Teams Client – PowerShell and Group Policy

There’s no great ADMX or ADM file for Teams Group Policy Object or GPO settings. Beyond that, a lot of the user level Teams settings aren’t available in the Teams Admin settings either. But we still may need to push settings organization-wide, for example we may want to disable GPU Hardware Acceleration for everyone to help ease the burned on workstations or VDI. This article covers individual PowerShell commands to change a handful of user-level settings by manipulating the desktop-config.json. We do this with single line commands of Powershell, which can also be pushed through a GPO by adding them to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. We’ll detail a few here, you can then use this as a template to flip other settings as well.

Disable GPU hardware acceleration

This one is the most common I see, so we’ll put it up front. GPU hardware acceleration can help or hinder performance, so we may want to toggle it on or off. By default, it’s turned on. To turn it off, we’ll want to edit the %appdata%\Microsoft\Teams\desktop-config.json file (which is unique to each user account as it’s stored in the profile). In this file there’s a setting called disableGPU, this is set to false by default but we may want to flip it to true.

Running this PowerShell command as the user will flip that switch for you from off to on. If you want to take it from on to off just flip the true and false in the below command. However the change will not be seen until you restart Teams (I’ve actually seen Teams need to restart twice for it to take effect before).

((Get-Content -path $env:APPDATA\Microsoft\Teams\desktop-config.json -Raw) -replace '"disableGpu":false','"disableGpu":true') | Set-Content -Path $env:APPDATA\Microsoft\Teams\desktop-config.json

If you have a login script that runs in PowerShell you can toss that in there. If you have a batch file, or want to run this inside of a GPO, you can put the following command in a batch file or in HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

powershell -command "((Get-Content -path $env:APPDATA\Microsoft\Teams\desktop-config.json -Raw) -replace '\"disableGpu\":false','\"disableGpu\":true') | Set-Content -Path $env:APPDATA\Microsoft\Teams\desktop-config.json"

Auto-start application

I won’t go through the trouble of repeating myself, but instead I’ll just place the commands here for disabling auto-start. If you’re unsure of what I’m doing please read the above GPU section.

((Get-Content -path $env:APPDATA\Microsoft\Teams\desktop-config.json -Raw) -replace '"openAtLogin":true','"openAtLogin":false') | Set-Content -Path $env:APPDATA\Microsoft\Teams\desktop-config.json

For placement in HKCU\Software\Microsoft\Windows\CurrentVersion\Run:

powershell -command "((Get-Content -path $env:APPDATA\Microsoft\Teams\desktop-config.json -Raw) -replace '\"openAtLogin\":true','\"openAtLogin\":false') | Set-Content -Path $env:APPDATA\Microsoft\Teams\desktop-config.json"

Register Teams as the default chat app for Office

((Get-Content -path $env:APPDATA\Microsoft\Teams\desktop-config.json -Raw) -replace '"registerAsIMProvider":false','"registerAsIMProvider":true') | Set-Content -Path $env:APPDATA\Microsoft\Teams\desktop-config.json

For placement in HKCU\Software\Microsoft\Windows\CurrentVersion\Run:

powershell -command "((Get-Content -path $env:APPDATA\Microsoft\Teams\desktop-config.json -Raw) -replace '\"registerAsIMProvider\":false','\"registerAsIMProvider\":true') | Set-Content -Path $env:APPDATA\Microsoft\Teams\desktop-config.json"

Finally, On close, keep the application running

((Get-Content -path $env:APPDATA\Microsoft\Teams\desktop-config.json -Raw) -replace '"runningOnClose":true','"runningOnClose":false') | Set-Content -Path $env:APPDATA\Microsoft\Teams\desktop-config.json

For placement in HKCU\Software\Microsoft\Windows\CurrentVersion\Run:

powershell -command "((Get-Content -path $env:APPDATA\Microsoft\Teams\desktop-config.json -Raw) -replace '\"runningOnClose\":true','\"runningOnClose\":false') | Set-Content -Path $env:APPDATA\Microsoft\Teams\desktop-config.json"

How do I set a policy to disable toll free conference use in Microsoft Teams?

If you’re here, it’s likely because you tried out a toll free number for Audio Conferencing in Microsoft Teams, it applied to all users, and you were charged way more than you had anticipated. Now you’re looking to control costs and turn it off via policy so that only select users can have it. Spoiler: There’s no policy (as of 9/29/2020 at least), it’s user by user so we’ll need to script it.


But we want to turn it off for everyone, then turn it back on for a few people. That’s going to require PowerShell. We’ll be using the commands Get-CSOnlineDialInConferencingUser and Set-CSOnlineDialinConferencingUser.

A fun thing about these commands, you can’t simply pipe one into the other as the Identity field is formatted differently. If you try a simple Get-CSOnlineDialinConferencingUser | Set-CSOnlineDialinConferencingUser You’ll end up with a bunch of errors saying “WARNING: The user cannot be found or does not belong to the specified tenant”. However, in most cases, the identity of the Set-CSOnlineDialinConferencingUser matches the SIP Address from the Get- command minus the “sip:” portion. That’s easy enough to remove with the below command.

Get-CSOnlineDialinConferencingUser -resultsize unlimited | foreach {Set-CSOnlineDialinConferencingUser -identity ($_.SipAddress).substring(4) -AllowTollFreeDialin $false} 

The only thing that’s missing is that all new users will still need to have it disabled until a policy does arrive, which I expect we’ll see shortly.

If we just want to hide the Toll Free number, there’s another option…

If you only need to modify one or two offenders, the easiest way is through the Admin Console, find the user, click Edit next to Audio conferencing and set “Include toll-free numbers in meeting requests from this user” to Off.

SfB: An exception has been thrown in processing BeginApplyMediaLines

Just a small one I was fighting for a solid half hour, wasn’t popping up a lot in Bing and I let my mind get overwhelmed for a moment. Thought I’d toss it here in case anyone ended up fighting the same issue.

This was a Skype for Business Server (mixed 2015 and 2019) environment where the virtual infrastructure took a complete loss and everything had to be restored overnight. Everything came back online and seemed to be working well, but calling was failing. All services were running, the event log was nearly free of errors. Rebooted everything for good measure, still no calling. The debug logger was throwing the following error:

ms-diagnostics: 10014;source=””;reason=”An internal exception received while processing the incoming request”;component=”MediationServer”;Exception=”An exception has been thrown in processing BeginApplyMediaLines”
ms-diagnostics-public: 10014;reason=”An internal exception received while processing the incoming request”;component=”MediationServer”;Exception=”An exception has been thrown in processing BeginApplyMediaLines”

I stared at that for a moment and my brain started to overthink the issue and my itchy fingers went right to an Internet search which was revealing little. I’m thinking corrupted or mismatched DLL, reinstall patches, and on and on… the AudioCodes syslogger however revealed a much more clear error. “Classification Failed”. That error basically means the session border controller can’t validate that the call is coming from an approved source. We checked the IP addresses and there it was. The restore had created a new virtual NIC which was stuck on DHCP. Putting the static IP back on, and rebooting everything to get back online quickly (probably didn’t need to, but just in case anything is hard cached) put it all back to normal.

They were lucky… I’ve seen so much worse after complete restores.

Move Teams Media Between Devices

This is a crummy, but sometime necessary workaround. As with all things Teams, new features are constantly hitting, new capabilities and new tactics so this may be unnecessary in a month, year, or perhaps even today.

The scenario is: You’re using Microsoft Teams on a phone call or other media chat and you need to move that media from your desktop client to your mobile client. However, there’s no obvious way to accomplish this. Many of my clients just assume this standard feature exists because it exists on other VoIP platforms. When this scenario needs to be accomplished, there are two options I’ve been able to find.

Option 1: Transfer to yourself (voice only)

Unfortunately, you can’t transfer to your own user account so this isn’t as fully featured as it seems, you can however transfer to your own phone number if you have the Phone System license. In the transfer box, type your own Microsoft Teams phone number and let it transfer. You should now see the incoming call on all of your logged in Microsoft Teams devices, effectively allowing the movement of media from one device to any other device logged into Teams.

Option 2: Call Park (includes video and more, but with a catch)

This one requires some Admin setup and the phone system license still, but makes life a little easier if you’re going from web to mobile to desktop. The big problem is that you can’t park or retrieve it from a Skype 3PIP desk phone at the moment. Each side may also need to re-initiate video or content sharing after the call resumes from its hold state.

To enable call park and retrieve, follow the directions as seen in this Microsoft Docs Article:

EDIT: Below, based on what I’m hearing from Teams MVP Randy Chapman of Twitter fame and call parking does actually work on Teams firmware desk phones. The document I referenced for the table below is likely in need of an update. I did not bring my Teams firmware phones home during the Coronavirus event to allow myself to test.

CapabilityTeams DesktopMac AppTeams Web Teams mobile Teams phoneSkype phone
Park a callYesYesYesYesYesNo
Retrieve a parked callYesYesYesYesYesNo
Unretrieved call ring backYesYesYesYes?No

To park a call or other media within a mobile device, click the ellipsis () during the call and choose “Park Call”. You will be given the code to retrieve or unpark the call on another device. To retrieve a parked call parked from a different device, attempt to make a new call and look for the phone icon with a P in the upper right as seen below.

From a desktop, parking is similar. Click the ellipsis () during the call and choose “Park Call”. You will be given the code to retrieve or un-park the call on another device.

To retrieve the call, navigate to your speed dial and in the upper right, find “Parked Calls”. If you look closely at the picture below, you can also see the number of the currently parked call on hold in the upper left.

Hopefully this was somewhat helpful. If you have a better (or just another) method of moving the media, please let me know, I’m curious to see if there’s a smoother approach.

Another edit, Randy beat me to the punch on Option 2 a bit, so if you want more info on this approach, visit his blog by clicking here.

Free Tool: Microsoft Teams Information Barrier Manager GUI

I was working on an information barrier setup for Microsoft Teams, and was getting a little tired of going back and forth with my notes to remember command and filter structure.  So as I do, I wrote a GUI tool to handle a lot of it for me.  This is the very first iteration of it, and I tried to get enough bug checking in there to get you some decent pop-ups, but the code is open source (it’s PowerShell) and it’s on GitHub so edit it as much as you want to suit your needs and if you add something cool, send it my way or submit a pull request on GitHub if you’re into that kind of thing.

If you don’t know what I’m talking about when say “information barrier”, they’re also known as ethical walls.  There will be situations where one department shouldn’t be able to talk to another department for legal reasons.  A more common scenario is that a high-up executive wants access to instant messaging, but only wants a specific group of users to be able to disrupt him.  In the Skype world, this required MSPL scripting and was tricky and could be dangerous if you messed it up.  In the Teams world, it’s built in if you have E5 or other appropriate licensing.  

The hardest part about information barriers in Teams is making sure you meet the prerequisites.  This includes getting the information you want to filter on, such as department name, accurate for each user.  This also means that your policies will need to be symmetrical (ex: if non-execs can’t IM the CEO, then we need a matching policy that blocks the CEO from IMing those non-execs as well).  I considered building a prerequisite checker in, but haven’t gone that far just yet.  Some of this would require pulling different PowerShell modules to check licensing, contact info, and Teams settings which can cause additional authentication prompts.  For now I have a simple help button that gives common reason why the application of your policy may not be working the way you expect.

Now, on to the tool.  It’s available at is pure PowerShell, so all you need to run it is a Windows box, nothing to install.

You’ll need the right role to assigned to modify this stuff (Global Admin, Compliance Admin, or the new IB Compliance Admin role).  It’s also helpful to read Microsoft’s overview of the solution before you start:

Finally, the screenshot ๐Ÿ™‚


Feel free to hack at it and let me know if you find bugs.

PSA: Safari Will Reject Certificates > 398 Days Expiration

I’m spending a moment blogging about this because it will affect remaining Skype and Lync deployments out there, which aren’t going away any time soon. Apple announced that Safari will trust only certs within 398 days of issuance, effectively taking the maximum validity time down to a year. This was a unilateral decision on Apples part in an effort to increase security, and to an extent, it’s a decent decision despite the maintenance hassle. I expect other browsers to eventually follow suit so a heads up for anyone who manages certificates as part of their day to day.

Read more here:

Reminder: Quarterly Microsoft Teams User’s Group

A reminder for those of you in the Chicago area, Monday, February 10th is our quarterly Microsoft Teams user group, this one is during lunch and I’m catering Mediterranean!

These are always fun and valuable, and a great place to network with your peers and make those relationships.  Vendors and local experts attend regularly as well so itโ€™s a place to get those questions answered too!

This time around there are two sessions, the first Iโ€™ll be presenting on Private Channels, then we’ll talk about all that’s new in Microsoft Teams. I can’t wait!

To register or to find other local groups visit

Please note this meeting will be held at the Downtown Microsoft Office in the Aon Building (200 E. Randolph, Suite 200).

UPDATE: 911 Teams Mobile Calls No Longer Use Cell Network

I’m going to start this post off by thanking a friend of mine who works for CDW, Matt Edlhuber for pointing this out. If you’ve read my previous article below or tested yourself in the past, the 911 calling behavior from the Teams mobile client used to force the call through the cell carrier.


With the new Dynamic Emergency Calling configuration, we have additional location controls and can often send more accurate info. Calls from the Teams mobile clients now use the licensed calling plans or direct routing configuration.

No better time than now than to ensure your location settings are up to date!

In Preview! Teams Meetings Live Captions is Here!

Oooooo I’ve been waiting for this one forever! I fell in love with this tech years ago when we saw it first with Skype for Business Broadcast Meetings. Now we have it with every meeting in Teams. Live Captions (what you may think of as closed captioning) in in preview and has hit my tenant.

I love this feature for several reasons, not only because I’m a lousy multitasker and like to reread what was said if I look away for a moment, but also because there are a lot of meetings where I’m simply not a presenter, the content isn’t critical to me, and I’d rather read along that wear my headphones. I can only imagine this being huge for the hard of hearing and can’t wait to see it translate into other languages as I expect it will some day.

It’s super easy to enable, just click the ellipsis (…) in a meeting and turn it on. You can disable this for your users via policy, but… why? Anyhow, run and check your tenants and see if the feature has hit yours yet.

Quick Update: Teams Available on Linux!

Tweets are everywhere about this, starting today, Microsoft Teams is available for Linux users in public preview. People screamed for this for OCS, Lync and Skype forever, but they get it with Teams ๐Ÿ™‚ Gone of the days of trying to get Pidgin configured to connect to your on-premises deployment, Microsoft has released a full client. The packages are available in .deb and .rpm formats, alongside with iOS, Android, Mac and Windows, this client can be run from anywhere. This is the first Microsoft 365 App for Linux and will support all of the main functionality. I can think of a few shops this will be a game changer for, no more web clients or strange IM platforms.