James Robinson | MVP

Microsoft MVP - Intune and Windows

| Cloud-Native Endpoint Advocate | Neurodivergent Loudmouth |

| All thoughts my own |

[James Robinson | MVP @SkipToEndpoint]

What's better on a Friday afternoon than dropping a blog about the use of HAADJ and how it fits into "Modern Management"?

https://t.co/GRouba3jET

#MSIntune #HAADJ #Autopilot #CloudNative

[James Robinson | MVP @SkipToEndpoint]

@NathanMcNulty @ariaupdated Server? What's that? Sounds awful.

[James Robinson | MVP @SkipToEndpoint]

@NathanMcNulty @ariaupdated The reality is that nobody outside of us freaks are sat at that screen waiting for things to happen. The first most people know that an update wants a reboot is when they get the notification, which _does_ only happen when they're all complete.

[James Robinson | MVP @SkipToEndpoint]

@AdamGell Make policies manageable and give them useful and descriptive names.
A device doesn't give a crap how you separate or name your policies. That's entirely for the admins benefit.

[James Robinson | MVP @SkipToEndpoint]

@rafal_fitt @namitguy

[James Robinson | MVP @SkipToEndpoint]

@WesleydelaCruz7 Yep imports are completely fresh copies and don't touch any of your existing policies.

[James Robinson | MVP @SkipToEndpoint]

#OpenIntuneBaseline Windows v4.0 is here! 🎉
Highlights include:

* Continuing to be the most agile and cutting-edge Intune baseline on the planet!
* A shake-up of Compliance policies, allowing true grace period granularity (and ditching the EAS Password policy because it's 🗑️)
* Edge settings for days! Simple support for the Edge Management Service and security hardening and user experience improvements.
* Updated M365 Apps Security baseline alignment.
* Fixed MS breaking the in-box app removal policy.
* Defender behaviour tweaks based on real customer feedback, not arbitrary check-boxes.
* Deprecated and obsolete settings sent to live on a farm.

As always:
✅ Take what you want
✅ Change what doesn't suit your environment
✅ Test it before yeeting to 40,000 endpoints on Friday afternoon
❌ Don't treat any security baseline as a magical compliance button

Check out the full release notes at: https://t.co/FS3CVjDVxz

Then, head on over to the OIB Deployer to deploy the new and updated policies, or check your current config vs 4.0 with the Settings Validator!
https://deploy[.]https://t.co/1quHU5axSU

And, uhh, keep an eye on Friday, too ;)

#OIB #Windows #EndpointSecurity #Community #Capybara

[Ugur Koc @UgurKocDe]

TenuVault - Baselines, Backup and Restore for Intune

[ariaupdated @ariaupdated]

To the person asking earlier today how to have Windows update CSPs/Cloud policies win over Group Policy - check out the new policy we added to do just that: https://t.co/ToWjyER6i1

[James Robinson | MVP @SkipToEndpoint]

@angry_tarsier I've added "Interactive Logon Machine Inactivity Limit" into the Power and Device Lock policy with the same outcome :)

https://t.co/CJXWlIFJMc

[James Robinson | MVP @SkipToEndpoint]

@merill People stopped hosting on-prem exchange when it became too expensive in hardware and time keeping it patched.
I don't see why AD is any different.
The biggest security win is going Entra Join for devices. Cut that direct infrastructure tie from endpoints.

[James Robinson | MVP @SkipToEndpoint]

@modaly_it @bdam555 "Roof Inspector" 🤣🤣🤣

[James Robinson | MVP @SkipToEndpoint]

@NathanMcNulty "But that's how I do it on the firewall!"

[James Robinson | MVP @SkipToEndpoint]

@mozzeph @NathanMcNulty Nah sorry, they just weren't good and had functionality that was available just as easily elsewhere.

[James Robinson | MVP @SkipToEndpoint]

@DBMandrake @Berbe5y And thus configured it contrary to *any* recommendation.

[James Robinson | MVP @SkipToEndpoint]

This whole thing is super weird. The default for that setting is 0 (Disabled). It was set to 0 in the Microsoft 24H2 Baseline.
Are people just configuring a setting to something that nobody is recommending now? Or is there something else going on?

https://t.co/tscLowH6tL

[James Robinson | MVP @SkipToEndpoint]

@timbeer Very kind of you, but unconfigured should mean disabled anyway, at least according to the docs...

Weird one.

[James Robinson | MVP @SkipToEndpoint]

@timbeer Poking a bit more, being set to Disabled is the Default setting for that, and I can't see it being recommended (set in any way) in any other baseline. So someone's gone and set that from the default on purpose for an unknown reason.

[Rudy Ooms @Mister_MDM]

Defender is turned on, while Windows Security Center tells your users it’s off...

That’s an issue. But when the device suddenly becomes noncompliant in Intune because of it... well, that’s something else.

It seems a race condition between Defender and WSC during startup left WSC thinking Defender was turned off. Defender platform 4.18.26080.4 fixed it in our testing.

Read the full blog to see what went wrong and how to get the Defender update.

https://t.co/n6VDq5TMW5

@PatchMyPC #PatchMyPC

#Intune #MSIntune #Defender #Security #Windows11

[James Robinson | MVP @SkipToEndpoint]

@acjuelich Yeah, MacOS is kinda busted and I haven't specifically fixed it because mentally that was behind MacOS v2.0, but thats essentially indefinitely delayed until I have a Mac to actually test it on.

Go grab the 2.0 beta branch from github (and provide feedback!)