User Profile
NickNieuwenhuis
Copper Contributor
Joined 5 years ago
User Widgets
Recent Discussions
Re: ASR "Block process creations originating from PSExec and WMI commands" in enterprise context
Hi, You can use this ASR rule only with Intune since it is incompatible with management through Configuration Manager because this rule blocks WMI commands the Configuration Manager client uses to function correctly (see this table for reference: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#asr-rules-supported-configuration-management-systems) Other than that, I would opt to deploy it in audit mode to all admins that need to use it and evaluate the results through the ASR report in M365 Defender (https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-report?view=o365-worldwide). After evaluating (think 7-14 days minimum) you can create exclusions if necessary (though these would affect all ASR rules), deploy it to block mode for all admins, or if you want to be really sure you can deploy it to a couple of admins in the target group to see if nothing happens that was missed during the evaluation period mentioned before. I hope this helps17KViews0likes1CommentRe: Need some resources to help me with very SMB type questions about Conditional Access.
Hi Daelos, It's worth looking into Microsoft Defender for Business, which is basically enterprise-security for SMB (up to 300 seats). Furthermore you can do the following: A: turn off services you don't want your users to use, you can do this from the m365 admin portal. E.g. turn off power automate and only use Teams & Exchange (be aware that Teams uses other services that might need to be enabled for it to function as expected) B: I think you should only look at how the device is managed (unmanaged/managed) and use Intune to create specific protection policies for registered devices C: Auto detect in Azure AD, see below response 😧 You can use (hybrid) azure ad join as a condition to grant access to one or several apps for specific users (might use group-based licensing to seperate business standard and premium users) This might be a useful resource as well: https://www.bing.com/search?q=register+vs+join+azure+ad&cvid=b39ab099ef8e453983c4700a9e78f2d6&aqs=edge.0.0j69i57j0l7j69i11004.2456j0j1&pglt=163&FORM=ANNAB1&PC=U531 Cheers, Nick952Views0likes0Comments
Recent Blog Articles
No content to show