4 Commits

Include renames

Author	SHA1	Message	Date
Wesley van TilburgandClaude Opus 5.5	ebe1d80f80	fedora-intune: enforce Defender protection settings ... Defender's defaults left behavior monitoring off and every setting unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json: real-time protection, behavior monitoring, PUA blocking, cloud-delivered protection at the high block level, automatic definition updates and sample submission, and scheduled scans (daily quick at 12:00, weekly full on Wednesday 12:30, low priority). Users can't change managed settings. The build fails if the file isn't valid JSON. Network protection (Insiders channels only) and tamper protection (audit-only preview on Linux) are left out. The compliance script and rules now also check behavior monitoring and cloud-delivered protection. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 12:19:17 +00:00
Wesley van TilburgandClaude Opus 5.5	4213575206	fedora-intune: validate the onboarding JSON in the Defender script ... A paste into Intune that lost the first "{" line produced an unreadable mdatp_onboard.json, and Defender reported "No license found". Check that the pasted JSON parses and has onboardingInfo before writing it, and log what to fix otherwise. The placeholder also appeared twice, so a find-and-replace of it broke the script; match it by prefix so it appears only once. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 12:10:58 +00:00
Wesley van TilburgandClaude Opus 5.5	6afa1d21e6	fedora-intune: cron for Intune config scripts, Defender remediation script ... Himmelblau installs Intune Linux custom configuration scripts as /etc/cron.d jobs, and the image had no cron, so a script policy failed to apply. Add cronie and enable crond. Add a custom configuration script that repairs Microsoft Defender on its schedule: finishes first-boot setup, restarts a stopped daemon, onboards with the tenant's mdatp_onboard.json (pasted into the script in Intune), and re-enables real-time protection and updates definitions when needed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 09:15:28 +00:00
Wesley van TilburgandClaude Opus 5.5	75c3b502d7	fedora-intune: report full image version to Intune, Defender compliance script ... Himmelblau reports VERSION_ID from /etc/os-release as the device OS version, so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own os-release (bind-mounted in their mount namespace only) with VERSION_ID set to OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock VERSION_ID that toolbox, flatpak and dnf expect. Add an Intune custom compliance discovery script and rules for Microsoft Defender for Endpoint (installed, running, onboarded, licensed, healthy, real-time protection, definitions up to date). These are uploaded to Intune, not shipped in the image. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 09:13:03 +00:00