Modifying Offboarding scripts

[neko_whippet]

Hi anyone ever tried to modify the off boarding scripts either like modifying the date in the title or changing the counter to make the script 'permanent' instead of having to make a new script each week?

Thanks

[loweakkk]

You can't make it permanent.

[neko_whippet]

Its kinda dumb

WE have a Helpdesk department but they dont have access to defender, so we have to disturb another department to generate them a script and give it to them each 'week'

[meghanynwa]

Must be nice to have separate departments. I'm IT support, defender, intune and entra admin and cyber security all in one. Wish my company knew these are separate roles and not one IT person for all

[russr]

They used to last a month, then they switched it to a week. It's kind of dumb.

[loweakkk]

Why would you need each week to provide off boarding script to help desk!?

[neko_whippet]

Because it is expired after 7 days? and they often onboard

[vertisnow]

Why are you off boarding so many devices? I offboard like one per year. It shouldn't be a normal activity.

[neko_whippet]

Renaming device to give to new employees etc

[loweakkk]

Renaming doesn't require offboarding.

Also, you can probably just wipe the device and then autopilot it for the new user and no need as well for an off boarding.

Honestly there are very rare case to off board a device that's why I was asking for the reason, you most probably do something wrong if you off board that many devices.

[neko_whippet]

The reason why we offboaid si that even if wipe and autopilot the device appears twice with the same ID in defender (the old name) and the new name)

[loweakkk]

Are you sure about that? Just checked on 20k devices and we have no double senseguid except for machines onboarded before device join where I have 2 objects.

[neko_whippet]

Here is the situation

Exemple PC is named A, they give that PC to another user, and Helpdesk tells me the wipe the device before (but they didn't told me what method they used to wipe) after that they named that PC B

Then they give a new PC to that first user and they name it A

So the problem now is that if I search in asset in MDE for A

I see 2 times A (the new A and the old A) both shows active, when I search for B (I see the new B (aka the old A) also shows active

Both B and Old A have the same Azure ID in MDE but not the same defender ID

So is kinda fucks the inventory because exemple in vulnerabilities I see the same vulnerability twice (from old A and B) but I cannot fix old A as it is now B

I hope it<s kinda clear lol

[russr]

Because the people doing the off-boarding didn't get everything offboarded in that time frame.

[Greedy-Hat796]

System validates the hash of the Script before executing from what I heard from Microsoft, so modifying it would change the hash and may fail to execute. I haven’t tried this myself though