Endpoint Privilege Management deep-dive - Intune Academy Office Hours

[00:00:07][music] [music] [music] [music] [music] [music] [music] [music] [music] [music] [music] [music] [music] [music] [music] [music] >> Hi Hardik, good to see you. Much more muted intro that time, wasn't it?

[00:02:10]>> Yeah, it was.

[00:02:12]>> Feels a little bit of a easier intro than the one I usually spend the entire morning producing and then release.

[00:02:20]>> With the grandpa music.

[00:02:23]>> This one was one click. It's one click.

[00:02:25]>> Yeah.

[00:02:26]>> I think we've got a little guy down there. There he is.

[00:02:29]>> There he is.

[00:02:29]>> Um So, welcome everyone. Thank you for joining. This live webinar is all about the Intune Academy. It's one of the office hours that we've uh decided to do. We're going to do two a week actually for the next few weeks.

[00:02:43]And the focus of this one, I think he's right in my way, isn't he? The focus I'm going to go over here.

[00:02:48]The focus of this one is to uh cover a specific bit of Intune, specifically the Intune suite actually.

[00:02:56]Uh it's an advanced feature of Intune called endpoint privilege management.

[00:03:02]And uh it's for no other reason that I think it's pretty cool.

[00:03:07]Uh I like endpoint privilege management.

[00:03:09]I think it's a good idea. We don't have any relation to it within Rubberduck. It's the the Intune Academy is unrelated to Rubberduck other than the fact that part of the team in Rubberduck are uh responsible for kind of building the content. We have other people outside of Rubberduck that are building content for us.

[00:03:28]So, it's not really about Rubberduck at all.

[00:03:31]Um but one of the features we want to focus on today is the endpoint privilege management.

[00:03:37]Tomorrow um just scheduled uh about an hour ago is Windows Autopilot versus Windows Autopilot V2 with the incredible Yuri.

[00:03:47]>> Mhm.

[00:03:48]>> Um so that That be fun as well. But this one, yeah, all about uh EPM.

[00:03:54]We have a few people in chat already. So, we'll just introduce that. My mic is a bit low. Thanks, Dan.

[00:04:01]I can either shout or I can bring it closer. I'm going to need to uh >> Uh sorry, it's not Dan, it's Daz. Sorry, I read that very quickly. Um I actually I cannot pronounce that at all. d a z d c f n z d Uh thank you very much anyway for letting me know.

[00:04:21]Um I'll try and increase it actually. I have a little button.

[00:04:26]I did that. Little button thing. Is that any better, Hadjit? I don't know if I feel louder.

[00:04:32]>> Yeah, I can Wonderful. The button works and I moved it closer and I shouted. So, we're all there.

[00:04:38]Um good. Confirmed on the stream as well. So, yeah, I mean this this is going to be very hopefully very interactive. If you have ever used EPM, please let me know.

[00:04:48]And we're going to talk about it and uh other things. I'll just I'll share my screen in a minute. We haven't got much uh Dazed and Confused.

[00:04:57]Very clever.

[00:04:59]Very clever.

[00:05:00]Um I understand it now.

[00:05:02]>> with maybe explaining what EPM is uh for those that may or may not >> good idea. Yeah. Yeah. Yeah, it's a great idea.

[00:05:11]Um would you like to do it or shall I?

[00:05:14]>> Yeah, you know, it's basically it's a uh EPM Microsoft Endpoint Privilege Management. It's uh has been part of the Intune suite uh enable enables organizations to remove local admin uh rights, right? That's the whole uh goal of it uh while allowing users to perform an elevated like approved elevated uh processes. Uh that's the gist of it, I think.

[00:05:41]>> [snorts] >> That [clears throat] is it. Yeah. There are third-party alternatives and until EPM came about, I was using one of those third-party alternatives. For some customers I still am because Intune Suite until now has been pretty expensive.

[00:06:00]And still is actually time of time of recording this. It is still expensive.

[00:06:04]It's an extra few maybe $10 per month depending on your on the skew that you manage to get from Microsoft.

[00:06:12]>> Yeah.

[00:06:13]And and then and also EPM supports, you know, the zero zero trust approach, right? By you know, using the principle of least privileges and stuff like that.

[00:06:24]You know, I think some people like, you know, for us that we've been in the sysadmin world for a long time, you know, it's it's the equivalent of just-in-time admin, right? With PowerShell and things like that back in the several years.

[00:06:40]>> Yeah, but as I say, I I still use an alternative for some of my customers because it's expensive and if you only want EPM, Intune Suite may not be worth it. There might not be enough value in that, but it really it depends on you and your customer and your your decision on that. Um soon that will all change. I'm not sure if sure if you've you've kept up-to-date, Harjit, but Intune Suite all the features of Intune Suite the advanced features of Intune Suite are going to be moved into Enterprise E3 and also Enterprise E5.

[00:07:14]They're going to split. It's going to be four in one and and four in the other or five in the other.

[00:07:19]>> Yeah.

[00:07:19]>> And EPM lands into E5. So, if you have E5, then you [clears throat] get EPM.

[00:07:28]Is that right? I hope that's right.

[00:07:30]>> Yes, you're right. You're right.

[00:07:32]>> I may be not be right.

[00:07:34]>> No, EPM is in E5. It's not in E3. Remote remote uh remote help and it's in E3 and then yeah.

[00:07:44]>> I did a I did a a live stream on this yes not a live stream a a recording on this yesterday. You would think I actually would remember just yesterday.

[00:07:54]Um what is in That's it. You get um tunnel for mem you get remote help and you get advanced analytics in E3. And then really fun stuff is all in E5 for obvious reasons.

[00:08:14]Um Anyway, so I did it yesterday.

[00:08:16]>> Cloud PKI and all of that is in E5 I believe. Yeah.

[00:08:20]>> Yeah.

[00:08:20]>> Yeah.

[00:08:21]>> So like like I said, I did a quick video yesterday on setting up EPM mainly because I was preparing for this and I thought it would be a good idea to at least check whether it works and I'm happy to say that I've learned a lot.

[00:08:36]Um I don't think it works for Windows 365 business.

[00:08:40]Um because I couldn't get it to work. It definitely doesn't work if you uh take a machine that is not enrolled and enroll it only in device management rather than doing the full Intune enrollment. Uh that also doesn't work.

[00:08:55]If you use a DEP account, that doesn't work. Uh it really needs this um it needs a normal Intune enrollment through the traditional sense. Because it does uh as I found out from reading Rudy's blog that it does a a second enrollment a linked enrollment using MMPPC which we'll go into in a little while.

[00:09:15]But that only works in specific enrollment types and so that's why >> co-management?

[00:09:24]>> I didn't look at that. Um why not?

[00:09:27]Yeah.

[00:09:27]>> It should, right?

[00:09:28]>> Um yeah, I guess so.

[00:09:30]>> Yeah.

[00:09:30]>> Uh maybe not actually thinking about it.

[00:09:34]I don't know. That's a good one. I'm not going to test it now before we go live on this because we're already we're >> already 4 or 5 minutes in and it would be a good idea to get started with it. Um in the chat though, if you can let me know if you've had a go at using EPM or if you've tried it and hated it and tried it or or loved it, that would be great to know.

[00:09:53]Um we do have uh some help in the chat for us as well, so that's wonderful.

[00:10:00]And we'll dump jump, not dump, we'll jump straight in now.

[00:10:05]Um let me share my screen and find the stuff that I want to talk about.

[00:10:12]Mm oh, it's this one. I've got the button already done. There he is.

[00:10:16]Um >> There we go.

[00:10:18]>> We have a couple of things already set up, so I decided to get this in place a little bit early uh before the stream went live because I wanted to check that it actually worked and on what at least one machine it did work.

[00:10:31]Uh so that's good. We have something to show. But we start in endpoint privilege management. And within EPM, I created this policy called E enable EPM because that's pretty much all you can do with the this elevation settings policy. So I did that and I'll go into it now. And one of the reasons I did it early is because it takes a little while, one error.

[00:10:53]Honestly, you can't go anywhere, can you, without getting errors in Intune.

[00:10:56]This is a brand new demo environment, two devices, and I got 50/50.

[00:11:02]Um one of the reasons I did this early was because it it needs to do some setup on the endpoint. So it's not just that you create the policy in Intune and then it just works on endpoint. It needs to push a thing to the endpoint. I'm going to show you that in a few moments. Let's see how far this has failed though. Let's let click report and see it generate this report for me. Uh system account for Megan B.

[00:11:27]I think this was the Windows 365 cloud PC, the business Cloud PC I was trying, which is why this has failed.

[00:11:36]And this was the You can see the time on that. This was the "Oh god, I I need to get this working now" kind of enrollment that I just did just before we went live.

[00:11:49]So, that's now applied there, which is good. So, we've enabled EPM.

[00:11:52]I can show you that machine actually.

[00:11:54]Uh if I just head to I've got so many windows cuz it was a little bit frantic right at the end there.

[00:12:01]Uh here we have a a folder called Microsoft EPM agent which gets downloaded to the computer when you enable it.

[00:12:08]And it has some stuff in it. So, all of this is like an agent that happens on the computer.

[00:12:13]>> Mhm.

[00:12:13]>> I'm going to head back to the policy itself and show you what it looks like when we configure it.

[00:12:18]And I'll just scroll down to the configuration settings.

[00:12:22]And here we go.

[00:12:28]So, for the past 4 hours I haven't stopped for a drink or anything cuz I've been trying to get this ready to go. Um EPM is enabled. We are default denying all requests for the elevation response, and we are sending elevation data for reporting.

[00:12:43]Uh yes, as opposed to no. And then we're also sending all endpoint elevations rather than just managed ones just to get as much data as possible into the report.

[00:12:52]>> Right.

[00:12:53]>> So, that's done, and that's applied at least on one machine now. So, then we can we can start using it.

[00:12:58]Uh I do want to just call out though that because of my frantic configuration of this, this user actually already is admin.

[00:13:08]So, I just need to let me move this around a bit so we can see it a bit better.

[00:13:16]There we go.

[00:13:17]Uh so, this user already is admin. So, if I was to take this user, so Megan, and just run as admin, actually they already are admin, yes.

[00:13:26]>> Yeah.

[00:13:26]>> Um but we're not going to be using that run as administrator thing during this demonstration. And maybe if we have time, we can remove admin from this user and then retry it.

[00:13:38]But what we're going to be doing instead is using the elevation settings. Uh, let me just find uh app.

[00:13:50]I didn't think I'd installed Notepad++.

[00:13:52]So, that's >> [laughter] >> interesting.

[00:13:54]Uh, okay. [snorts] Let's find an application.

[00:13:57]I was I I built a cloud PC originally because it was I had a trial available. So, I thought I'd use a cloud PC for this. And right at the last second I had to fall back to this on-premises VM.

[00:14:09]>> VM, yeah.

[00:14:10]>> Which is why it's uh which is why it's a little bit sluggish.

[00:14:16]Um, I also don't have any apps installed, which is probably not great.

[00:14:20]Let me find Where's Notepad? It's in system, isn't it?

[00:14:25]Windows Why can't I find Notepad? Anyone know where Notepad is?

[00:14:32]There he is. See Windows.

[00:14:34]>> See Windows, yeah.

[00:14:36]>> So, right now we have run with elevated access and the default policy says deny all. So, when I run with elevated access, I hope it will deny it.

[00:14:51]I hope it will deny it.

[00:14:53]>> Come on.

[00:14:54]>> Everything's so slow when it There you go.

[00:14:57]>> There you go.

[00:14:57]>> Your organization doesn't allow you to run this app as administrator.

[00:15:01]Uh, good. So, that's what we're going to be doing. We're going to be changing that so it actually lets me run it as administrator. And just to um make it easier to get to in the future, I want to put it on the desktop.

[00:15:16]Send to desktop.

[00:15:20]>> There you go.

[00:15:20]>> Yeah. So, we'll be using that in the future. [clears throat] I could have used Edge. I was just thinking about it, but Notepad is easier.

[00:15:29]>> So back to Intune?

[00:15:31]>> Back to Intune.

[00:15:33]Um Yeah.

[00:15:36]Let's go back to Intune. That's the wrong Intune.

[00:15:42]Come on, Intune.

[00:15:45]There he is.

[00:15:46]>> Look at these just all your windows.

[00:15:48]>> I [laughter] have I've got a few windows open right now.

[00:15:51]All right, so let's go to endpoint security and down to EPM.

[00:15:57]And we will go for create and we'll do a rules policy. Now, I went through this yesterday and I kind of had to gloss over a few things. I didn't have a Windows PC available to me, but I do have one now. [clears throat] I did actually have two, but I destroyed one while I was trying to get it working. Um We'll jump in and do this now. So, this is going to be elevate Notepad++.

[00:16:24]Elevate Notepad ++.

[00:16:31]And then we get this default rule which isn't configured and just you can't really do anything with it without um choosing edit instance and then you give it a name. So, we'll call this note Did I type ++?

[00:16:44]>> Yeah, it should be just Notepad.

[00:16:46]>> You should call me out when I make stupid mistakes. That's why you're here.

[00:16:50]Literally why you're here.

[00:16:51]>> Cuz I I had a feeling.

[00:16:52]>> [laughter] >> I did Notepad++ yesterday.

[00:16:56]So, this is going to be Notepad.

[00:16:58]Um and then we get these options. So, the question really is how do you want this approval to go? Cuz when I chose run with elevated access, there were a few options. One was deny, right? Which was it just denied it.

[00:17:12]The other option is that we get the user to confirm why they want to run it as admin and then it just runs as admin.

[00:17:18]That's the user confirmed with validation, so you can offer to ask them to provide business justification, and also Windows note Windows authentication. So, then we can see that they definitely are the right person.

[00:17:33]Uh and if we do that, then that's what happened. The user is prompted for that, and then they get access to it.

[00:17:39]The alternative in the elevation type is automatic, so then it would just automatically approve it, which would or deny, which is the default, so we don't need to create an explicit rule for that. We have support approved, which [clears throat] I will probably struggle to demonstrate now because uh I think we're going to run out of time before we get to that one.

[00:17:58]>> like support tickets, right? It creates a support ticket or something like that, right?

[00:18:02]Yeah.

[00:18:04]>> Yes, so rather than just kind of elevating it, it will it will create an action for the >> Yeah, it's an >> engine to approve that.

[00:18:12]Um and then the other one is elevated current user, which is very new. It wasn't in any in any of the documentation that I saw until recently, and it is a way of um keeping the same identity, the same actual user, and just give them permission to run this as admin, which is different to how all the other ones work because the other ones um create a new virtual user with the admin, and then use that account.

[00:18:39]>> Right.

[00:18:39]>> And I guess this one's been created because if you have if if you have specific things that that user has access to, then there might be some reason that you need to elevate as that user rather than just elevate as a user.

[00:18:54]Um good. So, let's do user confirmed first.

[00:18:59]We'll do business justification. Now, child process behavior, this is important to think about because if I was to run notepad, or let's say more obvious, if I was to run uh terminal command prompt if this app spawns a child process, should it also be admin or should it not?

[00:19:22]And we can either require rule, we can allow all trial processes to be elevated, or we can deny all, or we can leave the default. I don't know what the default does, >> [clears throat] >> but we can leave it as that.

[00:19:32]>> [snorts] >> Um I think require rule is probably the most obviously secure.

[00:19:38]Well, the >> I think you're right. This is really important, especially when it comes to developer tools, right? They always have trial things that processes and uh for for the tools that they use.

[00:19:51]>> Yeah.

[00:19:52]Uh I'm just while while for a moment, I just want to check something cuz I recently was told that we can reply to people on LinkedIn.

[00:20:03]And I didn't test it yet. I want to test that.

[00:20:08]And I'm just replying to Steven.

[00:20:11]Um hopefully >> [clears throat] >> you get that. If you do get that, please please say hi back just because that will clear some things up for me.

[00:20:20]Um In the meantime, we can choose the file name. Now, that notice this isn't required.

[00:20:27]The only thing that is required at the moment is certificate and certificate type. We can also change that to uh where is it?

[00:20:41]File hash. Um and file hash is easier but not easier. It's different uh to to using a cert.

[00:20:51]But, it also is um less persistent. So, if there's ever a change to that file, then the file hash will change, and so the file hash won't be relevant anymore.

[00:21:04]Um we'll do file hash, and I've just realized that I'm running this on a Mac and I won't be able to grab the file hash from my Mac. So, I'm going to get it from the VM and hope that I can somehow go back somehow get it across into Intune. Let's do that. That'll be fun, won't it?

[00:21:23]>> Oh boy, from a VM? Oh, no.

[00:21:27]>> It's fine. It's fine. It's fine. We'll do it.

[00:21:30]Um So, here's the rule and I'm going to just fail at doing this um very quickly.

[00:21:42]I don't think it lets me put anything in here. Needs to be 64 characters long.

[00:21:46]Uh let's I bought that.

[00:21:50]>> [laughter] >> I didn't get a reply on LinkedIn, which is sad.

[00:21:54]Um We're going to bowl all that. We're going [clears throat] to do this from this handy VM here.

[00:22:03]Won't that be fun? Doing Intune from a tiny little screen like this. And this is why I spun up that Windows 365 VM.

[00:22:13]>> Yeah.

[00:22:13]>> But, you know, it wasn't to be.

[00:22:16]Uh because stuff is never meant to work.

[00:22:21]Is it? That's uh it's just never going to work.

[00:22:27]Any uh I don't know if are you a movie fan, Hodget?

[00:22:31]>> Movie fan, yeah. Some of it, yeah.

[00:22:33]>> You heard of any idea where Cyberdyne came from?

[00:22:37]>> No.

[00:22:38]>> Anyone in the chat want to want to um Ah, there you go. So, yeah, I I sent a a hello LinkedIn message to all. That was what That's all I can do. I can only send to all.

[00:22:50]Um so, thanks, Stephen, for confirming.

[00:22:52]But, until today, we weren't able to reply to anyone on LinkedIn.

[00:22:56]Um doing any posting to LinkedIn at all. Uh anyone in the chat fancy if they if you have any movie knowledge at all, any recollection of what Cyber Cyberdyne is from.

[00:23:08]I needed to think of a name for an MSP.

[00:23:11]Um there you go. Terminator. Yeah.

[00:23:15]Yeah, that's the it's it's the organization in Terminator that I think, you know, AI and Anthropic and um uh OpenAI will eventually become.

[00:23:25]>> [sighs and gasps] [laughter] >> Okay.

[00:23:30]We are in a Windows machine with access to Intune. Look at that. We're making progress.

[00:23:36]>> You're making progress.

[00:23:37]Yeah.

[00:23:37]>> We are in endpoint security. So, all I do is go back to EPM.

[00:23:46]And you know, one of the um other reasons for doing these live streams is to is to really focus on some of the features that we're covering in the academy courses. This is the more of the advanced course that we're we're going through. Um the topics in the advanced course are including these things.

[00:24:06]And >> You're going to break >> them in much more depth and the demos actually work because you're not trying to do them live while also talking to Haja and an audience. Uh but they um yeah, this is what am I doing? Notepad.

[00:24:22]>> Yeah, notepad. Yeah.

[00:24:25]There we go.

[00:24:25]>> All right. So, we're back here.

[00:24:29]And we're going to call it notepad.

[00:24:31]And go for business justification and we'll do not configurable, do file hash for now and then I remember this from a little while ago when I did it.

[00:24:47]Uh I think it's C.

[00:24:50]Is it >> Yeah, it was C Windows.

[00:24:53]Yeah.

[00:24:54]>> Well, you know, you know, I thought it was.

[00:24:57]But my tab isn't completing.

[00:25:00]There it is. Okay.

[00:25:01]>> There it is. Yeah.

[00:25:03]>> That's the button you use when you are using a Windows machine. That is what the button you use when you're using a Mac. Bear with me a second while I scroll.

[00:25:12]Uh so, I'm also just going to do get {dash} file hash.

[00:25:19]And there's the hash. And this is I think just can just copy this. It's 64 characters.

[00:25:27]>> you just right click here.

[00:25:30]>> And that's that. Okay.

[00:25:32]>> Beautiful.

[00:25:33]>> So, that's the most basic rule you can use. Let me also just put the file name in here cuz when you're not using search, you do need to use the the file name.

[00:25:41]>> notepad.exe >>.exe, thank you.

[00:25:46]And you can specify a restricted file path as well under here. So, if you want to make sure that they're just running any file with that file hash somewhere else in the operating system, then you can also restrict the file path.

[00:26:00]Uh okay. So, that's pretty much that configured. And we'll do save. And that's the rule. And then we all we do is assign that to all devices or the specific users if you want. And create.

[00:26:13]And go.

[00:26:14]Um Umbrella Corporation, fantastic. Good idea. We should use Umbrella Corporation for the next one. Now, would Umbrella Corporation cuz the idea is that we're creating the MSP model for the um for the demonstrations we're using to figure out how an MSP would manage their customers.

[00:26:31]And Cyberdyne felt right. But I think Umbrella I guess they're kind of >> It does sound right. Cuz it's like a you know >> As a customer of Cyberdyne, do you think Umbrella would be a customer of Cyberdyne? Do you think that could ever happen?

[00:26:49]>> It could.

[00:26:51]>> [laughter] >> Mm. Okay.

[00:26:55]Uh right. So, I'm waiting for this policy to apply now. I'm going to head over to the machine, which ah, I'm on it. Fantastic news. I just need to um [laughter] go to accounts. I'm just going to sync this machine locally.

[00:27:13]Mhm.

[00:27:16]Anyone in the chat happen to have had the pleasure of attending Experts Live UK recently? Cuz we had the live In-Tune Academy. Um Love watching the chat. Everybody will be a customer of Cyber Drain.

[00:27:32]Very good.

[00:27:33]Um >> Could be a merger.

[00:27:35]>> [laughter] >> Could be a Imagine a merger between those two.

[00:27:40]Um okay. So, yeah, we had the Experts Live UK conference last week, and I'm still kind of tired from it cuz it was a lot of work, but it was great. Um And we had the In-Tune Academy workshop, a whole day workshop covering everything around In-Tune. And again, nothing to do with Roubaix Pack. Roubaix Pack did sponsor it and and provide the you know, essentially the day went ahead, but >> [clears throat] >> really it was the team, Lewis, James, Steve, and Andrew who really made that happen. So, thank you to them >> Yeah.

[00:28:12]>> for creating the content and for running the entire show while I was in and out, running around, trying to um trying to get the the day moving along as well.

[00:28:23]Uh but the point was that it just could covered all of In-Tune, all the different bits of In-Tune that you can possibly cover, and anyone could shout out and say, "Hey, can we talk about this?" It was pretty good.

[00:28:36]This is syncing now. So, what we see is that the enforcement for In-Tune management extension completed.

[00:28:46]This was needed in order to deploy the EPM agent, so that was already done in the past. We have security and device health monitoring. They haven't changed.

[00:28:55]So, nothing here shows us that there's any rules been applied. I'm going to give this a few more seconds and then I will choose Notepad and see if it runs.

[00:29:05]Um Let's have a look at the chat. The broken Neo. Oh god, I need to ship that Neo. Yes. Um we we we gave away a a MacBook Neo and it broke. I mean, it I don't think it was my fault. It wasn't even my tenant. I blame Andrew Taylor. I might just bill it to his uh to his department in Rubble Pack.

[00:29:28]We um yeah, [snorts] we broke it and uh someone won it, which was sad. So, we're going to have to get a new one and ship that to them, which would be good.

[00:29:40]>> I thought it was being I thought you were fixing it while we were uh drinking that beer.

[00:29:46]>> It didn't work. It didn't fix.

[00:29:47]>> Ah, okay.

[00:29:49]>> Um So, yeah, I need to return it and Pete, no, I didn't um I didn't return it yet. I pretty much haven't left the house since I got back because I drove all the way from London back to Hexham and then unloaded the van into my office and it's just here.

[00:30:06]I can see it all still. I haven't had a chance to go through the 13 TVs and and 15 booths.

[00:30:14]Um So, soon when the team get here cuz the rest of the team are coming up to help.

[00:30:21]Um Anyway, no, I haven't returned it yet, but thank you for the reminder. I will definitely do that.

[00:30:28]Uh okay.

[00:30:30]We are probably ready to give this a go and run elevated and see what it does. And I genuinely don't remember how fast this is meant to be at uh applying policies and that kind of thing. So, I'm just going to right click on it and uh, run with elevated access and it either denies or it asks for, yeah, it denies.

[00:30:54]Um, >> Yeah, I saw that earlier.

[00:30:56]>> Question in the chat while we wait.

[00:30:58]Practical, let me put this on the screen so I can see it.

[00:31:02]Practical wise, don't apps like Notepad update regularly?

[00:31:05]So, it's best just for apps that don't automatically update for the hash. Yes, you're right, definitely.

[00:31:12]Uh, using the hash isn't going to last very long.

[00:31:17]Um, the hash will change very often. So, don't use the hash unless you uh, expect to update the hash frequently.

[00:31:26]>> Yeah.

[00:31:27]>> Um, the alternative, which I should go through now while we wait because waiting is fun, would be to use the certificate. Um, so, let's go through how do you edit a policy?

[00:31:44]>> You went over that before. You went over that earlier.

[00:31:46]>> yeah, sorry. Yeah.

[00:31:48]Would be to use the certificate.

[00:31:51]And that you configure by changing the certificate source or signature source to, uh, certificate that you've put in reusable settings, which means you can reuse it between Defender app control and also uh, other bit, uh, firewall and that kind of thing. So, there's loads of different places where you can reuse these reusable settings. Um, you can use one of those or you can upload a certificate file here. Now, we'll go into that. I want to keep this policy as it is for now while we're just waiting for this to actually apply, otherwise we could be um, here a while.

[00:32:28]We got some message. Let me see what this is saying.

[00:32:32]The PowerShell module to get the file info for EPM. Yes. So, when you look through the docs Uh let me take this one off the screen.

[00:32:42]When you look through the docs of EPM, there's a lot more information than there used to be. And now there's a a new um PowerShell tool that allows you to get the file attributes and and do that kind of thing. And we will go through that if we have time in a few moments once this actually works. But let's In fact, while we're waiting, let's grab that cuz we have nothing else to do.

[00:33:08]Uh >> [sighs] >> Raj, you just um entertain the crowd while we uh while I do some typing.

[00:33:15]>> [laughter] >> You know at this point Steve Winer would would absolutely relish that op- opportunity.

[00:33:23]>> He loves it. Yeah.

[00:33:24]>> to um >> He's talking about his Dunkin' Donuts.

[00:33:27]>> Anything.

[00:33:29]>> We were with him in London. It was hilarious. Oh my god.

[00:33:33]>> He >> I see Vince now in the crowd.

[00:33:36]>> [gasps] >> Yeah, you do? Oh, yeah. Of course, right at the top. Yeah.

[00:33:41]Uh EPM >> [clears throat] >> EPM Come on.

[00:33:47]That's not there.

[00:33:49]>> So, how many people are confused about EPM versus Windows LAPS?

[00:33:55]>> [clears throat] >> Oh.

[00:33:57]>> That's another >> Go on. Explain to me what Windows LAPS is.

[00:34:03]>> What is that?

[00:34:05]>> Explain to me what Windows LAPS is.

[00:34:07]>> Well, Windows LAPS is uh it uh it provides admin access to the machine.

[00:34:16]Uh but it resets the the uh the the passwords periodically. So, when you use one, it changes it on the fly. So, the built-in admin admin accounts Yeah, they are completely different, yes, absolutely.

[00:34:37]>> All right, that worked. Need to run as admin in order to get to it.

[00:34:41]And then get No, that's not >> Where you at?

[00:34:47]>> module first, right? Then get dash file attributes.

[00:34:55]Not by plane, file path.

[00:34:58]And then See if it works from being right here.

[00:35:11]Ooh, it does a lot of stuff.

[00:35:13]>> Yep.

[00:35:17]>> That's cool.

[00:35:18]Um Okay.

[00:35:23]One search chain found, which is good.

[00:35:25]And it has exported it to this location here.

[00:35:33]Certificate chain Microsoft Windows PCA.

[00:35:37]Good.

[00:35:38]Uh Exported to here. That's Is that I don't even know where that is.

[00:35:45]Uh Yuri's in the chat.

[00:35:47]>> Oh, yeah.

[00:35:48]>> Wonderful.

[00:35:51]>> [clears throat] >> Wonderful. Um Jigsaw, interested in seeing the virtual users within MDE.

[00:36:00]Uh I don't know if you can see them, but that's an interesting point.

[00:36:05]I don't know if you can see them at all.

[00:36:07]Where did it say it put it? See Windows 32. I don't think it would have put it there, but it guess it could.

[00:36:14]System 32 Uh I I I mean it can't, can't it?

[00:36:29]Oh, yes.

[00:36:31]That's interesting. It's created a thing there.

[00:36:35]Uh, so, it has put the root there as well. So, we've got these.

[00:36:43]Now, that's cool.

[00:36:50]Right, so, I don't know which one we should use, to be honest. We have the publisher cert is [clears throat] cert index. Is that right?

[00:37:04]>> Yeah.

[00:37:07]Export it to >> PCA 2011 and the root CA. So, I don't think we want the root CA.

[00:37:14]Probably Windows cert.

[00:37:18]Um, we'll try that.

[00:37:21]I guess any cert would work cuz it's not it's not going to actually >> Trial and error, yeah.

[00:37:25]>> get to the point where we can test it because it takes far too long for stuff to actually roll through onto Windows devices these days. So, yeah, we'll just scroll down and go to signature source upload and put in the file from >> system 32.

[00:37:49]>> Notepad, and then we'll do this one here.

[00:37:53]See if that works.

[00:37:55]That so far has worked, and it is uh, >> Is it a CA or a publisher?

[00:38:05]>> Don't know.

[00:38:06]Any idea?

[00:38:08]In chat?

[00:38:09]>> Does it say the uh, >> We could open it, I guess.

[00:38:14]>> Doesn't it show in the gray box that's in there?

[00:38:17]>> Well, that's the Microsoft Windows production PCA >> Sounds like a CA.

[00:38:30]>> It does, but it also seems like a P.

[00:38:33]Anyone any idea? I would find out if this is a publisher cert or a CA cert.

[00:38:50]No one in the chat.

[00:38:51]>> No one yet.

[00:38:53]>> [clears throat] >> I like the fact that it's delayed.

[00:38:55]>> Publisher would make sense.

[00:38:56]>> I mean, it doesn't I don't think it'll be a CA cuz we have the root CA there. Um Okay, we'll go with publisher.

[00:39:04]And I'll take that out the file hash in case I got it wrong, and then we'll do save and save. And save. Okay, good.

[00:39:14]So, in the meantime, this is probably >> Uh >> been syncing, and maybe I can run this app as elevated now.

[00:39:29]>> Try it.

[00:39:32]>> Yay.

[00:39:33]Enterprise certification because it's um >> You did ask for that, right?

[00:39:38]>> Uh yeah.

[00:39:38]>> Wasn't >> Yeah, so this was the original policy that I had, so you would Please.

[00:39:45]Please.

[00:39:46]I can't type.

[00:39:48]Please.

[00:39:49]>> [laughter] >> The keyboard's delayed on this, all right? It's I'm not an idiot. Well, I am an idiot, but also the keyboard is delayed.

[00:39:56]>> Continue.

[00:39:57]>> Continue. And that will allow you to run it as admin, and we can check if it's admin you know, by going into various places, but one of the other ways we can check is to go into uh some restricted place like that, for example. Uh no, not that. Um where was I?

[00:40:16]Uh >> What are you trying to do?

[00:40:19]>> I was I was Yeah, it's running as admin.

[00:40:22]It's fine.

[00:40:23]Um Good. So, that worked. And that was because it was the uh the previous policy which used the file hash.

[00:40:35]>> Yeah, so business justification, you know, whatever you put in there, it it it gives you access pretty much right away. Um So, it doesn't it doesn't send to an admin or or back end to say you know, is there something we can see in the back here? Yeah.

[00:40:53]>> Yeah, it d- it doesn't send it to an admin. It will the whole point of the policy, if you recall, >> Is audited.

[00:41:03]>> the elevation type was user confirmed. So, we just need the user to confirm that they want to do it.

[00:41:08]>> Right.

[00:41:08]>> And they don't even need to run uh to put in a business justification, I don't think.

[00:41:14]Uh it's just there for auditing because at the end of this, we can run a report and see who's been elevating stuff.

[00:41:22]Um Now, the other way you can get this information is to actually run the elevation report. I don't think it will work work quickly enough for me to show it on this live, you know, reporting is deliberately delayed.

[00:41:35]Um But, that's the way you normally get that information about the file hash and the certificates because it will be reported in the elevation report whether it was denied or approved. And so, you can essentially gather all the information as to who wants to run things because the elevation requests are denied.

[00:41:54]Um the other way you can do it is to default allow elevation requests with user confirmed um justification and gather the auditing logs that way.

[00:42:06]>> Yeah.

[00:42:06]>> And then use that as a to plan your deployment of EPM in the future.

[00:42:12]>> Mhm. Um So, you said it's shown in the command in the module.

[00:42:22]Okay.

[00:42:23]Um Well, luckily, as you can clearly see, I haven't done a lot of research into EPM since the first time I looked at it probably 6 months ago.

[00:42:35]Uh and I haven't started recording that element of the course yet. So, when it comes to that element of the course, it will have all of the detail that we need.

[00:42:44]Uh yeah.

[00:42:45]But, for now, that's pretty much how you configure EPM.

[00:42:49]Uh some people have told me that it's got some limitations and isn't quite as friendly to use as uh some of the alternatives.

[00:43:01]I could name alternatives, but I'm not going to They're not sponsoring this. But, neither is Microsoft, actually. But, yeah. This is This is focused on EPM.

[00:43:09]Um They're all alternatives allowing you to um elevate to admin context on a request basis. You could almost call it admin by request, couldn't you?

[00:43:23]Um but, I'm not going to name any of those products.

[00:43:27]No. No, several are there, yeah.

[00:43:29]Yeah. Um Okay. So, the next thing we're going to be covering I In fact, I'll I'll kind of pause for any questions and while I wait for questions and wait for stuff to come along in the chat.

[00:43:43]The other thing we're going to be covering next is uh Windows Autopilot versus Windows Autopilot Device Prep.

[00:43:52]Mhm. And hopefully, we'll be able to do a demo of that. You'll be pleased to know that it's not me running the demo.

[00:43:59]Um it is the incredible Yuri. So, Yuri, um I'll just put you on the chat there just so people can see your happy smiley face.

[00:44:09]Um it's uh it's your job tomorrow to do the demo.

[00:44:15]So, this should be fun.

[00:44:17]Um >> Is he doing a demo of both, right?

[00:44:21]Uh >> Sorry, say again?

[00:44:23]>> The V1 V1 and V2.

[00:44:26]>> Which Don't call it V2 and V1. That's not the name.

[00:44:29]>> I know. I loved I love to do that.

[00:44:31]>> [laughter] >> Uh Yeah, it's V1 versus V2.

[00:44:36]>> Yeah.

[00:44:37]>> Yeah.

[00:44:39]W- W- I'm not going to I'm going to leave the commentary until um >> tomorrow.

[00:44:45]>> Until tomorrow because there's a there's a there's a whole hour where we can talk about the pros and cons of each. Um >> S- So, >> come back to your question, Chris, in a second, but the Pete has spoken and um it seems mighty complicated in comparison to the alternatives. This is true. The alternatives uh seem pretty simple. They need an agent, but then so does this.

[00:45:13]>> Yeah.

[00:45:14]>> I think one of the huge reasons to use this would be that it is included in your license and therefore you should probably make use of it if you can.

[00:45:24]>> Right.

[00:45:24]>> Anything that allows us to get rid of local admins is a good thing.

[00:45:28]Uh LAPS obviously helps, but is a bit of a sledgehammer approach. This is much more fine- grained and potentially uh more useful if you can get it working.

[00:45:40]But, yes, I appreciate Um Yuri, I'm terrified because you said I'm not. I hope that doesn't mean that you're not doing a demo because then it's on me and then I have to do a I'll be up all night creating a demo for APDP.

[00:45:53]>> So, I think he meant he's not doing both.

[00:45:57]>> He's not what?

[00:45:58]>> He's not doing both of them.

[00:46:00]The uh >> I I hope he's playing cuz I really would like you to do the demo.

[00:46:05]Um and then we have a question from uh Chris.

[00:46:11]Did you encounter the error code when applying the policy?

[00:46:16]Um I got some error code.

[00:46:20]I don't remember exactly which. We can look actually cuz it's in I reset the PC. Let's go back and take a look at the policy that I did.

[00:46:34]Cuz it might show the error code.

[00:46:38]It is in report.

[00:46:45]>> Oh yeah, there it is.

[00:46:47]>> No, no, that one.

[00:46:48]>> No, error code.

[00:46:50]>> That's fine.

[00:46:51]Uh no, I didn't. Let me check here.

[00:46:57]Um here we are.

[00:46:58]>> Uh he's asking for a specific uh 214.

[00:47:01]>> Yeah.

[00:47:02]Um Let me find the error code cuz I put it in my notes.

[00:47:08]Um No, I got Let me put it in the chat.

[00:47:14]In the chat. Do I have chat? I have chat. I got this specific error code. Uh failed to enroll MMPC for dual enrollment mode. And that was because I was using Windows 365 Business and also because I was using enroll in device management only. And so I got that.

[00:47:31]Uh we are running E5 and we'll do a complete review of all the additional services if we should use them. And that's probably the best approach, you know.

[00:47:39]>> Yeah.

[00:47:39]>> Test it out. See if it's what you need.

[00:47:43]I [snorts] as I say, I I didn't buy Intune Suite for some of my customers because it's it was an additional cost and for the additional cost stuff you have to justify it. And it might be the easy path to use this because it's included in your license.

[00:48:00]>> Yeah, up to until July 1, it's what, $10 per user per month. So, it's pretty expensive, I think.

[00:48:07]>> Yeah.

[00:48:08]Yeah. And so, on July 1st, it will the pricing will change so that it's then included for anyone who buys an E3 or an E5 license. If it's E5, they will get EPM.

[00:48:21]But, the features won't actually roll out to the tenants necessarily until the end of the month. So, the timeline is um it's not unknown. It is known that it will take around a month for the engineering teams to roll it out across the entire world, across all tenants.

[00:48:38]Um So, yeah, that's happening. And in chat, we have a couple more things. So, Dazed and Confused, mighty complicated indeed. This project could take weeks to properly configure. It could. And maybe if you got reusable settings configured, maybe that would be better. If you're already using WDAC, then maybe you can reuse those certs. Uh if you've got those certs already in place, um then maybe it would be easier to configure. And maybe if you use the default allow, then it will be easier to configure. There's many ways to make it less complicated than doing it properly.

[00:49:13]Um And then also from the Pete, we have Cloud PKI. Yeah.

[00:49:20]We're we're going to do Cloud PKI um next week. So, I mentioned we're doing two live streams per week. This week is EPM and Autopilot V2 versus V1.

[00:49:32]I didn't mean to call it that. APDP versus Autopilot.

[00:49:36]Um And then next week, we are sneaking Cloud PKI in there. So, that's going to be a full rundown of why you should consider Cloud PKI.

[00:49:46]And I guess one of the reasons that we're including this is because it's now included in this week in in the in the core engine product which most customers will have.

[00:49:56]And that's better than having to buy it as an Intune suite. So, it's more involved in the course that we're creating.

[00:50:05]>> Yeah.

[00:50:05]>> So, yeah.

[00:50:06]Uh good point. Yeah, thank you for doing that. I haven't scheduled the live stream yet. So, do wait until that actually um appears.

[00:50:16]Logistics question. Thank you. Is it always Tuesdays and Wednesdays on the live streams? It is this week. Um >> It's usually Wednesdays.

[00:50:25]>> But pretty pretty much. Uh yeah, this week and next week is definitely that. Uh and in fact the week after, yeah, the 30th of June is also a a Tuesday live stream.

[00:50:35]>> Mhm.

[00:50:36]>> And if we can get the co-host alongside me and Harjit, then we will have a one on Wednesday, the uh 1st of July as well.

[00:50:47]>> Hey, Canada Day.

[00:50:50]>> Sorry?

[00:50:50]>> Canada Day.

[00:50:52]>> Is that Canada Day?

[00:50:53]>> Yeah, July 1st.

[00:50:55]>> Uh I mean I I love the idea of Canada with its in I'm ready to selfishly take an entire day.

[00:51:02]>> [laughter] >> The UK have never taken an entire day, I don't think.

[00:51:07]>> Maybe we should do a an episode about soccer. World Cup soccer.

[00:51:13]>> [laughter] >> World Cup soccer.

[00:51:17]Oh, you mean football. Sorry, yeah, that took me a while.

[00:51:19]>> Football.

[00:51:19]>> Yeah.

[00:51:20]>> Um you see I have to differentiate that here, you know.

[00:51:23]>> Right.

[00:51:23]>> On this side of the pond cuz people get confused.

[00:51:27]>> Yeah. [laughter] Uh so, yeah, Tuesdays and Wednesdays uh we're going to try and focus on that. We probably will, as we release the courses uh on the Intune Academy, we will be kind of restricting one of those to people who are actually taking the courses because we're running live streams for for the candidates there. Thank you, Danny. Uh we have the Intune Academy sign up QR code um on the screen as well. So, please do take a look at that. You can still sign up. We haven't released the first cohort yet. The first course will be going live this week. And uh it's essentially a very basic course. And it's probably if you have any I think pretty much everyone in the chat I've I can see so far has a good enough knowledge of Intune to not need to take the first course and they probably learn nothing from it. It really just is there as a way to get uh a nice ease [clears throat] into how to use the platform. And then the next course is all about the advanced stuff that we're running including this when I've really given it a good run through and got some more information.

[00:52:36]And I guess one of the differences between a live stream which is you have to talk and you have to interact and you have to uh think about various things while running a live demonstration. Very different to running a course because with a course and the module in a course you can kind of focus a clip on a particular thing and a clip can be anywhere between 5 and 10 minutes long and you can focus on that and then if you if I for example if I needed to figure out how to do the certificate which certificate I would be able to pause that recording, figure it out, come back with the knowledge and then make it much more um easy to listen to and this easy to watch as a learning module. This is much more interactive.

[00:53:20]>> Well, a live stream is like like doing a live demo at a session, you know, at a conference, right? You It's it may work, it may not work, but you know, the idea is there.

[00:53:30]>> It It is. It It's It's like that in every way apart from the audience because with the audience you can you can kind [clears throat] of interact with them in real time. Whereas this, I appreciate people are speaking to us. It's fantastic to have the the chat going on, but it is about 15 to 20 seconds delayed. So, you can't have that backwards and forwards, which is slightly different to being on stage.

[00:53:55]I appreciate, thank you uh for the kind >> Oh, nice it is. Thank you.

[00:54:01]>> kind comments. Big kudos to the duo for tirelessly giving time and effort to the community. Thank you very much.

[00:54:08]Um we will uh have a question just before I move on to the >> I create the rule from the >> Very weird. There's a noise behind me.

[00:54:25]Very weird noise behind me. Sorry about that.

[00:54:27]Uh we when you use support approval, then you can create the rule from the request at the top. It's more easy. Ah.

[00:54:34]That's a good idea.

[00:54:36]>> That's the ticketing system.

[00:54:39]>> Yeah, so let's do that. I'm not going to go have a chance to go into it too much, but let me just jump in to see [clears throat] what you're talking about cuz I think that sounds good. Um >> I'll share a screen.

[00:54:53]>> [laughter] >> Good shout. Thanks, Ash.

[00:54:55]Um just typing away on my hidden screen [laughter] there.

[00:54:58]Um let's try this. Uh just going to pick a new one and going to go with uh oh, no.

[00:55:07]I didn't create a new one.

[00:55:09]Delete that.

[00:55:10]Edit.

[00:55:15]So, support approval.

[00:55:17]Which >> That one there. Okay.

[00:55:19]>> We need the file name, but we still need this.

[00:55:23]We still need the file hash. So, you can create the rule from the request at the top.

[00:55:32]Oh, maybe if the ah, I see what you might be saying. I'm going to I'm going to preempt that you'll come back to me and and tell me what I got wrong just then. If we enable EPM and use the default as support approved, then maybe that will create that opportunity.

[00:55:50]So, [snorts] require support approval.

[00:55:54]>> Okay.

[00:55:55]>> Yeah. And so, what that will do, I haven't got a specific rule, which means that anything that gets gets requested will come through to the support approval flow. And then I can maybe create the rule. That sounds like a great way to migrate to EPM from a different product.

[00:56:15]You essentially give everyone the opportunity to um to use this and use support approve. That's a great That's a great idea. Thank you very much for that. Um come back on the screen just to see you have a a shout out of your name. Very clever. Thank you for your um help.

[00:56:33]Um And we only have a couple of minutes left.

[00:56:38]Uh yes, you did Yeah, thank you. I I caught up. Uh you meant on the settings at the beginning. Thank you. I was being a little bit stupid and realized. Um so, we have this elevation request setting uh button here, which will where the It will show where the >> Where the request will come in, right?

[00:56:55]>> Ryan find a way to do this. I doubt it will have refreshed the settings just yet because in tune I'm not going to say it. In tune is designed as a massively scalable cloud service, so can't be instant.

[00:57:15]Um it is not slow.

[00:57:18]I would get fired as an MVP, I think, if [laughter] I called it slow.

[00:57:22]In tune is not slow. It In tune is scalable and and right-sized for every for every uh, every task it performs.

[00:57:32]Um I think we'd run with elevated access and see where it goes.

[00:57:38]Okay.

[00:57:39]Request >> the key is also right. Okay, it's accepted.

[00:57:43]>> verify your identity. Okay.

[00:57:45]>> It's accepted.

[00:57:46]All right, sent.

[00:57:49]>> Now the default behavior before was deny request. This is support approval. So, it has been sent.

[00:57:56]>> there it goes.

[00:57:57]>> So, we head over to here and hope.

[00:58:01]>> There it is.

[00:58:02]>> And then from here, >> What does it say?

[00:58:06]Does it say please?

[00:58:07]>> settings.

[00:58:08]>> Where's the please button?

[00:58:09]>> that the Microsoft Corporation but thank you for joining, whoever you are.

[00:58:14]You're a >> [laughter] >> You're a nice person. You've just fundamentally changed how I'm going to talk about this in the course.

[00:58:23]Um, >> Oh, there it is.

[00:58:25]>> This gives you all the information from that user and essentially lets you build up this uh, repository of um, of reusable settings. Let's add that. I don't know how long it'll take.

[00:58:40]So, it has been added as a reusable setting and I will, if I allow it, then they'll be allowed to do it once.

[00:58:49]But if >> click on approve right there?

[00:58:52]>> I could click approve, but that would only allow it once and by adding it to the reusable settings, that hasn't necessarily created a rule. So, everyone can do it. You would still need to go in and do that. So, I'm going to ignore this request. In fact, I'll deny it.

[00:59:08]And that means it won't run.

[00:59:12]>> Right.

[00:59:15]>> But I do want to create a policy and in that policy we'll use the reusable setting.

[00:59:21]So, um, that's a good point.

[00:59:25]Kevin, they do need some Rub a Dub swag.

[00:59:27]You are being a wingman for them. Well done.

[00:59:31]Yeah, they they need some swag. We'll sort that out.

[00:59:35]Thank you, Danny. Can you make a note of that?

[00:59:38]Um We will create this and call it Edge, I think it was.

[00:59:45]>> Was it Edge? Okay.

[00:59:48]>> And in here, we'll call it Edge.

[00:59:52]And it is Let's do all automatic and I think it's MS Edge, isn't it?

[01:00:00]>> You said not in the reusable way.

[01:00:03]Uh not the create rule.

[01:00:06]>> he's he's I think they're about 15 seconds behind us. Um Jigsaw, the S in In-Sync stands for speed. Exactly my point. Exactly. Yes, it does.

[01:00:17]Um So, while we wait Pete, don't know if this would be good.

[01:00:25]The user would tell IT what to implement. Hope that makes sense. Um I It could be good.

[01:00:33]>> I think it's not more about, you know, what they tell IT. I think what they need. So, they'll just say, "Hey, I'm using these applications. I need to use them."

[01:00:43]Something like that, right? So, then admin will have to add all of those rules and things like that in place.

[01:00:52]>> [clears throat] >> All right, I'm going to grab this from the usable settings.

[01:00:57]Find the setting here. And this is a publisher cert, I assume. We're not using a file hash.

[01:01:06]I think it's MS Edge, isn't it?

[01:01:09]I should probably check, otherwise it's not going to work.

[01:01:11]>> High in the top then reusable, use the plus sign.

[01:01:18]>> High in the top then reusable.

[01:01:25]>> Open the request and by the plus sign, you said.

[01:01:34]>> MSH actually, yes it is.

[01:01:36]Okay. So, I'm going to carry on as I'm going, but I I appreciate that Michael's trying to help.

[01:01:45]Um I just don't know where Let me go out of this and apply this to all devices.

[01:01:52]So, at least we get one thing happening in the background. But, you're saying in Open the request.

[01:02:02]>> Yeah.

[01:02:03]>> Open the request. The request, yeah.

[01:02:07]Ah, create a rule.

[01:02:09]>> Ah, there it is.

[01:02:10]>> Just listen to the man. Just >> I know, right?

[01:02:13]>> Create a rule with these file details.

[01:02:15]That's even better, isn't it? There's a blinking button for it.

[01:02:20]Um yeah, thank you for that. Good shout.

[01:02:25]Um I think we get this guy on to do the to do the demonstration next time.

[01:02:31]>> [laughter] >> Yeah.

[01:02:35]I'll handle the chat stuff. Me and Harjit can do the talking. You can just do the demo.

[01:02:40]>> That's awesome.

[01:02:41]>> All right, we will uh do sync and give us a few seconds.

[01:02:51]>> Are we over time?

[01:02:52]>> scan the uh the Intune the Intune Academy thing. Thank you for that.

[01:02:57]Um please uh sign up. We'll be releasing the courses very soon.

[01:03:05]>> [sighs and gasps] >> Um synced. Okay.

[01:03:10]Let's try running Edge as admin. And I think I did it as automatic approval.

[01:03:17]Mm, this is probably going to go in the information we sent to your IT admin.

[01:03:21]So, that's not quite ready yet.

[01:03:24]Um Okay.

[01:03:29]Jumping around a little bit because we have to keep the flow going while we're waiting for Microsoft's speedy um >> How much time do we have?

[01:03:39]>> stuff. How much time do we have? I've got all day.

[01:03:43]>> [laughter] >> Um >> That's a good one.

[01:03:49]>> [laughter] [snorts] >> Yeah. Uh you know, these are scheduled for anywhere between 15 minutes and uh and and 6 hours, I guess.

[01:03:59]So.

[01:03:59]>> Yeah, I'm trying to think of all the admin admin account type of things that Microsoft has come up with. Obviously, I I brought up Windows LAPS and we got, you know, EPM here and stuff like that. But, there was one other one, wasn't there? Uh maybe a couple of years ago.

[01:04:16]Uh admin protection.

[01:04:19]Does anyone recall that?

[01:04:21]It worked a little differently, but I can't just pinpoint what it was.

[01:04:26]>> Admin protection.

[01:04:27]>> I believe it was admin protection.

[01:04:30]Uh >> Windows admin >> If I type admin protection in Google, I'm not going to get a result that is helpful. So, what kind of admin protection? In-Tune admin protection?

[01:04:42]>> It wasn't In-Tune admin protection. It was definitely for Windows. Uh >> Is it still there?

[01:04:48]Cuz we have account security.

[01:04:50]Uh account protection.

[01:04:52]>> Is that it?

[01:04:53]>> Uh No, that's where LAPS is. No.

[01:04:57]>> I think it's account protection. Click on that. Yeah.

[01:05:00]>> No, that's Credential Guard and that kind of thing.

[01:05:03]Um >> Yeah.

[01:05:06]>> Did you know you can do that? I didn't know you can do that on this new settings thing.

[01:05:11]It says skip past name. in the previous iteration of the configuration profile >> You couldn't.

[01:05:17]>> uh interface. You had to put a name before you could move on. And I just accidentally clicked configure settings before typing a temporary name. You could do that. That's actually a good idea.

[01:05:28]um No, I don't know what you're talking about, Arjit. Uh thank you for the for for the question, but I don't know what you're talking about.

[01:05:36]>> Yeah.

[01:05:38]>> We'll find out for the course.

[01:05:41]Uh and Pete, you mentioned that you could do something. Let me go back to your original comment, which was um you could implement this by running your normal user, Pete, and then request it um from your admin user. So, you can essentially take a machine that you have and run uh run an elevate request elevation for all the apps you want to put into your reusable settings, and just request them all, and then use that to build up the policy. That's a good idea, rather than crowdsourcing it from your users.

[01:06:15]Um and then you say that you kind of confirm that. That's a good idea.

[01:06:20]I think that's a pretty neat way to use it.

[01:06:23]um >> Yeah.

[01:06:26]>> I think that's pretty neat.

[01:06:27]>> So, what to do?

[01:06:29]>> Uh well, this was fun.

[01:06:33]I've learned a lot.

[01:06:34]Uh >> Yeah, me, too.

[01:06:36]>> It's uh I wonder if we got the I keep >> But, you know, you you got this done pretty nicely, though, because you know, it's like a new [clears throat] admin or whatever is trying to do this, trying to figure out EPM, and you kind of basically showed the steps right there. And I think it was brilliant, actually, that you went into the VM itself >> [laughter] >> to get the hash and stuff. It's >> Yeah, I it's um doing all this stuff from a Mac is actually pretty pretty difficult, which is why I try to run that cloud PC because most of the time when I'm admining admining?

[01:07:13]>> Admining.

[01:07:13]>> I guess admining is a word.

[01:07:14]Administrating um an environment I will be using a cloud PC for the customer environment rather than my own Mac.

[01:07:22]It's just when I do a demonstration or use the lab environments I'm on my own my own Mac. So it's um it's different, but you do need a a Windows PC in order to use all the tools. But uh I I would yeah, massive shoutout to all the people who have helped through this.

[01:07:39]Uh Michael and then there was one at the top.

[01:07:42]>> Yeah, that was the Dez.

[01:07:45]>> Uh no, it was Michael again. Honestly, that he he was the one who mentioned the um get file attributes. You're a legend.

[01:07:51]Thank you very much.

[01:07:53]Um okay.

[01:07:55]Let's close this here. Thank you so much to everyone for paying attention. We'll be doing the same again, maybe less hectic because maybe the demo would have worked for you Yuri first time, but crucially I'm not going to be involved. So >> [laughter] >> we'll see that tomorrow.

[01:08:13]Uh thanks everyone for joining and we'll see you >> later.

[01:08:17]>> Cheers.

[01:08:18]>> Bye-bye.