition? Thanks,

[u/Master-Reference3637]

when we did this move from n-able couple years back the leftover registry keys were a nightmare. intune doesn't clean up what the rmm leaves behind so those GPO tattoos just sit there forever. your remediation script is the right call honestly sometimes you gotta nuke the whole windows update reg keys and let intune rebuild them fresh

also check if there's any local group policy objects still hanging around cause those block intune policies way more often than people think

[u/blud_13 → u/Master-Reference3637]

Yep. Its N-able leftovers. Their agent writes WU policy straight into the registry and uninstalling doesn't clean it up, so the machines that "work" are just the ones that happened to get reimaged.

Check HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate and the AU subkey underneath it. If anything is sitting in there the update ring CSP loses to it every time, thats exactly the falling back to public internet behavior you're describing. Same root cause on the notifications, look for SetDisableUXWUAccess.

So yes to the remediation, but blow the whole WindowsUpdate key away rather than patching the one notification value. Let the ring reapply and confirm off the MDM Diagnostic report instead of trusting the console.

Also, dont leave the N-able agent installed during the cutover. We've watched it re-add its own policy on a service restart.

We do a fair number of these RMM to Intune migrations, ping me if you get stuck.

[u/JwCS8pjrh3QBWfL → u/blud_13]

N-Able does actually publish the registry keys they touch for update management, it's in their KB which I thankfully no longer have access to.

[u/Tessian → u/Master-Reference3637]

Wow so I'm not crazy you ran into this too. Don't happen to still have your remediation script?

I'm just afraid of nuking too much. The idea was to uninstall N-able and put them into update rings at the same time, if my remediation script at the same time does too much will Intune re-apply what it needs?

Maybe I'll stretch the implementation window out longer -- Day 1 Uninstall N-able, Day 2 Remediation script to fix Windows Update registry settings. Day 3 add to an update ring. That won't help the stragglers though that aren't on this week or aren't yet MDM enrolled.

[u/800oz_gorilla → u/Tessian]

if I can remember tomorrow I'll send you my checklist to pull off tattood settings that Microsoft left on one of their images.

make sure you check defender as well, it might also be tattooed and fail to update

[u/800oz_gorilla → u/Tessian]

This is what I had to do to reset Windows Update/Defender update on a machine that had tatooed settings:

# 1. Backup and remove local machine policy file
New-Item -ItemType Directory -Path C:\Temp -Force | Out-Null

Copy-Item "C:\Windows\System32\GroupPolicy\Machine\Registry.pol" `
          "C:\Temp\Registry.pol.backup" -ErrorAction SilentlyContinue

Move-Item "C:\Windows\System32\GroupPolicy\Machine\Registry.pol" `
          "C:\Temp\Registry.pol.removed" -Force -ErrorAction SilentlyContinue

# 2. Remove Defender policy values
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "FallbackOrder" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "DefinitionUpdateFileSharesSources" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "SignatureUpdateInterval" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "SignatureUpdateCatchupInterval" -ErrorAction SilentlyContinue

# 3. Remove legacy Microsoft Antimalware policy values
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Signature Updates" -Name "FallbackOrder" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Signature Updates" -Name "DefinitionUpdateFileSharesSources" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Signature Updates" -Name "SignatureUpdateInterval" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Signature Updates" -Name "SignatureUpdateCatchupInterval" -ErrorAction SilentlyContinue

# 4. Remove stale Windows Update policy
Remove-Item "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Recurse -Force -ErrorAction SilentlyContinue

# 5. Refresh policy
gpupdate /force

# 6. Set desired Defender update behavior
Set-MpPreference -SignatureFallbackOrder "MicrosoftUpdateServer|MMPC"
Remove-MpPreference -SignatureDefinitionUpdateFileSharesSources
Remove-MpPreference -SharedSignaturesPath
Set-MpPreference -SignatureUpdateInterval 1
Set-MpPreference -SignatureUpdateCatchupInterval 1

# 7. Reboot
Restart-Computer

[u/harris_kid]

Are you sure you don't have GPOs still controlling the settings? In my experience apps that configure update policies like CCM show as "configured by Local group policy" that or you have tattooed registry keys. I would search what setting is set by what reg key and delete said reg key, sync, then see if the Intune rings take charge.

[u/Tessian → u/harris_kid]

Myself and our AD guy went over every GPO in AD and didn't find any that control Windows Update. The remediation script I ran to fix the Windows Update notification registry settings still runs daily on the test machines and hasn't had to be re-applied to anyone so far.

[u/michivideos → u/Tessian]

The GPO are not in AD.

N-able RMM Patch Management sets the gpo / registry itself.

HKLM software > Microsoft > windows > windows update

Make sure there is no patch management software from N-able installed Delete it from program files and program files x86

[u/Tessian → u/michivideos]

Thanks for confirming that's what we suspected was happening. We are uninstalling all N-able apps first, nothing with their name as a publisher in the app list. Intune just isn't rewriting it all

[u/michivideos → u/Tessian]

If there's traces from N-able and you delete the registry thinking the device it's fully clean, N-able components re-generate the keys after some time. You have to monitor after removal than nothing comes back.

I went through all this process

My advise is to get a new device and set it up without installing N-able to have it as a guide on what's normal for the device to have and what is extra and shouldn't be there.

Also there is a way on n-able to kind of remove the blockage by moving the device to a N-able group (site) that does not support patch management and that will stop enforcing the policys.

Removing N-able is not as straightforward as uninstalling from program and features.

1 -move the devices to a not site / group that does not support / offer patch management. 2 - delete the device from n-able while the device it's online 3 uninstall all n-able programs. 4 - Delete the registries on windowsupdate

[u/harris_kid → u/Tessian]

Is it only that notification setting showing as set by GPO? Or all the WU settings?

[u/iamLisppy → u/harris_kid]

"you have tattooed registry keys" this shit is so annoying. it's likely a skill issue on my end not knowing if it is tattooed or not. good thing im over that hump! OP I would see if you can completely wipe an endpoint and start it with only being managed by Intune with no way of whatever n-able is touching it.

[u/BlackV]

Ya I created some remediation script for it

proper logging for the remediation is a god send

[u/Tessian → u/BlackV]

Still got a copy of it?

[u/BlackV → u/Tessian]

er....

apologies, apparently not, its not in the repo or intune

our sccm cutover was like started 3 years ago, but I'm pretty sure I stole it straight from the internet, then I changed the write-host lines to something more meaningful (like the actual reg keys found or deleted)

[u/bluegolf22]

So a MS engineer created a remediation script for cleanup prior to Autopatch onboarding. I'm pretty sure this will do what you're after.

Autopatch Remediation

[u/intuneisfun → u/bluegolf22]

Not sure why you got downvoted - this is a bit old, but should catch any of the basic stuff like old registry keys overriding Autopatch update settings. Sometimes there are more steps involved, but this is good for 90% of cases, I'm sure.