Skip to main content
Unlisted page
This page is unlisted. Search engines will not index it, and only users having a direct link can access it.

Enabling Config Refresh Is a No-Brainer - But Why it's Still Not Enough

· 3 min read
Mecken Swyter
Mecken Swyter
Author

Config drift is a never-ending battle we fight to keep devices secure and compliant. It's important administrators implement tools and strategies to prevent, detect, and remediate config drift in their environments to keep their devices secure and maintain compliance. Config Refresh is a Windows 11 feature that can help with that effort.

What is Config Refresh?​

Let's get one thing out of the way: Config Refresh is not an Intune feature - it is a Windows 11 feature that can "refresh" MDM policy settings on a set interval.

Prerequisites​

warning

Config Refresh is only available on Windows 11 - Windows 10 is not supported.

  • Microsoft Intune subscription
  • Windows 11 Pro, Enterprise, or Education edition

Configure Config Refresh with Intune​

  1. Navigate to the Intune admin center
  2. Click Devices > Manage devices > Configuration > + Create > + New policy
  3. Platform: Windows 10 and later
  4. Profile type: Settings catalog
  5. Create profile:
    • Name: Enable Config Refresh
    • Click + Add settings > Search for Config Refresh
    • Select the following settings: Config Refresh and Refresh cadence
    • Configure settings:
      • Config Refresh: Enabled
      • Refresh cadence: 30 (in minutes)

configure config refresh in Intune

  • Click Next > Assign to appropriate groups > Next > Create

That's it, all your config drift problems are solved. Just kidding. 😄

tip

Confirm Config Refresh is enabled on a device by checking the registry key: HKLM\SOFTWARE\Microsoft\Enrollments\{GUID}\ConfigRefresh

What Config Refresh Will Fix​

Let's look at a scenario where Config Refresh should fix config drift. According to the Config Drift announcement by Microsoft, any Bitlocker CSP polices should get refreshed at the 30 minute refresh cadence configured for Config Refresh. Let's put that to the test.

Using Intune, the device will be configured with Silent Bitlocker encryption.

Silent Bitlocker encryption is enforced on the device. The drive encryption status can be verified by running the following command in an elevated PowerShell prompt: manage-bde -status