Dirk O'Client 🥨🛣️

IT System Engineer @ de-DE | Windows Client and SCCM *ahem* ConfigMgr Tamer | Loves his Vespa

[Darren Shepherd @ibuildthecloud]

This is awesome. https://t.co/2E1rNaWULE

[ALI TAJRAN @alitajran]

Microsoft updates mitigation guidance for Windows BitLocker security feature bypass vulnerability with a NEW script!

The updated guidance replaces previously documented manual mitigation steps with a script that helps reduce exposure while a future security update is developed to address this vulnerability.

The Windows versions below are affected:

- Windows 11 26H1
- Windows 11 25H2
- Windows 11 24H2
- Windows Server 2025

Windows devices that use BitLocker may be exposed to this vulnerability if mitigations are not applied.

Organizational environments that previously implemented the documented manual mitigation steps do not need to take additional action, as the script only simplifies deployment of the existing mitigation.

Learn more: https://t.co/jbLXPHfnhu

#Microsoft #Windows #Bitlocker #Cybersecurity

[Dirk O'Client 🥨🛣️ @OClient]

@IntuneSuppTeam Self healing. After 12h all complained packages do show Uninstall as it was before the issue. Call it a hickup but someone has to close all these tickets now.. ! 🤬

[Dirk O'Client 🥨🛣️ @OClient]

Since today available packages do not show an uninstall button anymore after install from CP, re-install only. Same package different client, installed yesterday does offer uninstall. Toggled "Allow available uninstall" did not help. Seen this anywhere else? 🧐 @IntuneSuppTeam

[Dirk O'Client 🥨🛣️ @OClient]

Microsoft's new Patch Tuesday update adds Secure Boot deployment scripts on drive! #Windows11
Detect, Aggregate, Deploy-GPO and others.
https://t.co/xDlYwUBvWW

[Abdulkadir | Cybersec @cyber__razz]

Yes. Attackers can create hidden admin accounts on Windows that fly completely under the radar.

The most common method is registry manipulation. By modifying a specific key under HKLM\SAM, they can create an account that doesn’t appear on the login screen or in normal user management tools. It shows up nowhere a regular user would look.

Another approach is cloning an existing account. Attackers copy the RID of a legitimate admin account onto a low-privilege or guest account. On the surface it looks harmless. Under the hood it has full admin rights.

Net user commands can also create accounts that blend in with system defaults, especially if named something generic like $ appended accounts, which Windows hides from standard directory listings by design.

How to actually catch it:

Run net user and wmic useraccount list full and compare results. Discrepancies are a red flag. Check the SAM registry directly or use tools like Autoruns and GMER. Review Event ID 4720 (account created) and 4728/4732 (group membership changes) in the Security event log.

Most people never check. That’s exactly why it works.

[Burke Holland @burkeholland]

Found Winget TUI yesterday by accident and man what a life improvement.

TUI's are just so much fun. This does not get old.

https://t.co/3gqiyxZbIX via @shanselman

[Mikael Nystrom @mikael_nystrom]

Check-SecureBoot.ps1 - Script Updated https://t.co/PsFzR8op0w via @mikael_nystrom

[@rnabmitra @rnabmitra]

If you haven’t already, update your #MSIntune Properties Catalog to include #Application #Inventory information

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[SoyITPro @SoyITPro]

Ya existe una llave de registro para eliminar el mensaje de advertencia al ejecutar archivos RDP en #Windows11

Muchos sysadmin ayer tuvieron muchas llamadas de usuarios preguntando que había pasado con su conexión remota.

Les dejo él .reg para que desplieguen por GPO, Intune en su empresa.

https://t.co/FRXGfqNosm

[SystemCenterDudes @scdudes]

Ignore Secure Boot updates now… but deal with the risks later.

Get ahead of it with this guide from #SCDudes:👇
https://t.co/n2AALsVcSV

#MSIntune #Security #Windows #ConfigMgr #SecureBoot

[Dirk O'Client 🥨🛣️ @OClient]

A WPF application to automate Active Directory preparation for #SCCM/#MECM deployments. #ConfigMgr https://t.co/vTLBRl1jRi

[Jorgeasaurus @jorgeasaur_us]

https://t.co/EEN2QG719D
Built a self-updating Intune docs tracker styled like a broadsheet newspaper. GitHub Actions fetches the Microsoft Learn RSS feed every 6 hours, categorizes updates, and publishes to GitHub Pages, so zero maintenance. Serif type, two-column grid, lead stories. The Intune admin gazette nobody asked for. 📰

[ALI TAJRAN @alitajran]

Microsoft finally introduces Group Insights in Microsoft Entra ID!

Organizations should look into their groups and clean them up regularly. Yet tenant-wide statistics show that very few actually do.

This changes now.

The Groups Insights dashboard now provides immediate visibility into common group hygiene and governance gaps, such as:

- Groups with no owners
- Groups with service principals as owners
- Groups with guest users as owners
- Groups with complicated rules
- Groups with low efficient operators
- Newly created groups
- Expiring groups
- Soft deleted groups
- Restored groups
- Groups without sensitivity labels

#EntraID #Microsoft365 #Microsoft

[Dirk O'Client 🥨🛣️ @OClient]

⌛️ Patched within 2024. v2403 or higher KB29166583

[Dirk O'Client 🥨🛣️ @OClient]

#SCCM #ConfigMgr SQL injection vulnerability allows remote attackers with no privileges to gain code execution and run arbitrary commands with the highest level of privileges 🫤
https://t.co/I4pHxAedHO

[Daniel Lemire @lemire]

Notepad++, the popular text editor used by programmers, was hacked by the Chinese government…

[BMFTR @bmftr_bund]

Zu viel nerviges Cookie-Geklicke? Hier hilft der Consenter: Die Browsererweiterung kann Cookie-Einwilligungen zentral verwalten. Das Tool stammt aus dem BMFTR-geförderten Projekt „YourPrivacyLawyer“.
👉https://t.co/fGkbLlQ3cg

#DataPrivacyDay #DataProtectionDay #Datenschutztag

[BobPony.com @TheBobPony]

Windows cumulative updates are now separate for Windows 11 and Windows Server 2025.
Different KB update number, smaller file size and lack of A.I. components in the Windows Server 2025 update package.
Update packages made for Windows 11 won't install on Server 2025 and vice versa