Windows-itpro-docs: Give an example how to give user rights with MDM Policy CSP

[PanuSaukko]

With Windows 10 1803 you can grant user rights with MDM Policy CSP. The documentation is missing what is the correct syntax to grant user rights to specific users/groups. Because MDM policy's are used in cloud-only environments, the examples should include how you can grant the user rights to Azure AD users/groups.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 3b62d452-1910-d962-0ccc-9ac3f8135f15
• Version Independent ID: 5a4e6f0c-bcd4-8d8b-93f7-5bda7135b931
• Content: Policy CSP - UserRights
• Content Source: windows/client-management/mdm/policy-csp-userrights.md
• Service: unspecified
• GitHub Login: @nickbrower
• Microsoft Alias: maricia

[Cragsworth]

Would really like some examples here, what is the CSP expecting User SIDs? in what format. I cannot consume these CSPs with the information provided.

[MariciaAlforque]

Added examples and link to well known SIDs.

[dan529]

Your examples seem to be flawed. I can't get this to work using the SIDs. Are you sure this is the correct syntax?

[shortpatti]

I will help resolve this one 👍

[Heidilohr]

@dan529 The dev team informed me that this feature is only supported in the next major Windows release, and you won't be able to use it before then unless you're using an Insider build.

[schenardie]

So you saying this will only work with 1809?? Its working on 1803 currently but only one group added as a String (example Administrators) but if 2 groups are needed on the same Settings it doesn't work. Already tried with "name1;name2" "name1; name2" "name1,name2" "name1, name2" "Name1Name2" "Name1Name2" can someone provide more info on how to get the these settings working?? Thanks

[schenardie]

Anyone following this issue?

[Illnasty]

Hey MS, just tell these people the truth that everything in this article doesn't work!

Here's what I did to get it to work.

1. The separator for the values like "Remote Desktop Users" and "Administrators" is 
   
   
   
   • Will that work as "Remote Desktop UsersAdministrator" ?
     
     -Absolutely NOT!
   
   
2. Go to https://coderstoolbox.net/string/#!encoding=xml&action=decode&charset=us_ascii
   -Set string conversion to XML, Decode, and US-ASCII
   -Input = 
   -This will spit back a rectangle box in the Output
   -Copy that rectangle box and put it in the middle as the separator - Remote Desktop UsersAdministrators
   
   
   
   • DO NOT COPY FROM HERE; IT WILL NOT WORK!!!
   
   

So here's the kicker!
-USE EDGE Browser. It WILL NOT WORK in Chrome

[Illnasty]

Ok so it actually converts the code here! Putting spaces to help:

• Input = & # 6 1 4 4 0 ;

[shortpatti]

@Illnasty, Thank you for your feedback. I'll look into this policy and make the necessary changes.

[schenardie]

@Illnasty thanks for that mate. Mine is still not working. I'm decoding the code provided at the website and pasting in between AdministratorsRemote Desktop Users as a simple string and the OMA is ./Device/Vendor/MSFT/Policy/Config/UserRights/AccessFromNetwork but still not working. Are you adding any more coding as per the page?? ie ?? thanks

[shortpatti]

So that I can get a better understanding, why doesn't \ work as the separator?

[schenardie]

Hi patti. it give s catastrophic failure. i got it working too following @Illnasty solution. the code &#xF000 ; is not encoded, so if you use it between the groups (like admin &#xF000 ; Authenticated users) it wont work. you need to go to the website and encoded it to xml (then you are left with that square symbol) that is what you copy and paste in between the groups. Funny thing is that if you encode, copy the square and paste on the input line and decode, if are left with &#61440 ; and not &#xF000 ; anymore

[shortpatti]

@schenardie, thank you for the response. Now that I understand it better, and your response makes sense, it sounds like the code in the doc needs to be replaced and a note added about the \&#xF000 code not being encoded :)

[schenardie]

Well to be honest it says on the documentation
"Here are examples of data fields. The encoded 0xF000 is the standard delimiter/separator" but that is not clear how you encode it. And also i got that working via GUI, if you try to import that via Graph API passing either encoded or decoded it doest work. Once it reaches Intune if you check via the GUI its something like ??and a square. So it cannot currently be automated.

If you could check that it would be great. It makes all the difference on fully automated environments. Thanks @shortpatti

[shortpatti]

@schenardie, you bet, I'll check with the engineering team about this one.

[schenardie]

Also since we're at it. The empty input () works but it gives a catastrophic error as well on the event logs. If you can dig the right input which doesn't generate errors would be very helpful. Thanks again

[schenardie]

Any news?

[Heidilohr]

@schenardie I'm getting in touch with the engineering team. I'll let you know if there are any new developments.

[mypil]

@Heidilohr - Do you have any updates on this? Thanks.

[illfated]

Ok so it actually converts the code here! Putting spaces to help:

• Input = & # 6 1 4 4 0 ;

Just to remind users of Github; MarkDown code block fences ( ``` ) are useful to show code and not letting the web page convert it into symbols:

* Input= 

[jvsam]

@officedocsbot assign @jvsam

[Ricardo-Cz]

For me it works if I use the CDATA syntax and the separator as described in the documentation. The settings are applied successfully on the client but the verification in Intune fails. I get an "Error" for all user rights settings in the "per setting status" of my profile. Can somebody confirm this behavior?

Example of a setting:
OMA URI: ./Device/Vendor/MSFT/Policy/Config/UserRights/AllowLocalLogOn
Value:
<![CDATA[Users&#xF000;Administrators]]>

[PeterKlapwijk]

@Ricardo-Cz I can confirm this behavior. I also used OMA URI: ./Device/Vendor/MSFT/Policy/Config/UserRights/AllowLocalLogOn The policy is successfully applied, but in Intune it shows an error -2016281112 (Remediation failed)

[schenardie]

Is there a way to get the policy to be applied and the status on Intune show
Succeeded using custom profiles??

[illfated]

@ManikaDhiman : Sorry to ping you about this in your otherwise busy schedule,
but maybe you could answer the unanswered questions here?

[billgatesfan]

After fighting over few months with Intune Premier support, here is the answer we got from them :

Essentially the issue is caused because of the encoding of the user groups used when adding the users into the policy.
When Intune does a GET on the value set, it expects it to match what was sent in an ADD or REPLACE, in this case due to the encoding, it doesn’t which is why we see the remediation failed message:
This is documented in the following article - https://docs.microsoft.com/en-us/intune/custom-settings-windows-10#find-the-policies-you-can-configure

To work with Intune, the setting must support the Add, Replace, and Get operations. If the value returned by the Get operation doesn't match the value supplied by the Add or Replace operations, then Intune reports a compliance error.
This error can be safely ignored as it is expected.

While this is "understandable" from technical point of view, I am still surprised that they did not implemented some additional code to handle this.
From a customer point of view, I did nothing wrong and errors are reported anyway in Intune... For me, I still see this as a bug.

[prlpl]

Beware of browsers for coding/decoding

[schenardie]

Has anyone found a way to deploy the decoded character via graph api? (not using the CDATA, i dont really want to see the profile failing for settings which i know are implemented).

Thanks

[joinimran]

@PanuSaukko - This is something that is not yet available in a way that can be deployed easily. I would suggest you put this as an idea in the Azure User Voice portal. This is the only best way to highlight and get this sorted out in a way this should be.

@nam31 - Please guide the user on how an idea can be submitted on the Azure User Voice channel.

Thanks.
Imran.

[nam31]

@PanuSaukko thank you for engaging with the community here for the docs.
I know the product teams are always looking for user feedback and how to make Azure better . They keep a close tab on user feedback and it would be awesome if you could add your voice in User Voice
You might find others have made a similar request that you can add to, or you can open a new one. Let us know here if you do so we can up-vote your request.

Thank you for your contribution to make the docs better! Much appreciated!

[djatw0rk123]

I entered the boilerplate MSFT recommendation:

https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-userrights#userrights-accessfromnetwork

Doesn't work, registry entries are 'Dirty'

Still looking for a way to manage these settings for compliance.