Peter Richardt

Dad of a girl, dad of twins, husband, bicycle and IT enthusiast, master of Labrador, gardener out of necessity

[Ru Campbell @rucam365]

Folks, MDE In Depth 2nd Edition which we've been working on for a while is now available for order in May.

UK: https://t.co/bFhKSHncKt
USA: https://t.co/fWnzP1U8CB

3 new chapters one tuning + situational optimisations, mobile threat protection, and safely rolling out to prod. All others refreshed + updated since the 1st edition 3 years ago.

[Peter Richardt @RichardtPeter]

@rucam365 @WelkasWorld Do you maybe know how to license mde on windows 11 intune shared devices? There seems nothing official?

[Peter Richardt @RichardtPeter]

@Mister_MDM There were also issues with vuln scanners just looking for build numbers. Vuln tool was not build already to detect hotpatch devices as up to date. Canceled hotpatch feature for this reason.

[Peter Richardt @RichardtPeter]

@xenappblog @dhoody82 @MSIntune Could you give us more details on what you design different for VMs? 🙏♥️

[Peter Richardt @RichardtPeter]

@stats_feed @grok are there official sources? In which areas did it improve?

[Peter Richardt @RichardtPeter]

@Mister_MDM @PatchMyPC @MisterMDM Knock, knock ☺️ happy new year. Did you had already time to look at our must have feature?

[Peter Richardt @RichardtPeter]

@Mister_MDM @PatchMyPC @MisterMDM That would be lovely ❤️❤️

[Peter Richardt @RichardtPeter]

@buckleyplanet Yes, now it works

[Peter Richardt @RichardtPeter]

@Trisha_Techie @threadreaderapp enroll

[Stephan Berger @malmoeb]

During a recent incident response case, we observed the following file access: \\localhost\C$\@ GMT-2025.06.21-10.53.43\Windows\NTDS\ntds.dit

This is a clever method of accessing a Volume Shadow Copy (VSS) snapshot. Many EDR and detection systems typically monitor for commands such as 'vssadmin list shadows', and may trigger alerts based on their use.

However, by leveraging the "Previous Versions" feature in Windows (see screenshot), attackers can select a snapshot, view its properties, and enter the '@ GMT' path directly in Explorer. This allows them to browse the snapshot's contents without needing to use the command line.

Because this technique doesn't rely on typical shadow copy commands, it may evade detection by your EDR or SIEM solution. You might want to test it in your environment to identify and close this potential detection gap 🦸‍♂️🦸‍♀️

[Peter Richardt @RichardtPeter]

@SkipToEndpoint @deanbrighton Change it to what?

[Peter Richardt @RichardtPeter]

@PatchMyPC @Mister_MDM Nice one 🦾

[Peter Richardt @RichardtPeter]

@PatchMyPC @djammmer 100% Intune, msi

[Peter Richardt @RichardtPeter]

@djammmer Dell Support Assist OS recovery is good enough for bare metal.

You need to lower your demands on perfection 😅

[Peter Richardt @RichardtPeter]

@shedntcare_ Hustle

[Peter Richardt @RichardtPeter]

@byteben @PatchMyPC A Consultant meant, that 1.000 would be a magical maximum.

But even with 200 products activated in Pmp assigned to All devices, this can have Performance impacts?

[Tal Be'ery @TalBeerySec]

if "The Browser is the New Operating System", where can I find the "Browser* Internals" book?
@aionescu @markrussinovich @lcamtuf @ericlaw @zodiacon
If it does not exist yet, who (org & people) should write it?
* Browser/ Chrome/ Chromium