iiinova — where your digital self keeps evolving

Anthony J. Fontanez @ajf8729.com · 07/02/2026

Four years running now, still managing to keep my lab root CA alive! I think the VM has been moved 3 or 4 times at this point, but I still keep managing to publish a new CRL! #PKI #ADCS

020

Reposted by Anthony J. Fontanez

Martin Himken | MVP @intune.best · 21/01/2026

What do #Certificates, #SecureBoot, and #BlackLotus have in common? Read my new blog post for more context on what's actually happening and why you need to do more than just flip a few settings in the long run. Enjoy reading! manima.de/2026/01/secu...

manima.de

Secure Boot, Certificates and BlackLotus – mAnimA.de

Microsoft wants you to update your Secure Boot certificates as soon as possible. Join me as I explain the situation and take action now!

021

Anthony J. Fontanez @ajf8729.com · 12/12/2025

It really grinds me gears when Teams meeting organizers do not force end meetings when they are over, and people that walked away or fell asleep stay stuck in the meeting for hours, leaving the camera icon there saying there's an active meeting.

220

Anthony J. Fontanez @ajf8729.com · 14/11/2025

There's a new boot image option available in #ConfigMgr 2509! #BlackLotus

083

Anthony J. Fontanez @ajf8729.com · 21/10/2025

Why is it every time I hear/see things like "Delivery Optimization broke our network", the "solution" always seems to be "so we blocked DO [in all the incorrect ways]" instead of "we finally decided to upgrade our ancient network infrastructure"?

000

Anthony J. Fontanez @ajf8729.com · 13/10/2025

RIP Windows 10 tomorrow, can still remember running the initial insider builds!

030

Anthony J. Fontanez @ajf8729.com · 10/10/2025

Woohoo, #Autopatch can use a Win32 app instead of a platform script for the broker now! Go to intune.microsoft.com#view/Microso... and hit that Migrate button right meow! In case you missed the MC notification about this, it's here admin.cloud.microsoft#/MessageCent... #Intune

044

Anthony J. Fontanez @ajf8729.com · 12/09/2025

TIL that you need DA to view RODC password replication policy results (was testing/verifying for AzureADKerberos). @josephryanries.bsky.social maybe you know why, seems odd, thought that would fall under typical RO directory data for domain users.

000

Anthony J. Fontanez @ajf8729.com · 08/09/2025

Reminder! - "The option to move back to Compatibility mode will remain until September 2025. After this date, the StrongCertificateBindingEnforcement registry key will no longer be supported" - support.microsoft.com/en-us/topic/... #ADCS #InfoSec

support.microsoft.com

KB5014754: Certificate-based authentication changes on Windows domain controllers - Microsoft Support

022

Reposted by Anthony J. Fontanez

Martin Himken | MVP @intune.best · 29/08/2025

#INR aka #Intune Network Requirements script just got an update and a new home. Update your bookmarks! Also, new ASAs added: * Microsoft Defender for Endpoint * Visual Studio github.com/MHimken/Intu... #MVPBuzz

github.com

GitHub - MHimken/IntuneNetworkRequirements: This tool provides a way to verify Intune network requirements automatically

This tool provides a way to verify Intune network requirements automatically - MHimken/IntuneNetworkRequirements

053

Anthony J. Fontanez @ajf8729.com · 18/08/2025

I scored 11/21 on e-mail.wtf and all I got was this lousy text to share on social media.

e-mail.wtf

Email is Easy

Everyone knows what an email address is, right?

150

Anthony J. Fontanez @ajf8729.com · 15/08/2025

It might just load it into memory, which is what I would imagine happens when passing a UNC path.

010

Anthony J. Fontanez @ajf8729.com · 15/08/2025

Not quite sure, don't see it in C:\Windows\Temp, and can't tell from a quick procmon glance.

010

Anthony J. Fontanez @ajf8729.com · 15/08/2025

TIL you can pass an HTTP(S) URL directly to msiexec.exe and it will totally work. I had no idea!

361

Anthony J. Fontanez @ajf8729.com · 13/08/2025

ICYMI - #PowerShell 2.0 removal coming soon! learn.microsoft.com/en-us/window... - "Windows PowerShell 2.0 is removed from Windows 11, version 24H2 starting with the August 2025 non-security update. It’s also removed from Windows Server 2025 starting with the September 2025 security update."

learn.microsoft.com

Windows message center

032

Reposted by Anthony J. Fontanez

Merill Fernando 💚 @merill.net · 06/08/2025

Folks, bookmark this 👇 Did you know I curate a list of all the awesome Entra related links all in one place? Here's a quick peak into this list

1113

Anthony J. Fontanez @ajf8729.com · 01/08/2025

Aye, this new #Entra feature is pretty neat once you work out the missing bits! After you set isCloudManaged=true, add the group to the Cloud Sync Entra->AD config, trigger provisioning, and watch the group get relocated/renamed! SOA reversal with the SID maintained! See before and after images:

Synced group in Entra prior to isCloudManaged attribute change

Synced group in Entra after isCloudManaged attribute change

020

Reposted by Anthony J. Fontanez

Sean Bulger @seanbulger.bsky.social · 10/07/2025

It has been almost 3 years since my last blog post, but I am excited to share my first Microsoft Tech Community post! Want deeper Intune reporting? I walk through building a Windows 365 dashboard using Power BI + Log Analytics. Check it out! #Intune #Windows365 #TechCommunity

techcommunity.microsoft.com

Creating Custom Intune Reports with Microsoft Graph API | Microsoft Community Hub

  Systems administrators often need to be able to report on data that is not available in the native reports in the Intune console. In many cases this...

1113

Anthony J. Fontanez @ajf8729.com · 10/07/2025

If you were to trust their root CA as instructed, anything it issues would be inherently trusted by your device.

000

Anthony J. Fontanez @ajf8729.com · 10/07/2025

This is actually hilarious and no, you shouldn't blindly trust some root CA like this. This defeats the purpose of how PKI works. Public CAs are heavily regulated in terms of auditing and security.

100

Anthony J. Fontanez @ajf8729.com · 10/07/2025

Notepad++'s code signing cert expired, couldn't get a new one under the "Notepad++" name, so instead of getting one under their name (what the WinSCP developer does), they instead created their own root CA, issued a code signing cert, and want you to trust it notepad-plus-plus.org/news/v883-se...

notepad-plus-plus.org

Notepad++ v8.8.3 - Self-signed Certificate: Certified by Code, Not Corporations | Notepad++

121

Anthony J. Fontanez @ajf8729.com · 28/05/2025

And it's a super easy setup/upgrade, go do it now! #Entra

162

Reposted by Anthony J. Fontanez

joeloveless.com @joeloveless.com · 25/05/2025

Happy Memorial Day Weekend Everyone! Indy 500 tomorrow, Game 3 between the Pacers and Knicks. What better way to celebrate the weekend than a new post about converting SCCM Configuration Items to Intune Remediation Scripts? joeloveless.com/2025/05/conf... #sccm #intune #mecm #powershell

joeloveless.com

Converting Registry Based SCCM Configuration Items to Intune Remediation Scripts

Script walkthrough on converting SCCM Configuration Items to Intune Remediation Scripts.

041

Anthony J. Fontanez @ajf8729.com · 19/05/2025

My take on remediating #BlackLotus via #Intune Remediations & #ConfigMgr CIs. It sure was fun to code up and test as much as I was able to. Please let me know if you have any feedback or run into any issues if you try the scripts out! ajf.one/blacklotus

ajf.one

Dealing With CVE-2023-24932, aka Remediating BlackLotus

CVE-2023-24932. 2023 feels like so long ago, and yet, this is still an issue. Why? Because it’s quite frankly a mess to deal with and has multiple moving parts. I highly recommend reading tho…

142

Anthony J. Fontanez @ajf8729.com · 30/04/2025

Oh I'll bet all of those other roles will hybrid join fine. I think if you sync a DC, it will hybrid join, but not sure if it causes any issues; def not supported. It might be blocked/prevented somehow now, but I'm pretty sure I did it by accident in a lab many years ago.

010

Anthony J. Fontanez @ajf8729.com · 30/04/2025

So I shouldn't hybrid join my DCs and send the DSRM password to Entra?

110

Anthony J. Fontanez @ajf8729.com · 30/04/2025

(yes, that's a Server 2019 VM in my lab 😊)

000

Anthony J. Fontanez @ajf8729.com · 30/04/2025

Did you know you can send LAPS passwords to Entra on Server OS? Neither did @adamgrosstx.bsky.social or I until yesterday! Just need to hybrid join the server(s) and set the GPO to backup to "AAD"! Neat!

2154

Reposted by Anthony J. Fontanez

James Robinson | MVP @skiptotheendpoint.co.uk · 28/04/2025

📬 #Windows Recall had a rocky start, but where do we stand now as it moves into GA? With a complete security overhaul, fresh admin controls, and a default-off strategy, the improvements are promising! Interested to read a more optimistic view? stte.me/recallisgreat

stte.me

From Criticism to Confidence: Windows Recall

Windows Recall is a powerful tool, but is it secure, should you be concerned, and how do you manage it?!

031

Anthony J. Fontanez @ajf8729.com · 06/04/2025

New Soapbox Post: Obsolete Security – Stop Setting These Policies! anthonyfontanez.com/index.php/20... Here I talk about requiring Ctrl+Alt+Del to log in, not displaying the last logged-in username, and logon banners, and why you should stop setting these! #Intune #WinAdmins

anthonyfontanez.com

Obsolete Security – Stop Setting These Policies!

The settings in the above screenshots were fairly common to be applied to all workstations as a requirement 20-ish years ago. However, it’s now 2025, and we really don’t need to be sett…

062

Reposted by Anthony J. Fontanez

Merill Fernando 💚 @merill.net · 27/03/2025

Folks, the latest episode of Entra.Chat podcast is out! Featuring our very own and beloved @nathanmcnulty.com Subscribe in your favorite podcast player today 👇 entra.news/p/operationa...

teaching Entra new tricks: Operational
Groups
unleashed!

1165

Anthony J. Fontanez @ajf8729.com · 25/03/2025

When did "zero trust" start to mean "use a 'VPN' for everything"?

100

Reposted by Anthony J. Fontanez

WinAdmins Community @winadmins.io · 20/03/2025

Going to Workplace Ninjas UK 2025 wpninjas.uk in June? Don't miss these sessions with fellow WinAdmins and MVPs @jgkps.bsky.social, @krysonthe.net, and @intune.best!

044

Anthony J. Fontanez @ajf8729.com · 11/03/2025

PSA for Teams meetings organizers - you can end meetings for all participants when it's over.

000

Anthony J. Fontanez @ajf8729.com · 06/03/2025

It's 2025, why do I need to do this in order for #Intune to run PowerShell scripts in 64-bit mode?

061

Anthony J. Fontanez @ajf8729.com · 11/02/2025

It's Strong Certificate Binding Enforcement day everyone! support.microsoft.com/en-us/topic/...

031

Reposted by Anthony J. Fontanez

Nathan McNulty @nathanmcnulty.com · 07/02/2025

This article is a great deep dive by @cryps1s I am also a huge fan of this Firewall series by Anthony Fontanez (used to be @ajf8729) anthonyfontanez.com/index.php/20... He covers how to handle certificate auth in the firewall and use with Entra joined devices, explains hard stuff well :)

2202