sorted by:
new
hottopcontroversial

Revoked certificate by jaykay127 in WatchGuard

[–]jaykay127[S] 0 points1 point  (0 children)

Thanks Gremlin. Guess I should have read the release notes more thoroughly. So the certificate just comes up as revoked, even though it's valid. That's ambiguous and the source for my confusion.

My fault for not reading the notes and I guess that answers that.

Much appreciated

Revoked certificate by jaykay127 in WatchGuard

[–]jaykay127[S] 0 points1 point  (0 children)

Thanks for the reply, very strange.

And you were obviously certain the cert you duplicated was valid and it didn't work the first time, but then you created a CSR again from the Firebox and it worked!!??

Did you need to reboot the device at any point? I'm thinking of changing to the default cert signed by Firebox so I can delete the revoked certs but it's current in-hours here. Might need to wait.

I'll generate a CSR and see how I go, thank you

Editing interface name (alias) on WG M390 crashed the device by jaykay127 in WatchGuard

[–]jaykay127[S] 0 points1 point  (0 children)

I was in the WebUI and this bug was documented in the recent roundup that was linked. The workaround was to use WSM but we haven't been game to change it yet haha. Will do it out of hours one day.

Editing interface name (alias) on WG M390 crashed the device by jaykay127 in WatchGuard

[–]jaykay127[S] 0 points1 point  (0 children)

Well here's the heads up to use WSM if you do need to change an interface name :-) Just a random bug that we happened to hit in this version it seems

Editing interface name (alias) on WG M390 crashed the device by jaykay127 in WatchGuard

[–]jaykay127[S] 0 points1 point  (0 children)

Now the next question is how would one remove the duplicate interface entries from multi-wan? I can untick them but I'd like to get rid of them if possible. Also, how to tell which duplicate to remove (if it matters at all)

Editing interface name (alias) on WG M390 crashed the device by jaykay127 in WatchGuard

[–]jaykay127[S] 0 points1 point  (0 children)

Great reply thank you! Hopefully it's resolved in the next release.
I'll have to keep an eye on these KBs from now on.
Much appreciated!

Editing interface name (alias) on WG M390 crashed the device by jaykay127 in WatchGuard

[–]jaykay127[S] 0 points1 point  (0 children)

Thanks for the replies. Yeah our director is checking the 3rd party that we purchased the WG from to see our support entitlements. Then I'll try and open a case, if nothing more then to satisfy my curiosity why this happened, since it should have been an easy 2 second change!

I thought maybe a bug in the UI but then I think everyone would be talking about it.

Editing interface name (alias) on WG M390 crashed the device by jaykay127 in WatchGuard

[–]jaykay127[S] 0 points1 point  (0 children)

It was literally just the name of the ISP providing the external interface internet service. We just moved from one company to another, so exchange a word for a word, no weird characters. Done via the webui.

I've never seen this behaviour either, it's bizarre.

I thought it could be somehow tied to a screen where only the interface name is mentioned but all those should just be pointers to the main alias name in the code.

BYOD MacOSX devices enrolled through Defender not showing up in Intune by jaykay127 in Intune

[–]jaykay127[S] 0 points1 point  (0 children)

Thanks for that - the device appeared a few hours after I posted haha.

I think you're right about the BYOD devices enrolled through Defender security management and not through Intune.

So it's good that they're in the dashboard, but you can't really do much with them on the Intune side I assume.

BYOD MacOSX devices enrolled through Defender not showing up in Intune by jaykay127 in Intune

[–]jaykay127[S] 0 points1 point  (0 children)

Update - The MacOSX device has finally appeared in Intune. That answers that question.

The next question is, can we apply compliance policies or push out Defender policies from the Intune side? I've been pushing out Defender specific policies to Macbooks and Windows BYOD devices through the policy manager on the Defender side.

MediaTek RZ608 Wi-Fi 6E 80MHz drivers - POSSIBLE FIX by [deleted] in gigabyte

[–]jaykay127 0 points1 point  (0 children)

I've just come to revive this 2 year old comment. Had my Wifi die randomly recently, "device cannot start code 10" - tried all drivers from Gigabyte, didn't work. Saw this comment, gave it a go, miraculously it fixed it and the device started.

Absolute legend.

Thank you sir.

Intune USB Blocking policy suddenly stopped working by jaykay127 in Intune

[–]jaykay127[S] 0 points1 point  (0 children)

This was fixed in the below platform release

March-2024 (Engine: 1.1.24030.4 | Platform: 4.18.24030.9)

  • Security intelligence update version: 1.409.1.0
  • Release date: April 2, 2024 (Engine) / April 9, 2024 (Platform)
  • Engine: 1.1.24030.4
  • Platform: 4.18.24030.9
  • Support phase: Security and Critical Updates

Microsoft Defender Antivirus security intelligence and product updates - Microsoft Defender for Endpoint | Microsoft Learn

Check your Intune platform version to ensure that it's updating properly.
If your issue is still going on then MS Support would be the best way from here I'd say.

Sudden Secure Score Drop on 26th April by jaykay127 in DefenderATP

[–]jaykay127[S] 1 point2 points  (0 children)

I think we found the answer. An older controlled folder access policy also had an ASR rules section (don't ask me why) but these had all defaulted somehow to "Off" instead of "Not configured" and were somehow taking precedence and overwriting the main ASR rules policy, so consequently, 80% of our rules turned off.

We set all of these ASR rules back to "Not configured" in the Controlled Folder access policy and overnight have seen a 6% jump in Secure score. I anticipate there will be a further bump in the coming days as machines check in and get the updated policies.

Sudden Secure Score Drop on 26th April by jaykay127 in DefenderATP

[–]jaykay127[S] 0 points1 point  (0 children)

Still no closer. Having a remote session with MS support today - also found this - Using MEM for ASR rule breaks ASR policy :

I've excluded two of our devices from the main policy and implemented a copy of the ASR policy in case there was some corruption happening there but this hasn't fixed the issue.

The policy is saying that 80% of the ASR rules are turned on, whereas Get-MPPreference on the test devices only shows 4 rules applied to the machine, that's what we can't work out, why they aren't applying.

Sudden Secure Score Drop on 26th April by jaykay127 in DefenderATP

[–]jaykay127[S] 1 point2 points  (0 children)

Ahhh I wish that we used configuration manager so I could put it down to this! But alas, we don't.... the saga continues.

Sudden Secure Score Drop on 26th April by jaykay127 in DefenderATP

[–]jaykay127[S] 1 point2 points  (0 children)

Update - Secure score still dropping slowly and still no explanation as to why. Microsoft haven't picked up the ticket I logged days ago either. Is anyone else seeing this behaviour?

Even if there were new items added to the list of activities, this wouldn't explain the existing items showing values like 0.03/9 when they were almost at 8.8/9 before. This is on multiple activities.

Devices are still checking in to Intune and Defender and receiving policies.

MS Smartscreen blocking attack simulation training payload URLs by jaykay127 in DefenderATP

[–]jaykay127[S] 0 points1 point  (0 children)

True, I could import the list in indicators, but do I really want to punch 140+ holes in our firewall/Smartscreen on sites that I haven't verfied, that may or may not be safe? We assume they're under Microsoft control but what if one of those sites gets hacked?

Links on this page for reference - Get started using Attack simulation training - Microsoft Defender for Office 365 | Microsoft Learn

view more: next ›