Server? What's that? Sounds awful.

The reality is that nobody outside of us freaks are sat at that screen waiting for things to happen. The first most people know that an update wants a reboot is when they get the notification, which _does_ only happen when they're all complete.

Make policies manageable and give them useful and descriptive names. A device doesn't give a crap how you separate or name your policies. That's entirely for the admins benefit.

Yep imports are completely fresh copies and don't touch any of your existing policies.

I've added "Interactive Logon Machine Inactivity Limit" into the Power and Device Lock policy with the same outcome :) github.com/SkipToTheEndpoint…

#OpenIntuneBaseline Windows v4.0 is here! 🎉 Highlights include: * Continuing to be the most agile and cutting-edge Intune baseline on the planet! * A shake-up of Compliance policies, allowing true grace period granularity (and ditching the EAS Password policy because it's 🗑️) * Edge settings for days! Simple support for the Edge Management Service and security hardening and user experience improvements. * Updated M365 Apps Security baseline alignment. * Fixed MS breaking the in-box app removal policy. * Defender behaviour tweaks based on real customer feedback, not arbitrary check-boxes. * Deprecated and obsolete settings sent to live on a farm. As always: ✅ Take what you want ✅ Change what doesn't suit your environment ✅ Test it before yeeting to 40,000 endpoints on Friday afternoon ❌ Don't treat any security baseline as a magical compliance button Check out the full release notes at: stte.me/oib26h2 Then, head on over to the OIB Deployer to deploy the new and updated policies, or check your current config vs 4.0 with the Settings Validator! https://deploy[.]openintunebaseline.com And, uhh, keep an eye on Friday, too ;) #OIB #Windows #EndpointSecurity #Community #Capybara

People stopped hosting on-prem exchange when it became too expensive in hardware and time keeping it patched. I don't see why AD is any different. The biggest security win is going Entra Join for devices. Cut that direct infrastructure tie from endpoints.

"Roof Inspector" 🤣🤣🤣

"But that's how I do it on the firewall!"

Nah sorry, they just weren't good and had functionality that was available just as easily elsewhere.

And thus configured it contrary to *any* recommendation.

This whole thing is super weird. The default for that setting is 0 (Disabled). It was set to 0 in the Microsoft 24H2 Baseline. Are people just configuring a setting to something that nobody is recommending now? Or is there something else going on? bleepingcomputer.com/news/mi…

Very kind of you, but unconfigured should mean disabled anyway, at least according to the docs... Weird one.

Poking a bit more, being set to Disabled is the Default setting for that, and I can't see it being recommended (set in any way) in any other baseline. So someone's gone and set that from the default on purpose for an unknown reason.

Huh. Well, while I'd love to take some sort of credit, checking my changelog I just incorporated that setting from MS's own 24H2 Security Baseline: github.com/SkipToTheEndpoint…

Yeah, MacOS is kinda busted and I haven't specifically fixed it because mentally that was behind MacOS v2.0, but thats essentially indefinitely delayed until I have a Mac to actually test it on. Go grab the 2.0 beta branch from github (and provide feedback!)

The Edge Management Service has so many hidden gems. However, if you're using the #OpenIntuneBaseline, you're already benefitting from a *required* user prompt and significantly reduced forced restart period from the Edge defaults 😉