David Bailey

We block using a baseline using the below policy for the following apps. Then block CMD using profile: <Replace> <CmdID>ff9d3h54-c71e-453a-b1c9-28d2ef4c1d73</CmdID> <Item> <Target> <LocURI> ./user/vendor/MSFT/Policy/Config/ADMX_ShellCommandpromptRegeditTools/DisableCMD </LocURI> </Target> <Data> <![CDATA[<enabled/><data id="DisableCMDScripts" value="1"/>]]> </Data> </Item> </Replace> This way depending on your UAC setup we can right click and runas admin on CMD to allow access and launch PS/PS_ISE/Regedit etc. from there if required.

Are you able to confirm all the additional ADMX templates will come with GA release.. We are ideally looking for Edge and Office in the first instance. But will look for Chrome and Adobe further down the line(Jump to the answer in the video)

We had this issue and it was due to us removing and recreating the Airwatch application within Entra when creating the environment. There was a stale Airwatch entry lurking behind the scenes that only MS could see.

Hi Michael, Did you get anywhere with this? We are just testing the new Surface Copilot devices and having the same issue.