Martin Himken | MVP

#Intune/#Entra Auto-Discovery for MDM is being retired in January 2027. Meaning, if you set up the enterpriseenrollment-s.<domain> to enterpriseenrollment-s.manage[.]microsoft[.]com users will soon always be prompted to provide the mdm URL in some cases. techcommunity.microsoft.com/blog/intunec...

I've created some automation for #GlobalSecureAccess! It auto-disables GSA once it finds the specified PTR. It triggers on network changes and runs as a scheduled task. I know this goes against the idea of GSA, but there are legitimate use cases. intune.best/GSAAutoDisable

The preview update contains some interesting information about WinRE👀. What do you mean by 'remote management plug-in for extending WinRE management capabilities for MDM providers'? It's now ~828 MB, by the way. support.microsoft.com/en-us/servic...

📢 PSA #Windows Update September 2026 warning: Following MS latest recommendation for the WinRE partition size is about 750MB. If your WinRE partition is smaller, Windows Update will attempt to resize the partition, which may result in failure. Be aware :)

#FringeKnowledge #TheMoreYouKnow Me: ** Puts on dark shades and long coat ** Hey you... You: Me? Me: SHHHHH.... yes you... did you know Amazon is shutting down MTurk? You: MTURK? Me: SHSHSHSSSHHHH yeeess... en.wikipedia.org/wiki/Amazon_...

#Intune has finally gotten the #Autopilot Device Preparation update it needed! Device Association, Device Name templates and configurable OOBE! techcommunity.microsoft.com/blog/intunec...

📢 Do not disable VBS! I've seen this configuration before and, unfortunately, expect to see it again. If your environment can't support VBS, you're missing out on some of Windows 11's most important built-in security features. Fix whatever is holding you back now!

Wow! Thank you, Center for Internet Security! For those who don't know me or haven't seen my name on the Windows 11 (Intune) Benchmark, I now also have a fancy badge for it! 🤘 www.credly.com/badges/27fb1...

#Entra Cloud Sync has just introduced Hybrid Join capability. Attributes cannot be configured yet, but it works! Enable the checkbox for your cloud sync AD > Entra ID configuration and it's done! Run it in parallel with Entra Connect if need be #RTFM #Yeet learn.microsoft.com/en-us/entra/...

Stern reminder: If you are migrating to cloud-native devices, ensure that your hybrid identities are not in a protected group and that they don't have access to the AdminSDHolder object. This will safe you a lot of time when doing WHfB and Cloud Trust! learn.microsoft.com/en-us/window...

This is probably the most detailed explanation I’ve ever seen how #WHfB aka Windows Hello works. Many of the #ITSecurity folks might have picked up this document from @bsi.bund.de already, but thus far this 170 page behemoth is a good read! www.bsi.bund.de/SharedDocs/D...

My first #MVPBuzz as a dual MVP! I can now say that I am an Intune and Windows MVP. I'm one of many today - but I couldn't wait to post this! Thank you so much for having me, and thank you to everyone who has supported me. W/ you I wouldn’t have be here. mvp.microsoft.com/en-us/mvp/pr...

#Windows team is cooking * movable taskbar * more update related reboot control * enhanced search * file explorer speed improvements * WHfB reliability improvements * … This blog covers a lot of the concerns I keep hearing from the community. Nice! blogs.windows.com/windows-insi...

#Windows Backup for Organizations now has First Sign-In Restore! This means you can now have people sign in and select a backup even if the device wasn't enrolled. aka.ms/FirstSignInR...

People will be so mad if they already packaged the #OOB KB5077744 or KB5077797 to be deployed in #Intune manually...

What do #Certificates, #SecureBoot, and #BlackLotus have in common? Read my new blog post for more context on what's actually happening and why you need to do more than just flip a few settings in the long run. Enjoy reading! manima.de/2026/01/secu...

Using #PowerShell Graph modules for #Intune or #EntraID administration? Well, the interactive sign in for Connect-MGGraph has finally been fixed! All you need is to update your module(s)! Happy Holidays! github.com/microsoftgra...

📰 New blog post dropped! In this long due blog post, we explore the "split device" issue in your #Entra tenant a bit more. Don't think you have this? Run the script and find out! manima.de/2025/12/the-...

Oh hey, we're [finally] killing RC4 everywhere officially. www.microsoft.com/en-us/window...

📰🤯 #Microsoft just announced the biggest #Intune license update since 2023 (release of the first Intune Suite Feature "Remote help"). aka.ms/M365-PIBlog aka.ms/M365Governme... aka.ms/IntuneM365Blog

📰 Reminder that TLS inspection is unsupported for many of the endpoints required for #Intune services. In this case its the Store endpoints, that are required for things like license validation. github.com/MicrosoftDoc...

#MSIgnite listening to BRK1700 right now. So the „cloud restore“ will use WinRE to download and reinstall Windows. 👌🏻 This is exactly what I wanted for years! Early Christmas if you ask me ❤️

"Microsoft Ignite 2025 Book of News" is out and _man_ there is a lot to unpack. Go read about it! Keywords to look for: * Security Copilot * Windows Resiliency Initiative * Maintenance Window and many more! news.microsoft.com/ignite-2025-...

#PowerShell #Windows I just found one of the weirdest thing. Remember reagentc? If you /disable while using a x86 PowerShell the WinRE.wim will be put into a different folder than when you do it from x64. This is wild. github.com/MHimken/WinR...

#Intune network requirements page got a huge update! There is now a consolidated list for the network endpoints. Rejoice! However, it's still not fully complete 😭 But updating _that_ list should be much easier than the JSON 😊. learn.microsoft.com/intune/intun...

#Entra will have "soft delete" for _cloud_ security groups. I wonder if this would also restore access to things like Teams private channels and SharePoint. deltapulse.app/message/MC11... I wish I had this feature a couple moons ago...💀

📰🆕: The #INR script v1.4 to test #Intune and related network services just got its first big update in a bit. Here's what changed in the latest version. - ID-to-Service list is now available. - Test MCC - Test NuGet - ... Go grab the new version here: github.com/MHimken/Intu...

PSA: If you're running WSUS you will want to look at MC1178653 in your Message Center. The only workaround to CVE-2025-59287 is denying access to the service. If you haven't patched your Server 2025 yet (and as that update apparently was pulled) this is the replacement fix.

Hey #Intune peeps, @skiptotheendpoint.co.uk released a new version of his awesome #OpenIntuneBaseline #OIB today for 25H2! stte.me/oib25h2

💡New docs on #Intune "remote device actions". Apparently it was updated this month and while it looks much cleaner now, I think its missing crucial information (like what each action actually does?) I liked the old table more 🙈. learn.microsoft.com/intune/intun... web.archive.org/web/20250328...

Using #WindowsAutopatch in #Intune? You should go here and Migrate to the Win32 App. This will create an application for you "Windows Autopatch Client Broker" that you can use to deploy the AP service instead of the script. intune.microsoft.com#view/Microso... learn.microsoft.com/en-us/window...

TIL: Is it #Office ADMX x86 or x64 right for me? They're identical except for a minor version number string in the Lync16.adml files. Just use whichever download you prefer.

Ok, Citrix really? First of all, Intune has been able to do this for years. So, you've figured that out, and you've even got a working template? Oh, wait a minute - your new ADMX doesn't work too, because you forgot to include EXPLAIN strings in 2 spots. github.com/MHimken/FixM...

Reminder! - "The option to move back to Compatibility mode will remain until September 2025. After this date, the StrongCertificateBindingEnforcement registry key will no longer be supported" - support.microsoft.com/en-us/topic/... #ADCS #InfoSec

🖨️💡Have you switched your #Windows printer drivers to v4 or IPP with PSAs yet? Don't know I'm talking about? It's time to read up on this apparently forgotten topic. Out of the five customers I had today, none of them knew about the change. To busy w/ W11. learn.microsoft.com/en-us/window...

#INR aka #Intune Network Requirements script just got an update and a new home. Update your bookmarks! Also, new ASAs added: * Microsoft Defender for Endpoint * Visual Studio github.com/MHimken/Intu... #MVPBuzz

#Intune "Windows Quality Update management policies" just dropped on the roadmap. This will allow you to control non-security and OOB updates more granular. www.microsoft.com/en-us/micros...

#WindowsUpdate: Thinking of moving to #Intune and/or #Autopatch? Used GPOs or any RMM tool (yes CM too) to adjust the update settings? This cleanup script is for you. I recently received some requests for this again, so I'll share it once more. github.com/MHimken/tool... #MVPBuzz

'Windows 11 cloud-native migration with Microsoft Intune'. There's a great article from @onpremcloudguy.com with lots of useful information in the links. Afterwards, you can read my blog to find out about other relevant technologies 😉 techcommunity.microsoft.com/blog/windows...

Unattended access with Remote Help is on its way! Bear in mind that this is the GA date, so there may be a (private) preview available to join. I still highly recommend checking out the MMCCP to participate in early previews. techcommunity.microsoft.com/blog/windows... #MVPBuzz

Internet-facing file servers, using SMB over QUIC, and secured using Entra authentication! This turned out to be really easy to get up and running. ajf.one/entrafs #Entra #EntraID

Since I don't do a lot of macOS administration I completely missed this (thanks Andreas!). LAPS for macOS is here :) learn.microsoft.com/en-us/intune... #MVPBuzz

⚠️⚠️The preview update for #Windows 24H2 allows you to pin apps to the start menu ONCE (aka boolean). No mention of how yet though 🙈Finally, no more playing around with start2.bin Also: Quick Machine Recovery and many more things - go read now! support.microsoft.com/en-us/topic/... #MVPbuzz

This post does not have enough attention yet. 2.29.1 seems to finally solve the authentication issues that existed in Microsoft.Graph.Authentication for a good while now. Run your Update-Module now!

In case you're using a Windows 11 IoT version and it isn't a Microsoft Teams Room device, here's a reminder that (since may actually) Autopilot is _not_ supported. learn.microsoft.com/en-us/autopi... I can only assume that's because it - by default - skips the OOBE.

Part 8053 of eleventy billion on our path to killing NTLM: way way way way way better auditing. support.microsoft.com/en-us/topic/...

TIL: Using #Windows #24H2 with activated VBS (which is enabled by default on Windows 11) #WHfB PIN expiration and history are _not supported_. Time to change change some policies... learn.microsoft.com/en-us/window...