Working with application deployment & virtualization. #Appv #powershell #Workspace1 #Omnissa #VmWare #MSIX #MSI #PSADT #AppVolumes #Horizon
Tromsรธ, Norway
Joined August 2017
- Tweets1.2K
- Following456
- Followers167
- Likes3.6K
Arne Johansen retweeted
With the new season about to kick off, multiple record holder @Erling Haaland has been presented with certificates recognising his extraordinary football career highlights so far โฝ๐
guinnessworldrecords.com/newโฆ
Arne Johansen retweeted
Lots of goodies in the latest WinGet release:
I'm loving the sorted output!
github.com/microsoft/winget-โฆ
Arne Johansen retweeted
There is a subtlety here between a "user" and a session in the latest MSIX blog post:
devblogs.microsoft.com/insidโฆ
Arne Johansen retweeted
HWMonitor and CPU-Z developer CPUID breached by unknown attackers โ cyberattack forced users to download malware instead of valid apps for approximately six hours tomshardware.com/tech-industโฆ
Arne Johansen retweeted
Microsoft has finally listened to its... business users.
Windows 11 Beta and Dev insider build 26220.7535 has a new group policy to remove Microsoft Copilot app.
However, there's a catch...
- Microsoft 365 Copilot and Microsoft Copilot are both installed
- Microsoft Copilot app was not installed by the user
- Microsoft Copilot app was not launched in the last 28 days
- Users can still reinstall the Copilot app
This new policy is located in Group policy, can be found in User Configuration -> Administrative Templates -> Windows Components -> Windows AI -> Remove Microsoft Copilot App.
ALT Screenshot of the Windows 11 desktop showing the new group policy named Remove Microsoft Copilot app introduced in Windows 11 Insider Beta and Dev build 26220.7535, when enabled this policy will uninstall the Microsoft Copilot app by default as long the following conditions are met, Microsoft 365 Copilot and Microsoft Copilot are both installed, The Microsoft Copilot app was not installed by the user, and The Microsoft Copilot app was not launched in the last 28 days. The user can still reinstall the Microsoft Copilot app.
Arne Johansen retweeted
This Microsoft doc made my dayโฆ The keyboard does not work in WinPE, type in the following command to fix it :) Thanks for sharing @mniehaus
Arne Johansen retweeted
New blog post:
Notepad++ Now Has an Official MSI.
Is It Good and How Can You Improve It Yourself?
masterpackager.com/blog/Noteโฆ
ALT MSI installation view of Notepad++ created with the upcoming Master Packager Dev 2.0.0 software.
Arne Johansen retweeted
Amazing video by Dean Ellerby who explores how to wrap application installers with PSAppDeployToolkit (#PSADT) using Master Wrapper, and then upload them to Intune using Master Packager Toolbox.
youtube.com/watch?v=rbueCXB2โฆ
Arne Johansen retweeted
A simple, lightweight PowerShell script to remove pre-installed apps, disable telemetry.
Arne Johansen retweeted
Sysinternals is one of best tools for identifying malware on a running Windows system
Digital Forensics, Part 8: Live System Analysis with Sysinternals
hackers-arise.com/digital-foโฆ
Arne Johansen retweeted
New blog post: Removing preinstalled Microsoft Store apps using native functionality
petervanderwoude.nl/post/remโฆ
#MSIntune #Intune #EMS #MDM #Windows11 #ADMX
Arne Johansen retweeted
When you see an S-1-12-1-something SID in (for example) your local Administrators group, you have no idea what it actually represents.
Now thatโs changing! With the new feature flag active, Windows finally recognizes Entra groups by name.
No more guessing which SID, resembles which group . It's now perfect readable.
#Intune #MSIntune #Windows #Windows11
Arne Johansen retweeted
AppManagEvent 2025 is live!
We kicked off with an inspiring keynote by @Brinkhoff_C
The Future of Windows Cloud & AI
From Windows history to AI Agents โ what a way to start the day!
#AppManagEvent #AI #WindowsCloud #OpeningKeynote #Microsoft
Arne Johansen retweeted
Last session before the Closing Keynote at @Appmanagevent, @samilaiho showing us 11 ways to hack Windows 11. #AppManagEvent2025 โ at Utrecht, The Netherlands
Arne Johansen retweeted
โ ๏ธ Microsoft Outlook for Windows Bug Leads to Crash While Opening Email
Read more: cybersecuritynews.com/microsโฆ
Microsoft has confirmed it is investigating a significant bug in the classic Outlook for Windows desktop client that causes the application to fail upon launch.
The issue, which appears to be linked to Microsoft Exchange logon attempts, prevents users from accessing their mailboxes and displays a critical error message, disrupting daily workflows for affected individuals and organizations.
While this generic error can stem from various causes, Microsoft has noted that recent support cases point to a specific issue with user mailboxes attempting to connect to the service.
#cybersecuritynews
Arne Johansen retweeted
Why Do Required Apps Wait 60 Minutes to be installed after Autopilot Enrollment?
After setting up blocking apps and some required apps, youโd expect the required apps to install as soon as the user hits the desktop after Autopilot.
The funny thing? Sometimes they donโt. They wait exactly 60 minutes.
This deep dive shows the why, the how, and multiple ways to bypass the weird delay.
#Intune #MSIntune #Windows #Windows11 #WindowsAutopilot
patchmypc.com/blog/why-do-reโฆ
Arne Johansen retweeted
๐ฅ Microsoft patched a perfect 10.0 CVE in Entra ID (ex-Azure AD) that let attackers impersonate any user, even Global Adminsโacross every tenant worldwide.
๐ MFA? Conditional Access? Logging? All bypassed. Total tenant takeoverโSharePoint, Exchange, Azure resources.
Details here โ thehackernews.com/2025/09/miโฆ
Arne Johansen retweeted
Some of yโall never had to edit a config.sys file to get a game to run and it shows ๐๐
Arne Johansen retweeted
๐ย Secure Bits ๐ก
๐ง๐ต๐ถ๐ป๐ธ ๐ฅ๐๐ฃ + ๐๐ฟ๐ฒ๐ฑ๐ฒ๐ป๐๐ถ๐ฎ๐น ๐๐๐ฎ๐ฟ๐ฑ ๐ธ๐ฒ๐ฒ๐ฝ๐ ๐๐ผ๐๐ฟ ๐ฑ๐ผ๐บ๐ฎ๐ถ๐ป ๐ฎ๐ฑ๐บ๐ถ๐ป ๐ฐ๐ฟ๐ฒ๐ฑ๐ ๐๐ฎ๐ณ๐ฒ? ๐ก๐ผ๐ ๐ฟ๐ฒ๐ฎ๐น๐น๐.
Even in 2025,ย many ๐ฎ๐ฑ๐บ๐ถ๐ป๐ ๐๐๐ถ๐น๐น ๐ฒ๐
๐ฝ๐ผ๐๐ฒ ๐๐ต๐ฒ๐ถ๐ฟ ๐๐ผ๐บ๐ฎ๐ถ๐ป ๐๐ฑ๐บ๐ถ๐ป ๐ฐ๐ฟ๐ฒ๐ฑ๐ฒ๐ป๐๐ถ๐ฎ๐น๐ย without realizing it โ just by using RDP to access Domain Controllers from their regular workstation.
๐ง ย โBut Iโve got ๐๐ฟ๐ฒ๐ฑ๐ฒ๐ป๐๐ถ๐ฎ๐น ๐๐๐ฎ๐ฟ๐ฑ, Iโm protected!โ
Not always.
๐๐ฒ๐ฟ๐ฒโ๐ ๐๐ต๐ฎ๐ ๐ฎ๐ฐ๐๐๐ฎ๐น๐น๐ ๐ต๐ฎ๐ฝ๐ฝ๐ฒ๐ป๐ย ๐ถ๐ป ๐ฐ๐ฎ๐๐ฒ ๐ผ๐ณ ๐ฅ๐๐ฃ:
1๏ธโฃ You connect to a DC via RDP from your "basic " machine
2๏ธโฃ As part of that RDP session,ย your password gets cached in MSTSC memory
3๏ธโฃ An attacker on your workstation could extract it โย even in plaintext
๐ฅ ๐๐ฟ๐ฒ๐ฑ๐ฒ๐ป๐๐ถ๐ฎ๐น ๐๐๐ฎ๐ฟ๐ฑ ๐ฑ๐ผ๐ฒ๐๐ปโ๐ ๐๐ฎ๐๐ฒ ๐๐ผ๐ ๐ต๐ฒ๐ฟ๐ฒ.
Neither will SmartCards (care to guess what ends up in memory instead?)
๐ฏ The real fix? Implement ๐ฝ๐ฟ๐ผ๐ฝ๐ฒ๐ฟ ๐ฃ๐ฟ๐ถ๐๐ถ๐น๐ฒ๐ด๐ฒ๐ฑ ๐๐ฐ๐ฐ๐ฒ๐๐ ๐ช๐ผ๐ฟ๐ธ๐๐๐ฎ๐๐ถ๐ผ๐ป๐ (๐ฃ๐๐ช) ๐ฎ๐ป๐ฑ ๐ณ๐ผ๐น๐น๐ผ๐ ๐๐ต๐ฒ ๐ง๐ถ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ ๐ผ๐ฑ๐ฒ๐น. You can also take advantage of Restricted Admin Mode in RDP, but it requires the knowledge of the above.
Your credentials are only as secure as the device you log in from.
๐ Ever tested what MSTSC leaks in memory? Let me know in the comments.
#ActiveDirectory #WindowsSecurity #CredentialGuard #BlueTeam #SecureBits #CyberSecurity #HorizonSecured #PrivilegeEscalation @BlueTeamDave
