24-05-2023 10:37 PM
Last updated
Was this helpful?
Disclaimer: All information and content in this blog post is provided without any warranty whatsoever. The entire risk of using this information or executing the provided content remains with you. Under no circumstances should the mentioned persons or vendors, the author, or anyone else involved in creating these blog posts be held liable for any damage or data loss.
I’ve been writing about Windows 365 over the past few months, and in the original Windows 365 blog post I quickly mentioned that users by default doesn’t have local admin rights on their Cloud PC(s), and how to grant users local administrator privileges. The weather is cold and it’s raining today, and now that I’m just sitting here in my home office with a freshly brewed cup of coffee, why not write a post about how to manage local administrator rights on Windows 365 Cloud PCs.
Like in every great cooking show on television I’ve cheated a bit, and already prepared a security group within my on-prem Active Directory and it has been synced with AD Connect to Azure AD. This security group is named “W365_Enterprise_Local_Admin” and will only contain users that I will grant local admin rights.
I already created a filter for Windows 365 Cloud PCs, but you can copy the rule syntax used in my filter. (device.model -contains “Cloud PC”)
Once you have created the Windows 365 Cloud PC filter, you can go ahead and create the custom configuration profile. Click on Devices | Configuration profiles | Create profile Select Windows 10 and later in the drop-down menu. Select Templates in the drop-down menu. Select Custom on the list and click Create.
Fill in the required field and click Next.
Click Add.
Name
Add Domain Group to Local Administrator Group
Description
This is optional.
OMA-URI
./Vendor/MSFT/Policy/Config/LocalUsersAndGroups/Configure
Data type
String
Value
<GroupConfiguration> < accessgroup desc = “S-1-5-32-544”> <group action = “U”/> <add member = “MINDCORELABW365_Enterprise_Local_Admin”/> </accessgroup> </GroupConfiguration>
Click Next. Set scope tags if needed and click Next.
Add the security group and filter as Include in filter mode. Click Next. Set applicability rules if needed and click Next.
Review your configuration and click Create.
To monitor the status of the configuration profile, click on Devices | Configuration profiles and select the profile.
To check the filter evaluation on a Windows 365 Cloud PC, click on Devices | Windows and choose the Cloud PC. Click on Filter evaluation (preview) and select the configuration profile from the list.
If I connect to my Cloud PC, I can confirm that the security group has been added to the local administrator group. Awesome!
Another way to grant a user local administrator privileges, is to create a Windows 365 user setting.
The main difference between the two approaches is that the custom configuration profile adds a domain security group (which probably contains several users) to the local administrator group, and the Windows 365 user setting adds the logged-on user directly to the local administrator group (if that user is a member of the domain security group used in the user setting).
Both scenarios are quite dynamic as you only need to remove the user from the domain security group to take away the local administrator privileges from the end-user. Click on Devices | Windows 365 | User settings Click on Add.
Fill in the required field, tick the Enable Local admin check box, and click Next.
Add the security group and click Next.
Review your configuration and click Create.
The Windows 365 user setting didn’t add the logged-on user to the local administrator group, on my current Windows 365 Cloud PC, probably because it was provisioned with a custom Windows 11 image where I changed the system locale language to Danish before sysprep (which also translates the local group names to Danish during provisioning of new Cloud PCs).
If I reprovision my Windows 365 Cloud PC with a standard gallery Windows 11 image (which is in English), I can confirm that my user account has been added to the local administrator group, which kind of strengthens my suspicion that Windows 365 user settings are currently not working on custom images where you have changed the system locale language.
After a while, the custom configuration profile will also be applied to my Cloud PC if the profile still has an assignment.
In this blog post you have learned how to grant a user local administrator privileges on their Windows 365 Cloud PC. If you are using a custom image and you have changed the system locale language, the Windows 365 user settings will probably not work, but by the time of reading this blog post, it may have been fixed by Microsoft. Happy testing!
As always, if you have any questions regarding this topic, feel free to reach out to me.
I know that it can be done with a Group Policy Object (GPO) and via PowerShell, but in this blog post, I will be focusing on a custom configuration profile and the Windows 365 user settings. The original blog post about –
Let’s get started by visiting the Microsoft Endpoint Manager admin center. Go to First, we will create a filter for Cloud PCs. Click on Devices | Filters (preview) | Create
Note. For adding Azure AD users and/or groups please read more about that in the Tip. You can use SID S-1-5-32-544 instead of the group name (Administrators). – I would especially recommend it if you are managing a multi-language environment since the SID is not language dependent. Fill in all the required fields and click Save.
