Intune – Configure “Fast startup” (HiberBoot) for Windows 10

Since I changed my clients from GPO managed to Intune controlled, not all settings from GPO, but some of them needs to be set through Intune as well. As outlined in my previous blog, I tried to disable the Fast Startup Option on Windows 10 through a CSP. And I did not even found a CSP supporting this setting. Within this blog, I would like to show, how you can configure the fast startup (“Turn on fast startup (recommended)”) setting in Windows 10 through Microsoft Intune:

You may ask, why I want to disable this? My reason: I don’t want to reuse a desktop session which was hibernated. And only a reboot will force the client to create a new desktop session, if fast startup is enabled.
Continue reading

Windows 10 settings management with Intune

When a journey ends, a new journey will begin. My journey with the old school domain joined and GPO managed devices within my LAB ended, and I finally conquer new areas with Azure AD join and Intune controlled devices. Due to the lack of opportunities, I still waited so long, because a lot of settings were not possible to set. And some of them are still not that simple to set through Intune, but there is a solution for, I would like to say, most of the requirements.

So within this blog post, I would like to document my current knowledge of Windows 10 settings management through Intune. As today, we have the following options to configure GPO alike settings through Microsoft Intune:

  • Intune Windows Enrollment settings
  • Intune Portal blade settings
  • Intune Portal Custom CSP settings
  • Intune ADMX-backed administrative template settings (Preview)
  • PowerShell Script
  • Let’s have a closer look to the different options.
    Continue reading

    I have configured “Network Security: Restrict NTLM: NTLM authentication in this domain” months ago, here is why it catched me

    Today I would like to share my experience with troubleshooting a overcommitted security admin with less knowledge than it would be required (In fact, I’m talking about me here). Some month ago, I read about NTLM (v2 as well), and I decided to restrict NTLM in my LAB, to check what is working afterwards, and what stops working. To my surprise, everything went smooth, and I could not find an issue. So I forgot about this setting, everything seems to work, and it did.

    Lastly I decided to cut off Direct Access, since Microsoft does not invest in its future, and for other reasons, I’m not required to have a permanent connection to the LAB from remote, a VPN would be sufficient. I’m using WorkFolders as well, and secured it with Azure MFA, the same should apply to my VPN connection, the authentication should be not only be covered by Username and Password. With this, the goal was set, and I built up the LAB. Everything went nice, until the first VPN client wanted to connect. The NPS Server gave me the error:
    “The client could not be authenticated because the Extensible Authentication Protocol (EAP) Type cannot be processed by the server.”

    Continue reading

    Create your own Software Deployment Repository with Azure and Intune

    As you might know, within Intune you can only install applications on devices, if they are coming as an MSI. If you want to deploy anything else, this blog might be helpful for you.
    Let me talk about the requirements:

  • Azure Subscription for Storage
  • Intune Subscription (obviously)
  • This blog will provide the information how you can achieve this, and at the end, you will get a sample implementation from my LAB.

    Yes, that’s it. Now let us start creating the Azure Storage, and how you can access it. Go to the Azure portal, and open the storage accounts section. You can use the classic storage account as well, but I would recommend the newer ones:

    Continue reading

    Office 365 – Content Search and eDiscovery

    Today I would shed some light on the two options “Content Search” and “eDiscovery” from the Security and Compliance center of Office 365. You can reach the security and compliance center through the following URL:

    Office 365 – Security & Compliance Center

    The first questions that may raise up, what is content search and eDiscovery, and what is the difference of those two options.
    With content search, you can search all the content that is actually available, regarding existent policies (given example: Exchange Hold). Content search may help you in various occasions, where it may not be required to use eDiscovery. For legal documentation the eDiscovery should be used, where you also can specify Mailboxes, SharePoint Locations and OneDrive for Business to set hold policies on them.

    The next question might be: Who has access to those features by Default?

    It depends… Continue reading