Configure location redirection over the Remote Desktop Protocol

To enable location services using Microsoft Intune:

1. Sign in to the Microsoft Intune admin center.

2. Create or edit a configuration profile for Windows 10 and later devices, with the Settings catalog profile type.

3. In the settings picker, select System. Check the box for Allow Location, then close the settings picker.

   

4. Expand the System category, then from the drop-down menu select Force Location On. All Location Privacy settings are toggled on and grayed out. Users cannot change the settings and all consent permissions will be automatically suppressed.

5. Select Next.

6. Optional: On the Scope tags tab, select a scope tag to filter the profile. For more information about scope tags, see Use role-based access control (RBAC) and scope tags for distributed IT.

7. On the Assignments tab, select the group containing the computers providing a remote session you want to configure, then select Next.

8. On the Review + create tab, review the settings, then select Create.

9. Once the policy applies to the computers providing a remote session, restart them for the settings to take effect.

10. You need to enable the location setting Allow location override for the location to be updated in the remote session, which you can do by configuring a registry value and is set per user. Users can still change this setting in Windows location settings.

    You can do this by creating a PowerShell script and using it as a custom script remediation in Intune. When you create the custom script remediation, you must set Run this script using the logged-on credentials to Yes.

    try
    {
        New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\CPSS\Store\UserLocationOverridePrivacySetting" -Name Value -PropertyType DWORD -Value 1 -Force
        exit 0
    }
    catch{
        $errMsg = $_.Exception.Message
        Write-Error $errMsg
        exit 1
    }
    

11. Once you have made the changes, location services in the Windows Settings app should look similar to the following image:

    

To enable location services without Intune, you can use Group Policy to configure registry values. You can also configure location redirection using Group Policy. Configuring location services this way doesn't prevent users from changing its settings.

1. Open the Group Policy Management console on device you use to manage the Active Directory domain.

2. Create or edit a policy that targets the computers providing a remote session you want to configure.

3. Configure Group Policy Preferences to set the following registry values. To learn how to use Group Policy Preferences, see Configure a Registry Item. You can specify which apps and services can use location services, based on your requirements.

   1. Enable Location services (this value needs to be set per device):

      • Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location
      • Type: REG_SZ (String value)
      • Value name: Value
      • Value data: Allow

   2. Enable Allow location override (this value needs to be set per user):

      • Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\CPSS\Store\UserLocationOverridePrivacySetting
      • Type: REG_DWORD (DWORD value)
      • Value name: Value
      • Value data: 1

   3. Enable Let apps access your location (this value needs to be set per user):

      • Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location
      • Type: REG_SZ (String value)
      • Value name: Value
      • Value data: Allow

   4. Enable Let desktop apps access your location, such as Microsoft Edge (this value needs to be set per user):

      • Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged
      • Type: REG_SZ (String value)
      • Value name: Value
      • Value data: Allow

   5. Enable individual Microsoft Store, MSIX, or Appx apps (this value needs to be set per user). Replace <Package Family Name> with the package family name of the app, for example Microsoft.BingWeather_8wekyb3d8bbwe. You can get a list of apps and their package family name using the Get-AppxPackage PowerShell cmdlet.

      • Key: HKEY_CURRENT_USER\oftware\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\<Package Family Name>
      • Type: REG_SZ (String value)
      • Value name: Value
      • Value data: Allow

4. Make sure that location redirection isn't blocked. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection.

   

5. Double-click the policy setting Do not allow location redirection to open it. To allow location redirection, select Disabled or Not configured, then select OK.

6. Ensure the policy is applied to the computers providing a remote session, then restart them for the settings to take effect.