Azure Intune: Multi-User VDI

Witness Anywhere Deployment on Azure VDI (Multi-User) using Intune

Generate PAC Token & Download Files

1. As a User with Admin Role or above, log into the WitnessAI Console.
2. Click on the Settings menu item (1), then click on Proxy Configuration in the sub-menu (2).
3. Enter a name in the Key Name field (3).
4. Choose an Expiration Date (4).
5. Click the Generate PAC Token button (5).

1. Locate the row in the list with the Key Name and Expiration Date of the PAC Token you created (6), and click the Download Symbol.
2. Click on Microsoft Intune (Windows) (7) from the dropdown, and a zip file will be downloaded to your Downloads folder.

Configure The Device Group

1. Log in to Intune Admin Console
2. Navigate to Groups and click on New group
3. Enter the following information:
• Group type: Security
• Group name: Azure-VDI-Hosts
• Under Members, click on No members selected and add all the Azure VDI Hosts.
4. Finally Click on Create

Deploying The Registration Script

1. In the Microsoft Intune Admin Center, navigate to Devices > Scripts and Remediations > Platform Scripts, click Add, and select Windows 10 and later as the platform.

1. Enter the name of the script as Witness-Anywhere-Registration, then click Next to proceed
2. In the Script settings section, enter the following details and click Next:
• Script location: Browse and select the register_device.ps1 file downloaded from the WitnessAI console
• Run this script using the logged on credentials: No
• Enforce script signature check: No
• Run script in 64 bit PowerShell Host: No

1. In the Assignments section, click Add groups under Included groups, select the previously created device group Azure-VDI-Hosts, and then click Next.

1. Finally, review the configuration summary and click Create to complete the script deployment.
2. At this point, the script will be pushed to all VDI hosts that are members of the selected device group, and a scheduled task named "Witness-Anywhere-Registration" will be created on each host to run automatically at user logon.
Note: The registration script will be stored in the location specified below. Please ensure that this path is included in the persistent storage configuration.
C:\Users\Default\AppData\Local\WitnessAI
3. When a user logs on to a VDI host, the registration script executes, enrolling the user into Witness Anywhere and applying the configured Proxy PAC URL. From that point forward, all LLM traffic initiated by the user will be automatically routed through WitnessAI for policy enforcement and monitoring.
4. Each time a user logs in to the VDI host, the registration script will execute for all active sessions. Users who are already registered will be skipped, while any new users will be automatically enrolled in Witness Anywhere.

Deploying The Flush Script

1. To flush the Witness Anywhere configuration from a VDI host, follow the same steps as when deploying the registration script. However, instead of selecting the register_device.ps1 file, use the flush.ps1 file to remove the configuration.
2. When the script is executed on the host, all logged-in users are de-enrolled from Witness Anywhere. In addition, the scheduled task created for Witness Anywhere registration is removed, and old log files are cleaned up.
Logs: C:\Windows\Temp\pac-flush-log.txt