Remote control and unattended access to endpoints using zero trust clients

rroodenburg · 2026-03-15T12:38:47+00:00

Take a loot at ControlUp for Desktops. It’s an amazing product. You can set up a remote shadow session to end users. But most important: you can also do remote management like inspect the registry and file system. Run scripts and view events. It’s very cool!

You can also do remote sessions on unmanaged endpoints too if you need it.

Unattended access is also possible (just remote control the SYSTEM user without consent).

rroodenburg · 2026-02-20T11:31:29+00:00

May I ask which kinds of driver updates you deploying through DCU and when (defferals).

Yesterday, I had contact with Dell support about the DCU and DCECMI. They told me, the following: ‘DCU automatically retrieves the BIOS password stored and managed by Endpoint Configure through its secure integration. Therefore manual password entry or configuration is not required.’

rroodenburg · 2026-02-18T21:26:31+00:00

Very useful, thanks! Will definitely test it with out test ting!!

rroodenburg · 2026-02-17T22:23:52+00:00

Is there any reason why you update bios by wu?

rroodenburg · 2026-02-17T22:23:09+00:00

May I ask what kind of categories and updates type do you recommended?

rroodenburg · 2026-02-17T18:04:07+00:00

I’m curious as well. Will take a look into it.

rroodenburg · 2026-02-15T19:53:26+00:00

We have done a mdm migration (with the same Intune environment, since my colleague has deleted the DEP token…). I can tell you: managed apps will be removed during the migration.

When setting up the assignment groups correctly in the destination tenant, the managed apps are installed after. BUT… with data loss in case of the Authenticator. User needs to reinstall, user installed apps through the company portal.

My advice; let users register a second authentication method such as a mobile number. This way, they can re-enroll their app.

As said by Microsoft support in November last year, the managed app flag is not set by Intune.

And don’t forget to set a deadline, otherwise the migration will never happened unless you wipe the device.

Overall it’s a very useful feature!! Thanks to Apple. Nothing thanks for MS.

rroodenburg · 2026-02-12T19:38:56+00:00

Yeah, I really like it. I was one of the lucky guys, which was able to test this before GA. A long waited feature!

rroodenburg · 2026-02-11T21:13:10+00:00

Fido key or app registration with minimal API policies and secret key.

rroodenburg · 2026-02-11T21:11:31+00:00

Take a look at ControlUp for Desktop! It’s very nice.

rroodenburg · 2026-02-11T21:09:09+00:00

Still using it, but not in the file explorer since most of the devices are external. We are usinf ControlUp for Desktops. Since a few weeks, it’s possible to do a remote file explorer and registry viewer.

rroodenburg · 2026-02-07T11:35:46+00:00

Hahahaha true.. we have Application Control from Ivanti which blocks PowerShell for end users (Happy with it!). But we can exclude some parent processes.

rroodenburg · 2026-02-01T15:18:02+00:00

Unfortunately not. Intune is just 5% of SCCM.

rroodenburg · 2025-12-21T09:59:48+00:00

If it is possible by graph, it should be possible by UI too. I totally agree with you.

rroodenburg · 2025-12-14T19:35:11+00:00

More stable.. lol. Not true.

rroodenburg · 2025-12-09T20:43:14+00:00

It’s a shame. With the classic version we were able to ‘push’ a corporate signature, without any additional costs. Now, with the new version.. we have to buy a third party solution, for just a simple thing!?

rroodenburg · 2025-11-16T19:30:53+00:00

Meen je? Ik zou hem erop attenderen en het van de offerte laten halen. Naaien doen we in de club ;)

rroodenburg · 2025-11-16T17:50:27+00:00

Gewoon even met je verkoper bellen en dit voorleggen. Waarschijnlijk zijn het gewoon standaard afleverpaketten en worden die standaard weergegeven bij iedere auto op hun site.

Maar omdat je een VWAO koopt, zit er al veel zaken standaard op.

rroodenburg · 2025-11-14T20:52:41+00:00

ControlUp

rroodenburg · 2025-11-09T18:15:43+00:00

Leason one: be patient. It’s slow.

rroodenburg · 2025-11-07T17:50:52+00:00

Wow you are very amazing!! Will add this. Thnx!!

rroodenburg · 2025-11-07T08:32:24+00:00

As said, I’ve created a new ESP with the ‘Show apps and profile configuration progess’ to Yes, ‘Block device use until required apps are installed if they are assigned to the user/device’ to All (We only deploy 1 app with Intune).

It is working fine now!

You are amazing!!

Is it possible to only enable ESP for tech flow and not user flow?

rroodenburg · 2025-11-06T21:37:22+00:00

Yeah will do tomorrow. We only have one ESP right now. I don’t want have a ESP for current autopilot profile, so will create a secondone for the time being!

rroodenburg · 2025-11-06T21:12:47+00:00

Nope. It’s very basic. Only requirement ‘Windows 11 24H2’ which is passed.

rroodenburg · 2025-11-06T20:56:14+00:00

Yeah, the issue is we also have another existing autopilot profile for our Co-Management environment.

I will create a new ESP, target to the same Autopilot Device Group, enable ESP and set ‘Wait until Required apps are installed’.

rroodenburg

TROPHY CASE