Wow! Thank you, Center for Internet Security! For those who don't know me or haven't seen my name on the Windows 11 (Intune) Benchmark, I now also have a fancy badge for it! 🤘 www.credly.com/badges/27fb1...

2026 CIS Benchmarks™ Contributor was issued by The Center for Internet Security to Martin Himken.

A CIS Benchmarks Contributor is a subject matter expert within specific technology(ies) who attends most Community meetings and creates or comments on tickets, proposed changes, and discussions. They ...

credly.com

#Entra Cloud Sync has just introduced Hybrid Join capability. Attributes cannot be configured yet, but it works! Enable the checkbox for your cloud sync AD > Entra ID configuration and it's done! Run it in parallel with Entra Connect if need be #RTFM #Yeet learn.microsoft.com/en-us/entra/...

Stern reminder: If you are migrating to cloud-native devices, ensure that your hybrid identities are not in a protected group and that they don't have access to the AdminSDHolder object. This will safe you a lot of time when doing WHfB and Cloud Trust! learn.microsoft.com/en-us/window...

Appendix C - Protected Accounts and Groups in Active Directory

Learn more about: Appendix C: Protected Accounts and Groups in Active Directory

learn.microsoft.com

This is probably the most detailed explanation I’ve ever seen how #WHfB aka Windows Hello works. Many of the #ITSecurity folks might have picked up this document from @bsi.bund.de already, but thus far this 170 page behemoth is a good read! www.bsi.bund.de/SharedDocs/D...

My first #MVPBuzz as a dual MVP! I can now say that I am an Intune and Windows MVP. I'm one of many today - but I couldn't wait to post this! Thank you so much for having me, and thank you to everyone who has supported me. W/ you I wouldn’t have be here. mvp.microsoft.com/en-us/mvp/pr...

Microsoft Most Valuable Professionals

The Microsoft MVP Program connects technical community leaders with Microsoft to promote engagement, advocacy, and knowledge sharing on Microsoft Products & Services.

mvp.microsoft.com

#Windows team is cooking * movable taskbar * more update related reboot control * enhanced search * file explorer speed improvements * WHfB reliability improvements * … This blog covers a lot of the concerns I keep hearing from the community. Nice! blogs.windows.com/windows-insi...

Our commitment to Windows quality

Hello Windows Insiders, I want to speak to you directly, as an engineer who has spent his career building technology that people depend on every day. Windows touches more people's lives than almost a...

blogs.windows.com

#Windows Backup for Organizations now has First Sign-In Restore! This means you can now have people sign in and select a backup even if the device wasn't enrolled. aka.ms/FirstSignInR...

Windows first sign-in restore experience now available - Windows IT Pro Blog

With Windows Backup for Organizations, you can now restore Windows on even more devices.  

aka.ms

People will be so mad if they already packaged the #OOB KB5077744 or KB5077797 to be deployed in #Intune manually...

What do #Certificates, #SecureBoot, and #BlackLotus have in common? Read my new blog post for more context on what's actually happening and why you need to do more than just flip a few settings in the long run. Enjoy reading! manima.de/2026/01/secu...

Secure Boot, Certificates and BlackLotus – mAnimA.de

Microsoft wants you to update your Secure Boot certificates as soon as possible. Join me as I explain the situation and take action now!

manima.de

Using #PowerShell Graph modules for #Intune or #EntraID administration? Well, the interactive sign in for Connect-MGGraph has finally been fixed! All you need is to update your module(s)! Happy Holidays! github.com/microsoftgra...

📰 New blog post dropped! In this long due blog post, we explore the "split device" issue in your #Entra tenant a bit more. Don't think you have this? Run the script and find out! manima.de/2025/12/the-...

The disconnected Entra double computer object problem - Part 1 – mAnimA.de

Are there Entra devices in your tenant that you cannot delete? Is your Autopilot device pointing to the wrong Entra device? Read more here!

manima.de

Oh hey, we're [finally] killing RC4 everywhere officially. www.microsoft.com/en-us/window...

Beyond RC4 for Windows authentication

As organizations face an evolving threat landscape, strengthening Windows authentication is more critical than ever.

microsoft.com

📰🤯 #Microsoft just announced the biggest #Intune license update since 2023 (release of the first Intune Suite Feature "Remote help"). aka.ms/M365-PIBlog aka.ms/M365Governme... aka.ms/IntuneM365Blog

📰 Reminder that TLS inspection is unsupported for many of the endpoints required for #Intune services. In this case its the Store endpoints, that are required for things like license validation. github.com/MicrosoftDoc...

Update intune-endpoints.md by FadiJo · Pull Request #4841 · MicrosoftDocs/memdocs

As per ICM (675845676) SSL inspection is not supported for Microsoft store API and may cause reporting issues so we need to add the note that SSL inspection not supported for Microsoft Store API si...

github.com

#MSIgnite listening to BRK1700 right now. So the „cloud restore“ will use WinRE to download and reinstall Windows. 👌🏻 This is exactly what I wanted for years! Early Christmas if you ask me ❤️

"Microsoft Ignite 2025 Book of News" is out and _man_ there is a lot to unpack. Go read about it! Keywords to look for: * Security Copilot * Windows Resiliency Initiative * Maintenance Window and many more! news.microsoft.com/ignite-2025-...

#PowerShell #Windows I just found one of the weirdest thing. Remember reagentc? If you /disable while using a x86 PowerShell the WinRE.wim will be put into a different folder than when you do it from x64. This is wild. github.com/MHimken/WinR...

#Intune network requirements page got a huge update! There is now a consolidated list for the network endpoints. Rejoice! However, it's still not fully complete 😭 But updating _that_ list should be much easier than the JSON 😊. learn.microsoft.com/intune/intun...

Network endpoints for Microsoft Intune - Microsoft Intune

Review endpoints for Intune. This page lists IP addresses and port settings needed for proxy settings in your Intune deployments.

learn.microsoft.com

#Entra will have "soft delete" for _cloud_ security groups. I wonder if this would also restore access to things like Teams private channels and SharePoint. deltapulse.app/message/MC11... I wish I had this feature a couple moons ago...💀

Microsoft Entra: Soft deletion and restoration for cloud security groups

Microsoft Entra introduces soft deletion and restoration for cloud security groups, allowing recovery within 30 days while preserving settings, ownership, and m

deltapulse.app

📰🆕: The #INR script v1.4 to test #Intune and related network services just got its first big update in a bit. Here's what changed in the latest version. - ID-to-Service list is now available. - Test MCC - Test NuGet - ... Go grab the new version here: github.com/MHimken/Intu...

Release Version 1.4 (Community-Is-Key) released · MHimken/IntuneNetworkRequirements

A handful of updates (full changelog here) are finally implemented: ID-to-Service-List list is now available. This will show you which custom ID is related to which service. Test MCC endpoints Tes...

github.com

PSA: If you're running WSUS you will want to look at MC1178653 in your Message Center. The only workaround to CVE-2025-59287 is denying access to the service. If you haven't patched your Server 2025 yet (and as that update apparently was pulled) this is the replacement fix.

Hey #Intune peeps, @skiptotheendpoint.co.uk released a new version of his awesome #OpenIntuneBaseline #OIB today for 25H2! stte.me/oib25h2

Release windows-v3.7 · SkipToTheEndpoint/OpenIntuneBaseline

Windows v3.7 - 2025-10-15 - 25H2 Edition Added 🆕 Settings Catalog 🆕Win - OIB - SC - Device Security - D - Administrator Protection - v3.7 Added configuration to enable the new Administrator Protec...

stte.me

💡New docs on #Intune "remote device actions". Apparently it was updated this month and while it looks much cleaner now, I think its missing crucial information (like what each action actually does?) I liked the old table more 🙈. learn.microsoft.com/intune/intun... web.archive.org/web/20250328...

Remote Device Actions – Wipe, Lock, Locate, and More - Microsoft Intune

Discover how to use Microsoft Intune to remotely manage, wipe, lock, restart, and secure Android, iOS/iPadOS, macOS, Windows, and ChromeOS devices. Learn about available remote actions, prerequisites,...

learn.microsoft.com

Using #WindowsAutopatch in #Intune? You should go here and Migrate to the Win32 App. This will create an application for you "Windows Autopatch Client Broker" that you can use to deploy the AP service instead of the script. intune.microsoft.com#view/Microso... learn.microsoft.com/en-us/window...

TIL: Is it #Office ADMX x86 or x64 right for me? They're identical except for a minor version number string in the Lync16.adml files. Just use whichever download you prefer.

Ok, Citrix really? First of all, Intune has been able to do this for years. So, you've figured that out, and you've even got a working template? Oh, wait a minute - your new ADMX doesn't work too, because you forgot to include EXPLAIN strings in 2 spots. github.com/MHimken/FixM...

Reminder! - "The option to move back to Compatibility mode will remain until September 2025. After this date, the StrongCertificateBindingEnforcement registry key will no longer be supported" - support.microsoft.com/en-us/topic/... #ADCS #InfoSec

🖨️💡Have you switched your #Windows printer drivers to v4 or IPP with PSAs yet? Don't know I'm talking about? It's time to read up on this apparently forgotten topic. Out of the five customers I had today, none of them knew about the change. To busy w/ W11. learn.microsoft.com/en-us/window...

End of Servicing Plan for Third-Party Printer Drivers on Windows - Windows drivers

This article provides information on the end of servicing plan for third-party printer drivers on Windows.

learn.microsoft.com

#INR aka #Intune Network Requirements script just got an update and a new home. Update your bookmarks! Also, new ASAs added: * Microsoft Defender for Endpoint * Visual Studio github.com/MHimken/Intu... #MVPBuzz

GitHub - MHimken/IntuneNetworkRequirements: This tool provides a way to verify Intune network requirements automatically

This tool provides a way to verify Intune network requirements automatically - MHimken/IntuneNetworkRequirements

github.com

#Intune "Windows Quality Update management policies" just dropped on the roadmap. This will allow you to control non-security and OOB updates more granular. www.microsoft.com/en-us/micros...