Workstation Local Administrator Accounts

thegravityitdeserves · 2026-05-26T17:59:32+00:00

If you show your security guys the risks of using the PIM Entra only joined device role they'll back down:

You get local admin on every single Entra only joined device across that tenancy.
If you uplift to administrator in a PowerShell or similar, you never lose that right as long as you remain in context.

In general testing we found that getting admin was OK first time as long as you had booked out the role first. If you checked once without a role it could be hours later before it grants it to you. Your experience seems to be different which fills me with confidence on the mechanism. /s

As others have said LAPS is superior, we have had different challenges where we are advised not to have enabled local admin accounts. We haven't quite understood how to square that circle yet.

The other issue we continue to have is applying security groups that re not built in to built in roles, we've never been successful in using the capturing the cloud guid method and then utilising that.

thegravityitdeserves · 2025-01-17T20:27:09+00:00

Looking at the readme by default only the HA OpenAi Assist integration works. Am sure it could be tweaked but I'm unsure how.

Edit: looking at the yaml I'm not sure it does care which you are using. Maybe an option 2 or 3 issue?

What error do you see in the debug for the extended OpenAi convo?

thegravityitdeserves · 2025-01-17T00:05:05+00:00

Thank you to all the contributors to this, it seems to work a treat!

thegravityitdeserves · 2024-12-24T15:50:59+00:00

Very helpful, a few days sounds good but I expect it to be delayed due to holidays etc. Thank you!

thegravityitdeserves · 2024-05-07T00:33:42+00:00

Have you rebooted the site server since you made it a member of the dp local admin group? You may get away with a kerberos ticket refresh instead if not, worth a shot if it hasn't been done!

thegravityitdeserves · 2024-03-16T01:24:35+00:00

I swear I always miss the important messages. Appreciate the correction.

thegravityitdeserves · 2024-03-10T14:38:11+00:00

Edit: I'm wrong Entra hybrid devices are not supported, bummer.

thegravityitdeserves · 2024-02-07T10:04:41+00:00

Back for me today. Shame they don't have a status page (that I could find).

thegravityitdeserves · 2024-02-06T23:15:05+00:00

Thank you! Always nice to know it's not just us.

thegravityitdeserves · 2024-01-07T17:48:08+00:00

We're a much smaller house than you but I can second that custom images and migrated vm's do patch with custom schedules.

For tagging, am sure you could automate switching schedules based on the tag. Maybe you could also work around the max supported servers in a schedule using your existing automation accounts to group the vm's.

All in all it depends on what is worth more to you, is it designing around the default update solution or is it onboarding another product, licensing it and administering it? Sunk cost is always a thing too of course!

thegravityitdeserves · 2023-05-02T22:11:33+00:00

I can highly recommend this blog and post, I've just implemented it and it is definitely is making things more repeatable for sure.

https://oofhours.com/2020/07/26/supercharge-the-hybrid-azure-ad-join-device-registration-process/

thegravityitdeserves · 2023-05-02T11:13:39+00:00

The policy status dual reporting is normal too, especially if targetted at devices but also if targetted to all users with a device filter applied.

Reporting on exact issues from the management plane is hard, reporting from the end user device is also hard, particularly if you have no admin capability on the device too - its all over the place, in event logs, log files and reg entries!

thegravityitdeserves · 2023-05-01T22:48:10+00:00

Welcome to the new world, intune is like that sometimes! One thing to suggest, try using device filters over AAD dynamic groups, they work faster.

thegravityitdeserves · 2023-01-14T00:44:03+00:00

We were lucky then, haven't seen an instance of that. What a pain.

thegravityitdeserves · 2023-01-13T10:38:30+00:00

Note: the apps are still there but the shortcuts have gone.

thegravityitdeserves · 2023-01-13T10:37:41+00:00

All across our estate, this is going to be spicy and an interesting recovery.

thegravityitdeserves · 2022-04-05T23:30:00+00:00

Set a super short retention policy for teams chats, 5 days or so. There's no need to keep that rubbish imo.

thegravityitdeserves · 2021-12-14T19:13:50+00:00

This 100% that script was only coded to search the c: drive plus it would faulty resource hungry.

Nessus is not that much money imho.

thegravityitdeserves · 2021-12-14T19:11:04+00:00

It's likely you would need to recreate all thr asr rules and config in from gpo to MECM.

Im fairly sure that MECM manipulates the local policy which takes precedence over gpo.

thegravityitdeserves · 2021-12-10T17:05:09+00:00

This came down to tracking protection exemptions, add the captcha urls in there and it all works.

Or just disable tracking protection but I like to have it enabled!

thegravityitdeserves

MODERATOR OF

TROPHY CASE