Manage font with Intune in Outlook

Fonts are often an important part of CI/CD in an organization, but there is no way to manage them with Microsoft's standard tools. So we need to write a script and distribute it through Intune.

In my Google search, I came across several approaches to this, of which the variant via Proactive Remediations convinces me the most, because unlike a normal script, this variant would also notice if the user changes the font afterwards. At this point I would like to thank Joey Verlinden for his first blog post, which led me to the right path during my Google search.

For Proactive Remediations, we need a "Detect" script and a "Remediaditon" script. The latter is executed when the PC starts and the detection script is negative. But step by step:

1. Create template in Outlook
2. Export Data
3. Create Detection Script
4. Create Remediation Script
5. Deploy with Intune
6. Check Status

1. Create template in Outlook

First we need to create a template in Outlook with the fonts we want to use. The settings for this can be found in Outlook under "File - Options - Mail - Stationery and Fonts":

In my case, this is the Corbel font in size 11 for new emails, reply emails and unformatted text. Note that you should only use fonts provided by Microsoft and not custom fonts. Custom fonts would not display on PCs that do not have this font. Set these three fields the way you want to use them:

2. Export Data

Once you have set your fonts as desired, you can find your settings in the "Registry Editor". Just search for it on your PC and navigate to the following path:

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\MailSettings        

There you will now find your settings in binary code:

Here we need the binary strings for the script. You can export them under "File", but that is not well formatted with backslashes in between and things like that. So I created a script to extract them in the right format:

$Path = "registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\mailsettings"
$Name1 = "ReplyFontComplex"
$Name2 = "ComposeFontComplex"
$Name3 = "ReplyFontSimple"
$Name4 = "ComposeFontSimple"
$Name5 = "TextFontComplex"
$Name6 = "TextFontSimple"

(Get-ItemProperty -Path $Path -Name $Name1 -ErrorAction Stop | Select-Object -ExpandProperty $Name1 | ForEach-Object { '{0:X2}' -f $_ }) -join ','
(Get-ItemProperty -Path $Path -Name $Name2 -ErrorAction Stop | Select-Object -ExpandProperty $Name2 | ForEach-Object { '{0:X2}' -f $_ }) -join ','
(Get-ItemProperty -Path $Path -Name $Name3 -ErrorAction Stop | Select-Object -ExpandProperty $Name3 | ForEach-Object { '{0:X2}' -f $_ }) -join ','
(Get-ItemProperty -Path $Path -Name $Name4 -ErrorAction Stop | Select-Object -ExpandProperty $Name4 | ForEach-Object { '{0:X2}' -f $_ }) -join ','
(Get-ItemProperty -Path $Path -Name $Name5 -ErrorAction Stop | Select-Object -ExpandProperty $Name5 | ForEach-Object { '{0:X2}' -f $_ }) -join ','
(Get-ItemProperty -Path $Path -Name $Name6 -ErrorAction Stop | Select-Object -ExpandProperty $Name6 | ForEach-Object { '{0:X2}' -f $_ }) -join ','        

3. Create Detection Script

Now we can create the "Detect" script. For the recognition I used only the complex strings, because they contain all the details like sizes and so on. The simple values only contain the font itself, so the complex value contains all the details from the simple value anyway.

All you have to do is copy the binary string for "ReplyFontComplex" into the field for $Value1 and the binary string for "ComposeFontComplex" into $Value2 in the following script:

$Path = "registry::HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\mailsettings"
$Name1 = "ReplyFontComplex"
$Name2 = "ComposeFontComplex"
$Value1 = "3c,68,74,..."
$Value2 = "3c,68,74,..."

Try {
? ? $Registry1 = (Get-ItemProperty -Path $Path -Name $Name1 -ErrorAction Stop | Select-Object -ExpandProperty $Name1 | ForEach-Object { '{0:X2}' -f $_ }) -join ','
? ? $Registry2 = (Get-ItemProperty -Path $Path -Name $Name2 -ErrorAction Stop | Select-Object -ExpandProperty $Name2 | ForEach-Object { '{0:X2}' -f $_ }) -join ','
? ? $Registry3 = Get-ItemProperty -Path $Path -Name ThemeFont -ErrorAction Stop | Select-Object -ExpandProperty ThemeFont
? ? If ($Registry1 -eq $Value1 -and $Registry2 -eq $Value2 -and $Registry3 -eq 2){
? ? ? ? Write-Output "Compliant"
? ? ? ? Exit 0
? ? }?
? ? Write-Warning "Not Compliant"
? ? Exit 1
}?
Catch {
? ? Write-Warning "Not Compliant"
? ? Exit 1
}        

Save the script as "Detect.ps1".

4. Create Remediation Script

Next, we need to define what happens when the detection script ends with "Exit 1".?

Again, just paste your strings into the correct fields in the script. You only need to insert the simple values once, as this is always the same for reply, compose and text. Not so the complex values, they differ slightly from each other even if they have the same font and size, so here you have to insert all the values in the right places.

$ValueSimple = "3c,00,00,..."
$ValueComposeComplex = "3c,68,74,..."
$ValueReplyComplex = "3c,68,74,..."
$ValueTextComplex = "3c,68,74,..."

$registryPath = 'HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\mailsettings'
$Name1Simple = "ComposeFontSimple"
$Name1Complex = "ComposeFontComplex"
$Name2Simple = "ReplyFontSimple"
$Name2Complex = "ReplyFontComplex"
$Name3Simple = "TextFontSimple"
$Name3Complex = "TextFontComplex"

$hexSimple = $ValueSimple.Split(',') | % { "0x$_"}
$hexComposeComplex = $ValueComposeComplex.Split(',') | % { "0x$_"}
$hexReplyComplex = $ValueReplyComplex.Split(',') | % { "0x$_"}
$hexTextComplex = $ValueTextComplex.Split(',') | % { "0x$_"}

IF(!(Test-Path $registryPath))
{
New-Item -Path $registryPath -Force | Out-Null
New-ItemProperty -Path $registryPath -name NewTheme -PropertyType string
New-ItemProperty -Path $registryPath -Name $Name1Simple -Value ([byte[]]$hexSimple) -PropertyType Binary -Force
New-ItemProperty -Path $registryPath -Name $Name2Simple -Value ([byte[]]$hexSimple) -PropertyType Binary -Force
New-ItemProperty -Path $registryPath -Name $Name3Simple -Value ([byte[]]$hexSimple) -PropertyType Binary -Force
New-ItemProperty -Path $registryPath -Name $Name1Complex -Value ([byte[]]$hexComposeComplex) -PropertyType Binary -Force
New-ItemProperty -Path $registryPath -Name $Name2Complex -Value ([byte[]]$hexReplyComplex) -PropertyType Binary -Force
New-ItemProperty -Path $registryPath -Name $Name3Complex -Value ([byte[]]$hexTextComplex) -PropertyType Binary -Force
}

ELSE {
Set-ItemProperty -Path $registryPath -name NewTheme -value $null
Set-ItemProperty -Path $registryPath -name ThemeFont -value 2
Set-ItemProperty -Path $registryPath -Name $Name1Simple -Value ([byte[]]$hexSimple) -Force
Set-ItemProperty -Path $registryPath -Name $Name2Simple -Value ([byte[]]$hexSimple) -Force
Set-ItemProperty -Path $registryPath -Name $Name3Simple -Value ([byte[]]$hexSimple) -Force
Set-ItemProperty -Path $registryPath -Name $Name1Complex -Value ([byte[]]$hexComposeComplex) -Force
Set-ItemProperty -Path $registryPath -Name $Name2Complex -Value ([byte[]]$hexReplyComplex) -Force
Set-ItemProperty -Path $registryPath -Name $Name3Complex -Value ([byte[]]$hexTextComplex) -Force
}        

Save the script as "Remediation.ps1".

5. Deploy with Intune

Now we are ready for deployment. Navigate to "Proactive Remediations" in the Endpoint Manager portal. You can use the search bar to find it.

Upload your scripts and set the settings as desired:

6. Check Status

And you are done. You can now see where the scripts detect incorrect fonts (problems) and whether they have been corrected or not: