TokenCacheHelperEx.cs Error

[SkipToTheEndpoint]

Hey Mikael.

I'm having the same problem as issue #21

Add-Type : (0) : Source file 'c:\Git\IntuneManagement-3.9.1\CS\TokenCacheHelperEx.cs' could not be opened ('Unspecified error ')
At C:\Git\IntuneManagement-3.9.1\Extensions\MSALAuthentication.psm1:551 char:9
+         Add-Type -Path ($global:AppRootFolder + "\CS\TokenCacheHelper ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (Microsoft.Power...peCompilerError:AddTypeCompilerError) [Add-Type], Exception
    + FullyQualifiedErrorId : SOURCE_CODE_ERROR,Microsoft.PowerShell.Commands.AddTypeCommand

Failed to compile TokenCacheHelperEx. The access token will not be cached. Check write access to the CS folder and ASR policies Exception: Cannot add type. Compilation errors occurred.

I've tried everything I can think of to resolve it, even going as far as pushing an ASR policy with everything turned off, as well as setting ASR exclusions for the path. It's also not permissions as I have Full Control over the file:

Looking at the TokenCacheHelperEx.cs file I see it's supposed to create %LOCALAPPDATA%\GraphPowerShellManager\MSALToken.bin and it's not.

Am I missing something?

Thanks

[Micke-K]

Hello!

Is PowerShell in Constrained Language mode? Add-Type is not allowed if that is enabled.

Cheers!

[SkipToTheEndpoint]

No, PS is in Full Language mode, however that did trigger me to look at other things because I saw something about Device Guard User Mode Code Integrity. The CodeIntegrity event log caught it:

I am trying this on devices without AppLocker or WDAC, however the following policies are being applied from Intune:

Hmm, not sure where to take this one as you can't create exclusions for things. I wonder if this could end up causing issues if MS continue to take a "secure by default" approach with Windows, such as Smart App Control even on consumer devices...

[Micke-K]

Closing this issue.

I will look into a way to replace the code compiling. There are currently 2 thigs this is used for; cache logins and proxy. So I need a new solution for those. First one, and what caused your issue, might be solved by a new version of MSAL.DLL.

Feel free to reopen this issue or create a new one if you have any other problems with this.

Cheers!