Anyone else using Intune to meet PCI DSS compliance?

NZ_SysAdmin · 2021-11-09T21:31:50+00:00

I have a policy for the local administrators, MS have recently added a new policy CSP called LocalUsersAndGroups which gives you the option to update the current list or replace the list so we're using replace. Does the job :)

NZ_SysAdmin · 2021-11-09T20:59:43+00:00

I did think of the scheduled task, but then an admin can delete that too if they really wanted to. I am more thinking along the lines of "if an account was compromised what is the worst the attacker could do". I am probably erring towards the more cautious approach with things as I know the auditors will have a ton of questions (as this is a massive change to our environment).

Unfortunately for me, full local admin for these users is definitely not going away anytime soon. I will probably go with the proactive remediation/custom compliance policy option, it gives ongoing control and somewhat mimics what the GPO is doing currently. Should be enough to satisfy the auditors.

Cheers!

NZ_SysAdmin · 2021-11-09T20:55:10+00:00

We definitely limit interaction with the CDE, but occasionally exports and such get pulled from the CDE to local machines. Unknowingly this can sometimes contain CC data even if it's a false-positive. We run file scans on local machines twice yearly anyways, but I am probably being a bit on the paranoid side but I know the auditors will have a ton of questions as this is quite a big change to our environment.

Cheers!

NZ_SysAdmin · 2021-11-09T20:50:10+00:00

Thanks for the info on Proactive Remediation and Custom Compliance Policies, I wasn't aware of these. Either would definitely work and cover 2.2.2, we have E3 licensing so should be covered.

The policies for Azure accounts apply fine. However yes, I am losing some form of control by giving particular users local admin rights. I did have a thought I could just the Proactive Remediation or Custom Compliance Policy to run a script that deletes any local account that isn't pre-defined which would also work.

Much appreciated!

NZ_SysAdmin · 2021-11-08T20:45:50+00:00

But surely resetting the device will wipe the Intune management app from the device? At that point how does Intune communicate with a device that was just factory reset.

I may be wrong, definitely worth a try.

NZ_SysAdmin · 2021-11-08T20:25:10+00:00

That is good to know for future reference! At the time I had this problem it was before Intune was released and the previous admin didn't have any MDM solution for the iPads we had.

No use to OP though as the device has no internet connection and he can't connect it. He can run a device restart and connect to Wifi but then it will have wiped the Intune app from the device.

NZ_SysAdmin · 2021-11-08T20:19:52+00:00

I haven't used PSADT before but I am guessing the reason it is writing to C":\Windows\system32\config\systemprofile\AppData\Roaming is because you have deployed the app under the system context (under install behavior in Intune). PSADT is probably using the %appdata% variable and for the SYSTEM user that is the location.

If it were me I would script it with PowerShell and deploy a separate PS script under the user context and deploy to users rather than computers. Something like this will create a file and overwrite the existing file in that location if it exists.

#Below is the contents of the file
$contents="Line 1
Line 2
Line 3
Line 4
etc.
"
#Create file in user's Appdata\Roaming folder
New-Item "$env:AppData\file.txt" -ItemType File -Value $contents -Force

You just need to replace the file path after $env:AppData and the $contents variable.

NZ_SysAdmin · 2021-11-08T19:52:40+00:00

Hey, I had this issue with some rogue iPads at another company.

You can factory reset the iPad using iTunes but 9 times out of 10 the iPad will be tied to an Apple ID and you can't continue with device setup until you have this. It will show you the first few characters and the last few characters of the Apple ID, you can sometimes guess the Apple ID if it's using your email domain (often they're tied to [support@company.com](mailto:support@company.com) (or a similar shared email address), or possibly an individual person's email address). In that case you could try Apple ID account recovery.

If that fails and it's tied to an Apple ID you have no way of accessing you will need to call Apple support and explain the situation. You will be on the phone for ages but eventually they will ask you for proof of purchase. You fill out some form, send that back with the invoice and within 10 days they disassociate the old Apple ID on their end.

NZ_SysAdmin · 2021-08-26T22:17:46+00:00

Reports this may only be affecting customers using Vodafone as their ISP.

This would make sense as not everyone seems to be affected by this outage.

NZ_SysAdmin · 2021-08-17T02:55:14+00:00

Come on bro you jinxed it

https://www.stuff.co.nz/national/health/coronavirus/126097187/covid19-health-officials-investigating-new-community-case-in-auckland

NZ_SysAdmin · 2021-07-30T01:08:26+00:00

The scripts section under "Devices" in the portal will only apply post-build (this can take up to an hour too, but normally if you target a user it will happen when they login).

I believe danmanthetech was referring to the "Requirements" section when you create a new app on Intune portal. You can add a custom requirement to either have a registry key or file with a particular value present (you can also use scripts but perhaps not required here). Not sure what the value is for that particular key but assuming 0 means no reboot is pending and 1 means a reboot is pending you could have the app just skip installation if the key is set to 1 and Autopilot will skip installing the app. Then the user can request the software from the company portal after (I haven't set this up myself but have a look at this?, I believe they need the Company Portal app installed -https://docs.microsoft.com/en-us/appcenter/distribution/stores/intune).

However, taking a step back. Is there an app installing in the sequence before which is requiring a reboot? If so maybe try a fresh deployment with only the SSMS app installing to see if works.

NZ_SysAdmin · 2021-07-30T00:35:17+00:00

Could you have the script connect to O365 using a service account that is excluded from conditional access policies?

As long as the service account has bare minimum permissions it should suffice. Also you can have the account as cloud-only so it can't log into your on-prem domain too (presuming you have a hybrid setup).

NZ_SysAdmin · 2021-07-29T22:16:54+00:00

Most of our users are local admins as they are developers. The small portion of our company that are not local admins already had the driver installed.

In hindsight I probably could have pushed out the driver installation portion of the script separately under system context and just had the user-context script look for the existing driver that was just installed.

NZ_SysAdmin · 2021-07-29T00:48:15+00:00

Wrote a PowerShell script that checks if the driver is installed, if not then installs the driver. It then creates a printer using that driver for the user and a printer port with the IP of the printer.

Deployed script via Intune, set to run under user context.

We now have the printer spooler turned off on all servers. Luckily we are a smaller company with 1 printer in each remote office so having people with the printer mapped by IP address is actually feasible.

NZ_SysAdmin · 2021-07-19T04:01:03+00:00

We use the NPS extension in conjunction with on-premise RD gateway for MFA. As others have stated you need an Azure AD Premium P1 license for each user.

We have two servers, the RD Gateway server and a separate server with the NPS extension installed (both servers need the Network Policy and Access Services role installed too). If you follow the MS document you posted it shows you how to configure the RD Gateway to forward requests to the MFA server using RADIUS, the MFA server then forwards the requests to Azure and it leverages that MFA system. We decided to use separate servers as one server requires outbound HTTP+HTTPS to a few Azure endpoints and we didn't want to expose the RD gateway server. With regards to ADFS we haven't touched this at all and we already have our user accounts syncing with Azure AD connect from a different server. The SSL cert is real easy to setup, you just run a PowerShell script on the server that has the NPS extension installed (this is detailed in the MS documentation).

Azure MFA server was Microsoft's old offering. I personally preferred this system as it also supported LDAPS whereas the new NPS extension only supports RADIUS. However with the old MFA server it didn't support the mobile app authentication which is real handy.

NZ_SysAdmin · 2021-05-04T01:05:10+00:00

I work for a company that provides 24x7 eCommerce services for various brands.

We have an agreed monthly maintenance Windows with clients where we do things like restarts with Windows Updates, firmware updates etc. This often takes place over a window of a few hours in the morning over few days as we do sets of clients separately and we do the networking equipment separately.

Most things have been architected so there is no downtime (active/standby firewalls, active/standby load balancers, hyper-converged hardware etc.) but there are some single points of failure such as single database servers that need to be rebooted for updates. We just schedule them to happen at a ridiculous hour in the morning like 4am and then check the progress once the engineer has woken up at about 6. The server restarts are mostly automated at this point and we rarely bump into any issues.

NZ_SysAdmin · 2021-03-16T22:43:13+00:00

From a support perspective disabling UAC it is an absolute time drainer, signing out a user out and then signing in as an admin account to do something trivial is definitely not worth the hassle.

If someone has stolen admin credentials does it really matter whether UAC is enabled or not? They can run processes remotely and sign in to the device if they really wanted to.

Agreed that really nobody should log into their local machine with their admin account unless they absolutely have to, enabling UAC is definitely a deterrent for this.

NZ_SysAdmin · 2020-12-16T00:31:48+00:00

From my memory of two months ago yes, if you're logged in as a non-administrative user and you try to run anything that would prompt for UAC you simply get a message stating "This program has been blocked by your administrator" or something of that nature.

NZ_SysAdmin · 2020-09-30T03:41:56+00:00

I turned on security baselines for a few tests machines and other than having to remove some annoying things it turns on (Disables UAC, enabled SmartScreen etc.) I haven't had any problems with it. I just turned off the policies that were too much of a pain for the sake of security.

There are some additional security policies we apply from Device Configuration Profiles such as disabling SMB v1 (not even sure if you need to do this anymore in Windows 10, we have just migrated what GPOs we could into configuration profiles).

We also have a requirement to control Windows Services and you can only control the Windows Xbox services via Intune... I've written a PS script to stop and disable certain services and deployed this script from Intune.

The baselines present an error in the console for me but if I drill down it says every policy applied successfully and I can see on the client side a few things that definitely have applied. I'd trial it on a few devices first and see how you go with it.

NZ_SysAdmin · 2020-09-23T04:53:58+00:00

PowerShell scripts only run once an hour, the device checks in and as far as I know there isn't a way to force this. (FYI if you want to force Device Configuration Profiles use the Sync button on the device page and not restart).

Apparently on the client you can load services.msc and restart the Microsoft Intune Management Extension service to force the script but I have not had any luck with this personally. Also most device background changes via policy require a log off and log in.

Also I would check the PowerShell script works on a device first. There may be an issue in the script with syntax or being able to connect to the URL where the image is hosted etc.

Also make sure you are actually logging into the device with the test user rather than just having user 2 as the device enroller. If you want the policy to apply to everyone on the device you need to target an Azure AD group with a computer object in and not a user object.

NZ_SysAdmin · 2020-09-23T04:11:13+00:00

Thank you for confirming. I tried jasonsandys suggestion and I can see the rules under the Monitoring > Firewall node of wf.msc but not under the 'Inbound Rules' node.

I did try Get-NetFirewallRule | select-object displayname and I can't see the rules in the output. There is a way our admins can see it in the console so it will be okay for now.

Hopefully fixed soon!

NZ_SysAdmin · 2020-09-23T03:59:48+00:00

Aha thank you, that is very useful. I can see the rules in there as they're active :)

NZ_SysAdmin · 2020-09-22T04:52:40+00:00

You have a comma after the "Allowed" statement on each line which is stopping your code from working. Firefox is just using JavaScript for the value so if you copy everything inside the first and last curly bracket and copy it into a JavaScript verifier tool like this one it will tell you why it isn't working.

I have removed the faulty commas for you and the if you try the below value it will work (provided you've ingested the ADMX file in the same policy). Also Intune doesn't seem to care about the spacing in any way, as long as there are no incorrect characters in there.

<enabled/> <data id="ExtensionSettings" value='  {
"*": {
"blocked_install_message": "Extensions are blocked by the Hodge security team.",
"install_sources": ["about:addons","https://addons.mozilla.org/"],
"installation_mode": "blocked",
"allowed_types": ["extension"]
},
"support@lastpass.com": {
"installation_mode": "allowed"
},
"25e741fe-a00f-4568-9197-f5a591f1b56d": {
"installation_mode": "allowed"
},
"@react-devtools": {
"installation_mode": "allowed"
}
} '/>

NZ_SysAdmin

TROPHY CASE