Pinned Tweet
Since I've got a couple of requests around this I wrote another blog post on how to modify the recovery partition itself. This should be interesting for folks that encounter 0x80070643 for the #CVE-2024-20666 patches.
manima.de/2024/01/winre-patc…
#Intune/#Entra Auto-Discovery for MDM is being retired in January 2027. Meaning, if you set up the enterpriseenrollment-s.<domain> to enterpriseenrollment-s.manage[.]microsoft[.]com users will soon always be prompted to provide the mdm URL in some cases. techcommunity.microsoft.com/…
I've created some automation for #GlobalSecureAccess! It auto-disables GSA once it finds the specified PTR. It triggers on network changes and runs as a scheduled task. I know this goes against the idea of GSA, but there are legitimate use cases. intune.best/GSAAutoDisable
Customers have been begging for something like this. I can’t wait! Hopefully it’ll allow for the installation of Hotpatch instantly while bundling the other updates to one day.
Martin Himken | MVP retweeted
PSA The one restart a month feature is currently only turned on for Consumers. We are working on bringing this to commercial soon - updating the blog to clarify now. We are just waiting until we have the appropriate commercial controls in place to manage such. :)
Martin Himken | MVP retweeted
DO Troubleshooter 1.3.1 is live 🚀 One script to check your Delivery Optimization, P2P and Connected Cache health. Get it: aka.ms/do-fix #Windows #SysAdmin #DeliveryOptimization
Martin Himken | MVP retweeted
#MDDR 2026 is out – a must-read for everyone in #MicrosoftSecurity. Password spray still leads by volume, but post-authentication attacks keep gaining ground: token theft shows up as a distinct post-compromise tactic. Check out the full report:
aka.ms/MDDR2026
Martin Himken | MVP retweeted
#OpenIntuneBaseline Windows v4.0 is here! 🎉
Highlights include:
* Continuing to be the most agile and cutting-edge Intune baseline on the planet!
* A shake-up of Compliance policies, allowing true grace period granularity (and ditching the EAS Password policy because it's 🗑️)
* Edge settings for days! Simple support for the Edge Management Service and security hardening and user experience improvements.
* Updated M365 Apps Security baseline alignment.
* Fixed MS breaking the in-box app removal policy.
* Defender behaviour tweaks based on real customer feedback, not arbitrary check-boxes.
* Deprecated and obsolete settings sent to live on a farm.
As always:
✅ Take what you want
✅ Change what doesn't suit your environment
✅ Test it before yeeting to 40,000 endpoints on Friday afternoon
❌ Don't treat any security baseline as a magical compliance button
Check out the full release notes at: stte.me/oib26h2
Then, head on over to the OIB Deployer to deploy the new and updated policies, or check your current config vs 4.0 with the Settings Validator!
https://deploy[.]openintunebaseline.com
And, uhh, keep an eye on Friday, too ;)
#OIB #Windows #EndpointSecurity #Community #Capybara
Thank you Microsoft, for bringing back the ability to position the taskbar to #Windows 26H2. However, I don't see a good reason why that'd influence the "hide the taskbar" option at all...??
I honestly think this is a step backwards. Microsoft is about to close off the rest of learn from public GitHub contributions. If you're as sad about this as I am, I recommend leaving a comment under that post - it's probably a shot into the wind but...
For all you RTFMers out there ...
Yes, both of you 😂
techcommunity.microsoft.com/…
The preview update contains some interesting information about WinRE👀. What do you mean by 'remote management plug-in for extending WinRE management capabilities for MDM providers'? It's now ~828 MB, by the way.
support.microsoft.com/en-us/…
📢 PSA #Windows Update September 2026 warning: Following MS latest recommendation for the WinRE partition size is about 750MB. If your WinRE partition is smaller, Windows Update will attempt to resize the partition, which may result in failure. Be aware :)
ALT Windows WinRE partition size calculation via Microsofts own documentation, checked on 09.09.2026
Martin Himken | MVP retweeted
I really recommending reading this.
In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada.
It is a catastrophic data breach, probably one of the worse I've ever seen. If you're in the United States and have traveled, gotten a hotel, purchased marijuana or alcohol, there is a high probability you're in this.
Unlike other breaches, this includes a photo of the person (from the license), making verification you've identified the person significantly easier.
This poses a significant threat to celebrities (musicians, YouTubers, streamers, adult entertainers, actors, etc), politicians, lawyers, wealthy people (CEOs, investors, people of public interest), Law Enforcement Officers, etc
Krebs himself, and several other security researchers, have already confirmed they're in the data leak.
tl;dr gah damn dawg this company is going to be sued into oblivion
krebsonsecurity.com/2026/09/…
#FringeKnowledge #TheMoreYouKnow
Me: ** Puts on dark shades and long coat ** Hey you...
You: Me?
Me: SHHHHH.... yes you... did you know Amazon is shutting down MTurk?
You: MTURK?
Me: SHSHSHSSSHHHH yeeess... en.wikipedia.org/wiki/Amazon…
#Intune has finally gotten the #Autopilot Device Preparation update it needed! Device Association, Device Name templates and configurable OOBE!
techcommunity.microsoft.com/…
📢 Do not disable VBS! I've seen this configuration before and, unfortunately, expect to see it again. If your environment can't support VBS, you're missing out on some of Windows 11's most important built-in security features. Fix whatever is holding you back now!
Wow! Thank you, @CISecurity ! For those who don't know me or haven't seen my name on the Windows 11 (Intune) Benchmark, I now also have a fancy badge for it! 🤘
credly.com/badges/27fb161a-c…
#Entra Cloud Sync has just introduced Hybrid Join capability. Attributes cannot be configured yet, but it works! Enable the checkbox for your cloud sync AD > Entra ID configuration and it's done! Run it in parallel with Entra Connect if need be #RTFM #Yeet
learn.microsoft.com/en-us/en…
Stern reminder: If you are migrating to cloud-native devices, ensure that your hybrid identities are not in a protected group and that they don't have access to the AdminSDHolder object. This will safe you a lot of time when doing WHfB and Cloud Trust!
learn.microsoft.com/en-us/wi…
This is probably the most detailed explanation I’ve ever seen how #WHfB aka Windows Hello works. Many of the #ITSecurity folks might have picked up this document from @BSI_Bund already, but thus far this 170 page behemoth is a good read!
bsi.bund.de/SharedDocs/Downl…