Tech Community Live: Endpoint Manager edition
Jul 21 2022, 08:00 AM - 12:00 PM (PDT)

End User AutoPilot reset themselves / lack of auditing of such action in DMAC

%3CLINGO-SUB%20id%3D%22lingo-sub-2486216%22%20slang%3D%22en-US%22%3EEnd%20User%20AutoPilot%20reset%20themselves%20%2F%20lack%20of%20auditing%20of%20such%20action%20in%20DMAC%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2486216%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3ETrying%20to%20figure%20out%20if%20an%20end-user%20managed%20to%20do%20this%20to%20themselves%20via%20the%20login%20screen%20or%20if%20some%20tier%201%20screwed%20up.%20I've%20checked%20the%20audit%20within%20DMAC%20(nothing)%20and%20all%20that's%20on%20the%20device%20management%20screen%20is%20that%20the%20reset%20was%20kicked%20off%20at%203%3A25PM%20but%20nothing%20to%20indicate%20who%20(which%20is%20really%20really%20dumb%20IMO).%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22DBR14_0-1624637801961.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F291462iBAC5941B3A4BAFFA%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22DBR14_0-1624637801961.png%22%20alt%3D%22DBR14_0-1624637801961.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2486216%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2489060%22%20slang%3D%22en-US%22%3ERe%3A%20End%20User%20AutoPilot%20reset%20themselves%20%2F%20lack%20of%20auditing%20of%20such%20action%20in%20DMAC%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2489060%22%20slang%3D%22en-US%22%3EYou%20would%20to%20except%20to%20see%20a%20nice%20name%20..%3CBR%20%2F%3E%3CBR%20%2F%3EAlso%20nothing%20in%20the%20device%20actions%20log%3F%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fendpoint.microsoft.com%2F%23blade%2FMicrosoft_Intune_DeviceSettings%2FDevicesMonitorMenu%2FdeviceActions%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fendpoint.microsoft.com%2F%23blade%2FMicrosoft_Intune_DeviceSettings%2FDevicesMonitorMenu%2FdeviceActions%3C%2FA%3E%3C%2FLINGO-BODY%3E
Frequent Contributor

Trying to figure out if an end-user managed to do this to themselves via the login screen or if some tier 1 screwed up. I've checked the audit within DMAC (nothing) and all that's on the device management screen is that the reset was kicked off at 3:25PM but nothing to indicate who (which is really really dumb IMO).

DBR14_0-1624637801961.png

 

 

2 Replies
Rudy,

Good call, I didn't think to look at that spot, assumed since it showed nothing on the main managed area that it would also be reflected as such there. I don't get why that doesn't reflect the same within the manage devices area.

Had what I need, only question now is it was def a tier1 tech that kicked it off, but he swore up and down he didn't.