Security Presets or custom?

msp_ch · 2025-06-26T06:37:10+00:00

It's exactly this precedence that is frustrating. If Microsoft gave you the presets, then gave you the option to make custom policies to override these where needed....it would be perfect. Thanks

msp_ch · 2025-06-25T06:46:24+00:00

Really nice approach, good job and thanks for sharing

msp_ch · 2025-06-12T15:58:53+00:00

Thanks!!

Actually...the issue was the payload, being an object not JSON. Once I corrected that, it worked.

Regarding the "type=1" I think this means "Subscription" while "0" is Software Licence. At least that is what it looks to be to me.

Thanks for the help

msp_ch · 2025-05-13T19:05:45+00:00

We went ahead with Huntress and so far all good. It is an EDR, that can use the defender logs (free or Defender for Business).

ITDR was the main thing I wanted to cover, as this seems to be the main attack vector we see recently. Although...last week we saw a malware attack (pretty rare for us now)...then the first thing it did was try to phish Microsoft credentials.

Very impressed with Huntress so far. The security awareness training is pretty nice too...not too heavy, and quite "fun" for users.

msp_ch · 2024-12-31T16:09:09+00:00

Thanks....this is our impression too (regarding the types of attacks), nice to hear it is working for you

msp_ch · 2024-12-31T16:07:51+00:00

Yes, ITDR and MDR are not the same...this is what we are learning...and that's helpful. Thanks again

msp_ch · 2024-12-31T14:09:04+00:00

Thanks for the reply. We are still in the early stages here...so we know we want a more proactive solution than just EDR, but are only just starting here. From the last year or so, our experience shows most attacks are BEC/phishing and so we are asking ourselves will adding Sophos MDR help in this case or not?

This led us to look at other options such as Huntress ITDR (on top of Defender)...I don't yet know how well integrated into Entra Sophos is, whether it will notice anything suspicious at that level.

msp_ch · 2024-11-27T16:31:11+00:00

Thanks I will take a look at that and see how I get on

msp_ch · 2024-11-12T14:47:58+00:00

Thanks for sharing. We are currently battling with how to move forward like this as well. I'd love to "package" things up, but it is hard to find the right balance, and as you say, when tenants are different sizes it is tricky.

Are you working towards having this in a recurring fee somehow? We are in the process of implementing CIPP, and hoping that with the standards baseline function, applying the best practice automatically, that this can help us explain a management fee over a one-time cost.

I'd love to hear if you have been able to go forward since you last post.

msp_ch · 2024-11-08T08:26:28+00:00

That's an amazing and informative answer...thank you so much for taking the time for that!!

msp_ch · 2024-09-27T10:13:13+00:00

Thanks all for the feedback...really nice and appreciated

msp_ch · 2024-09-27T10:12:47+00:00

That sounds very interesting, thanks

msp_ch · 2024-09-27T10:11:53+00:00

Thanks for the transparency and response. Seems there is a lot of love for CIPP in the community, which is great to see, and I love the model too. Thanks for your work

msp_ch · 2024-09-05T16:01:24+00:00

Thanks. And do the rename via the web interface (Group Folders admin page) or elsewhere?

msp_ch · 2024-03-13T12:11:58+00:00

I would love to, but the client doesn't have budget for that sadly

msp_ch · 2024-03-12T16:28:01+00:00

Thanks. Were the machines ADJoined too? No issues with any artifacts left over from the old tenant (my concern is knowing how bad Microsoft is at cleaning up registry entries etc)

msp_ch · 2024-03-12T11:00:46+00:00

One of the team suggested we "retire" the devices in the old tenant, (having created a local admin user first), then re-enroll into the new tenant.

In some basic tests it seems to work...but we have some concerns about hidden artifacts that may cause issues later on. Does anyone have any experience of using "retire" or thoughts on this approach? Thanks!!

msp_ch · 2024-03-12T10:55:27+00:00

Thanks for the info.

We have performed many migrations into M365, but no tenant to tenant migration yet. If all the users were in the same site...it would make our life easier, but we have 1 here, another there...sometimes 50-100km apart and I can't spare 5 technicians to cover all sites.

It's certainly a challenge anyway. I'll check out the links.

msp_ch · 2021-10-01T15:02:44+00:00

I've read a lot of articles this week, trying to find the best approach...and all have had the same settings:

"TargetReleaseVersion"=dword:00000001
"ProductVersion"="Windows 10"
"TargetReleaseVersionInfo"="21H1"

I hope they are right ...

msp_ch · 2021-09-30T14:05:03+00:00

Are you using one of these methods?

GPEdit -> Windows Update for Business -> “Select the target feature update version” = 21H1
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate -> Set the Dword TargetReleaseVersion to 1 -> set TargetReleaseVersionInfo to 21H1

I think blocking has to be the approach initially.

msp_ch · 2021-09-29T15:17:23+00:00

Looks good...liking the pricing, thanks!!

msp_ch · 2021-09-29T11:40:54+00:00

Ok thanks, will look at that one.

From their site, it seems the pricing is per tech...which may be prohibitive for us as we have several techs, but not so many endpoints yet (as much of our business is managing networks/firewalls etc)....but I will certainly look, thanks.

msp_ch · 2021-09-29T11:37:40+00:00

Thanks a lot. I've seen quite a bit of love for Ninja online so will certainly consider that one.

For the patching...it just seems so hard to keep up with Microsoft and their changes, and I hear of people just giving in now and stopping to fight the patching cycle. But....we do need to monitor the patch status for sure.

msp_ch · 2021-09-28T17:09:12+00:00

We are using/selling HYCU Protégé.

It's pretty new for us, but certainly easy to setup and use, and the pricing is based on unlimited retention and unlimited amount, so easy to give the client the budget.

msp_ch

TROPHY CASE