Defender Offboarding using Intune - The EDR way!

-

Every now and then, I get asked by customers for ways of offboarding devices from Defender for Endpoint for various reasons. Most of the time it involves troubleshooting of some sort which requires going off MDE altogether. While I normally recommend to use put the device in troubleshooting mode, sometimes, it is just not the way to go. And therefore, one finds themselves offboarding the devices. 

Until now, I had been using the OMA-URI way of offboarding a device in Intune, but recently I stumbled upon another way which I had no idea it ever existed. Did you know that you can use EDR to offboard a device? Surprise, surprise. I always used EDR under endpoint security in Intune, to use the blob connector to onboard a device. However, the same EDR profile also allows offboarding devices using value from the WindowsDefenderATP offboarding package. Here is how you can go about -

1. Head over to the Microsoft Defender admin portal.
2. Navigate to Settings > Endpoints > Offboarding and grab the downloading package for Windows 10 and 11 using Microsoft Intune as the deployment method.


3. Once downloaded, copy the content of the .offboarding script as shown below -



4. On the Microsoft Intune admin center, navigate to Endpoint security > Endpoint detection and response and click on Create policy.
5. Give a name.
6. Select 'Offboard' against 'Microsoft Defender for Endpoint client configuration package type'.
7. Against 'Offboarding (Device)' setting, paste the value from .offboarding script we grabbed earlier. You will notice that the value is pasted in hidden form. This is by design.


7. Rest of the settings can be left with default values.
8. Assign the policy to a group of devices for offboarding. Note: Make sure to exclude this group from any onboarding policies you may have created in Intune.


End Result

After the device receives the policy, the offboarding will start. This will be evident in the device timeline events in the Defender Portal.


 
The command, SenseIR.exe OfflineSenseIR 5800 is part of the offboarding package that Microsoft provides when you want to disconnect an endpoint from Microsoft Defender for Endpoint (MDE).

Here’s what it means:

SenseIR.exe > The executable included in the offboarding package (downloaded from the Microsoft 365 Defender portal).

OfflineSenseIR > The command-line argument telling it to run in offline offboarding mode.

5800 > An identifier/version argument used for the specific package.

The device will no longer be onboarded and the status will change both on the device and in Intune.



Final thoughts

The offboarding process is a lot similar to using the custom CSP ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding. However, in my honest opinion, the process has been made a lot simpler using the EDR policy. You only need to extract the value of the .offboarding script and you are good to go.

Comments

Post a Comment

Popular posts from this blog

How to force escrowing of BitLocker recovery keys using Intune

-
Image
Every now and then it so happens that BitLocker recovery keys do not escrow in AAD. The usual culprits are incorrect BitLocker policies and\or the device hardware configuration failing to meet the minimum requirements. The other scenario and something I recently experienced is when everything is setup right and still the recovery key doesn’t escrow in AAD. As I understand, this can happen if the escrow process got interrupted the first time due to network or local devices related issues and the process could not resume. To circumvent this issue, one can simply push a PowerShell script to the devices to force the escrow of the recovery keys to AAD. Here is a script to do so. try{ $BitlockerVol = Get-BitLockerVolume -MountPoint $env:SystemDrive         $KPID=""         foreach($KP in $BitlockerVol.KeyProtector){             if($KP.KeyProtectorType -eq "RecoveryPassword"){              ...
Read more

Fixing Tamper Protection Blob Error 65000 using Microsoft Intune

-
Image
I recently encountered an issue with enabling Tamper protection as part of the implementation of Defender for Endpoint in one of customer's tenant and considering how unusual the behavior was and how I didn't encounter this before, I decide to blog my experience. If you have been battling with the same issue, then this blog may just help you. There are multiple ways to enable Tamper protection as part of MDE. One can enable at a tenant level using Defender portal or do it using Intune. I normally choose the Intune, especially when dealing with endpoints to maintain uniformity with other Defender policies being managed by Intune. However, in this particular instance, the issue started cropping randomly on some endpoints where tamper protection would not enable and throw an error code 65000, as show below. Additionally, the status in Defender will report as Unknown instead of reporting Active or something else like EDR in block mode to suggest that Defender Antimalware is running...
Read more

Prevent users from running certain programs or applications on Windows endpoints using Intune

-
Image
  When it comes to blocking or preventing users from running an application on Windows devices, one normally uses App locker policy, Windows Defender Application Control and not so new but pretty useful method called Defender Vulnerability management within Microsoft 365 Defender Portal. A recent question on the Tech Community Microsoft forum prompted me to look for all possible alternatives. I started reminiscing over the legacy GPO policies and that is when I stumbled upon the policy  Don’t run specified Windows applications  located under User Administrative Templates - The policy setting does come with its own caveat - " This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from st...
Read more