WAU/Intune Setup Guide

[spitty78]

Is there a guide to get Intune and WAU working? I thought it would be as easy as making a Windows app (Which installs just fine) and creating a policy using the .admx and pointing it at the same group. But the config/policy is not working. I can't change the update interval or blacklist from within Intune. Thoughts?

[KnifMelti]

Have you checked #955 ?

[KnifMelti]

https://github.com/Romanitho/Winget-AutoUpdate/tree/main/Sources/Policies#important-notes

[spitty78]

Yes I looked at both of those. The #955 I can look at in depth but I didn't notice anything off hand.

[KnifMelti]

It boils down to:

And making sure the GPO-managing taska has been run

[spitty78]

Maybe that's the issue. I am doing everything from Intune - not Group Policy Manager. I thought it'd work the same. I can't be the only one doing it this way, can I?

[KnifMelti]

No, it's the same.
I don't have Intune at home, just local GPO

[spitty78]

Reinstall happened perfectly. Scheduled tasks are as they should be. Get Black/White List from external Path (URL/UNC/GPO/Local) was not set, so I set it to GPO even though I am not using GPO - only Intune policy but the config policy is not hooking up with the installed application.

I am using the .msi. Should I be using a different install method?

[KnifMelti]

MSI is all there is.

And in Intune you've added the ADMX/ADML:
https://learn.microsoft.com/en-us/intune/intune-service/configuration/administrative-templates-import-custom#add-the-admx-and-adml-files

Intune Policy uses this the same as normal GPO, therefore GPO must be set and you must run:

And, of course adding apps in the:

[spitty78]

Yes, added the admx/adml. Below is a screencap of settings that were configurable from the admx. I added an app to the blacklist for testing. I've recreated the policy and run the scheduled tasks...so another waiting game. Appreciate the guidance.

[spitty78]

It looks like one of my devices has gotten the new policy. Registry entries now show in HKLM\Software\WOW6432Node\Policies\Romanitho\Winget-Autoupdate instead of just HKLM\Software\Romanitho\Winget-Autoupdate. So that's promising. We'll see.

[spitty78]

Yeah it looks like recreating the policy after the install kicked it in the pants and machines are showing up as the policy applies. Thanks again.

[Romanitho]

For me, a few things probably need to be adjusted:

• "Activate WAU GPO management" should be deprecated (other product policies don’t usually ask whether they should be GPO-managed).
• "Get Black/White list from external path" should be set to "GPO" by default.

Just my own opinion.

[Romanitho]

In my opinion, the scheduled task trigger doesn't need to be adjusted that often 😅. I haven't found another reliable way to manage it, but running it once per day should be sufficient.

[Romanitho]

"Activate WAU GPO management" should be deprecated (other product policies don’t usually ask whether they should be GPO-managed)

Merged #987

"Get Black/White list from external path" should be set to "GPO" by default

Not that easy to manage — let’s keep it as-is for now, it’s fairly well documented 😅

[spitty78]

Policy SAYS it is applied and registry entries have appeared where they should be. However, I have GPO in the Get Black/White List from external Path (URL/UNC/GPO/Local) setting but am "Intune only", so where is this being pushed to and managed on the end machine? It used to be in C:\ProgramData but that hasn't been updated since the install. Thoughts?

[KnifMelti]

Policy SAYS it is applied and registry entries have appeared where they should be. However, I have GPO in the Get Black/White List from external Path (URL/UNC/GPO/Local) setting but am "Intune only", so where is this being pushed to and managed on the end machine? It used to be in C:\ProgramData but that hasn't been updated since the install. Thoughts?

In the GPO itself:

[spitty78]

Oh yes, I see it here: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Romanitho\Winget-AutoUpdate\BlackList
No longer a file stored on the machine, but rather registry location. Thank you.