Technology Architect, Microsoft MVP, Microsoft Certified Trainer with a passion for #Deployment #Configmgr #Intune #Security #Development #CloudPC #Windows365

Denmark
Joined November 2011
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
If you've deployed #Micosoft NDES to issue SCEP certificates with Intune, an attacker can modify a registry key to redirect certificate enrollment. Here's how to restrict access to the MSCEP key and enable auditing to detect unauthorized changes. rmhci.co/4qxSyx5 #mobility #identity #pki
13
39
1,917
Microsoft turns on "Require risk remediation for high-risk users" in Entra ID P2 tenants the week of Oct 28 (MC1507808). Check your high-risk users can do MFA and verify break-glass exclusions first. blog.thomasmarcussen.com/mc1… #MicrosoftEntra #ConditionalAccess
4
14
2
73
5,408
Did your corporate Wi-Fi stop working this morning? Check for KB5127648. Yesterday's October Patch Tuesday update for Windows 11 (24H2, 25H2 and 26H2) breaks 802.1X PEAP authentication. WPA2-Enterprise Wi-Fi and wired 802.1X both fail. Home Wi-Fi and hotspots keep working, so it looks like "the office network is down" when it is actually the client. The fingerprint: - WLAN-AutoConfig event 12014 "OneX Held State timeout" and 12013 with error 0x80070285 - The request never reaches your RADIUS/NPS server - Uninstall the update and it works again The likely cause is not a bug. Microsoft announced a year ago that BlockNtlmv1SSO would flip from Audit to Enforce in October 2026, and PEAP with MS-CHAPv2 still depends on NTLMv1-derived credentials. Microsoft has not listed it as a known issue yet. In the post I cover: - How to confirm it in Event Viewer - How to pause it in Windows Autopatch and Intune update rings - A remediation script that sets BlockNtlmv1SSO back to Audit mode (temporary, and I explain why) - Why this is the push to finally move from PEAP-MSCHAPv2 to EAP-TLS Read it here: blog.thomasmarcussen.com/kb5… If you are seeing the same thing, drop a comment with your Windows version and whether wired or Wi-Fi is affected. It helps everyone triage faster. #Intune #WindowsAutopatch #Windows11 #PatchTuesday #KB5127648 #8021X #NTLM #EndpointManagement
2
6
7
2,053
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
Another great category featuring some amazing people. Our MVPs in the past, present, and future fill the gaps in Microsoft documentation and products overall. These people personify that sentiment. Make sure you come out and vote for them because they make our careers easier and better daily. It’s so amazing to be part of a community that celebrates the people who support us. Thank you to @SwiftOnSecurity @merill @getrubix @Mister_MDM @Ciraltos and the countless others who contribute every single day Register now: workplaceninjas.us
Happy Monday! We're here to announce another set of finalists for the Golden #Clippy Awards. This week it's the "Social Media Superstar" Award, which focuses on someone who does an exceptional job sharing information via social media channels, and supporting people eager to learn. Let's discuss the finalists! 🦘 @merill, the scourge of #ActiveDirectory is an amazing ambassador throughout social media, with Entra.chat, the newsletters, his website, and his activity throughout all social channels. He's a man of many talents, who has continued to lead the way on the entire #Microsoft #identity stack. πŸ€– @Ciraltos of @GetNerdio is an amazing star on the #YouTube side of the business, with over 100K followers on his YouTube channel shares content in so many areas like #Azure, #Entra, #DaaS, #MSSecurity, and so much more! β˜• @getrubix, a fantastic #MSIntune MVP who has continued to grow as his company Get Rubix continues to take the world by storm. His video content is unique, entertaining, and so solid. He's one of the world's favorite MVPs with his relatable content and personality that makes him a blast to watch. 🍺 @Mister_MDM, needs zero introduction, as one of the thought leaders in the Intune space who is constantly reverse engineering, probing, inspecting, and learning about changes Microsoft makes under the covers to educate all of us. He's super smart, very approachable, and an asset to all of us. He releases more blogs and content than anyone else, making him a rockstar. ✈️ @SwiftOnSecurity, a very secretive and brilliant member of the #Twitter #Infosec community is somewhat overlooked for those of us that aren't on Twitter/X. However, if you are on there, you know EXACTLY what Swifty is, but not necessarily who they are. Their brilliance, incredible stories, entertaining takes, and vision makes them a 100% needed follow. They are the type of person who is simply polarizing, and their impact on our industry is immistakeable and invaluable. Don't forget to register for @wpninjasus Check out our registration portal to see the agenda, the speakers, and register now: cvent.me/ZgKb40 #WPNinjaS #WPNinjaSUS #ITPros #Community #MSIntune #MSSecurity #MSEntra #ActiveDirectory #SCCM #ConfigMGR #Windows365 #AzureVirtualDesktop #Copilot #AI #Infosec
1
3
13
801
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
Speaker announcement 🎀 We’re happy to welcome Rudy Ooms (@Mister_MDM) to the Modern Endpoint Management Summit in Paris, April 2027. Rudy is a Microsoft MVP and Technical Product Marketing Manager at Patch My PC, better known to many as Mister DLL. His idea of a good evening? Debugging Intune issues, preferably with a good beer within reach. That hobby has given him a deep understanding of everything that happens under the hood of Windows Autopilot, Intune and Endpoint Privilege Management. If you’ve ever been stuck on an enrollment that just wouldn’t finish, chances are one of his blogs on call4cloud.nl already explained why. In Paris, he’ll take you past the portal and into the moving parts. Bring your toughest questions. Join us: endpointsummit.com/ #MsIntune #MEMSummit
5
9
788
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
Windows Update certificates expire in May and June 2027. Most current devices need no action. Older or outdated ones can lose Windows Update if you wait. Early guidance from Andrew Brown: what to update, what to upgrade, and why to plan now. techcommunity.microsoft.com/… #windows #intune #WindowsAutopatch
πŸ€– Made with AI
17
1
49
4,766
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
Call for Speakers is open! Submit your sessions before the deadline of October 31! This is your chance to share your knowledge with the community. For more information, checkout Sessionize sessionize.com/MEMSummit2027 #MEMSummit #MsIntune #Windows #Security #Automation #Copilot
4
2
439
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
You asked we promised - we have now delivered Windows 11 26H2 Security Baseline in Microsoft Intune. Great collaboration between Windows and Intune engineering org. #MSIntune #Windows11 #SecurityBaseline
6
20
104
6,753
Windows 11 26H2 is GA. With Intune + Autopilot it's just a restart, but: - 24H2 Pro ends Oct 13 - Set ring deferral to 0 days - 26H1 devices can't take 26H2 - WMIC is gone - Turn on Windows data for reports Full guide: blog.thomasmarcussen.com/win… #Intune #Windows11
1
3
509
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
Blogged: Final thoughts on Windows 365 Reserve niallbrady.com/2026/08/27/fi… #Windows365 #MSIntune @megahoch
4
3
417
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
One of my favorite conferences - I have so lucky to be picked as a speaker every single year, including the virtual one #MEMSummit #CFS are open
Call for Speakers is open! We're excited to officially open the CfS for the Endpoint Management Summit 2027. This is your chance to share your knowledge with the community. For more information, checkout Sessionize sessionize.com/MEMSummit2027 #MEMSummit #MsIntune #Windows
4
8
1,849
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
1
14
42
4,001
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
Blogged: Following up on Windows 365 Reserve niallbrady.com/2026/07/30/fo… #MSIntune #Windows365
1
3
5
888
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
Lots of new capabilities with #MSIntune 2607 #July βœ… Updated #Windows Device Sync βœ… Custom Compliance for #macOS βœ… Firmware Updates for #Samsung devices βœ… #MAM #APP Multi-Managed Accounts techcommunity.microsoft.com/…
13
43
3,636
Microsoft retires SMS and voice MFA in Entra ID on Feb 1, 2027. Full playbook: find affected users, move to passkeys, opt out temporarily, and suppress nudges. blog.thomasmarcussen.com/ent… #EntraID #MFA #Passkeys
1
15
1
108
7,775
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
Good news. IT administrators can now automatically accept SSO permissions on managed Windows devices using a supported registry setting. Read more: learn.microsoft.com/en-us/en…
8
55
3,276
Thomas Marcussen - MVP πŸ‡©πŸ‡° retweeted
πŸ—ž Want to know what's new in the world of #Windows365 #CloudPC? Check out this week's newsletter‡️ πŸ‘‰ w365community.com/weekly-new… πŸ‘ Aarthi Sukumar, @BurgerhoutJ, @ncbrady, @vaishnavk93
6
6
499
Enhanced host pool management for Azure Virtual Desktop just went GA, and it changes how you run session hosts. Instead of deploying and patching session hosts yourself, your host pool gets a session host configuration: one definition of image, VM size, network and credentials. The platform then creates, updates and replaces the hosts for you, batch by batch. No more registration tokens. I set it up in my own tenant and wrote a step by step guide, including two gotchas the wizard will not warn you about: πŸ”‘ VM admin credentials must come from Key Vault. If your vault runs access policies instead of RBAC, deployment fails with UnableToAccessKeyVaultSecret. The fix is a single az keyvault set-policy. πŸ“ Validation passes even if the VM size is restricted for your subscription in that region. It only fails at deployment. Check az vm list-skus first. Full walkthrough with screenshots from my own environment: blog.thomasmarcussen.com/enh… #AzureVirtualDesktop #AVD #Azure #CloudComputing
202