Martin Bengtsson

A brief first look on Microsoft Defender ATP Tamper Protection

by

Introduction

Late last night my time, Tamper Protection in the Microsoft Defender stack went Generally Available.

In short and as the name implies, this is a feature which essentially locks Microsoft Defender and prevents your security settings from being tampered with, including changes made by an administrator.

From a security perspective, this is a great and welcomed addition – let’s take a closer look. 🙂

PS. I did find some oddities in some of the behavior when trying to disable Microsoft Defender through Group Policy. More on that in the end of the post.

Read more…

Remind users to enroll into Windows Hello for Business using Toast Notifications and ConfigMgr

by

Introduction

I recently did a tweet about doing a toast notification to lure end-users into enrolling their device with Windows Hello for Business voluntarily.

Prior to doing the tweet, I found my self wrestling with Powershell and a way to locate devices not enrolled into WHfB yet. Seeing I only wanted to nag people not enrolled yet, this was a requirement for the entire process.

So this post is a little something on both the actual toast notification, but also on how I ended up locating devices not enrolled into WHfB yet using a Compliance Baseline in ConfigMgr.

Read more…

Windows 10 Toast Notification Script Update: Check for Active Directory Password Expiration

by

Introduction

My Windows 10 Toast Notification Script has received another update, now being on version 1.4. What’s new and delicious are mentioned in details below.

Note: I know that expiring passwords are not ideal, but reality is that many still have them configured like so while trying to find their way out with Windows Hello for Business, Password-Less etc.

The toast notification might even serve as a good entry point into enrolling into WhFB when one are ready to do so. I’ll make an example of such in the future 🙂

Read more…

CMPivot use case: Hunt down devices infected with malware (WannaCry ransomware)

by

Introduction

CMPivot is a utility which was introduced with SCCM 1806 (System Center Configuration Manager).

In short, it’s a utility which enables us to query all currently connected devices for information in real-time.

This is extremely useful in a variety of situation, where a great example of such will be in case of a malware outbreak.

In case of a malware outbreak, a lot of questions becomes relevant to answer quickly:

  • How many devices are infected?
  • Which devices are not infected?
  • Are the malware spreading?
  • etc.

CMPivot to the rescue!

Read more…

Modify Windows HOSTS file using SCCM (System Center Configuration Manager) and Powershell

by

Introduction

I was just doing some work today where I needed to modify the content of the HOSTS file in Windows on a good bunch of devices. (This is the file being located in C:\Windows\System32\drivers\etc)

I figured this is something anybody might find useful, so I wanted to share the Powershell script I ended up creating for the purpose.

For your convenience, I’m also illustrating how this can be used in combination with ConfigMgr as this was a requirement for automation purposes 🙂

Read more…

Windows 10 Toast Notification Script updated to version 1.3

by

Introduction

As the topic suggests; my Windows 10 Toast Notification Script has been updated to version 1.3 and here’s what’s new and delicious. 😀

Note: The screenshot below is intentionally in jibberish (danish). This is to illustrate that all text elements now are customizable through the config file.

Read more…

Windows as a Service: Example of fixing Compat Scan errors (A driver is installed that causes stability problems)

by

Introduction

Sooner or later you will encounter some Compatibility Scan errors with your Windows 10 upgrades.

And if you like me run the Compat Scan prior to the actual Windows 10 upgrade, you will have time to fix these errors before the end-user is aware. Clever, right? 😀

So this post is an example of such and is based on a really simple approach to fixing an incompatible driver. Curious? Read on 🙂

Read more…

Managing Microsoft Edge Chromium settings with SCCM (System Center Configuration Manager)

by

Introduction

The new Microsoft Edge Chromium browser is a real treat, and not too long ago this delicious new browser was deemed ready for testing in the enterprise.

Therefore I figured it would make a decent blog post to give some insights on, how you can manage the new settings using SCCM (System Center Configuration Manager).

I have previously shown how you can install Google Chrome extensions also using SCCM. This post is based on the same approach: https://www.imab.dk/forcefully-deploy-the-windows-defender-google-chrome-extension-using-configuration-manager/

Read more…

Enrollment of co-managed devices based on Azure AD device token with ConfigMgr 1906

by

Introduction

A short and sweet peek into the latest improvement to the enrollment of co-managed devices into Microsoft Intune.

Prior to SCCM 1906 (System Center Configuration Manager), the enrollment into Microsoft Intune required a user to sign in to the device. This has now changed and the device is able to auto-enroll into Microsoft Intune based on its Azure AD device token.

Note: This is not an A-Z guide, so I’m sadly not covering all the basics and requirements around enrollment nor co-management. Instead I’m touching base with some of the interesting parts, based on my own environment, setup and curiosity. 🙂

Read more…

Updating SCCM (System Center Configuration Manager) Current Branch to version 1906

by

Introduction

Yesterday happened to be one of those #SCCM Fridays. And a big and awesome one indeed. So awesome I had to take a break from my vacation to catch up on the latest and greatest. 🙂

Configuration Manager Current Branch version 1906 was released and as with previous versions, I will walk you through the update process based on my own environment. I do this before touching base with some of the new and delicious features in upcoming posts.

Read more…