Windows Autopilot is a convenience feature and not a security feature. And this can be remediated after through Intune
How to hack yourself admin rights on any Autopilot installed Windows 10 - aka The Return of the Shift+F10!
#suomalaismies #4sysopshttps://4sysops.com/archives/hacking-admin-rights-on-an-autopilot-installed-windows-device-return-of-the-shift-f10/ …
-
-
-
Agreed. Like I said in the blog it is a lost cause as one has physical access. But remediating is not easy as one can install persistance in multiple ways :) And still... Shift-F10, come on...
- Još 3 druga odgovora
Novi razgovor -
-
-
Hey bud, you should swap steps 6 and 7 in the autopilot workflow. The devices is determined to be an autopilot machine before a user logs in.
-
Thanks! My mistake.
Kraj razgovora
Novi razgovor -
-
-
The immutable law of having physical access used to be a whole lot more challenging when the first time you got your hands on a device was after it was bitlockered.
-
100% agree
Kraj razgovora
Novi razgovor -
-
-
2 scenarios: Employee - Can gain local admin rights and enrol the device. In this scenario your Intune policy/gpo should remove unapproved entries in local admins group. OR an unauthorised user gets hold of laptop. But without AAD creds its just a vanilla Windows device.
-
The second part I agree on completely
Kraj razgovora
Novi razgovor -
-
-
Admins might try and use this to mitigate (modifications might be required)....https://www.iphase.dk/local-administrators-on-aad-joined-devices/ …
-
Cool script! Thinking of modifying to run as schedtask for larger organisations where dispersed regional admins are required and frequent IAM-changes is a PITA from an Intune mgmt perspective tbh
Kraj razgovora
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.