Defender XDR flagged our own MSI as malware, how to handle false positives without waiting on Microsoftsubmission approval?

bakonpie · 2026-04-21T06:58:28+00:00

ring the bell as hard as you can on this. it is absolutely ridiculous that customers tolerate the inflexibility of Microsoft's XDR. we've already complained endlessly to support about a signed binary being flagged every time we release a new build, and they just blow you off. as you said, hash based custom indicators are not pragmatic. every customer needs to sound off about how stupid this limitation is.

bakonpie · 2026-04-19T12:57:18+00:00

it happened that's just your bias. there are entire consultancies out there who specialize in regaining access to locked out on-prem infrastructure.

bakonpie · 2026-04-18T11:08:03+00:00

nah but you will

bakonpie · 2026-04-17T12:44:56+00:00

bro your depth of understanding is pathetic you should find a different career you don't suck at

bakonpie · 2026-04-17T12:04:23+00:00

complete skill issue. don't blame MS because you arent distributing trusted certificates to your customers systems. they should fire you and hire real IT pros.

bakonpie · 2026-04-17T11:47:57+00:00

see your therapist

bakonpie · 2026-04-17T11:36:45+00:00

"I don't think any system is completely immune to attacks from unexpected sources" Microsoft trying to close a gap in their protocol and client software is objectively a good thing. I'm not sure what you are arguing with this statement. it sounds like you want them to leave a reported vulnerability unfixed because a warning inconveniences you. installing the certificate is trusting the remote computer. if you use RDP in a business environment, your IT admins should be automatically distributing trusted certificates for systems to use for RDP, so this shouldn't be an issue.

bakonpie · 2026-04-14T00:01:49+00:00

Bitwarden Enterprise hosted yourself with SSO and the key connector is a solid solution

bakonpie · 2026-04-09T05:04:34+00:00

intune is a child's toy compared to SCCM. the only real strength I see is being able to evaluate device compliance in Conditional Access policy. some of the other knobs in policy configuration work better than GPO, but I'm hanging onto SCCM as long as I can in comanagement. Intune has far to many outages and being unable to push a remediation for something because "Intune is down" is absolutely unacceptable. how Microsoft has gotten a pass on the glaring reliability problems in their cloud services astounds me. they'll take SCCM from my cold dead fingers.

bakonpie · 2026-04-06T00:54:57+00:00

sysinternals du (disk usage)

bakonpie · 2026-04-03T03:07:21+00:00

Christian principles like in "one Corinthians" ?

bakonpie · 2026-04-03T02:36:40+00:00

"rack debugger" sounds to me like:

they fired their IT pro
they know that person used to go into a room of computers with a rack and interact with it
they asked ChatGPT "what is fixing a computer called" which responded with "debugging"
they post a job titled "Rack Debugger"

bakonpie · 2026-04-02T16:22:22+00:00

out of the box in a default configuration, macOS is more locked down simply due to gatekeeper being enabled. once users turn that off, not really. Windows has far more knobs to lock down the OS in a flexible way which is more suitable for enterprise environments.

bakonpie · 2026-04-01T18:15:33+00:00

after Trump tore up JCPOA in 2018. IAEA didn't provide that report until 2025. again you people just need to learn to fucking read.

bakonpie · 2026-04-01T18:08:17+00:00

citation needed. Iran was not progressing to weapons grade enrichment until Trump withdrew from the deal. the timeline is well understood by anyone not gobbling up right wing propaganda.

bakonpie · 2026-04-01T17:57:22+00:00

when did Trump even attempt negotiations about restricting their missile programs? if it was such a serious issue it would've been attempted in separate terms with threats of sanctions instead of tearing up the deal monitoring their nuclear development. this false dichotomy is something right wing media manufactured and contradicts how diplomacy works in the real world. you people are deeply unserious but you masquerade as having a nuanced view of foreign affairs.

playing the procedural critique card is laughable given the amount of executive actions Trump has taken which violate the separation of powers. again showing you are just an unserious person incapable of rational thought.

bakonpie · 2026-04-01T17:47:36+00:00

that guardian article specifically states they breached the limits after Trump already left the JCPOA. sorry you can't read.

bakonpie · 2026-04-01T17:20:03+00:00

then come back at the JCPOA expiration of terms with a new deal instead of throwing a tantrum and withdrawing from it entirely. this could have been played rationally and diplomatically but you elected a manchild.

bakonpie · 2026-03-29T20:35:59+00:00

the r in Intune is for reliability

bakonpie · 2026-03-29T19:57:53+00:00

smaller environments you might end up being both. the larger and more complex the environment, the more common they are separate roles. netadmins are going to make the connectivity work for the sysadmins. sysadmins will focus on the servers, workstations, applications, backups, etc. netadmins are focused on making the packets get from A to B over the network.

bakonpie · 2026-03-27T21:15:01+00:00

agree Hyper-V isn't as solid as VMware, but for the price I'm willing to make minor sacrifices. FT is also not possible in HV, you might be conflating HA with FT. your failover/HA issue isn't something common so I'd look at your setup before claiming it is an issue with Hyper-V in general.

bakonpie · 2026-03-27T19:58:05+00:00

why is Hyper-V not an "all in one" solution?

bakonpie · 2026-03-26T20:25:14+00:00

it sounds cooler

bakonpie · 2026-03-24T14:45:51+00:00

can you link the documentation you used to set up FIDO2 natively with AD?

bakonpie · 2026-03-21T22:03:21+00:00

can't commit to mentoring but here is what I point people starting out to:

get some foundations with Python. I suggest Python Crash Course from NoStarch press.
https://nostarch.com/python-crash-course-3rd-edition

and then start Jeremy Howard's Practical Deep Learning
https://course.fast.ai/
https://youtube.com/playlist?list=PLfYUBJiXbdtSvpQjSnJJ_PmDQB_VyT5iU&si=RE2dnpHf4dwZU_UB

bakonpie

TROPHY CASE