First of all, install and load the exchange module (I’m using PowerShell 7.6.3)

# Download and Load Exchange Module
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Import-Module ExchangeOnlineManagement

# Connect to the tenant
Connect-ExchangeOnline -UserPrincipalName admin@jouwdomein.nl

And Confirm the 365 sign-in popup

Now check a mailbox with the current settings:

Get-MailboxMessageConfiguration -Identity user@joudomain.nl

AfterMoveOrDeleteBehavior              : OpenNextItem
NewItemNotification                    : All
EmptyDeletedItemsOnLogoff              : False
AutoAddSignature                       : False
AutoAddSignatureOnReply                : False
SignatureText                          :
SignatureHtml                          :
SignaturesList                         :
SignatureName                          :
SignatureHtmlBody                      :
DefaultSignature                       :
DefaultSignatureOnReply                :
DeleteSignatureName                    :
AutoAddSignatureOnMobile               : True
SignatureTextOnMobile                  :
UseDefaultSignatureOnMobile            : True
DefaultFontName                        : Calibri
DefaultFontSize                        : 3
DefaultFontColor                       : #000000
DefaultFontFlags                       : Normal
AlwaysShowBcc                          : False
AlwaysShowFrom                         : False
DefaultFormat                          : Html
ReadReceiptResponse                    : DoNotAutomaticallySend
PreviewMarkAsReadBehavior              : OnSelectionChange
PreviewMarkAsReadDelaytime             : 5
ConversationSortOrder                  : ChronologicalNewestOnTop
ShowConversationAsTree                 : False
HideDeletedItems                       : False
SendAddressDefault                     :
EmailComposeMode                       : Inline
CheckForForgottenAttachments           : True
AreFlaggedItemsPinned                  : False
IsReplyAllTheDefaultResponse           : True
KeyboardShortcutsMode                  : Owa
LinkPreviewEnabled                     : True
ShowPreviewTextInListView              : True
ShowUpNext                             : True
GlobalReadingPanePosition              : Right
IsFavoritesFolderTreeCollapsed         : False
IsMailRootFolderTreeCollapsed          : False
MailFolderPaneExpanded                 : True
IsHashtagTreeCollapsed                 : False
IsGroupsTreeCollapsed                  : False
GroupSuggestionDismissalCount          : 0
GroupSuggestionDismissalDate           :
ShowSenderOnTopInListView              : True
ShowReadingPaneOnFirstLoad             : False
NavigationPaneViewOption               : Default
AllOwaConfiguration                    :
PreferAccessibleContent                : False
EchoGroupMessageBackToSubscribedSender : False
SmimeEncrypt                           : False
SmimeSign                              : False
SigningCertificateSubject              :
ManuallyPickCertificate                : False
SigningCertificateId                   :
ReportJunkSelected                     : False
CheckForReportJunkDialog               : False
MailSendUndoInterval                   : 0
WebSuggestedRepliesEnabledForUser      : False
ShowNotificationBar                    : False
IsDarkModeTheme                        : False
IsFocusedInboxEnabled                  : False
ShowInlinePreviews                     : False
DisplayDensityMode                     : Full
FavoritesBitFlags                      : 0
NavigationBarWidth                     : 0
NewEnabledPonts                        : None
MailboxOwnerId                         : 77956c6b-c040-4556-9201-ef2d971a38d9
Identity                               : 77956c6b-c040-4556-9201-ef2d971a38d9
IsValid                                : True
ObjectState                            : Unchanged

Now set the default Fontname and FontSize like below for all users in this tenant.

Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    Set-MailboxMessageConfiguration `
        -Identity $_.UserPrincipalName `
        -DefaultFontName Arial `
        -DefaultFontSize 11
}

Now you can check on the client side if the settings are set (Its set to all)

Below is the setting per user.

set-MailboxMessageConfiguration -DefaultFontName Arial --DefaultFontSize 11 -Identity user@joubedrijf.nl

set-mailbox -MessageCopyForSentAsEnabled $True

set-mailbox -MessageCopyForSendOnBehalfEnabled $True

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory -Path "C:\HWID"
Set-Location -Path "C:\HWID"
$env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
Install-Script -Name Get-WindowsAutopilotInfo
Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv

You can try install reader also. But the solution is simple.

Add the regkey below

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown:“bIsSCReducedModeEnforcedEx”=dword:00000001

Now if a user has a license, Adobe Pro is active,
if a user dont have a license, reader is active.

Source: pdf – Installing Adobe Pro and Adobe Reader on the same machine – Super User

Issues with Updating: How to Fix Error Applying Transforms Error Issue
(How to Fix Error Applying Transforms Error Issue)

Step 1. Click on the Windows Start button on your taskbar and type registry editor in the Windows search box.

Step 2. Select Registry Editor in the search result displayed in the Best match.

Step 3. Navigate to the path below using the folders in the left pane of the Registry or copy-paste the location in the navigation bar.

HKEY_CLASSES_ROOT\Installer\Products

Step 4. Now, right-click on the Products key and choose the option Find in the context menu to open the search box.

Step 5. In the Find window, check the boxes next to Keys, Values, and Data in the Look at section.

Step 6. Enter the name of the application that is raising the Error applying transforms message in the text box next to Find what in the window.

Step 7. Tap on the Find Next button to search for the registry value associated with the application.

Step 8. Once the search completes, it will automatically take you to the registry key for the problematic application.

Step 9. With the registry key selected in the left pane, double-click on the Transforms entry on the right side to open the Edit String window.

Step 10. Delete the value that is present in the Value Data field.

Then, click on OK.

Note: If this error was raised while uninstalling the application, then right-click on the Transforms key and choose Delete to remove the key from the Registry.

Step 11. Reboot your PC after closing the Registry.

Step 12. Check if the error still appears after the system startup.

Restrictions and limitations in OneDrive and SharePoint – Microsoft Support

After some test, we found out that when download a file, delete the online file and place the file back with the same name, the file could be opened without issues. Looks like the Meta data of the file is corrupted.

Ok. Now I have a solution, but how to do this with 50 GB of data and over 40.000 files to check.
Then found 2 ways, Connect the Sharepoint to a Onedrive. and do the local copy job. “Download” the files, Move it outside Sharepoint or on a new Sharepoint folder. But when you are doing this, there are some negative points.

• Downloading and Uploading costs a lot of time
• Owner name / last modified name is changed.
• Version history is lost.
• Data is temporary not available.

Based on the points above it was not the good way.

The other way maybe better. A Powershell script that connects to Sharepoint online, and do a move internally in Sharepoint online. This is the best way to skip all the negative points above.

Now its clear what to do, because I’m admin of the tenant but I don’t have a system in that tenant, and I don’t want to use my own system, I created a Hyper-V VM on my own system.
Installed the Default Windows 11 Image from Microsoft on the VM.

Now I’m trying to sign in with a test account on that system. Mm, that’s not working. Found out that system is blocked by Intune policy (Enrollment restriction) that don’t allow Personally owned devices to add the the tenant.

Example above.

I created a new Enrollment restriction what is automatically placed above the default restriction. And add only personally owned to allow.
Added a new AAD group and add the test account in it. Added the AAD group to the new Enrollment restriction policy. Now waited 5 minutes and tried again. Finally signed in is working.

Next step. Install PnP.PowerShell module.

Start Powershell as Admin on the system. and type the following command to install the module.

Install-Module PnP.PowerShell -Scope CurrentUser -Force

When you get the message about NuGet update. Press Y and enter.

Type

Get-Module PnP.PowerShell -ListAvailable

You should get info about what module is installed.
On the default Windows 11 25h2 Powershell 5.1 is installed and wont give any output about the module that is installed.

Issue here is the PnP.Powershell module is working on minimal PowerShell 7.4.0.
So first we need to update Powershell to the latest. Easy way to update is trough Winget.

Type in the current powershell window the following command to install the latest Powershell version

winget install --ID Microsoft.PowerShell --Source winget

Now is PowerShell Automatic installed.

Close current Powershell (5.1)

Open the new Powershell 7 (x64) as Admin.

Run the command

Install-Module PnP.PowerShell -Scope CurrentUser -Force

And then to check if its installed.

Get-Module PnP.PowerShell -ListAvailable

Result:

Now you need to connect to the Sharepoint tenant. Because all the security at Microsoft is higher than it was before. You cannot start connecting with username and password. Now you need to Register an Application with the correct rights to continue

With the website Connect to SharePoint Online using PnP PowerShell – SharePoint Diary I found the solution.

The following code you need to enter in the Powershell 7 and edit the Tenantname:

Register-PnPEntraIDAppForInteractiveLogin -ApplicationName "PnP PowerShell" -SharePointDelegatePermissions "AllSites.FullControl" -Tenant Tenantname.onmicrosoft.com

Edge browser will automatic be opened Fill in the Admin username and password, and MFA. Then you get the message to close the browser.

Powershell is still running, and after 30 seconds the browser opens again. You need to Sign in again. After that you need to accept the following window.

Now the App is registered with the correct rights.
In the Powershell output, Save the ClientID for connecting to

You can check if the connection is working with

Get-PnPWeb

Now we can connect to the Sharepoint with Powershell with the following code (Change <TENANTNAME> And <SITENAME>, and the CLIENTID.

$SiteURL = "https://<TENNANTNAME>.sharepoint.com/sites/<SITENAME>"
Connect-PnPOnline -Url $SiteURL -Interactive -ClientId "<CLIENTID>"

Now you can test a file if this fix the issue, You need to validate the locations because of language. Add/Change location of the test file. (Code is generated by ChatGPT)

$library    = "Documenten"
$channel    = "Algemeen"
$tempFolder = "TempRehydrate"
$dryRun     = $True

$testFile   = "Gedeelde documenten/General/<LOCATION OF A TEST FILE>"

Write-Host "== Test 1 bestand ==" -ForegroundColor Cyan
Write-Host "Bestand:" $testFile
Write-Host "Dry-run:" $dryRun

# Temp folder maken (alleen echte run)
if (-not $dryRun) {
    Add-PnPFolder -Name $tempFolder -Folder "$library/$channel" -ErrorAction SilentlyContinue
}
# Naar temp
$targetUrl = $testFile -replace "$library/$channel", "$library/$channel/$tempFolder"

Write-Host "→ Naar temp:" $targetUrl
if (-not $dryRun) {
    Move-PnPFile -SourceUrl $testFile -TargetUrl $targetUrl -Force
}

# Terug
$originalUrl = $targetUrl -replace "$library/$channel/$tempFolder", "$library/$channel"

Write-Host "← Terug:" $originalUrlif 
(-not $dryRun) {
    Move-PnPFile -SourceUrl $targetUrl -TargetUrl $originalUrl -Force
}

Write-Host "== Test klaar ==" -ForegroundColor Green

If the Test is working, Change $dryRun = $False
Now it moves the file.
When I did this, somehow it updated the whole Sharepoint site, and all files was accessable trough Teams.

I did some commands with

Get-PnPListItem -List "Documenten"

Because I could not get the correct directory. You can use this to browse in the sharepoint.
Add after Documenten/<Foldername> to go in to a folder.

When done, don’t forget to remove if you are done and not needed anymore.

• Enterprise Application (Link)
• App registration (Link) (check All Applications)
• Remove the created AAD group
• Remove the temp Enrollment restrictions (Link) if created
• Remove the Device (Link)

In cmd, net user <NAME> /add

net localgroup Administrators <NAME> /add

cd OOBE

msoobee.exe && shutdown.exe -r

Go to https://intune.microsoft.com

Devices > Windows > Configuration

Click on + Create > + New Policy

Select by platform Windows 10 and Later
Select by Profile type Settings catalog
Then click on Create

Give the policy a name

Click on + Add Settings

Search on OneDrive

Search and check for row
Prevent users from syncing personal OneDrive accounts (User)
Silently sign in users to the OneDrive sync app with their Windows credentials

Slide the settings to Enabled
If you use Scope Tags, use them, else next
Select Assignments, User or groups. Next
Then Create.
It takes around 30 minutes to be active

Put in the same folder a JPG file.
Max resolution is 1024×768
File size max 32751 bytes.
(https://developers.hp.com/hp-client-management/doc/Set-HPFirmwareBootLogo)

All HP files can be found on Client Management Solutions – HP Downloads | HP® Official Site

About the Script.
First checks if exist. If yes, it delete them. Then imports the HP Modules.

With Set-HPFirmwareBootLogo -File “$PSScriptRoot\Logo.jpg” -Password “” you install the logo.
Fill in the Bios Password if used.

I’m using this install when installing/reinstalling systems with MDT. But script can be changed if you want to execute it via Intune

And Yes, in the bios MAC Address Pass Trough is set correct. (Reuse Embedded LAN Address is checked)

We don’t want to replace all USB-C Docks to something else, I found out that in Windows you can set a MAC address on NIC’s

Open Network Properties.

Click on Configure. Tab Advanced. Go to Property Network Address.
Here you can fill any MAC Address.

When this is filled, Network is working.

Because I’m IT Specialist, I don’t want to do this on every system manual.
Hereby my Script that I placed in a Computer GPO -> Scripts (Startup/Shutdown)

I think it can also be in Intune, but didn’t checked it.https://github.com/Daagvandermeer/Scripts/blob/main/NICPasstrough.ps1