Saltar al contenido
Microsoft scripts

Scripts de Intune

Configurar Known Folder Move de OneDrive

Escribe las políticas de OneDrive que mueven en silencio Escritorio, Documentos e Imágenes a OneDrive para tu tenant y bloquea que el usuario las regrese.

Antes de correrloCambia el registro del equipo y no tiene simulación. El movimiento es silencioso (sin notificación) y por defecto el usuario no puede revertirlo: avisa antes. Requiere que el usuario inicie OneDrive con cuenta licenciada.

Ejemplo en México

Despacho fiscal en Pachuca, 28 laptops en cierre fiscal

Antes del cierre fiscal quieren que los documentos de los contadores estén respaldados en OneDrive.

remediate-onedrive-kfm.ps1

Las carpetas se mueven a OneDrive en el siguiente inicio de sesión de cada usuario.

Cómo implementarlo

  1. Antes de subirlo, escribe el ID de tu tenant de Entra en $TenantId (en este script y en el de detección). Si quieres que el usuario pueda regresar las carpetas, cambia $BlockOptOut a $false.
  2. En el centro de administración de Microsoft Intune ve a Dispositivos > Administrar dispositivos > Scripts y correcciones (Scripts and remediations) > Remediations > Crear paquete de scripts.
  3. En Configuración sube detect-onedrive-kfm-not-configured.ps1 como script de detección y remediate-onedrive-kfm.ps1 como script de corrección.
  4. Deja desactivadas "Ejecutar con las credenciales del usuario" y "Aplicar verificación de firma", asígnalo primero a un grupo piloto y elige la frecuencia.
  5. Revisa en el paquete los equipos corregidos y avisa a los usuarios del movimiento de sus carpetas.
Ver el código completo de remediate-onedrive-kfm.ps1
<#
.TITLE
    OneDrive Known Folder Move Remediation Script

.SYNOPSIS
    Configures OneDrive silent Known Folder Move via policy registry keys.

.DESCRIPTION
    Writes the OneDrive policy registry values that silently move Desktop,
    Documents, and Pictures into OneDrive for the configured tenant:
    KFMSilentOptIn with the tenant ID, silent opt-in without notification, and
    KFMBlockOptOut so users cannot move the folders back out. OneDrive applies the
    move at its next sign-in or policy refresh. Paired with
    detect-onedrive-kfm-not-configured.ps1.

.TAGS
    Remediation,Action

.REMEDIATIONTYPE
    Remediation

.PAIRSCRIPT
    detect-onedrive-kfm-not-configured.ps1

.PLATFORM
    Windows

.MINROLE
    Intune Service Administrator

.PERMISSIONS
    DeviceManagementManagedDevices.ReadWrite.All

.AUTHOR
    Ugur Koc

.VERSION
    1.0

.CHANGELOG
    1.0 - Initial release

.LASTUPDATE
    2026-07-20

.EXAMPLE
    .\remediate-onedrive-kfm.ps1
    Writes the KFM silent opt-in policy for the configured tenant

.NOTES
    - Runs in SYSTEM context via Intune Remediations
    - IMPORTANT: set $TenantId to your Entra tenant ID before deploying (both scripts)
    - Users must be signed in to OneDrive with a licensed account for the folder move to complete
    - Set $BlockOptOut to $false if users should be allowed to redirect folders back
#>

$ErrorActionPreference = "Stop"

# Set this to your Entra tenant ID before deploying
$TenantId = "00000000-0000-0000-0000-000000000000"

# Prevent users from moving known folders back out of OneDrive
$BlockOptOut = $true

try {
    if ($TenantId -eq "00000000-0000-0000-0000-000000000000") {
        Write-Output "Configuration error: TenantId has not been set in the remediation script."
        exit 1
    }

    $policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive"
    if (-not (Test-Path $policyPath)) {
        $null = New-Item -Path $policyPath -Force
    }

    # Silent opt-in moves Desktop/Documents/Pictures without user interaction
    Set-ItemProperty -Path $policyPath -Name "KFMSilentOptIn" -Value $TenantId -Type String
    Set-ItemProperty -Path $policyPath -Name "KFMSilentOptInWithNotification" -Value 0 -Type DWord

    if ($BlockOptOut) {
        Set-ItemProperty -Path $policyPath -Name "KFMBlockOptOut" -Value 1 -Type DWord
    }

    Write-Output "KFM silent opt-in configured for tenant $TenantId. OneDrive applies the folder move at its next sign-in or policy refresh."
    exit 0
}
catch {
    Write-Error $_
    exit 1
}

# Copia sin cambios de https://github.com/ugurkocde/IntuneAutomation (commit 797bb2e).
# MIT License
#
# Copyright (c) 2025 Ugur Koc | Microsoft MVP
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

Relacionados