AppLocker in Intune or: How I Learned to Love the (ChatGPT) Bot and Start Worrying

I’ve been playing around with OpenAI’s ChatGPT bot and… this is going to be a really short blog post (just like my career).  It actually **welp** did a pretty damn good job… Not perfect but scarily close. Impressive, right? But not perfect. To start off with, the solution the bot suggested isn’t AppLocker but rather App Protection….

Read More

Security Identifiers (SIDs) and Object Permissions in Windows [Part 1]

Welcome to Part 1 of a planned four-part series! Part 1: Security Identifiers (SIDs) and Object Permissions in Windows (you’re reading this it now!) Part 2: Security Identifiers (SIDs) and how to understand them Part 3: Converting Azure Object IDs in Azure into Security Identifiers (SIDs)  Part 4: Security Identifiers (SIDs) and User Rights Management  So on to Part…

Read More

Credential Guard: Protect Windows from pass-the-hash and pass-the-ticket attacks

Credential Guard is a component of Microsoft’s Virtualization-based Security Suite (VBS). With the help of the hypervisor, it protects the hashes of the credentials cached in RAM from attackers. And it is super simple to enable using Intune or Group Policy! So how does Credential Guard work? After successfully logging on to Active Directory, Windows…

Read More

Assigning Local Log on User Rights via Intune Settings Catalog

As helpful as wizards like Intune Security Baselines are useful for greenfields and inexperienced admins, those needing a little umph in their setups (especially those admins used to on-premise GroupPolicy Administrative Templates) found Intune’s offerings lacking – forced to use CSP policies and custom OMA-URIs like in the example above.   The settings catalogue aims…

Read More

Intune Security Baselines – What are they and how to use them?

Security baselines are intended to make it easier to configure security-related settings in Windows or Edge. They are available from Microsoft as Group Policy packages, or they can be configured through the interfaces for mobile device management such as Intune.   In my opinion, they are mainly intended for clients who have limited experience with Intune and/or security, i.e.,…

Read More