From 3df9ce77d6c68ed0b9a7d2f2d4ad27382b403897 Mon Sep 17 00:00:00 2001
From: Wesley van Tilburg <wesley.van.tilburg@referit.nl>
Date: Wed, 21 Oct 2026 11:31:14 +0000
Subject: [PATCH] fedora-intune: Defender script also turns on behavior
 monitoring

Behavior monitoring is off by default and the repair script never
checked it, so on devices without the image's managed config (another
distro, a plain install) it stayed off and the compliance rule failed.
Enable it, and cloud-delivered protection, when they're off and not
managed.

Only start mdatp-firstboot where the image installed it; elsewhere every
run logged that first-boot setup hadn't completed and tried to start a
unit that doesn't exist.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../intune/defender-remediation.sh            | 20 +++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/images/fedora-intune/intune/defender-remediation.sh b/images/fedora-intune/intune/defender-remediation.sh
index 403f542..5b8a668 100755
--- a/images/fedora-intune/intune/defender-remediation.sh
+++ b/images/fedora-intune/intune/defender-remediation.sh
@@ -56,7 +56,7 @@ if [[ ! -x "${MDATP}" ]]; then
 fi
 
 # The image finishes the Defender install on first boot (mdatp-firstboot).
-if [[ ! -f /var/lib/mdatp-firstboot.done ]]; then
+if [[ -x /usr/libexec/mdatp-firstboot && ! -f /var/lib/mdatp-firstboot.done ]]; then
   log "Defender first-boot setup has not completed; starting it."
   systemctl start mdatp-firstboot.service
 fi
@@ -93,18 +93,30 @@ if [[ -z "$(field org_id)" ]]; then
   fi
 fi
 
-# Settings Defender's own policy manages show " [managed]" and can't be
-# changed locally; this only fixes a locally disabled real-time protection.
+# Settings a managed config (mdatp_managed.json) sets show " [managed]" and
+# can't be changed locally; these fix devices without one, where behavior
+# monitoring is off by default. Behavior monitoring needs real-time
+# protection, so that goes first.
 if [[ "$(field real_time_protection_enabled)" != true ]]; then
   log "Real-time protection is off; enabling it."
   "${MDATP}" config real-time-protection --value enabled
 fi
 
+if [[ "$(field behavior_monitoring)" != enabled ]]; then
+  log "Behavior monitoring is off; enabling it."
+  "${MDATP}" config behavior-monitoring --value enabled
+fi
+
+if [[ "$(field cloud_enabled)" != true ]]; then
+  log "Cloud-delivered protection is off; enabling it."
+  "${MDATP}" config cloud --value enabled
+fi
+
 if [[ "$(field definitions_status)" != up_to_date ]]; then
   log "Definitions are not up to date; updating them."
   "${MDATP}" definitions update
 fi
 
 healthy="$(field healthy)"
-log "healthy=${healthy} licensed=$(field licensed) org_id=$(field org_id) rtp=$(field real_time_protection_enabled) definitions=$(field definitions_status)"
+log "healthy=${healthy} licensed=$(field licensed) org_id=$(field org_id) rtp=$(field real_time_protection_enabled) behavior_monitoring=$(field behavior_monitoring) cloud=$(field cloud_enabled) definitions=$(field definitions_status)"
 [[ "${healthy}" == true ]]