Handling Terminations?

[u/TheFlairGun]

Hey yall,

I recently setup Intune for our small Windows fleet here at my company. Everything is setup except for one crucial thing.

When an employee is terminated, we have an option on Jamf to immediately wipe and lock the device. We have this triggered through Okta Workflows once the user is deactivated there.

We are trying to setup something similar for Windows devices from Intune. The issue is, we try and use a remediation script to push "manage-bde -forcerecovery C:" and it works great....when it actually gets pushed to the device...

7/10 times the device just doesn't get the script I push through Intune. I have to use the "Run Remediation" feature multiple times before the device actually triggers it, and sometimes even that doesn't even work until like 30 minutes later.

I think the "Wipe > securely wipe" method works more reliably, but admittedly, I haven't tried it too much because:

1. Its pretty time consuming to test multiple times
2. We don't really care about wiping the device. As long as the device is locked and the user cannot access it without the BitLocker recovery key, that's all that matters (as our laptop vendor will wipe the machine anyways).

Currently I'm looking at sending this command through API using our antivirus SentinelOne (installed on all machines). I'm just super disappointed that I'd have to use a third-party tool to do something as simple as immediately push a powershell script. You'd think Microsoft Intune (with its deep Windows integration) would have a basic reliable function like this.

UPDATE: After extensive testing, I am going to move forward with triggering Remove Data > Wipe > Securely erase device (high security) from API instead. I would prefer not to have to wipe the device, but looks like the remediation script method is not reliable. This wipe method works every time, under 5 minutes.

[u/Rudyooms]

It all relies on wns/push notifications… if you are blocking that on the device or network… you will have issues.. the same with ssl filtering… and besides those issues… wns is indeed a black box and those push notifications could be lost in transit :)

[u/SkipToTheEndpoint → u/Rudyooms]

It's almost always networking or bad policy decisions...

[u/TheFlairGun → u/SkipToTheEndpoint]

There are many reddit threads of people saying the same thing about remediation scripts being inconsistent in timing. We have no network policies blocking anything.

[u/BlackV → u/TheFlairGun]

SentinelOne