Knowledge
Technical articles for administering Windows, Intune and Entra.
Intune, Configuration Manager, Entra ID, Windows Update: what really happens on devices and how to configure it. Every article says what it rests on — a measurement, or Microsoft's documentation — and when. When a script is needed, it is there to read before you run it.
3 articles
Windows Hello for Business cloud Kerberos trust: UseCloudTrustForOnPremAuth, Entra Kerberos and hybrid devices
The mechanism, the prerequisites and the step-by-step configuration in Intune or Group Policy, with no PKI. How to check a device, what drops it back to key trust, and migrating from key or certificate trust.
Automatic client push in Configuration Manager: NTLM flaw, KB15599094, disable, secure or replace?
The NTLM relay risk of client push, what disabling fixes or not (the push account stays), the Group Policy, WSUS, Intune and manual alternatives with their flaws, and the deciding criterion: how many devices you install by push, and a read-only audit script.
KB36495448: restoring the Windows Update scan source policy after ConfigMgr 2503/2509
The hotfix stops ConfigMgr setting incomplete scan source keys and cleans up the ones that exist, but puts no configuration in their place. The target configuration, what Windows 11 actually does, and a script that audits, corrects and verifies.
More articles are on their way. A specific question, a case you would like covered? Write to us.