Your Help Desk Operator role covers every Remote Help permission. Still can't start an unattended session. Microsoft left "Windows unattended control remote sign-in" out of every built-in role. endpointweekly.com/blog/intune-...

You Turned On Windows Unattended Control in Remote Help.…

A step-by-step setup guide for unattended Remote Help on Windows: licensing, prerequisites, RBAC permission, and the…

endpointweekly.com

Microsoft has fully removed wmic.exe from Windows 11, not disabled, gone. Ships in the August 2026 update (KB5067470). Old scripts calling it will fail with no warning. Free script + full translation table: endpointweekly.com/blog/wmic-re...

WMIC Has Been Removed from Windows 11: Replace Your…

The August 2026 preview update (KB5067470) removes wmic.exe from Windows 11 for good - no Feature on Demand fallback.…

endpointweekly.com

The ZTDID: The One Attribute That Proves a Device Is Really Autopilot-Registered — endpointweekly.com/blog/autopil...

The ZTDID: The One Attribute That Proves a Device Is…

A device enrols, reports compliant, and still never joins your all-Autopilot dynamic group. The reason is a marker…

endpointweekly.com

Which apps actually block the Enrollment Status Page (and why yours did not) — endpointweekly.com/blog/autopil...

Which apps actually block the Enrollment Status Page (and…

You set the ESP to block until your required apps install, it cleared in four minutes, and half the apps were missing.…

endpointweekly.com

Repaired laptop shows a generic setup screen. Intune still lists it registered. Autopilot disagrees. Motherboard/TPM swap = new device - the key never leaves the chip. Free audit script: endpointweekly.com/blog/autopil...

Listen to Endpoint Weekly on Spotify for Creators open.spotify.com/episode/0g6R...

Your Conditional Access "Compliant Device" Check Is Trusting a Stale Signal

Endpoint Weekly · Episode

open.spotify.com

CA's compliant-device check doesn't ask the device anything - it reads a flag from last check-in. Default validity: 30 days. A dark device passes CA for a month, undetected. Free Graph audit script: endpointweekly.com/blog/entra-c...

Your Conditional Access "Compliant Device" Check Is…

Require device to be marked as compliant reads a stored flag, not a live device check - and Intune gives silent devices…

endpointweekly.com

Did you know Edge lets you sign in with a personal Google account on a work laptop? If you do, your saved passwords and browsing history sync straight to Google - not Microsoft, not your company's IT team. endpointweekly.com/blog/microso... #sysadmin #windows #cybersecurity

Microsoft Edge Now Lets Users Sign In With Google —…

Edge now shows a Google sign-in option for browser profiles. On managed endpoints, that means corporate passwords and…

endpointweekly.com

Your user visited real microsoft.com/devicelogin. Typed a code. MFA passed. Two days later - inbox rules, SharePoint reads, session gone. Device code flow is on by default. One CA policy blocks it. endpointweekly.com/blog/device-code-phishing-microsoft-365-entra.html #EntraID #Microsoft365

User went to microsoft.com/devicelogin. Typed a real code. MFA passed. Attacker already had the token. No fake domain. No stolen password. CA block: Authentication flows → Device code flow → Block 👉 endpointweekly.com/blog/device-... #EntraID #CyberSecurity

Full guide covers: → 16 Autopilot event IDs decoded → Registry keys for ESP, profile download, tenant match → Error codes 0x80180014, 0x80070774, 80180018 → Every DLL + service breaks Autopilot → 2 PowerShell scripts on GitHub 👉 endpointweekly.com/blog/autopil... #WindowsAutopilot #Intune #ITAdmin

Windows Hello for Business feels hardware-backed. But without RequireSecurityDevice, some devices run Hello on a software key: no TPM guarantee, and the portal won't tell you. Get-Tpm shows the truth: endpointweekly.com/blog/whfb-tp...

TPM and Windows Hello for Business: Require It, Diagnose…

The TPM is what makes a WHfB key unexportable - but without RequireSecurityDevice, some of your fleet may be running…

endpointweekly.com

Which Windows Hello gesture did they actually use — face, fingerprint, PIN or password? Entra won't tell you. I built a read-only script that rebuilds it from the Windows event logs. Real output 👇 endpointweekly.com/blog/windows... #WindowsHello

Which Windows Hello Gesture Did They Actually Use? Face,…

Entra only ever says "Windows Hello for Business" — never whether someone used face, fingerprint, PIN or password. Here…

endpointweekly.com

Deploy a Store app in Intune, get "failed" — but it's clearly installed? Store apps are winget now. The flow, the IME device footprint, the logs & the error codes that fool everyone: endpointweekly.com/blog/intune-... #Intune #MSIntune

Microsoft Store Apps in Intune — Deployment &…

Store for Business is gone — modern Intune Store apps are winget-backed. The full deployment flow, what the IME leaves…

endpointweekly.com

Passwordless is no longer a future goal — it's deployable today with the right automation. I published a full technical guide on automating Windows Hello for Business enrollment using PowerShell What's covered: ✅ GitHub repo with scripts you can fork and adapt Read it here 👇 lnkd.in/eaCFmzcw

Autopilot now installs monthly security updates during OOBE — before the user hits the desktop. New profiles default ON. Old profiles default OFF. That gap will catch you out. endpointweekly.com/blog/autopilot-quality-updates-oobe-2026.html #Intune #Autopilot

Windows Autopilot Now Installs Monthly Security Updates…

From January 2026, devices going through Windows Autopilot automatically receive the latest monthly security update…

endpointweekly.com

Bulk PowerShell script for Intune — give it a list of device names, get back primary user and last sync time for each one. Useful for audits, stale device cleanup, and offboarding. Exports to CSV. endpointweekly.com/blog/get-intune-primary-user-last-sync-powershell.html

Get the Primary User and Last Sync Time for Any Intune…

You export a list of devices and all you get is hostnames. This script feeds that CSV into Microsoft Graph and gives…

endpointweekly.com

Bulk PowerShell for Intune — give it device names, get back primary user and last sync time for each one. Exports to CSV. endpointweekly.com/blog/get-intune-primary-user-last-sync-powershell.html #Intune #PowerShell

Windows Autopilot Now Installs Monthly Security Updates…

From January 2026, devices going through Windows Autopilot automatically receive the latest monthly security update…

endpointweekly.com