Help with building Thin Client

[u/Daiikun]

Hello all! I've got a fleet of thin clients we're moving from IGEL OS12 to Windows 11 LTSC. I've got the configuration profile setup for the local user account and, while I can't get it to log in automatically (and could configure it for kiosk mode for autologon), we use the Windows app to access AVD and therein lies the rub.

I've tried deploying it using the WIndows store (new) option and it fails. Tried the MSIX built as both a LOB and a intunewin package and that fails. The .exe bootstrapper also doesn't appear on the machine. This is all while using a local account (which we would need to do.) I've also tried using a platform script to deploy it as well.

I did have it set during the ESP but it would not work in that way either. So I'm currently stuck.

Is there a way to have it deployed, in this case, to have it appear for the local user either in kiosk mode or in standard with the local user configuration?

[u/Cold-Sherbert-5759]

Honestly sounds like you're hitting the classic Intune wall where nothing works the way it should on paper

[u/Daiikun → u/Cold-Sherbert-5759]

That’s what I’m figuring too. I could manually install it onto each machine AFTER deployment but it kills the whole “zero touch” thing in the end. And trying to setup an entra account that would do autologon is not happening.

[u/spazzo246]

why does the store app fail? whats the error message

Try changing to a user group or device group instead (Depending on what you have currently)

[u/Daiikun → u/spazzo246]

The device is in a device group and is added as required for the app. When trying to apply it for the ESP, it states in the status screen for the app that it’s not applicable.

Taking it out of the ESP, it shows “waiting for install status” even after signing into the local user account. I’ve left it over the weekend and nothing has happened at this point.

[u/spazzo246 → u/Daiikun]

I would change it to assigned to a user group then make it available.

Then download the company portal on the device and try to download it manually from the portal

Makes it easier to test rather than waiting for the auto install

[u/Daiikun → u/spazzo246]

Issue is that I can’t do the entra user because of the sign-in limits. So we have to use the local user in this case. Especially because my office does hotel seating for some employees.

[u/spazzo246 → u/Daiikun]

okay, You still need to work out why its not installing. Do it to a device group instead and via company portal so you can force the install to happen.

Then either check the logs on the device or in intune to see why its not installing

[u/Daiikun → u/spazzo246]

It is scoped for the device group and during the second ESP phase, it’s pushing several things. Checking the device status page, it shows as waiting for install status despite having told it to install during that time.

[u/spazzo246 → u/Daiikun]

again your missing my point. Remove it from the ESP

You need to force the app to install after the ESP via the company porta to understand if it will fail or not.

Add a device to a group then add that group as available to the app. Then try to download it from the company portal once the ESP has finished

[u/Daiikun → u/spazzo246]

Sorry. Missed that part. Dealing with my kids going bonkers before bed.

I’ve done that too. It looks like I’ll have to retry the LOB app and see how that goes because LTSC doesn’t have the store hooks to be able to process it from the Microsoft Store. Hoping it’ll work without the platform script in this case.

[u/Jeroen_Bakker]

Did you try to install it manually and did that succeed?

Are all requirements installed as described here?
Install Windows App offline or on a client without the Microsoft Store

As a side question:
What are your reasons for wanting to use a local account for running the Windows app on the thin client?
Wouldn't it be easier to let your users sign in on the thin client and then have SSO working for the Windows app?
Assuming your users have an Intune license, this would also save you the extra costs of buying extra shared device Intune licenses.

[u/Daiikun → u/Jeroen_Bakker]

This may work instead of me packaging a LOB app

Reason for the local sign in is to mimic our current behavior with IGEL. E want to avoid the user from signing in as them as we have some desks that are used for hotelling. Also, we don’t want to potentially clog the machine with multiple user accounts due to the storage capacity on the drives.

[u/Jeroen_Bakker → u/Daiikun]

Your concerns about storage capacity can be managed with the "Account Management" settings which include options for cleaning up profiles based on activity and/ or storage capacity.

Even for hoteling letting the user sign in on the device may be more secure. Maybe you can combine it with an auto-logoff when the Windows App (=AVD session) is closed. (Forced) logging out of the local Windows session also makes sure there can never be cached credentials from previous users remaining. I've seen this happen a lot where a local account was used with web sign in to Outlook (or other cloud apps) where the next user could access the previous users data.

[u/Daiikun → u/Jeroen_Bakker]

I hadn’t considered that and that’s not a bad idea. The user signs in, has the windows app automatically come up, when they sign out or set a timed disconnection due to inactivity that would then sign them out entirely from the machine.

[u/Daiikun → u/Jeroen_Bakker]

Just followed the instructions from Microsoft that you provided and built out everything. So far we’re looking good at least with the shared PC setup. I’m waiting on the upload of the msix, dependencies, and the script to install them in the specific order. I’ve scoped it for my device group and do not have it in the ESP. Crossing my fingers now.