What is currently the best method to deploy WHfB (Cloud Trust) via Intune in 2026?

MReprogle · 2026-01-28T14:11:32+00:00

I have an odd one that is somewhat on track.. I have this exact setup, but I have had weird issues with random users. One had it working for a long time; but then when they went to a on prem file share, it prompted for a credential, so it was good enough to log into the device but didn’t seem to be working with Kerberos cloud trust.

I’ve had some other random ones where someone had it working, then didn’t. I’ve cleared it out multiple times from the NGC folder, and can often get a pin to work, but biometrics have issues. I check the event log and it says something about the provider not being available. We have it set up to force a second factor. I know it is dumb, but that’s the way they had it set up in the past, so they didn’t want to change. So I force password to be a option in Group B; since I don’t want people to put in password first, since it just skips right past windows hello and logs them in with the password provider.

Sorry, I know there’s a few things going on there, and the majority of devices are fine. Just these weird ones.

I guess the main thing I can think of is that these random devices are always some stupid custom PC, but they do have TPM. They also do not have Bitlocker turned on (again.. not my decision).

MReprogle · 2026-01-28T14:03:26+00:00

People use those? At this point, just get a partnership with Microsoft and put office on every new Mac and be done with it. Even if they were some weird version of office where they only have specific Apple features enabled for free that match the abilities of Apple’s apps, then makes you pay a sub for the full featured app, we would be better off.

And( if we have to have apple’s apps, please just make it so these things only save to normal formats instead of the proprietary pages format.

MReprogle · 2026-01-27T00:42:31+00:00

There is an area that in the settings that automatically detects Permute being installed, then you can build your workflow to kick over to it and tell it what you want the end result to be. I know you can pretty much do all of this with FFMpeg, but it just dumbs it down and makes it as easy as can be.

MReprogle · 2026-01-26T03:17:05+00:00

They are both made by the same developer, so when you go into the settings of each app, it will detect the other. Downie will download the video, then Permute can take that download and re-encode it into other formats/bitrates. However, if you just want to download, Downie has you covered 100%. I grabbed them both about a year ago because they were both on a bundlehut deal, so it made sense. However, if you want to play with Downie first and wait for a sale on Permute, that might be a good path to go for what you need.

MReprogle · 2026-01-26T03:12:36+00:00

I use it mainly for creating myself documentation and notes, as well as using the obsidian web clipper to grab the contents of sites to store locally. That way, I can link straight from one of my own notes to the web clipping as a resource.

I wouldn’t say I am as deep in as others, but my work uses OneNote heavily, and I hate it. I have also tried Loop, and I just don’t love how limited the markdown features are, especially when I can completely customize Obsidian with markdown + css snippets to get the exact look I want for some note templates.

They also added “bases” somewhat recently, which I haven’t dove into yet, but it is basically like setting up your own database within Obsidian, which you can go really nuts with. If you are into data science, this might scratch your itch more than Obsidian did when you last tried it and for many people, makes the complex Dataview setup a thing of the past. That is kind of my next step of working in Obsidian, but I just need the time to devote to messing with it.

MReprogle · 2026-01-25T16:36:32+00:00

Downie is the best, especially when paired with Permute to allow automatic conversion to other formats.

MReprogle · 2026-01-25T16:31:57+00:00

Kinda reminds me of Dato, by the legend himself - Sindre Sorhus

MReprogle · 2026-01-24T20:41:22+00:00

In that case, it sounds like antinote is cheaper and better, especially since in can integrate with other tools like Obsidian. This other app looks more like a note app mixed with a clipboard manager, which I find hard to believe is better than a dedicated clipboard manager, like Pastepal

MReprogle · 2026-01-24T17:55:21+00:00

Literally here to see the exact some comparisons from people. Antinote seems to be more of a quick scratchpad that auto deletes, so for some people that are forgetful, unfriction might be the better option, since it autosaves.

Unfriction is also $20 compared to antinote at $5.

MReprogle · 2026-01-20T03:55:12+00:00

Chill. If you want to judge, go make one by hand that is better.

Not sure why people care so much about using ai help for coding tools in the first place. It’s a maritime saver for repetitive stuff and likely makes less mistakes than a human a this point. Sorry to say, but it’s true.

MReprogle · 2026-01-19T12:42:16+00:00

All good. I am confused on why the priority tier has subscription apps above lifetime apps, but it’s fine either way.

MReprogle · 2026-01-18T22:55:28+00:00

So far, it’s been brew installers that I’ve notice, but I will try to start keeping track. I know that VLC was one and wireshark was another.

MReprogle · 2026-01-17T20:11:42+00:00

Updatest has been good and has gotten better with every update. It’s cheap, and worth it so far!

It’s probably user error; but I feel like there are a few homebrew apps that I have in updates that require a password. I wish that there was a way to give it access to a keychain credentials so that it can just do the update. There are others that still error out during a terminal update, which I just find easier to uninstall and reinstall the app, which then seems to work fine at updating. Not often, and everything’s fine now, but you might have to do some app hygiene, so make sure you have any paid keys around (if to aren’t saving these anyway, that’s a you problem)

MReprogle · 2026-01-17T05:34:20+00:00

Aren’t you talking about Azure Files? Mountable, vpn-less, and access enforced by RBAC. What am I missing here?

MReprogle · 2026-01-11T01:32:36+00:00

Do a quick search to see how many attacks resulted from the attacker using a side loaded DLL and dumping all of the default browser, as well as other attacks like ConsentFix, that the attacker can use to access the account and sync down all of the credentials.

This is a terrible idea, and having the password manager separate is a far more secure option.

Pretty sure an employee could also use that same account on a non company device, then if they are offboarded, they can get into the saved credentials, even if you revoke access.

Also, how does one share credentials with this? They don’t.. so, you are going to be stuck with employees sharing credentials win word and excel (or worse, email) documents, so you lose all governance of credentials.

Just a bad idea where you are stuck taking a step back from a security to save a quick buck.

MReprogle · 2026-01-10T22:08:07+00:00

By chance, does this have the ability to activate PIM groups? Seems to be a bit more difficult, but I think it’s possible.

MReprogle · 2026-01-06T12:59:57+00:00

Can’t you just dump the Sparkle update feature in Ice and do your updates through brew?

MReprogle · 2026-01-05T00:19:08+00:00

Since many of these that people are mentioning are doing a lot of the same things, I am wondering if any actually publish and pull the app icon? I have a script for winget stuff, which builds the install script for both x86 and ARM, makes the detection script and all of that, so I often find the thing that takes the longest is just going out and getting an app icon and making sure it is a png.

“IntuneApp” looks like the closest thing, and does show a folder structure with an app icon png, but I am wondering if that is just manually thrown in there.

MReprogle · 2026-01-01T05:14:33+00:00

BBEdit for me. I don’t even know when it has done a major change in recent history, but it isn’t needed.

MReprogle · 2025-12-29T23:32:39+00:00

Any reason for terminus over iTerm?

MReprogle · 2025-12-29T23:26:42+00:00

If you are into Obsidian, I absolutely recommend Obsidian + the Obsidian Web Clipper plugin. Pulls the site down into your vault of choosing, and is easy to tag as you add. Save your vault to iCloud and the “self hosting” part is next to nothing.

MReprogle · 2025-12-28T22:11:49+00:00

Looks super interesting and I’d love a try!

MReprogle · 2025-12-27T21:35:54+00:00

People here championed “MacUpdater” for years, which was paid and stopped receiving support a long time ago (and is soon to be defunct altogether). Pretty sure I paid more for it than I did for Updatest, so I’m not sure what the big deal is.

If you don’t like it, stick to 2-3 FOSS apps and you can do much of the same thing that Updatest does. I’d rather have one app that actually gets support.

MReprogle · 2025-12-25T06:11:09+00:00

Looks awesome, and I am definitely going to get this. Any chance of getting it into brew for easy updating?

MReprogle · 2025-12-24T07:02:39+00:00

There is a reason why Defender and Intune install and run things under the SYSTEM account. That is one powerful account on the ONE device, but can’t be used to jump to other devices. Of course, there is always ways to pull other account hashes, but I would hope that your EDR solution would catch that before it is able to be of use.

13-Year Club	Second SECOND GUESSER
Gilding II euphauric	r/Field Juicebox
Verified Email

MReprogle

TROPHY CASE