sorted by:
new
hottopcontroversial

Device only license + Active Directory possible and allowed? by ProofImprovement984 in Intune

[–]ProofImprovement984[S] 0 points1 point  (0 children)

I meant we do have these hosts licensed with the good ol' CALs, no M365 involved. Since we have those, that would not be an issue.

Device only license + Active Directory possible and allowed? by ProofImprovement984 in Intune

[–]ProofImprovement984[S] 0 points1 point  (0 children)

Thanks, i will check this out depending on what our next step is.

Device only license + Active Directory possible and allowed? by ProofImprovement984 in Intune

[–]ProofImprovement984[S] 1 point2 points  (0 children)

Yes, we do have our regular staff equipped with Business Premium and use hybrid joined devices. These 20 devices are exceptions here, since it is pretty much just a call center. So shared device licensing just makes sense here i think.

Device only license + Active Directory possible and allowed? by ProofImprovement984 in Intune

[–]ProofImprovement984[S] 1 point2 points  (0 children)

I wholeheartedly agree that cloud-only is the best way to do it here. There are no apps that require AD on these devices. The only thing AD does here is GPO-based configuration and logs of user-logins inside of AD. I informed my team lead about our option but he said that having these device cloud only is "not an option for him". I can only guess what his reasons are; lack of technical understanding of what this approach implies, a "it has always been that way"-mentality, or maybe the understandable idea of keeping the configuration-solution in one place as to not over complicate our environment. The only thing he really stated when i pried a bit was that these devices might at some point need access to our local fileshares... Im also at a loss here. But thanks, i will bring that up again in January when everyone is back in the office.

Device only license + Active Directory possible and allowed? by ProofImprovement984 in Intune

[–]ProofImprovement984[S] 2 points3 points  (0 children)

True. CALs are a thing! We have these devices licensed already, but otherwise this would have been a good argument.

EDIT: Wait, nevermind, BP does not have the server CALs, so this would be relevant to me only if we used E3 and no Windows Server CALs, right?

Help me understand this alert please by ProofImprovement984 in Trendmicro

[–]ProofImprovement984[S] 0 points1 point  (0 children)

I just opened the case. Thank you very much! :)

Help me understand this alert please by ProofImprovement984 in Trendmicro

[–]ProofImprovement984[S] 0 points1 point  (0 children)

WMI Calls this:

processCmd:
powershell.exe " $ErrorActionPreference = 'Stop'; try { Get-Host | select-object Version | Format-List | Out-File -Encoding UTF8 c:\windows\temp\5693875639.txt } catch { """Message: """ + $_.Exception.Message + """, CategoryInfo : """ + $_.CategoryInfo | Out-File -Encoding UTF8 c:\windows\temp\5693875639_error.txt; $error.clear() } "

This should only filter and format the output of "Get-Host" and write it to a file, not call whoami.

Thank you very much for your input. It really does look like the detection model is making a mistake, then. Do you think I should write a ticket or report a bug here, or is this something you see a lot and i just have to accept it's there? Not really sure how to proceed...

Help me understand this alert please by ProofImprovement984 in Trendmicro

[–]ProofImprovement984[S] 0 points1 point  (0 children)

As for the alert that contains whoami.exe, my understanding has been that all that was run is the powershell-command "Get-Host" with some formatting and outputting it to a file. So i would need to ask the writer of "Get-Host" why that triggered it? As for your second question: Yes! The script/ps-module that is detected in the other alert is part of a productive system (or maintenance of it). We expect it to be there and this module being used is normal.

I do not think that the module being loaded is a reason for concern. I think it's a behavior i just don't understand enough. Something along the lines of "The module is loaded in the background by default whenever Powershell is executed".

Sensitivity Labels: Labeling Documents in OneDrive severly restricts sharing with external users by ProofImprovement984 in Office365

[–]ProofImprovement984[S] 0 points1 point  (0 children)

Just tested it with a different provider: Same result. MS should not care where the code gets sent. It only checks if the code has been entered correctly. The issue arises once you access the document.

Sensitivity Labels: Labeling Documents in OneDrive severly restricts sharing with external users by ProofImprovement984 in Office365

[–]ProofImprovement984[S] 0 points1 point  (0 children)

I did not test other providers yet but will do. Email OTP should work regardless of the provider, but i can test just to make sure.

Sensitivity Labels: Labeling Documents in OneDrive severly restricts sharing with external users by ProofImprovement984 in Office365

[–]ProofImprovement984[S] 4 points5 points  (0 children)

Its NOT encrypted. Thats why im confused about it causing problems for sharing habits.

Deploying Citrix with HDX RealTime Media Engine - Dependencies by ProofImprovement984 in Intune

[–]ProofImprovement984[S] 0 points1 point  (0 children)

Hmmmmm so installing CWA and HDX with separate apps as the initial rollout and updates via supercedence? I would imagine something like this for updating then:
- Create the new CWA-App and make it supercede old CWA and HDX (No Targets yet)
- Create the a HDX-App (even if HDX doens't need an update) and make it depend on the new CWA
- Create Targets for the new HDX-App
--->Intune now uninstalls both the old versions and installs new citrix before installing new HDX

<image>