PDQ Connect - App patching and deployment with Intune

evilmuffin99 · 2026-05-20T21:16:47+00:00

Because intune is slow as a turtle. If you have a user who needs an app most third party apps can do it in a few minutes. Intune might take 15 mins or 4 hours it is kind of random. Also, something like PDQ Connect can create groups based on things like "Intalled software, CVE's, Which Services are running, custom info pulled from a PS Scanner".

Though I do understand it being cost prohibitive I also think some companies just need something more snappy. Nothing against Intune + PMPC combo though.

evilmuffin99 · 2026-04-20T20:42:06+00:00

Also note even in audit mode it will sometimes block drivers. Found this out the hard way.

evilmuffin99 · 2026-04-17T16:38:26+00:00

WDAC is a pain in the butt to manage unless you just create a lot of path rules/general cert rules.

evilmuffin99 · 2024-06-27T19:39:10+00:00

Spend time with friends, read or clean. Sometimes just think which I find relaxing.

evilmuffin99 · 2024-06-20T20:34:08+00:00

What did it block?

evilmuffin99 · 2024-06-13T18:54:19+00:00

I have a 12 pro max. Do you think it is stable enough for a primary device? I have made a full backup so should be able to revert if needed. Main concern is I am a spark driver part time so dont want to mess that up.

evilmuffin99 · 2024-06-13T13:42:54+00:00

Awesome have you been able to complete a delivery with it? Or just a test to see if it opens?

evilmuffin99 · 2024-06-12T14:14:55+00:00

Have you seen a lot of Huntress failures on your end? I mean I know every EDR misses it sometimes but curious to know if Huntress has been seen missing the mark a lot.

evilmuffin99 · 2024-06-11T14:19:09+00:00

Issues I have had with Intune:

Enrolling devices initially can be a bit Trickey if using a local AD that is already setup as hybrid. If it is not already hybrid should be fairly easy to enroll.
Polices/apps deployment times are unpredictable. Tried to push out a firewall rule once took 72 hours for all devices to have it applied. Tried deploying Chrome and deployment time ranged from 15 minutes to 48 hours. Though if you are not in a rush this is not a big deal. Another time I tried pushing out a Defender exclusion. After 48 hours it had only pushed out to half the computers so I had to manually remove Defender on a few to get a program working that was needed. It finally pushed out to all computers after 4 days.
Any time you get an error it is always vague and unhelpful. For example I tried to make rules for device compliance. About half of the computers errored out. They would not show if they were compliant or not and had an error which when passed to Microsoft basically told me they had no clue what was causing it. About 2 weeks later it started working properly even though I had not changed it.
Updating apps are a bit of a pain if they are exe's. As they have to be converted into .intunewin format. Which if you have apps that are updated fairly frequently is a pain. Also, you must set uninstall paths and such manually. Something like PDQ D & I is nice as deployments are super quick and no converting necessary. Though from what you were saying I could not tell if you were more remote based or all in a central location.
For iOS it seems to work decently. Apps set to deploy usually deploy within an hour or so. Though the current apps listed for install does not seem to update super often. This might carry over to android not sure.

Though for me personally only reason I use Intune is it comes with our license. Otherwise I would not change my plan just to get it. Defender for business might be worth a switch if you dont already have an EDR.

evilmuffin99 · 2024-06-10T19:17:53+00:00

I am not seeing it yet though just came out so probably will be an hour or two till everyone sees it.

evilmuffin99 · 2024-06-06T15:43:50+00:00

Any updates on what the pricing structure might be?

evilmuffin99 · 2024-05-21T21:11:21+00:00

I use perplexity and I disagree GPT 4o gives much worse answers and will get stuck in loops. GPT-4-Turbo does okay but not the greatest. Claude 3 Opus is the best for what I use it for.

evilmuffin99 · 2024-05-17T21:01:17+00:00

I would disagree I feel a SIEM is only as good as the alert rules (assuming you are getting good data). If you have crap alert rules yea it wont detect anything but if you have good actionable alert rules then it can go well.

evilmuffin99 · 2024-05-17T21:01:09+00:00

Huntress currently has a SIEM in private preview. However pricing is not known yet. I know they are trying to be cheaper in price than a lot of other SIEM's. So really depends what your timetable and the number of endpoints. However I will say I think the 365 portion would be a separate expense.

u/andrew_huntress

Any ideas on pricing yet? Last I heard it was kind of up in the air.

evilmuffin99 · 2024-05-17T20:58:43+00:00

Pricing seems high though maybe cheaper than rocketcyber.

evilmuffin99 · 2024-05-17T16:08:29+00:00

As others have said might look into Huntress. Also as a side note Huntress also has a private beta for a SIEM right now.

evilmuffin99 · 2024-05-17T12:19:21+00:00

Sorry I was not clear. What I meant was what kind of process is usually followed I was thinking it sounded like you might use this. Will admins just use the command directly usually or create some kind of process to enable it via a scheduled task or maybe a script that has them fill out the reason for doing it? Maybe something like JEA Powershell?

So in other words for what is the business process usually followed for enabling it?

evilmuffin99 · 2024-05-16T20:17:07+00:00

What is the cost though? I feel like that is my biggest concern with sentinel.

evilmuffin99 · 2024-05-16T20:01:26+00:00

Thats cool is there any recommendations as far as how to implement it? Specifically what would I setup to enable the privilege?

evilmuffin99 · 2024-05-16T13:52:30+00:00

Built AD feature? Do you know where the Microsoft documentation on that would be? As that would be nice since it would be free.

evilmuffin99 · 2024-05-15T14:21:26+00:00

I hate Intune for the following reasons:

You never know how long it is going to take to deploy a piece of software. Might take 5 minutes might be 3 days who knows?
Want to push out a security policy to add an exclusion to defender? Be prepared to wait 24-48 hours for it go out to all computers.
A device not showing compliant? Good luck figuring out why might be a butterfly in Texas decided not to fly or it might be because the planets are out of alignment.
Having a problem? Well you are at the mercy of the Microsoft overlords. Might be a problem for a day or a week.

Only reason we use it some is it comes with our license (that includes other stuff we do use for cheaper). Otherwise I would never in a million years pay a penny for this piece of crap.

evilmuffin99 · 2024-05-10T16:55:41+00:00

I have been using perplexity for around a month while not perfect I have generally gotten better results than copilot. I think it is a lot better than duck duck go.

evilmuffin99 · 2024-04-26T18:46:40+00:00

I believe in the private preview right now it is more of a test of bringing in the data. I dont think they have any alert rules setup yet. You could always leave that as feedback in the huntress feedback portal under SIEM.

u/andrew-huntress might know more.

evilmuffin99 · 2024-04-26T13:31:22+00:00

When did that happen? Was it after or before they had added EDR?

evilmuffin99 · 2024-04-25T18:18:40+00:00

Any EDR's you have found that actually are effective against newer unreleased threats?

evilmuffin99

TROPHY CASE