Default App Association

[ecopit]

Hi All,

I am trying (and have been for 6+ months) to get a default apps configuration pushed via OMA-URI on GCPW devices. I have tried absolutely everything I can think of and I have engaged Google support and Microsoft Support on different occasions. Each of them pointed the finger at the other, please see the facts below:

Policy: ./Device/Vendor/MSFT/Policy/Config/ApplicationDefaults/DefaultAssociationsConfiguration

1. I am pushing the values as a base64 encoded string. I have tried many encoders and it doesn't help. I am of course using OMA-URI policies built into the Windows Settings section.

2. The audit log shows a "200 Successful" message for the policy.

3. Despite this, the default apps don't actually change. 

4. Some policies work just fine, so I know management is possible at some level.

5. Curiously, Microsoft support said they tested the same policy with the exact same base64 string using Intune and they couldn't get it to work there either. So they told me I was SOL, instead of taking ownership.

6. I can't find the actual value in the registry of a managed device to compare and see if there's something lost in translation, so I'll settle for this information at least.

If anyone has an idea of something to try, I am all ears.

[emreknlk]

Did you check event logs to see if there are any errors? Microsoft/Windows/DeviceManagement-Enterprise-Diagnostics-Provider/ has Admin and Operational logs. 

You can also collect MDM diagnostic logs following these instructions: https://learn.microsoft.com/en-us/windows/client-management/mdm-collect-logs

is your base64 string large? I would suggest trying with a one small example and make it work. Can you paste your XML content before and after encoding?

[ecopit]

Yes I checked event viewer just now. What's odd is that there are many policies that are working perfectly, and the error in the event viewer is 454.

I collected the MDM diagnostics, I can see the correct policy and value in the list just fine.

Here is my base64 string:

PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPERlZmF1bHRBc3NvY2lhdGlvbnM+CiAgPEFzc29jaWF0aW9uIElkZW50aWZpZXI9Ii5odG0iIFByb2dJZD0iQ2hyb21lSHRtbCIgQXBwbGljYXRpb25OYW1lPSJHb29nbGUgQ2hyb21lIiAvPgogIDxBc3NvY2lhdGlvbiBJZGVudGlmaWVyPSIuaHRtbCIgUHJvZ0lkPSJDaHJvbWVIdG1sIiBBcHBsaWNhdGlvbk5hbWU9Ikdvb2dsZSBDaHJvbWUiIC8+CiAgPEFzc29jaWF0aW9uIElkZW50aWZpZXI9Imh0dHAiIFByb2dJZD0iQ2hyb21lSHRtbCIgQXBwbGljYXRpb25OYW1lPSJHb29nbGUgQ2hyb21lIiAvPgogIDxBc3NvY2lhdGlvbiBJZGVudGlmaWVyPSJodHRwcyIgUHJvZ0lkPSJDaHJvbWVIdG1sIiBBcHBsaWNhdGlvbk5hbWU9Ikdvb2dsZSBDaHJvbWUiIC8+IAogIDxBc3NvY2lhdGlvbiBJZGVudGlmaWVyPSJyZWFkIiBQcm9nSWQ9IkNocm9tZUh0bWwiIEFwcGxpY2F0aW9uTmFtZT0iR29vZ2xlIENocm9tZSIgLz4KPC9EZWZhdWx0QXNzb2NpYXRpb25zPg==

And the XML:

<?xml version="1.0" encoding="UTF-8"?>
<DefaultAssociations>
<Association Identifier=".htm" ProgId="ChromeHtml" ApplicationName="Google Chrome" />
<Association Identifier=".html" ProgId="ChromeHtml" ApplicationName="Google Chrome" />
<Association Identifier="http" ProgId="ChromeHtml" ApplicationName="Google Chrome" />
<Association Identifier="https" ProgId="ChromeHtml" ApplicationName="Google Chrome" />
<Association Identifier="read" ProgId="ChromeHtml" ApplicationName="Google Chrome" />
</DefaultAssociations>

[emreknlk]

Can you email me the export of the event log and the MDM diagnostic file? I am the engineering lead of the Windows MDM can see if I can figure out anything from logs. My email is <PII removed by staff>

[ecopit]

Yes. Will send shortly, thank you for your help here.

[arussell]

Are the computers domain joined? If not you cannot set default app associations. The group policy that controls this requires them to be domain joined. 

[ecopit]

Hi,

No they are not. However I don't believe that is accurate. Can you cite a source for this information? I have spoken to Microsoft and Google separately and I feel like that would have been one of the first qualifying questions. I do not have a GP server of any kind.

I'm doing this with configured OMA-URI policies pushed to GCPW managed computers. Many of the settings work beautifully, but not this one. The XML value for the associations is pushed as a base64 string to the computer. I have verified that it's getting there and that it's correct on the computer end, but the settings don't actually change. 

[arussell]

I attached an image of the group policy in the previous post. "If this policy is enabled and the client machine is domain joined ..." 
I had the exact same issue trying to make chrome the default browser. 

[ecopit]

So again, please correct me if I am wrong. The MDM OMA-URI policies do not relate to GP in any way. This is essentially an alternative option. This is actually what Intune uses as well and hilariously they couldn't get it to work with Intune either. I also have a setting pushed that tells computers to ignore all GP settings in favor of deployed OMA-URI policies. So I don't think this is the issue.

[arussell]

They are the same thing with different implementation methods. Group Policy is usually controlled locally or through Active Directory while OMA-URI is called through MDM whether is be google or Intune or whatever else.

Below is a link, the top setting is the OMA-URI your looking for and the correlating group policy setting. The verbage "domain joined" is there as well. This is really a thing microsoft has made difficult on purpose. 

https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-applicationdefaults

[ecopit]

So I completely agree that this would be a thing that Microsoft would do on purpose just because that's their MO. I see in the CSP article where it says that, but because you can use Intune without joining to an AD server for management, I can't imagine that this specific policy requires that. The text of that CSP does make it sound that way though, the reason I hesitate is that Microsoft isn't well known for the clarity of their knowledgebase articles.

All that being said, it would explain everything if you were right. 

[arussell]

I would wager most people using Intune are likely using Azure Active Directory as their Idp and therefor wouldn't have this issue. I cannot verify that. I can add that this group policy does work on my non-GCPW machines which are old school Active Directory. 

This is a relevant diccussion. 
https://www.reddit.com/r/gsuite/comments/m81vhe/set_chrome_as_default_web_browser_using_gcpw/

[emreknlk]

Thanks for pointing out the AD requirement. I setup a new VM yesterday and tried this and it didn't work. It must be because of this requirement.

[ecopit]

Because I don't have an AD environment where I can test this, would you be able to validate this as the solution? Also, can you test if this specific policy being "Not Configured" even if the computer is domain joined wil work? I would appreciate it. 

[ecopit]

So here's what I don't get: If this is the case, you have to enter a filepath for the XML. Why does intune or Google Admin accept a base64 result to pass to the machine? What's the point of this? Is your understanding that if it's domain joined and this policy is not configured, it will accept the base64 result?

[arussell]

The file path exists because when the GPO was created by Microsoft it assumed you were in an active directory environment where you would use a local file share to reference. Base64 is just used here as a method to encode the XML data as a string for transfer. 

You can do a lot more than this using OMA-URI. Perhaps you want to set GPO policies for software not native to Windows such as Chrome. You can download and ingest the admx files for the third party GPOs pretty much the same way. I wouldnt do this with Chrome, using "Managed Chrome Browsers" Is what I prefer, but I am providing the example so that you can see any admx files can be ingested and any GPOS then set. 
https://support.google.com/chrome/a/answer/10407780?hl=en

[laurentdelosier]

Hello ecopit,

We also tried to achieve that without any success. And unfortunately, GCPW does not allow us to execute scripts out of the box. However, you can install MSI packages via OMA-URI. One possible solution would consist in creating an MSI package via e.g. Visual Studio Code and update the Windows registry from there 🤔

Best,
L.