Website Technology Profiler

{
  "PageContent": "Thomas Marcussen - Everything System Center Professional with a passion for technologyThomas MarcussenMicrosoft is offering clients an updated Intune Connector for Active Directory and this connector is what Intune will be using starting from Intune 2501. This connector uses Windows Autopilot to deploy devices that are Microsoft Entra hybrid joined.The updated version of the connector aims to enhance security and will be using a Managed Service Account (MSA) instead of a SYSTEM account. Customers currently using the old version of the Intune Connector for Active Directory (that uses the local SYSTEM account) should know that this connector will no longer have support, starting in late June 2025.Therefore, it’s important to start planning for the update because once support ends, enrollments from the old connector build will no longer be acceptable.Key Features of the Intune ConnectorThe main role of the Intune Connector for Active Directory is to join computers to an on-premises domain and add them to an organizational unit (OU) allowing for central management and policies.The Intune Connector also places joined computers within a specific OU, something that helps establish granular control over device configurations and settings. Furthermore, customers will also benefit from hybrid enrollment of devices which offers the convenience of device management by both on-premises AD and Intune.The Intune Connector plays a key role in leveraging Windows Autopilot to set up and deploy devices. And for all those already using Autopilot, they will know that this feature will have a huge impact in making life easier for customers by simplifying deployment processes.In addition to all the above, the Intune Connector ensures that the policies defined in both AD and Intune continue to enforce, thus offering compliance and consistency.Why Switch to Managed Service Accounts?As the new version of the Intune Connector for Active Directory makes the change to using Managed Service Accounts, it’s important to understand why they are important. The use of MSAs will enable the new connector to follow least privilege principles and thereby strengthen security.With MSAs, clients enjoy managed domain accounts that have automatic password management. They are also generally permissible with privileges to perform their duties. With such measures in place, there is a reduction in the risk of compromise, intentional or otherwise.You can only use standalone MSAs on one domain-joined machine and can thus only access resources within that domain. MSAs can easily and securely run services on a computer while simultaneously maintaining the capability to connect to network resources as a specific user principal. When taking all of this into account, it’s not difficult to see why Microsoft views the use of MSAs as better for the Intune Connector moving forward.Securing The FutureThe security update to the Intune Connector for Active Directory fits in seamlessly with Microsoft’s Secure Future Initiative. Microsoft is uniquely ideal within the tech industry to play a key role in safeguarding the future for all its clients.As such, the tech giant is taking a comprehensive approach to cybersecurity with a key focus on certain areas that are critical to enhancing security across the board. There continues to be substantial progress in these areas:identity and secret protectionUpdates to Entra ID and Microsoft Account (MSA) are live for both public and U.S government clouds to generate, store, and automatically rotate access token signing keys using the Azure Managed Hardware Security Module (HSM) service.Microsoft has continued to drive broad adoption of its standard identity SDKs, which provide consistent validation of security tokens. As a result, we now see this standardized validation covering more than 73% of tokens issued by Microsoft Entra ID for Microsoft owned applications.Tenant Protection and Isolation of Production SystemsA full iteration of app lifecycle management for all production and productivity tenants has been performed. This has resulted in the elimination of 730,000 unused apps. Additionally, because of the elimination of 5.75 million inactive tenants, the potential cyberattack surface has become significantly smaller.Not only that, but a new system to streamline the creation of testing and experimentation tenants with secure defaults is available. It also enforces a strict lifetime management.Protect networksMore than 99% of physical assets on the production network record in a central inventory system. This enriches asset inventory with ownership and firmware compliance tracking. Virtual networks with backend connectivity are isolated from the Microsoft corporate network, as well. They are additionally subject to complete security reviews to reduce lateral movement.With the expansion of platform capabilities such as Admin Rules to ease the network isolation of platform as a service (PaaS) resources such as Azure Storage, SQL, Cosmos DB, and Key Vault, Microsoft has made it easier for customers to secure their own deployments.Protection of engineering systemsWe are now experiencing more consistent, efficient, and trustworthy deployments because 85% of production build pipelines for the commercial cloud are now using centrally governed pipeline templates.Other notable changes include shortening the lifespan of Personal Access Tokens to seven days, disabling Secure Shell (SSH) protocol access for all Microsoft internal engineering repos, and massively reducing the number of elevated roles with access to engineering systems.Moreover, proof of presence checks for critical chokepoints in software development code flow are now available.THREAT DETECTION AND MONITORINGA lot of progress continues toward the goal of pushing all Microsoft production infrastructure and services to adopt standard libraries for security audit logs. Additional efforts include those to emit relevant telemetry and to retain logs for a minimum of two years.A good example is the establishment of central management and a two-year retention period for identity infrastructure security audit logs, including all security audit events throughout the lifecycle of current signing keys. Add to this the fact, that no less than 99% of network devices now have enablement with centralized security log collection and retention.We can now observe improved time to mitigate for critical cloud vulnerabilities because of the recent process updates across Microsoft. Customers will also appreciate the greater transparency provided by the publishing of critical cloud vulnerabilities as common vulnerability and exposures (CVEs). This is especially helpful even when there are no direct customer action requirements. In addition to this, the establishment of the Customer Security Management Office (CSMO) will go a long way to improve public messaging and customer engagement for security incidents. Required PermissionsAs we look at the new version of the Intune Connector for Active Directory, one of the key areas that can help us distinguish this new connector from its previous version is doing a comparison of account permissions: Old ConnectorNew ConnectorLogged On AccountSYSTEMDomain/MSAPassword ManagementSet by user, subject to domain rulesManaged by domain only – automatically resetPrivilege Set SizeMAX5 Privileges:   SeMachineAccountPrivilege – Disabled default SeChangeNotifyPrivilege – Enabled Default SeImpersonatePrivilege  –  Enabled Default SeCreateGlobalPrivilege –   Enabled Default SeIncreaseWorkingSetPrivilege – Disabled defaultRegistry Access RightsFull, implicitRead write, explicitEnrollment Certificate RightsFull, implicitFull, explicitCreate Computer Object Rights (required for hybrid Autopilot scenario)Unlimited if connector is on the same machine as domain controller. Delegation is required if connector is not on the domain controller.Explicit delegation requiredPre-requisitesAs with any product or application, there are certain requirements that all customers intending to use the Intune Connector for Active Directory will need to meet. So, before proceeding with the set up of the new Intune Connector, you need to verify that you can meet all the pre-requisites. These requirements include:The computer you’re installing Intune Connector for Active Directory to must be running Windows Server 2016 or later. You should also verify that you have .NET Framework version 4.7.2 or later installed.To facilitate communication with Microsoft’s Intune service, the server hosting the Intune Connector should have internet access.The Intune Connector will need standard domain client access to domain controllers.Customers must verify that they have a Microsoft Entra account with Intune Service Administrator permissions, as this is a requirement to download and manage the connector.Also needed will be a domain account with local administrator privileges and the ability to create msDS-ManagedServiceAccount objects.Verify that the Windows Server configuration aligns with the Desktop Experience and, for versions 2019 or earlier, install the Microsoft Edge browser manually before connector setup.The Microsoft Entra account should have an Intune license assigned to it.For those that will be using Hybrid Azure AD Join, they should check that it’s configured via Azure AD Connect tool.Lastly, the Intune Connector machine must have the appropriate delegated permissions to create computer objects in the target OU.Setting Up The ConnectorTo setup the new Intune Connector for Active Directory, you need to start by uninstalling the existing connector. You can do this by uninstalling from the Settings app on Windows and then, uninstalling using the ODJConnectorBootstrapper.exe (select Uninstall). With that done, you can download the connector build from Intune and then perform the installation (as described in detail in my previous blog).Configuring organizational units (OUs) for domain joinCustomers should be aware that by default MSAs won’t have access to create computer objects in any Organizational Unit (OU). Thus, if you intend to use a custom OU for domain join, you’ll need to update the ODJConnectorEnrollmentWiazard.exe.config file. Fortunately, this is something you can do before or after connector enrollment:Update ODJConnectorEnrollmentWizard.exe.config:Default location is “C:\\Program Files\\Microsoft Intune\\ODJConnector\\ODJConnectorEnrollmentWizard”Add all the OUs required in OrganizationalUnitsUsedForOfflineDomainJoinOU name should be the distinguished name.You need to be aware that the MSA is only granted access to the OUs configured in this file (and the default Computer’s container). This means that if any OUs are removed from this list, completing the rest of the steps will revoke access.Open ODJConnectorEnrollmentWizard (or restart it if it was open) and select the “Configure Managed Service Account” button. If successful, a pop up will appear showing success.Using the Intune Connector with multiple domainsFor those who are already using the connector with more than one domain, they will be able to use the new connector by setting up a separate server per domain and installing a separate connector build for each domain.Configuring the connectorCustomers should install the Intune Connector for Active Directory on each of the domains that they want to use for domain join. In case a second account redundancy is required, customers must install the connector on a different server (in the same domain).Go through the connector configuration steps meticulously and verify that everything has been done correctly. Also check that the MSA has the appropriate permissions on the desired OUs.Verify that all connectors are present in the in the Microsoft Intune admin center (Devices > Enrollment > Windows > under Windows Autopilot, select Intune Connector for Active Directory) and that the version is greater than 6.2501.2000.5.Configure Domain Join profileFollow the steps given below.Start by creating a domain join profile for each domain that you want to use for hybrid joining devices during Autopilot.Target the domain join profile to the appropriate device groups.Wrap UpThe Intune Connector for Active Directory provides an essential tool for managing hybrid devices in an Intune environment. With its many available features, customers will get centralized management capabilities for their environments thus allowing businesses to operate more efficiently.But, with security having been a big concern for many, Microsoft has made the switch to using a Managed Service Account instead of a SYSTEM account. This action has effectively tightened security in customers’ environments. Going forward, the previous version of the Intune Connector will no longer be supported. Therefore, if you are yet to download and set up the new Intune Connector for Active Directory, the sooner you do the better.",
  "Url": "https://blog.thomasmarcussen.com",
  "IpAddress": "104.21.69.152",
  "ReverseDns": null,
  "Asn": null,
  "Http2": false,
  "Http3": false,
  "ResponseTimeMs": 1731,
  "StatusCode": 200,
  "ServerHeaders": [
    "cloudflare"
  ],
  "Ssl": {
    "Issuer": "CN=WE1, O=Google Trust Services, C=US",
    "Subject": "CN=thomasmarcussen.com",
    "NotBefore": "2025-12-24T14:18:48-08:00",
    "NotAfter": "2026-03-24T16:16:41-07:00",
    "SubjectAltNames": [
      "DNS Name=thomasmarcussen.com",
      "DNS Name=*.thomasmarcussen.com"
    ],
    "Hsts": false,
    "Ciphers": [],
    "Protocol": "Tls13",
    "DaysUntilExpiry": 51
  },
  "Cdns": [
    "Cloudflare"
  ],
  "HostingHints": [],
  "Cms": [
    "WordPress"
  ],
  "Frameworks": [
    "jQuery"
  ],
  "JsLibraries": [],
  "Analytics": [
    "Google Analytics GA4"
  ],
  "AdsAndMarketing": [],
  "PaymentGateways": [],
  "EcommerceHints": [
    "Magento",
    "PrestaShop"
  ],
  "SocialSignals": [],
  "MediaProviders": [],
  "SeoTags": [
    "content-type: text/html; charset=UTF-8"
  ],
  "HtmlLanguage": "en-US",
  "HasRobots": true,
  "HasSitemap": true,
  "SecurityHeaders": [],
  "CookiesObserved": [],
  "XhrApiHints": [],
  "SitemapCounts": {
    "total_urls": 5
  },
  "ChatWidgets": [],
  "ABTesting": [],
  "PrivacyConsent": [],
  "EmailMarketing": [],
  "WebFonts": [],
  "DynamicJs": [
    "jQuery (CDN Detection)",
    "Web Server: cloudflare",
    "jQuery (script Resource)",
    "Cloudflare (script CDN)",
    "ES6+ JavaScript Features",
    "Foundation (CSS Classes)",
    "Bootstrap (CSS Classes)",
    "jQuery (Script Analysis)"
  ],
  "ResourceHosts": [
    "static.addtoany.com",
    "c0.wp.com",
    "blog.thomasmarcussen.com",
    "stats.wp.com",
    "static.cloudflareinsights.com",
    "gmpg.org",
    "secure.gravatar.com",
    "v0.wordpress.com",
    "jetpack.wordpress.com",
    "s0.wp.com",
    "public-api.wordpress.com",
    "0.gravatar.com",
    "1.gravatar.com",
    "2.gravatar.com",
    "i0.wp.com",
    "wp.me"
  ],
  "CssFrameworks": [],
  "BuildTools": [],
  "ServerTech": [
    "Generator: WordPress 6.9",
    "PHP (inferred from WordPress)"
  ],
  "DatabaseHints": [],
  "PageTitle": "Thomas Marcussen - Everything System Center Professional with a passion for technologyThomas Marcussen | Everything System Center Professional with a passion for technology",
  "MetaDescription": "Everything System Center Professional with a passion for technology",
  "ImageCount": 11,
  "ScriptCount": 20,
  "LinkCount": 27,
  "Errors": [
    "Reverse DNS failed: No such host is known."
  ],
  "UiFrameworks": [
    "Slate",
    "Swiper",
    "Bootstrap (Class Names)",
    "Vuetify (Class Names)",
    "Angular Material (Class Names)",
    "Ionic (Class Names)"
  ]
}