Roy Trenneman

TVM + Intune + PowerShell + uɐᴉlɐɹʇsn∀ #SanAntonioSpurs

[Roy Trenneman @RoyTrizzle]

@xenappblog @PatchMyPC Doesn’t occur for me, must be because I pre-provision.

[Roy Trenneman @RoyTrizzle]

@MSFTSecSuppTeam Forget about it. I’m not getting any suitable responses.

[Roy Trenneman @RoyTrizzle]

@MSFTSecSuppTeam @msftsecurity is there anybody that can explain how AppControl can be made simpler if all the bootstrap exes that come from the Microsoft AppStore (Web) are signed by a Microsoft Certificate???

[Roy Trenneman @RoyTrizzle]

@MSFTSecSuppTeam And before you reply telling me to write a block rule, this is also under because it doesn’t take into consideration ANY other Microsoft signed bootstrapper.

This is NOT a secure by design setup.

[Roy Trenneman @RoyTrizzle]

@MSFTSecSuppTeam I understand why it’s allowed. I’m saying this is undesirable. Organisations get audited under based on “installed” software.

So under this scenario I have users with multiple instances of Firefox that never updates and appears in defender cve reports ruining my Score

[Roy Trenneman @RoyTrizzle]

@IntuneSuppTeam @miketerrill @TKatzmanIT 👀

[Roy Trenneman @RoyTrizzle]

@MSFTSecSuppTeam Yes the first reply i received seems wrong. Try the Firefox bootstrapper. It’s signed by Microsoft. So staff can install it (but then not run the app). And I end up with devices that have the browser installed.

[Roy Trenneman @RoyTrizzle]

This response seems wrong. An example is the Firefox bootstrap signed by Microsoft.

I trust Microsoft but not Mozilla. I don’t want staff installing that browser.

Staff can install it because of this Microsoft trust

[Rudy Ooms @Mister_MDM]

Intune Management Extension: Release Notes.

When something changes in Intune, we usually get a “What’s new” update or a roadmap update. But what happens when the local IME changes?

That part is a big black box... And with the IME being responsible for much more than most people think. Win32 apps, scripts, remediations, reporting, APv2-related pieces, that list will only keep growing.

So I wanted my own Intune Management Extension Release Notes :) @IntuneSuppTeam :P

Every time a new IME version appears, an automation flow compares the MSI, custom actions, payload files, DLLs, and changed methods to determine what actually changed in the SideCar/IME agent.

#Intune #MSIntune #Windows11

https://t.co/x5rsv8GS7V

[Roy Trenneman @RoyTrizzle]

@NathanMcNulty Technology and infrastructure is just getting to the point of being so over engineered. The old
meme of “majority of end users use only 10% of the features in Microsoft Office” couldn’t be a better explanation of the entire industry.

[Rudy Ooms @Mister_MDM]

Under the Hood of the Intune Certificate

The Intune certificate matters more than most people think. That Certificate keeps the policy sync alive and is also needed for IME communication, which means apps and scripts depend on it as well.

But when the certificate or its chain breaks, things can get funny. The device can still show a recent last check-in, while it is no longer able to receive the latest policies, apps, or scripts.

In this webinar, we will explain what the Intune MDM device certificate does, what changed with the Intune Intermediate certificate renewal, why some devices may have missed it, and how to find devices that still appear healthy but may not be.

But hey, it is all fine because the last check-in still moved… right?

Register here: https://t.co/gZtj8m09Fp

#Intune #MSIntune

[Roy Trenneman @RoyTrizzle]

@xenappblog @MSIntune I hoping it’s a precursor to integration with ( and perhaps semi automated ) WDAC

[Roy Trenneman @RoyTrizzle]

@ariaupdated I would like to see a policy that allows admins to manage the current user manageable setting “Notify me when a restart is required to finish updating”.

This would help in situations like RDP sessions where users can easily miss the toast notification due to a timeout.

[ariaupdated @ariaupdated]

We have released a new report in #Autopatch to help you evaluate the patching vulnerability risk in your estate, along with some new guidance for how quickly to take patches. #WindowsUpdate https://t.co/55QvaxRHNN

[Roy Trenneman @RoyTrizzle]

@Mister_MDM this looks current still, just checking there is no default role now? 🙏 https://t.co/WxvYrPGyiW

[Roy Trenneman @RoyTrizzle]

@Mister_MDM Have a user right now on .109. that just got the problem. Need to start digging to figure out whats happening.

[Roy Trenneman @RoyTrizzle]

@Mister_MDM After monitoring devices yesterday (Australian time) I could see them updating to .109. and it seemed to be resolved. Then in the afternoon around 2:00pm I started seeing category fail warnings again along with errors listing apps.

[Bryan Dam @bdam555]

PSA: Known issue with April's LCU for basically everything.

In a _very_ specific scenario (see below), users are going to get a BitLocker recovery prompt after updating.

Link below is for one KB, but the story is the same everywhere.

https://t.co/THZAKQc8eb

[Roy Trenneman @RoyTrizzle]

@Mister_MDM Same devices today on the same version have been ok...

[Roy Trenneman @RoyTrizzle]

@Mister_MDM Yeah had a read. Interesting since most of my fleet are on .109. and yesterday we had a re-occurence of the problem.