Behavior monitoring is off by default and the repair script never
checked it, so on devices without the image's managed config (another
distro, a plain install) it stayed off and the compliance rule failed.
Enable it, and cloud-delivered protection, when they're off and not
managed.
Only start mdatp-firstboot where the image installed it; elsewhere every
run logged that first-boot setup hadn't completed and tried to start a
unit that doesn't exist.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A paste into Intune that lost the first "{" line produced an unreadable
mdatp_onboard.json, and Defender reported "No license found". Check that
the pasted JSON parses and has onboardingInfo before writing it, and log
what to fix otherwise.
The placeholder also appeared twice, so a find-and-replace of it broke
the script; match it by prefix so it appears only once.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Himmelblau installs Intune Linux custom configuration scripts as
/etc/cron.d jobs, and the image had no cron, so a script policy failed to
apply. Add cronie and enable crond.
Add a custom configuration script that repairs Microsoft Defender on its
schedule: finishes first-boot setup, restarts a stopped daemon, onboards with
the tenant's mdatp_onboard.json (pasted into the script in Intune), and
re-enables real-time protection and updates definitions when needed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Wesley van TilburgandClaude Opus 5.5