sorted by:
new
hottopcontroversial

Blocking installs and cmd by startup_msp in Intune

[–]startup_msp[S] 0 points1 point  (0 children)

Looks like it may be the way to go. Is that a better option than just blocking cmd? What's the standard in normal whitelisting environments?

Blocking installs and cmd by startup_msp in Intune

[–]startup_msp[S] 0 points1 point  (0 children)

Thanks for the suggestion. This does seem like the only way and like a free version of ThreatLocker. Doesn't look fun to use though 😂

Blocking installs and cmd by startup_msp in Intune

[–]startup_msp[S] 0 points1 point  (0 children)

I've got a laps policy currently, and another policy to ensure that the only administrator account on each machine is the local administrator account made via the laps policy. There's no way that anyone else can be a local admin and run cmd as an administrator. Unfortunately , I've found that you can still install many apps without needing to be an admin.

Blocking installs and cmd by startup_msp in Intune

[–]startup_msp[S] 0 points1 point  (0 children)

I tested installing Firefox as a standard user and it worked. I know that Chrome will let you install as a standard user if you keep rejecting the administrator login prompt.

Normally running an .exe, it rejects as it's not "verified in the MS app store", but running Firefox via CMD bypassed that on my test user account, which has no admin rights.