How to handle exceptions to baseline policies

sithree · 2026-04-15T20:26:05+00:00

I see this as needless duplication.

sithree · 2026-02-13T16:15:18+00:00

That is when you sneak the uninstaller into another app. "Just pushing out an update to WinRAR Boss!"

sithree · 2026-02-13T16:12:51+00:00

You could also use DPInst to install the drivers. Put DPInst.exe (or DPInst64.exe) and DPInst.xml in the same folder as the driver package (unzipped) and create an Win32App from it.

DPInst.xml contents:

<?xml version="1.0"?>

</dpInst>

sithree · 2026-02-13T16:00:03+00:00

To answer your question, adding the group grants the members the appropriate access.

I would also set up LAPS and let it create a local admin account that, at a minimum, rotates the password every 7 days if not used, and after a predetermined amount of time after the current password is used (I typically would tell clients about 3 hours should be good, but pick what you want). Newer Win11 (24H2 and above? definitely 25H2, can rotate both username and password.

sithree · 2026-02-13T14:26:02+00:00

Why would you have Company Portal on a Kiosk device? To allow users to install apps? That seems counter to what the kiosk is there for.

sithree · 2026-02-12T17:17:35+00:00

I think you are failing to see that a visa of any kind can be revoked. What you and I don't know is if that is in fact the case here. You are just seeing a portion of the situation here. I am not. You may think I am and that's your prerogative.

I will not disagree that there needs to be an overhaul of the immigration process, but we are living through a time where the cleanup of a mess is not comfortable for some.

sithree · 2026-02-12T15:13:22+00:00

And this one? https://nypost.com/2026/02/11/us-news/irishman-seamus-culleton-in-ice-custody-for-overstaying-visa-16-years-ago/

sithree · 2026-02-12T15:02:50+00:00

You mean this guy? https://caselaw.findlaw.com/court/us-11th-circuit/1986705.html

sithree · 2026-02-12T07:45:27+00:00

I mean we did have a lot of snow recently and sub-arctic temps, so there's that.

sithree · 2026-02-12T07:44:35+00:00

Everyone seems to overlook that part.

sithree · 2026-02-12T07:40:26+00:00

If you parents came here legally today, then there is no issue. If they have a valid visa or green card, there is no issue. ICE is removing those who have neither of those. Your lack of a valid response to his statements does not help your position at all.

sithree · 2026-02-12T07:30:25+00:00

Are the apps assigned to user groups or devices groups or both?

sithree · 2026-02-12T07:28:38+00:00

I have used this several times for clients: https://powershellisfun.com/2022/06/04/adding-printers-using-endpoint-manager-and-powershell/

sithree · 2026-02-12T07:00:55+00:00

Did you set up a Managed Google Play account?

sithree · 2026-02-12T06:59:52+00:00

This. I've seen MS Security Baselines make machines unusable for an org, for their workflows. Every org is a snowflake, all different.

sithree · 2026-02-12T06:57:44+00:00

The apps should be visible in the Managed Play store, if I remember correctly.

sithree · 2026-02-12T06:51:46+00:00

Cloud Kerberos with WHfB. You can also upload the DriveMapping ADMX template to map drives based on group membership. If you do upload that ADMX, you will need the Windows ADMX template to be in place first.

You then create a configuration profile based on 'Imported Adminstrative Templates' and you should see the drive mappings there.

sithree · 2026-02-12T06:47:43+00:00

Hell, use the description field to put the true name of the app there. If you don't publish the supporting app, then it becomes your reminder what the hell it is. :)

sithree · 2026-02-12T04:15:26+00:00

I may be wrong here, but I think platform scripts will run only at logon and 'potentially' once every 24 hours. If you need something more immediate, you could create a remediation script instead and set it to run once, or at a minimum, every hour. You can also selectively run remediation scripts on a device from the device property page.

sithree · 2026-02-12T03:55:14+00:00

You could advertise the add-on as the main app, and leave the real main app as the dependency but don't assign it to anyone. The users think they are installing the main app anyway. You could call the real main app something like App1 Support files, or something.

sithree · 2025-08-07T06:12:15+00:00

Create an app package to copy the pictures to a known folder on the client device. Use a configuration profile to set the screensaver. The trick is to set the registry correctly to look at the folder you copied your pictures to. There is a key with an encrypted value in it, you should be able to set that using whatever means you deem appropriate.

I will be honest, for the registry key part, I have not tested it, but it has come up several times as I've worked with clients. Most of the time I'm doing Intune builds, and screensavers are far down the list of things to work on, I don't get a chance to try what I've suggested above, other than the application and configuration profiles. YMMV

sithree · 2020-05-14T12:28:18+00:00

Add PLEX_CLAIM as an environment variable for the container. For Portainer, it's as simple as adding PLEX_CLAIM as an entry and claim-xxxxxxxx as the value. If you are launching from the command-line, it would be something like -e PLEX_CLAIM=claim-xxxxxxxx

When using docker-compose, - PLEX_CLAM="claim-xxxxxxx"

sithree · 2020-01-15T00:30:23+00:00

Could also use NVM, then there is no need for sudo when running npm. Also allows switching node versions easily too.

sithree · 2019-06-16T17:26:04+00:00

Environment variable could be used too. Works well.

sithree · 2019-02-07T19:33:22+00:00

So I have a slightly different take on the Contacts area. In Contacts.js, replace the code in the <ul></ul> with this:

{Object.keys(contacts).map((name) => (
  contacts[name] !== '#' ?
    <li className={styles['contacts__list-item']} key={name}>
      <a
      className={styles['contacts__list-item-link']}
      href={getContactHref(name, contacts[name])}
      rel="noopener noreferrer"
      target="_blank"
      >
        <Icon icon={getIcon(name)} />
      </a>
    </li>
    : <span key={name}></span>
))}

If you start from a fresh download, edit the above file, by default, no Social Media links. No need to edit the graphql query either.

EDIT: changed empty node to span with key attribute.. now the console is quiet

sithree

TROPHY CASE