2 Commits

Include renames

Author	SHA1	Message	Date
Wesley van TilburgandClaude Opus 5.5	49b360dffa	fedora-intune: take the first Defender health snapshot right after boot ... The first snapshot came 2 minutes after boot, so the compliance check at the first sign-in found none, fell back to mdatp (which won't answer it) and reported Defender as not running. Himmelblau then doesn't check again for 8 hours. Start the timer 20 seconds after boot, and wait up to 2 minutes for the daemon to answer so that snapshot isn't a false "not running". The timer runs it in the background, so boot isn't held up. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 13:47:07 +00:00
Wesley van TilburgandClaude Opus 5.5	111d3bea66	fedora-intune: give the Intune compliance check a Defender health snapshot ... Himmelblau runs the custom compliance script inside himmelblaud-tasks, and Defender refuses to answer `mdatp health` there: the daemon can't read /proc/<himmelblaud_tasks>/cmdline while checking the caller ("Permission denied" in microsoft_defender_err.log). The script saw no daemon, and every Defender rule failed although Defender was healthy. Add mdatp-health-snapshot.timer, which saves the health fields to /run/mdatp-health every 5 minutes as root, outside that service. The compliance script reads the snapshot when it's under 20 minutes old and otherwise asks mdatp directly, so it still works on other distros. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 13:23:17 +00:00