Use Proactive remediations to report on or install the Microsoft Update Health tools

Microsoft recently made a download available for their Update Health tools - if you're using Microsoft Endpoint Manager and enrolling or co-managing Windows devices these tools need to be installed to make use of the capability for expediting quality updates. For devices connected to Windows Update or Windows Update for Business these tools should already … Continue reading Use Proactive remediations to report on or install the Microsoft Update Health tools

MEMCM Compliance Item Scripts to Secure PointAndPrint Registry Keys

Microsoft published some updated guidance yesterday for the Windows Print Spooler Vulnerability (CVE-2021-3457) and recommend securing a couple of Point and Print registry keys if they exist, in addition to deploying the security update: After applying the security update, review the registry settings documented in the CVE-2021-34527 advisoryIf the registry keys documented do not exist, … Continue reading MEMCM Compliance Item Scripts to Secure PointAndPrint Registry Keys

Get the current patch level for Windows 10 with PowerShell

I was working on some updates to our unified reporting solution for Windows Updates (ie WUfB + MEMCM) and I wanted to figure out simply from the OS build number whether a Windows 10 workstation has the latest cumulative update installed. The only reliable and useable static list I could find for Windows 10 build … Continue reading Get the current patch level for Windows 10 with PowerShell

PowerBI Reports for Windows 10 Feature Update Compliance

This morning I saw an interesting tweet from Sandy Zeng with a Log Analytics workbook she'd created for W10 feature updates based on Update Compliance data. I'd been meaning to create a similar report for that myself in PowerBI for some time, so I took inspiration from her tweet and got to work on something! … Continue reading PowerBI Reports for Windows 10 Feature Update Compliance

Prevent Users from Disabling Toast Notifications – Can it be Done?

Another toast notifications post - this time to deal with an issue where users have turned off toast notifications. In my deployment of Windows 10 feature updates for example, I use toast notifications to inform users an update is available. Once we hit the installation deadline, the notifications become more aggressive and display more frequently … Continue reading Prevent Users from Disabling Toast Notifications – Can it be Done?

Get Previous and Scheduled Evaluation Times for ConfigMgr Compliance Baselines with PowerShell

I was testing a compliance baseline recently and wanted to verify if the schedule defined in the baseline deployment is actually honored on the client. I set the schedule to run every hour, but it was clear that it did not run every hour and that some randomization was being used. To review the most … Continue reading Get Previous and Scheduled Evaluation Times for ConfigMgr Compliance Baselines with PowerShell

Inventory Local Administrator Privileges with PowerShell and ConfigMgr

Any security-conscious enterprise will want to have visibility of which users have local administrator privilege on any given system, and if you are an SCCM administrator then the job of gathering this information will likely be handed to you! However, this task may not be as simple as it seems. Gathering the membership of the … Continue reading Inventory Local Administrator Privileges with PowerShell and ConfigMgr

New Free Tool: ConfigMgr Remote Compliance

Today I released a new free tool for ConfigMgr administrators and support staff. ConfigMgr Remote Compliance can be used to view, evaluate and report on System Center Configuration Manager Compliance Baselines on a remote computer. It provides similar functionality to the Configurations tab of the Configuration Manager Control Panel, but for remote computers. It is … Continue reading New Free Tool: ConfigMgr Remote Compliance

Deploying Custom Microsoft Office Templates with System Center Configuration Manager

Some time ago a wrote a blog describing a way to deploy custom templates for Microsoft Office applications using SCCM Compliance Settings. Since then, I have re-written the solution into something much more manageable as the previous incarnation was not very clearly defined in how to update templates, and involved some considerable admin overhead. This … Continue reading Deploying Custom Microsoft Office Templates with System Center Configuration Manager