Forum Discussion

Copper Contributor

Jan 17, 2021

ASR in Intune for "Block persistence through WMI event subscription"

Hello all, It seems that to address the "Block persistence through WMI event subscription", there is nothing in the Intune GUI that you can check/enable. You need to use an Administrative templat...

XPaulo

Copper Contributor

Jan 18, 2021

Hello braedachau

Thanks for your reply.

So you're not using an admin template but rather a PS script?

I am not sure I understand if it works in your case or not. Are you managing to see the recommendations go away?

Thanks

Paulo

braedachau

Brass Contributor

Jan 20, 2021

XPaulo

Yes both go away (since there are two associated with WMI)

I will ditch the PowerShell script when its officially supported by Intune

I just checked 3 machines that have a high "uptime" and its not reported in any of them, so resolved.

Regards