feat: OneDrive Known Folder Move backup for Desktop/Documents/Pictures (incl. Pictures)

[DevSecNinja]

What

Add a post-install step that configures OneDrive Known Folder Move (KFM) to back up all
known folders — Desktop, Documents, and Pictures — so a machine without the org Intune policy
(or where the policy leaves Pictures out) still gets full folder backup.

Why

Org Intune policies back up Documents but leave Pictures out; on personal/unmanaged machines
there is no KFM at all. Baking the supported policy makes folder backup consistent everywhere.

Proposed approach

• Use the Microsoft-documented KFM policies under
  HKLM\SOFTWARE\Policies\Microsoft\OneDrive:
  • KFMSilentOptIn = <AAD tenant ID> (silently redirect Desktop/Documents/Pictures).
  • KFMSilentOptInDesktop / KFMSilentOptInDocuments / KFMSilentOptInPictures = 1 to force all
    three explicitly.
  • Optionally KFMBlockOptOut = 1 to prevent users turning it back off.
• Requires the AAD tenant ID as input (config/param) — cannot be hardcoded; document how to find
  it. Make the entry opt-in and skipped when no tenant ID is supplied.
• Machine-wide (HKLM policy) → fits the offline image build and the online post-install path;
  add as a catalog SetRegistry entry (or a small dedicated step if the tenant-ID input needs
  special handling) with citation + evidence grade, -WhatIf, and idempotency.
• Tests: value written correctly given a tenant ID; skipped/NotApplicable when absent.

References

• https://learn.microsoft.com/sharepoint/use-group-policy (Silently move Windows known folders to
  OneDrive)
• Citation + EvidenceGrade = 1 per the change-catalog convention.