Saltar al contenido
Microsoft scripts

Scripts de Intune

Detectar equipos sin Known Folder Move de OneDrive

Comprueba si la política de movimiento silencioso de carpetas conocidas (Escritorio, Documentos, Imágenes) apunta a tu tenant. Con exit 1 dispara la corrección que la configura.

Antes de correrloSolo lee el registro. Los equipos sin cliente de OneDrive se reportan como correctos. El permiso de Graph del encabezado no lo usa el código.

Ejemplo en México

Consultoría en Cuernavaca, 55 laptops

Se robaron una laptop con documentos locales sin respaldo y quieren que Escritorio y Documentos vivan en OneDrive.

detect-onedrive-kfm-not-configured.ps1

Identifica las laptops sin la política para corregirlas.

Cómo implementarlo

  1. Antes de subirlo, escribe el ID de tu tenant de Entra en $ExpectedTenantId; mientras siga con ceros, el script termina con error (exit 2).
  2. En el centro de administración de Microsoft Intune ve a Dispositivos > Administrar dispositivos > Scripts y correcciones (Scripts and remediations) > Remediations > Crear paquete de scripts.
  3. En Configuración sube detect-onedrive-kfm-not-configured.ps1 como script de detección y remediate-onedrive-kfm.ps1 como script de corrección.
  4. Deja desactivadas "Ejecutar con las credenciales del usuario" y "Aplicar verificación de firma", asígnalo primero a un grupo piloto y elige la frecuencia.
  5. Revisa en el paquete qué equipos no tienen la política.
Ver el código completo de detect-onedrive-kfm-not-configured.ps1
<#
.TITLE
    OneDrive Known Folder Move Detection Script

.SYNOPSIS
    Detects devices where OneDrive Known Folder Move is not configured via policy.

.DESCRIPTION
    Checks the OneDrive policy registry keys for silent Known Folder Move opt-in
    (KFMSilentOptIn with the tenant ID) and verifies the OneDrive sync client is
    installed. Returns exit code 1 when the KFM policy is missing or points to a
    different tenant, triggering the paired remediation that writes the policy keys.
    Desktop, Documents, and Pictures then move to OneDrive automatically at the next
    OneDrive sign-in.

.TAGS
    Remediation,Detection

.REMEDIATIONTYPE
    Detection

.PAIRSCRIPT
    remediate-onedrive-kfm.ps1

.PLATFORM
    Windows

.MINROLE
    Intune Service Administrator

.PERMISSIONS
    DeviceManagementManagedDevices.ReadWrite.All

.AUTHOR
    Ugur Koc

.VERSION
    1.0

.CHANGELOG
    1.0 - Initial release

.LASTUPDATE
    2026-07-20

.EXAMPLE
    .\detect-onedrive-kfm-not-configured.ps1
    Returns exit 1 if the KFM silent opt-in policy is not set for the tenant

.NOTES
    - Runs in SYSTEM context via Intune Remediations
    - IMPORTANT: set $ExpectedTenantId to your Entra tenant ID before deploying (both scripts)
    - Devices without the OneDrive sync client are reported compliant with a note, since KFM cannot apply there
#>

$ErrorActionPreference = "Stop"

# Set this to your Entra tenant ID before deploying
$ExpectedTenantId = "00000000-0000-0000-0000-000000000000"

try {
    if ($ExpectedTenantId -eq "00000000-0000-0000-0000-000000000000") {
        Write-Output "Configuration error: ExpectedTenantId has not been set in the detection script."
        exit 2
    }

    # OneDrive must be present for KFM to work
    $oneDrivePaths = @(
        "$env:ProgramFiles\Microsoft OneDrive\OneDrive.exe",
        "${env:ProgramFiles(x86)}\Microsoft OneDrive\OneDrive.exe"
    )
    $oneDriveInstalled = $false
    foreach ($path in $oneDrivePaths) {
        if (Test-Path $path) { $oneDriveInstalled = $true; break }
    }

    if (-not $oneDriveInstalled) {
        Write-Output "OneDrive sync client is not installed - KFM policy not applicable."
        exit 0
    }

    $policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive"
    $configuredTenant = $null
    if (Test-Path $policyPath) {
        $configuredTenant = (Get-ItemProperty -Path $policyPath -Name "KFMSilentOptIn" -ErrorAction SilentlyContinue).KFMSilentOptIn
    }

    if ($configuredTenant -eq $ExpectedTenantId) {
        Write-Output "KFM silent opt-in is configured for the expected tenant."
        exit 0
    }

    if ($configuredTenant) {
        Write-Output "KFM silent opt-in points to a different tenant ($configuredTenant)."
    }
    else {
        Write-Output "KFM silent opt-in policy is not configured."
    }
    exit 1
}
catch {
    Write-Error $_
    exit 2
}

# Copia sin cambios de https://github.com/ugurkocde/IntuneAutomation (commit 797bb2e).
# MIT License
#
# Copyright (c) 2025 Ugur Koc | Microsoft MVP
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

Relacionados