<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Lethsinspire</title>
	<atom:link href="https://lethsinspire.com/feed/" rel="self" type="application/rss+xml" />
	<link>https://lethsinspire.com</link>
	<description>Leth&#039;s inspire</description>
	<lastBuildDate>Thu, 17 Sep 2026 10:27:58 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.1.3</generator>

<image>
	<url>https://lethsinspire.com/wp-content/uploads/2026/09/cropped-lethsinspire-logo-32x32.png</url>
	<title>Lethsinspire</title>
	<link>https://lethsinspire.com</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Application Control for Business can break Autopilot User ESP in specific scenarios</title>
		<link>https://lethsinspire.com/application-control-for-business-can-break-autopilot-user-esp-in-specific/</link>
					<comments>https://lethsinspire.com/application-control-for-business-can-break-autopilot-user-esp-in-specific/#respond</comments>
		
		<dc:creator><![CDATA[Morten Leth Hedegaard]]></dc:creator>
		<pubDate>Thu, 17 Sep 2026 09:53:43 +0000</pubDate>
				<category><![CDATA[Windows Management]]></category>
		<category><![CDATA[ACfB]]></category>
		<category><![CDATA[Device Management]]></category>
		<category><![CDATA[Intune]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[WDAC]]></category>
		<guid isPermaLink="false">https://lethsinspire.com/?p=1582</guid>

					<description><![CDATA[TL;DR If you roll out an&#160;Application Control for Business policy with a Managed Installer to a device that is&#160; going through Windows Autopilot, and your Device ESP doesn&#8217;t contain at least one Win32 app, and your User ESP&#160;has at least one Win32 App, you can end up with a User ESP failure.&#160;The Managed Installer policy [&#8230;]]]></description>
										<content:encoded><![CDATA[		<div data-elementor-type="wp-post" data-elementor-id="1582" class="elementor elementor-1582">
						<section class="elementor-section elementor-top-section elementor-element elementor-element-191c3112 elementor-section-boxed elementor-section-height-default elementor-section-height-default" data-id="191c3112" data-element_type="section" data-e-type="section">
						<div class="elementor-container elementor-column-gap-default">
					<div class="elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6a0d4230" data-id="6a0d4230" data-element_type="column" data-e-type="column">
			<div class="elementor-widget-wrap elementor-element-populated">
						<div class="elementor-element elementor-element-1e4850d4 elementor-widget elementor-widget-text-editor" data-id="1e4850d4" data-element_type="widget" data-e-type="widget" data-widget_type="text-editor.default">
				<div class="elementor-widget-container">
									<h2>TL;DR</h2>
<p>If you roll out an&nbsp;<strong>Application Control for Business</strong> policy with a Managed Installer to a device that is&nbsp; going through Windows Autopilot, and your <strong>Device ESP</strong> doesn&#8217;t contain at least one Win32 app, and your <b>User ESP</b>&nbsp;has at least one Win32 App, you can end up with a <strong>User ESP failure</strong>.&nbsp;The Managed Installer policy is delivered through an Intune Remediation. The client doesn&#8217;t execute a newly assigned remediation the instant it&#8217;s received — Intune&#8217;s internal job scheduler (SerialJobScheduler) queues it and runs it on its own interval, separate from the Win32 app agent&#8217;s install timeline — so the policy can land after User ESP has already started tracking your Win32 apps. Those apps then sit in&nbsp;<span style="color: #d63384; font-family: monaco, consolas, 'Andale Mono', 'DejaVu Sans Mono', monospace; font-size: 14px;">InProgressPendingManagedInstaller</span>, waiting for a policy that hasn&#8217;t arrived yet, and by the time it does, ESP has already moved on without them.</p>
<p>The <b>fix</b> is simple once you know the mechanism: <strong>make sure Device ESP has at least one Win32 app</strong>. That forces Application Control for Business to wait for the Managed Installer policy <em>during <b>Device ESP</b></em>, before Autopilot ever hands control to <b>User ESP</b>.</p>
<p>This post walks through the mechanism and backs every step with lines pulled from an actual <code>MdmDiagReport</code> collected on the affected device &#8211; though annonymised.</p>
<h2>The environment</h2>
<ul>
<li><strong>Device ESP</strong> apps:
<ul>
<li>Microsoft 365 Apps (installed as <em>Microsoft 365 Apps</em>, <strong>not</strong> a Win32 app — it&#8217;s a Click-to-Run app type) (yes, i know, per Microsoft docs. you should not enable this, but some clients still want to do that).</li>
<li>Company Portal (a UWP/Store app, also not Win32)</li>
</ul>
</li>
<li><strong>User ESP</strong> apps:
<ul>
<li>3 Win32 apps</li>
</ul>
</li>
<li>An <span style="font-weight: bold; color: #1b1525;">Application Control for Business</span><span style="color: #1b1525;"> policy</span>&nbsp;with Managed Installer enabled.</li>
<li>A <b>Managed Installer</b> configuration created from the builtin policy from Intune.</li>
</ul>
<div>&nbsp;</div>
<div>
<h2 style="color: #1b1525;">The problem</h2>
</div>
<p>The Managed Installer policy is pushed via a <b>Proactive Remediation</b>, which — unlike a normal device configuration profile — isn&#8217;t applied to the client the instant it&#8217;s assigned. The client only picks it up on its own policy check-in cycle, independent of the Win32 app agent&#8217;s install timeline.</p>
<p>Because neither app in <b>Device ESP</b> is a Win32 app<b>, </b>nothing in <b>Device ESP</b> ever needs the <b>Managed Installer</b> AppLocker rule. <b>Device ESP</b> can complete perfectly fine while the <b>Managed Installer</b> policy is still nowhere near being applied, resulting in the <b>User ESP </b>failing on Application install.</p>
<h2>What the logs actually show</h2>
<h3>1. Device ESP registers a single, non-Win32-blocking app</h3>
<p>Logfile: Appworkload.log</p>
<pre><code>[Win32App][ESPAppLockInProcessor] 1 app(s) have been registered for ESP tracking
for device. 0 app(s) were skipped.</code></pre>
<p>At this point the device is still in Device ESP. Only one app is registered for tracking here (Company Portal); Microsoft 365 Apps doesn&#8217;t go through the Win32 app agent at all, so there&#8217;s no Win32 app whose enforcement is gated by AppLocker/Managed Installer during this phase.</p>
<h3>2. Device ESP finishes, User ESP starts tracking the 3 Win32 apps</h3>
<p>Logfile: Appworkload.log</p>
<pre><code>[Win32App][ESPAppLockInProcessor] 3 app(s) have been registered for ESP tracking
for user &lt;GUID&gt;. 0 app(s) were skipped.
0 app(s) were tracked in previous phase.
</code></pre>
<p>This is the moment Autopilot moves from Device ESP into User ESP (Account Setup), and the three Win32 apps assigned to the user start being processed.</p>
<h3>3. The Managed Installer policy isn&#8217;t there yet</h3>
<div>Logfile: IntuneManagementExtension.log</div>
<pre><code>[ManagedInstallerSync] Did not find managed installer policy
</code></pre>
<p>This log entry lands <strong>2 seconds</strong> after User ESP started tracking the Win32 apps. The client is now trying to enforce the Managed Installer requirement for Win32 app installs, but the AppLocker &#8220;ManagedInstaller&#8221; rule collection hasn&#8217;t been delivered by the remediation script yet.</p>
<h3>4. Every Win32 app targeted at the user is put on hold</h3>
<p>The Win32 app agent logs show, for each of the Win32 apps, the same pattern within the <code>EspPhase: AccountSetup</code> window, in this sample, i have 3 apps:</p>
<p>Logfile: AppWorkload.log</p>
<pre><code>[Win32App] Managed installer opt-in is enabled, but the policy has not been set
on this client, app will not be downloaded until the policy is processed.
PolicyId: &lt;Application_GUID&gt;

[Win32App][ReportingManager] Download state for app with id:
&lt;Application_GUID&gt; has been updated.
Report delta: {"EnforcementState":{"OldValue":"InProgress",
"NewValue":"InProgressPendingManagedInstaller"}}

[Win32App][DownloadActionHandler] Pending Managed Installer enforcement.
App will be processed again after managed installer is enabled.
</code></pre>
<p>The same three-line pattern repeats for all three Win32, and the apps are parked in <code>InProgressPendingManagedInstaller</code> almost simultaneously, right at the start of User ESP.</p>
<p>A note which also appears in the logfile is that: the <em>download requests</em> for these apps went out with <code>"EspPhase":"AccountSetup"</code> in the JSON payload (visible in the same log lines) — confirming this is happening inside User ESP, not Device ESP.</p>
<h3>5. The Managed Installer policy only lands minutes later</h3>
<div>
<p>Logfile: AgentExecutor.log</p>
<pre><code>VerifyCompliance Effective AppLocker Policy is: ... RuleCollection Type="ManagedInstaller" ...
[...]
detect.ps1 Intune management extension is set as the managed installer.</code></pre>
<p>The AppLocker policy containing the ManagedInstaller rule collection — the thing that actually turns on Managed Installer enforcement — shows up as applied here, roughly 2.5 minutes after the Win32 apps were parked pending it. That delay is a direct consequence of the policy being delivered via Remediation: the client has to pick up the policy on its own check-in cycle, queue it in the Intune Management Extension&#8217;s internal job scheduler (SerialJobScheduler), and only then execute it via agentexecutor.exe -remediationScript — a path with its own timing, independent of and uncoordinated with the Win32 app agent&#8217;s install sequence.</p>
</div>
<h3>6. Meanwhile, ESP has already moved on</h3>
<p>The Managed Installer policy briefly took effect once, but the app&#8217;s enforcement state flipped from <span style="color: #d63384; font-family: monaco, consolas, 'Andale Mono', 'DejaVu Sans Mono', monospace; font-size: 14px;">InProgressPendingManagedInstaller</span> to <span style="color: #d63384; font-family: monaco, consolas, 'Andale Mono', 'DejaVu Sans Mono', monospace; font-size: 14px;">InProgress</span> and back to <span style="color: #d63384; font-family: monaco, consolas, 'Andale Mono', 'DejaVu Sans Mono', monospace; font-size: 14px;">InProgressPendingManagedInstaller</span> within one second. By the time the app finally reached <span style="color: #d63384; font-family: monaco, consolas, 'Andale Mono', 'DejaVu Sans Mono', monospace; font-size: 14px;">EnforcementState: Success</span>, the same status report shows <b>&#8220;EspPhase&#8221;:0</b> instead of <b>&#8220;EspPhase&#8221;:3</b> — meaning ESP was no longer tracking it at all. In other words: the app did eventually install correctly once the Managed Installer policy was fully in place, but only after <b>User ESP</b> had already exited, so from ESP&#8217;s perspective the installation counts as failed.</p>
<h2>Why Device ESP would have prevented this</h2>
<p>If <b>Device ESP</b> had contained <strong>at least one Win32 app</strong>, that app would have hit the exact same <code>Managed installer opt-in is enabled, but the policy has not been set on this client</code> check — but <em>during Device ESP</em>. <b>Device ESP&#8217;s</b> tracking window is evaluated before Autopilot is allowed to proceed to <b>User ESP</b> at all, so Autopilot would simply wait (within its own timeout) at the device phase until the Managed Installer policy landed — which is also when Application Control for Business&#8217;s AppLocker policy is normally in place early, since it&#8217;s rolled out early in the flow.</p>
<p>In other words: forcing at least one Win32 app into Device ESP turns the Managed Installer dependency into a <em>device-phase</em> blocker instead of a <em>user-phase</em> blocker — and the device phase is exactly where you have the runway to let a Remediation-delivered policy actually land before the client needs it.</p>
<h2>The fix</h2>
<p><strong>Ensure Device ESP always contains at least one Win32 app</strong> in autopilot that uses:</p>
<ul>
<li>Application Control for Business with Managed Installer enabled, <strong>and</strong></li>
<li>A Managed Installer policy delivered via Intune&#8217;s builtin managed installer, which uses a &#8220;Proactive Remediation script).</li>
</ul>
<div>In this above scenario we used the builtin &#8220;Microsoft 365 Apps&#8221; policy to install in the device scenario, we could have &#8220;solved&#8221; our issue by converting this into a Win32 app, but we did not want to do that. Hence we made a script that created a registry, converted it into a Win32 app, and deployed that in <b>device ESP</b> &#8211; alongside the other applications.&nbsp;</div><div><br></div>
<p>This is a small, low-risk addition to your Device ESP app list, but it closes a real timing race that otherwise makes Autopilot ESP intermittently — and confusingly — unstable, since the failure is entirely dependent on how fast the remediation happens to run on a given device.</p>								</div>
				</div>
					</div>
		</div>
					</div>
		</section>
				</div>
		]]></content:encoded>
					
					<wfw:commentRss>https://lethsinspire.com/application-control-for-business-can-break-autopilot-user-esp-in-specific/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>Reflections from an Organizer</title>
		<link>https://lethsinspire.com/wrapping-up-experts-live-denmark-reflections-from-an-organizer/</link>
					<comments>https://lethsinspire.com/wrapping-up-experts-live-denmark-reflections-from-an-organizer/#respond</comments>
		
		<dc:creator><![CDATA[Morten Leth Hedegaard]]></dc:creator>
		<pubDate>Tue, 03 Mar 2026 11:10:32 +0000</pubDate>
				<category><![CDATA[Event Planning]]></category>
		<category><![CDATA[Event coordination]]></category>
		<category><![CDATA[Volunteers]]></category>
		<guid isPermaLink="false">http://lethsinspire.com/?p=1497</guid>

					<description><![CDATA[Wrapping Up Experts Live Denmark Reflections from an Organizer I’m writing this for one simple reason: to share what I learned. Organizing Experts Live Denmark gave me insights I did not have before — and I believe experiences are more valuable when they are shared. This is not a post about what went wrong. It [&#8230;]]]></description>
			<style id="elementor-post-1497">.elementor-1497 .elementor-element.elementor-element-fbad212{width:var( --container-widget-width, 104.8% );max-width:104.8%;--container-widget-width:104.8%;--container-widget-flex-grow:0;}</style>							<content:encoded><![CDATA[		<div data-elementor-type="wp-post" data-elementor-id="1497" class="elementor elementor-1497">
						<section class="elementor-section elementor-top-section elementor-element elementor-element-17e786f elementor-section-boxed elementor-section-height-default elementor-section-height-default" data-id="17e786f" data-element_type="section" data-e-type="section">
						<div class="elementor-container elementor-column-gap-default">
					<div class="elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6b769d5" data-id="6b769d5" data-element_type="column" data-e-type="column">
			<div class="elementor-widget-wrap elementor-element-populated">
						<div class="elementor-element elementor-element-fbad212 elementor-widget__width-initial elementor-widget elementor-widget-text-editor" data-id="fbad212" data-element_type="widget" data-e-type="widget" data-widget_type="text-editor.default">
				<div class="elementor-widget-container">
									<h1>Wrapping Up Experts Live Denmark</h1>
<h2>Reflections from an Organizer</h2>
<p>I’m writing this for one simple reason: to share what I learned.</p>
<p>Organizing Experts Live Denmark gave me insights I did not have before — and I believe experiences are more valuable when they are shared. This is not a post about what went wrong. It is not a post about pointing fingers. It is a reflection on what I learned, what worked, and what I believe can be improved next time.</p>
<p>Because no matter how well something is executed, it can always be refined.</p>
<p>Before diving into the details, I also want to make something very clear: the volunteer team this year was exceptional. Truly. The level of ownership, professionalism, flexibility, and energy was impressive. You didn’t just “help out” — you delivered. And you made the event stronger.</p>
<p>To dive more into who it actually was, you can find all the volunteers here:&nbsp;<br><a href="https://expertslive.dk/volunteers-eldk26/">Volunteers ELDK26 &#8211; Experts Live Denmark</a></p>
<p>With that said, my reflections are about structure, planning, communication, and leadership decisions — the things I was responsible for.</p>
<h2>My Story — From Volunteer to Organizer</h2>
<p>I have always wanted to be part of the IT pro community. Sharing is caring — that has been my mindset for as long as I can remember. So when the opportunity arose to move from being a volunteer to becoming an organizer, I joined in without any hesitation.</p>
<p>I had no expectations. I had a lot of energy. And I had absolutely no idea what hit me.</p>
<p>The jump from volunteering to organizing is bigger than it looks from the outside. As a volunteer, you show up, you help, you contribute — and that is incredibly valuable. As an organizer, you carry the weight of decisions, logistics, communication, and the wellbeing of everyone involved. It is a different kind of responsibility, and it stretched me in ways I did not anticipate.</p>
<p>But that is exactly why it was worth it. I learned more about leadership, communication, and community in this experience than I could have learned from any course or certification. And that learning — earned through real situations, real pressure, and real people — is something I will carry with me going forward.</p>
<p>This year, many of my responsibilities were outside my usual area of expertise. I’m a Modern Workplace professional, but at Experts Live Denmark I was responsible for:</p>
<ul>
<li>All volunteers</li>
<li>The check-in experience</li>
<li>Social media prior to the event</li>
</ul>
<p>Each area came with its own challenges — especially volunteer management.</p>
<h2>Volunteer Management – A Bigger Task Than It Sounds</h2>
<p>Handling volunteers may sound simple. It is not.</p>
<p>Volunteers are the face of the event. They are often the first and last people attendees interact with. If they don’t present themselves professionally and confidently, it reflects on the entire conference.</p>
<p>That responsibility mattered to me — and I wanted to get it right. And as I said — the team delivered.</p>
<h3>Volunteer Sign-Up</h3>
<p>We used Microsoft Forms for volunteer sign-up. At the time, it seemed sufficient — but in hindsight, we missed some important details.</p>
<ul>
<li>I forgot to collect T-shirt sizes.</li>
<li>I didn’t structure the information as clearly as I could have.</li>
<li>We ended up using two forms, which created unnecessary administrative work.</li>
</ul>
<p>Having two forms meant consolidating data manually and ensuring everyone received correct communication. It cost time that could have been spent elsewhere.</p>
<p>What I would do differently next time:</p>
<ul>
<li>Get all necessary information in the first form</li>
<li>Think through logistics before publishing the sign-up</li>
<li>Ensure the data structure supports later communication</li>
</ul>
<p>Simplicity early saves complexity later. But I also want to make sure I address the package a volunteer gets, to begin with.</p>
<p>All volunteers receive the same package:</p>
<ul>
<li>An appreciation gift</li>
<li>Invitation to the appreciation dinner</li>
<li>Volunteer T-shirt</li>
<li>Hotel accommodation if needed</li>
<li>Limited shifts to allow networking</li>
</ul>
<p>Everyone is treated equally and receives the same level of appreciation and support.</p>
<p>What I should have done better from the beginning was creating stronger ownership around the role — already in the sign-up form. I wanted to ensure that volunteering was not perceived as simply a “free ticket,” but as a responsibility and a commitment to something bigger.</p>
<p>The vast majority of volunteers absolutely understood this — and showed up with exactly the right mindset.</p>
<p>We did, however, experience last-minute cancellations. And while unforeseen circumstances can always happen, I don’t think it was fully understood how much impact that has behind the scenes.</p>
<p>When someone withdraws at the last moment:</p>
<ul>
<li>Tasks have already been distributed</li>
<li>Schedules are aligned</li>
<li>Hotel rooms are booked</li>
<li>T-shirts are ordered</li>
<li>Awards and appreciation gifts are prepared</li>
<li>Budgets are committed</li>
</ul>
<p>It affects planning, finances, and the workload of the remaining team.</p>
<p>I mention this not to assign blame — but because it is worth understanding for anyone considering volunteering.</p>
<p>Next year, I will:</p>
<ul>
<li>Set clearer expectations around commitment</li>
<li>Communicate the responsibility aspect more explicitly</li>
<li>Make sure volunteers understand the full impact of last-minute changes</li>
</ul>
<p>Because volunteering at an event of this scale is not just participation — it is ownership.</p>
<h2>Volunteer Selection Process</h2>
<p>We used a simple “first come, first served” approach. In hindsight, we were fortunate — we ended up with the right people.</p>
<p>However, we lacked a structured selection and confirmation process.</p>
<p>Next year, I will:</p>
<ul>
<li>Send short, clear confirmations:
<ul>
<li>“You are selected”</li>
<li>“You are not selected”</li>
</ul>
</li>
<li>Ask volunteers to lock the dates in their calendars immediately</li>
<li>Clearly communicate who to contact if circumstances change</li>
</ul>
<p>Clarity early prevents confusion later.</p>
<h2>Task Distribution</h2>
<p>With 42 volunteers, this was one of the trickier parts. I needed to ensure everyone knew exactly what their tasks were — and I could not keep 42 individual schedules in my head.</p>
<p>We chose to do it in Excel. It worked well: once tasks and volunteer assignments were mapped, the sheet could be exported to CSV and used for mail merge. That allowed me to send personalized emails to each volunteer with their individual schedule — no mass emails, just direct 1-to-1 communication.</p>
<p>The process:</p>
<ul>
<li>Create a full overview of all tasks</li>
<li>Define how many volunteers were needed per task</li>
<li>Assign names to each task</li>
</ul>
<p>We used Copilot to help with assignments instead of doing everything manually. It sped up the process while still giving us control. I also wanted to automate Outlook calendar invitations for shift blocks, but time did not allow for that this year.</p>
<p>This approach worked — but it was centralized around me. Next year, I want to change that.</p>
<p>Instead of assigning everyone from one sheet, I want to structure the work around defined task areas — each with a designated leader who coordinates their own team. The structure would cover three phases: pre-event setup (venue prep, sponsor materials, attendee bags), event day operations (wardrobe, speaker support, badge scan, check-in, general operations, and guards), and post-event teardown. Each area gets one leader and a dedicated team of volunteers.</p>
<p>The key difference next year will not be the tool — Excel still works — but the ownership model. Responsibility should be distributed, not centralized.</p>
<p>If you want our Excel template for task distribution and mail merge, reach out and I will share it.</p>
<h2>Communication</h2>
<p>Communication balance is difficult. Some people want all the details. Others want only what is essential.</p>
<p>Before the event, I aimed for a middle ground. In hindsight, we should have made additional information available for those who wanted more depth, without overwhelming everyone. Next year: core information will be mandatory, extended information will be optional and easily accessible.</p>
<p>On event day, we used Signal. It worked — but it was not optimal. We had one channel for AV issues and one for all volunteers, and it sometimes became too chatty. During a live event, communication needs to be clear, direct, and operational. Next year, I will split it into three channels: AV, operations, and social — so volunteers can engage without disturbing operational flow.</p>
<h2>Volunteer Introduction Session</h2>
<p>We hosted an introduction session at 14:00 the day before the event.</p>
<p>Next year, I would:</p>
<ul>
<li>Schedule it earlier</li>
<li>Walk the venue physically</li>
<li>Review task areas in person</li>
<li>Align expectations face-to-face</li>
</ul>
<p>Some volunteers need that walkthrough. Others don’t. But it creates confidence and clarity.</p>
<h2>Trust Over Micromanagement</h2>
<p>With 1,400 attendees and 42 volunteers, there is no room for micromanagement. Each volunteer needs to own their area, feel empowered to make decisions, and know when to escalate. Minor issues should be solved on the spot. Major ones should go up the chain. Trust creates momentum — and that trust has to be established before event day, not during it.</p>
<h2>Final Thoughts</h2>
<p>You cannot anticipate everything in a large-scale event. There will always be blind spots — and that is okay. What matters is that you set expectations, empower people, reflect honestly, and keep improving.</p>
<p>With that in mind, after the dust settled I sat down and asked myself three honest questions.</p>
<h3>Will I do it again?</h3>
<p>Yes. Without hesitation, yes. Anytime. Organizing Experts Live Denmark was one of the most demanding things I have done — but also one of the most rewarding. The energy you get from seeing an event come together, from watching volunteers step up, from hearing attendees say they had a great experience — that is something you cannot replicate anywhere else. So yes, I will absolutely do it again.</p>
<h3>Is the time well spent?</h3>
<p>It takes a significant amount of time. Evenings, weekends, early mornings — the hours add up. But when I look at what I gained — the skills, the relationships, the perspective — I would not trade it. The time is not just spent. It is invested. In the community, in the event, and in yourself.</p>
<h3>Would I recommend it to others?</h3>
<p>Absolutely. If you have ever considered stepping up — whether as a volunteer or as an organizer — I encourage you to do it. It is hard work. It will challenge you. But the people you meet and the things you learn will make it more than worth it. The community needs people who care, and if you are reading this, you are probably one of them.</p>
<p>So join in. Step up. You will not regret it.</p>
<p>If you have questions about how we handled any of this, I am happy to share details. The more we share, the stronger our events — and our community — become.</p>								</div>
				</div>
					</div>
		</div>
					</div>
		</section>
				</div>
		]]></content:encoded>
					
					<wfw:commentRss>https://lethsinspire.com/wrapping-up-experts-live-denmark-reflections-from-an-organizer/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>Creating Windows Update for Business &#8211; Rings</title>
		<link>https://lethsinspire.com/creating-windows-update-for-business-rings/</link>
					<comments>https://lethsinspire.com/creating-windows-update-for-business-rings/#respond</comments>
		
		<dc:creator><![CDATA[Morten Leth Hedegaard]]></dc:creator>
		<pubDate>Mon, 24 Mar 2025 09:25:49 +0000</pubDate>
				<category><![CDATA[Azure]]></category>
		<guid isPermaLink="false">http://lethsinspire.com/?p=70</guid>

					<description><![CDATA[Introduction: Companies want to make sure that when doing deployments of Microsoft Updates, they go out through the organisation in a randomized facion. The reasoning behind it needing to be randomized is, you dont want to have the &#8220;entire IT&#8221; department as ring 1, because if the &#8220;shit hits the fan&#8221; your entire IT has [&#8230;]]]></description>
										<content:encoded><![CDATA[
<p class="wp-block-paragraph"><strong>Introduction:</strong></p>



<p class="wp-block-paragraph">Companies want to make sure that when doing deployments of Microsoft Updates, they go out through the organisation in a randomized facion. The reasoning behind it needing to be randomized is, you dont want to have the &#8220;entire IT&#8221; department as ring 1, because if the &#8220;shit hits the fan&#8221; your entire IT has been shut down, and they then need to only focus on fixing the &#8220;possibly broken update&#8221; instead of taking care of the users.<br>So what you want to do instead is, having one or 2 in Ring 1, and then have the others in other rings.<br>Besides the needs to have a randomized Ring methology you also need to be able to circumvent the Ring methology, because it is randomized.</p>



<p class="wp-block-paragraph">Of course, you can use AutoPatch &#8211; this solves this problem, but in case you dont have the licenses to support this, you need to create this yourself.</p>



<p class="wp-block-paragraph"><strong>Solution:</strong> </p>



<p class="wp-block-paragraph">The solution to this really is not that hard, because you can use the same approach as you have historically in Configuration Manager, use the GUID. So, every ressource in Entra ID has a GUID, this GUID seems randomized, but it is in fact not that randomized as one would think. It consists of hexadicimal symbols which means we have 16 characters at our disposal, meaning 1 symbol represent approximently 6.25%.<br>This knowledge we can use to our advantage, and create rings based on this. We can fx. create 4 rings, using these queries:</p>



<p class="wp-block-paragraph"><strong>WUfB – Windows &#8211; Ring 1 &#8211; Pilot</strong></p>



<p class="wp-block-paragraph"><code>(device.deviceOSType -eq "Windows") -AND<br>(device.deviceManagementAppId -eq "54b943f8-d761-4f8d-951e-9cea1846db5a") -AND<br>(device.deviceOwnership -eq "Company") -AND<br>(<br>     (device.deviceCategory -eq "Client group 1") -OR<br>     (device.deviceId -startsWith "0") -OR<br>     (device.deviceId -startsWith "1") ) -AND<br>(<br>         (device.deviceCategory -ne "Client group 2") -AND<br>         (device.deviceCategory -ne "Client group 3") -AND<br>         (device.deviceCategory -ne "Client group 4") <br>)</code></p>



<p class="wp-block-paragraph"><strong>Breaking down this query:</strong></p>



<p class="wp-block-paragraph"><strong>deviceOSType</strong> &#8211; this of course is the OS type<br><strong>deviceManagementAppId</strong> &#8211; this ID means that the device is co-managed, you can also use Intune managed, or not have it at all, and cover all devices.<br><strong>deviceCategory</strong> &#8211; This category is a category one needs to create yourself, and name what you want.<br><strong>deviceId</strong> &#8211; This is where the fun starts, this is the hexadicimal unique identifier.</p>



<p class="wp-block-paragraph"><strong>WUfB – Windows &#8211; Ring 2</strong></p>



<p class="wp-block-paragraph"><code>(device.deviceOSType -eq "Windows") -AND <br>(device.deviceManagementAppId -eq "54b943f8-d761-4f8d-951e-9cea1846db5a") -AND<br>(device.deviceOwnership -eq "Company") -AND<br>( <br>    (device.deviceCategory -eq "Client group 2") -OR <br>    (device.deviceId -startsWith "2") -OR <br>    (device.deviceId -startsWith "3") -OR <br>    (device.deviceId -startsWith "4") <br>) -AND <br>( <br>        (device.deviceCategory -ne "Client group 1") -AND <br>        (device.deviceCategory -ne "Client group 3") -AND <br>        (device.deviceCategory -ne "Client group 4")<br>)</code></p>



<p class="wp-block-paragraph"><strong>WUfB – Windows &#8211; Ring 3</strong></p>



<p class="wp-block-paragraph"><code>(device.deviceOSType -eq "Windows") -AND<br>(device.deviceManagementAppId -eq "54b943f8-d761-4f8d-951e-9cea1846db5a") -AND<br>(device.deviceOwnership -eq "Company") -AND<br>(<br>     (device.deviceCategory -eq "Client group 3") -OR<br>     (device.deviceId -startsWith "5") -OR<br>     (device.deviceId -startsWith "6") -OR<br>     (device.deviceId -startsWith "7") -OR<br>     (device.deviceId -startsWith "8") ) -AND<br>(<br>         (device.deviceCategory -ne "Client group 1") -AND<br>         (device.deviceCategory -ne "Client group 2") -AND<br>         (device.deviceCategory -ne "Client group 4") <br>)</code></p>



<p class="wp-block-paragraph"><strong>WUfB – Windows &#8211; Ring 4</strong></p>



<p class="wp-block-paragraph"><code>(device.deviceOSType -eq "Windows") -AND<br> (device.deviceManagementAppId -eq "54b943f8-d761-4f8d-951e-9cea1846db5a") -AND<br>(device.deviceOwnership -eq "Company") -AND<br>(<br> (device.deviceCategory -eq "Client group 4") -OR<br> (device.deviceId -startsWith "9") -OR<br> (device.deviceId -startsWith "A") -OR<br> (device.deviceId -startsWith "B") -OR<br> (device.deviceId -startsWith "C") -OR<br> (device.deviceId -startsWith "D") -OR<br> (device.deviceId -startsWith "E") -OR<br> (device.deviceId -startsWith "F") ) -AND<br>(<br>         (device.deviceCategory -ne "Client group 1") -AND<br>         (device.deviceCategory -ne "Client group 2") -AND<br>         (device.deviceCategory -ne "Client group 3") <br>)</code></p>



<p class="wp-block-paragraph">And that my dear friends, is how you can create groups to be used to assign your Windows Update for Business policies. It can also be used to deploy your feature updates.</p>
]]></content:encoded>
					
					<wfw:commentRss>https://lethsinspire.com/creating-windows-update-for-business-rings/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>Introductions</title>
		<link>https://lethsinspire.com/introductions/</link>
					<comments>https://lethsinspire.com/introductions/#respond</comments>
		
		<dc:creator><![CDATA[Morten Leth Hedegaard]]></dc:creator>
		<pubDate>Fri, 21 Mar 2025 11:06:29 +0000</pubDate>
				<category><![CDATA[Intro]]></category>
		<guid isPermaLink="false">http://lethsinspire.com/?p=63</guid>

					<description><![CDATA[Hallo dear reader.This here, is my very first blog post, and this, hopefully is not going to be the last one. My Name is Morten Leth Hedegaard, i work as a consultant in the area of Modern Workplace. My primary focus is endpoints, whether it be, iOS, Android, Mac&#8217;s or Windows devices.I thrive in challenging [&#8230;]]]></description>
										<content:encoded><![CDATA[
<p class="wp-block-paragraph">Hallo dear reader.<br>This here, is my very first blog post, and this, hopefully is not going to be the last one.</p>



<p class="wp-block-paragraph">My Name is Morten Leth Hedegaard, i work as a consultant in the area of Modern Workplace. My primary focus is endpoints, whether it be, iOS, Android, Mac&#8217;s or Windows devices.<br>I thrive in challenging tasks, and love to troubleshoot complex problems.</p>



<p class="wp-block-paragraph">This blog has been created to facilitate my experiences as a consultant, but also to have a place for me to dump thought and ideas.</p>



<p class="wp-block-paragraph">Kind Regards<br>Morten Leth Hedegaard</p>
]]></content:encoded>
					
					<wfw:commentRss>https://lethsinspire.com/introductions/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
	</channel>
</rss>

<!--
Object Caching 40/101 objects using Disk
Page Caching using Disk: Enhanced 

Served from: lethsinspire.com @ 2026-10-22 21:52:40 by W3 Total Cache
-->