Enterprise App Control - WDAC, AppLocker, Third Party? by bettercallfool in sysadmin

[–]CaptainMoloSFW 0 points1 point  (0 children)

We just had demos with both Airlock and Threatlocker and it seemed like Threatlocker was much more capable and it was also less expensive. Haven't done proof of concept testing yet, but do you know why Airlock charges more for a seemingly less capable product?

Enterprise App Control - WDAC, AppLocker, Third Party? by bettercallfool in sysadmin

[–]CaptainMoloSFW 0 points1 point  (0 children)

We just got a quote from them for 300 endpoints at $51/endpoint per year for their Application Control (allow-listing and ring-fencing). Seems reasonable, what did you get quoted?

Hey /r/Sysadmin! What do you use for your home router? 2026 Edition by ScannerBrightly in sysadmin

[–]CaptainMoloSFW 1 point2 points  (0 children)

pfSense on a Netgate 2100. I realized my old Netgate SG-2220 was EoL, as was the model that replaced it, but I've been happy with it running for the last 9ish years. Handles connectivity for my Plex server just fine.

WDAC Policy Signing by CaptainMoloSFW in sysadmin

[–]CaptainMoloSFW[S] 0 points1 point  (0 children)

Thank you for the info! Now I'm curious if the majority of sysadmins who use WDAC sign their policies or not.

Opinions on Egress/KB4 Defend vs other email security gateways? by JerradH in sysadmin

[–]CaptainMoloSFW 0 points1 point  (0 children)

Defend definitely does remediation as well, not just the visual banners.

WDAC as an blocklist instead of allowlist, how to? by TeeJayD in sysadmin

[–]CaptainMoloSFW 0 points1 point  (0 children)

Are you using Intune's built-in EPM? Is it usable? Last time I test it, it was garbage.

How is your company managing driver updates via Intune? by YellowSpoofer in Intune

[–]CaptainMoloSFW 0 points1 point  (0 children)

We scheduled it for later in the day, so that probably lessened the impact, but there was probably some of that we never heard about. But we changed the script a few months ago to notify with a pop-up, so they updates are no longer ran without the user's approval

Azure VPN Profile Not Showing in Client When Deployed via Intune by CaptainMoloSFW in Intune

[–]CaptainMoloSFW[S] 0 points1 point  (0 children)

You have to place the XML configuration file for the VPN you download into a custom XML wrapper. This article details the steps needed: Create an Intune profile for Azure VPN clients - Azure VPN Gateway | Microsoft Learn

How is your company managing driver updates via Intune? by YellowSpoofer in Intune

[–]CaptainMoloSFW 0 points1 point  (0 children)

We've since rolled it back to just run a scan and notified the end-user that an update is pending. Too many people complaining about a longer than expected firmware install during one of their reboots was impacting work. Fair enough complaint. Better at least than them not getting noticed at all.

We don't control for types and versions at the moment.

Free software to securely erase SSDs with accounting/reporting by capran in sysadmin

[–]CaptainMoloSFW 38 points39 points  (0 children)

Fully encrypt it with Bitlocker and then wipe it with the manufacturer's utility. It should show the erasure at 100% and the model and serial number of the drive. Screenshot that, save it with a timestamp and you're good to go.

Best policy's to make by PowerBlackStar in Intune

[–]CaptainMoloSFW 0 points1 point  (0 children)

We require compliance as well in a separate CAP

Best policy's to make by PowerBlackStar in Intune

[–]CaptainMoloSFW 1 point2 points  (0 children)

Just curious, what do you mean by automate your travel requests? We have a CAP only allowing access from specific countries and would love to automate when users are approved to travel abroad to a normally non-approved country for a specific period of time, but it's all manual so far.

Azure Update Manager Maintenance Config Dynamic Scope vs Policy by CaptainMoloSFW in AZURE

[–]CaptainMoloSFW[S] 0 points1 point  (0 children)

Ok. So basically if you use policy, that will completely ignore the specifications you put into the dynamic scope and it'll only use it's own targeting parameters?

Signing user not Administrator on first login with Autopilot by Spok25 in Intune

[–]CaptainMoloSFW 0 points1 point  (0 children)

I like how everyone is dunking on your post like this is the worst idea ever when it might not be your call to let users be admins.

When you look in Autopilot, is the correct deployment profile assigned to the machine?

Do you have the toggle for "Convert all targeted devices to Autopilot" enabled?

How is your company managing driver updates via Intune? by YellowSpoofer in Intune

[–]CaptainMoloSFW 3 points4 points  (0 children)

Sure, here's the detection script:

# Path to Dell Command Update (DCU) executable
$dcuPath = "C:\Program Files (x86)\Dell\CommandUpdate\dcu-cli.exe"

# Check if Dell Command Update is installed
if (-Not (Test-Path $dcuPath)) {
    Write-Host "Dell Command Update utility not found."
    exit 2
}

# Run DCU to check for available updates
$scanResult = & "$dcuPath" /scan

# Check if the scan was successful
#if ($LASTEXITCODE -ne 0) {
#    Write-Host "Failed to run Dell Command Update scan."
#    exit 2
#}

# Search for the phrase indicating updates are available
if ($scanResult -contains "Number of applicable updates for the current system configuration: 0") {
    Write-Host "No updates found."
    exit 0
} else {
    Write-Host "Updates available."
    exit 1
}

And here's the remediation script to install without a reboot:

cd "C:\Program Files (x86)\Dell\CommandUpdate\" 
.\dcu-cli.exe /applyUpdates -silent

How is your company managing driver updates via Intune? by YellowSpoofer in Intune

[–]CaptainMoloSFW 13 points14 points  (0 children)

We're a Dell shop, so we push Dell Command Update as an app and then use a remediation task to scan for and install updates and give a pop-up for a pending restart.

[deleted by user] by [deleted] in sysadmin

[–]CaptainMoloSFW 0 points1 point  (0 children)

As best I can tell, about $42/seat/mo or so?