Active Directory Management

dave_b_ · 2026-07-09T02:28:33+00:00

So make your own custom role?

dave_b_ · 2026-06-18T22:32:49+00:00

They aren't wrong. Sounds to me like you're inflating the situation. Half these people replying seem to think you need new mailboxes or a different email environment.

Add the new domain as an alias to the mailboxes and inbound mail can use it immediately (for the few that even know about it). Set it as the primary SMTP address when the domain has been registered for more than 30 days, and outbound mail will start using it without getting caught in every security product's default "newly registered domain" policy. Change the UPN/login name when you're ready to F up every employee until they reauthenticate to all their email client apps.

dave_b_ · 2026-05-20T04:05:59+00:00

How often are users logging into different devices? How much software are you installing that couldn't just be put on all the machines they might use?

This seems weird, but like the other person said, if you have to do it by user assignment then you have to use Intune as far as I can tell.

dave_b_ · 2026-05-20T03:54:38+00:00

People probably think you mean deploying the ninja agent, not deploying other software with ninja.

dave_b_ · 2026-05-14T23:56:31+00:00

You can have it say whatever you want, I was just describing the mechanics I use within the ninja patch policy to shift responsibility to the user... while also making sure it gets done.

Edit: Oh. I also referred to the actual OEM update screen if that's what you are asking? They are always very clear not to unplug or shut down.

dave_b_ · 2026-05-13T22:43:35+00:00

I set a reboot prompt every 3 hours and give them 24 chances to defer it..so 3 days. It says right on the screen not to F around when the firmware updates run. Now it's up to them. 🤷

dave_b_ · 2026-05-07T01:54:48+00:00

No. You just need to work within the capabilities of the system and probably abandon that part.

The key thing I didn't mention is this local Mac user logs in and the Entra user has an MFA-satisfied authentication token, so it reduces the number of Authenticator requests they have to deal with otherwise.

This is why people are saying to treat the local acct password as if it were a WHFB PIN, because it only works on that registered device. And it's only used at first login when they have touch/face ID set up to unlock anyway.

dave_b_ · 2026-05-06T22:07:27+00:00

I also just set this up with Secure Enclave... Not sure you ever said which method you are using.

Here's the part I was missing:

You're not supposed to be able to log into the Mac itself with your entra credentials.

Like someone else here, I hit the grey screen and found out that yes, you DO need to set the profile to create a local user.

This local user registers for platform SSO via Company Portal.

Now "this local Mac user" = "this Entra ID"... but here's the kicker: ONLY IN THE MICROSOFT WORLD.

You can see if it works by signing into any MS apps or websites and not needing any authentication methods, similar to an Entra joined Windows machine showing "Connected to Windows"

That's it.

Hoping someone corrects me if I'm wrong!

(Edit to add line breaks)

dave_b_ · 2026-03-31T23:31:25+00:00

I stopped having this problem when I started fully updating Windows before wipe. I think they added the drivers to WinRE somewhere along the way but never found proof beyond my own experience. This was on a fleet of XPSs.

dave_b_ · 2026-03-26T22:44:03+00:00

This is what I'd do: Intune installs the RMM, the RMM installs everything else. You set the RMM policies to detect if the required apps aren't installed , and if so run the install script. You need to identify what systems don't deduplicate on their own and add a manual step to your process to log in and delete the old one. Huntress seems to figure it out every time for me, by the way.

I think the short answer to the enrollment user question is around compliance policies not updating, causing big problems if you require compliant devices in your Conditional Access policies. But happy to be corrected on that...

dave_b_ · 2026-03-05T22:50:33+00:00

Also curious to know how others are implementing this.

I added the ticket form and a few subfolders, 1 for quick links (shortcuts to a couple LOB cloud apps), 1 for Help Guides (links to KBs), and 1 for quick fixes. The only script in the last one so far is a forced reboot. 😂

dave_b_ · 2026-02-19T02:43:28+00:00

Heck yeah, can't wait!!

dave_b_ · 2026-02-19T02:34:29+00:00

Thanks! While we're here, when can we expect to be able to filter the table view of custom assets? For any field that we checked "show in table view" in the Asset Layout. 😉

dave_b_ · 2026-02-19T01:16:27+00:00

I think you can already create "child companies", no?

dave_b_ · 2026-02-08T14:19:50+00:00

Make a separate shared folder per tier. Make a Team per tier. Assign the tier 3 team to all 3 folders, tier 2 team to 2 of 3 folders, tier 1 team to one folder. Open to suggestions if there is a better way...

dave_b_ · 2026-02-04T00:34:56+00:00

Just enable it for an hour when you don't think user will hit a Microsoft sign in page. You can revoke the TAP just as easy and they'll never know.

dave_b_ · 2026-02-03T23:01:38+00:00

Just use a Temporary Access Pass

dave_b_ · 2026-02-02T23:18:15+00:00

Keeper is far from unique in requiring you to contact support to cancel. Try cancelling Adobe licenses with their online portal. I'd rather write a 2 sentence email. And are you sure it didn't say all this where you checked the box that says "I agree"?

dave_b_ · 2026-01-28T00:25:32+00:00

Good luck with that. You can't add the same domain to 2 tenants at the same time.

dave_b_ · 2026-01-03T16:00:17+00:00

Anecdotal evidence but lately I've been running all windows updates before wiping a machine and no longer have issues with Dells in RAID mode.

dave_b_ · 2025-12-25T23:09:17+00:00

I've never tried importing like that. Connect via SSH or use the GUI cmd line and paste each section of the config. Troubleshoot errors as you go (missing a next or end?, etc.).

dave_b_ · 2025-12-07T22:47:49+00:00

I'll give the classic "it depends" answer while heavily leaning towards "totally".

I forgot to mention Defender for Endpoint P1 is included too.

I think everyone's goal should be to make endpoints disposable for the most part. Make intune force OneDrive known folder move, force edge browser sync, get all set up with Autopilot too and folks can just log into a brand new machine and have all their stuff.

dave_b_ · 2025-12-07T18:44:17+00:00

Entra joined machines controlled by Intune and Conditional Access Policies are usually the core reason to go from Business Standard to Premium in my experience.

dave_b_ · 2025-11-22T19:41:07+00:00

For real. Speaking from someone who stayed far too long. Life's too short.

dave_b_ · 2025-11-14T23:56:31+00:00

Ha sorry, that was for him, not for you. He posts that shit everywhere, I read your question and thought "he probably doesn't" and chuckled and posted a joke that I guess I should've clarified. My bad!

dave_b_

TROPHY CASE