From 49b360dffa2546d9cfc7d5753f21a404bdc93476 Mon Sep 17 00:00:00 2001 From: Wesley van Tilburg Date: Tue, 20 Oct 2026 13:47:07 +0000 Subject: [PATCH] fedora-intune: take the first Defender health snapshot right after boot The first snapshot came 2 minutes after boot, so the compliance check at the first sign-in found none, fell back to mdatp (which won't answer it) and reported Defender as not running. Himmelblau then doesn't check again for 8 hours. Start the timer 20 seconds after boot, and wait up to 2 minutes for the daemon to answer so that snapshot isn't a false "not running". The timer runs it in the background, so boot isn't held up. Co-Authored-By: Claude Opus 5.5 (1M context) --- images/fedora-intune/files/mdatp-health-snapshot | 7 +++++++ images/fedora-intune/files/mdatp-health-snapshot.timer | 4 +++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/images/fedora-intune/files/mdatp-health-snapshot b/images/fedora-intune/files/mdatp-health-snapshot index acdf0d7..c7cf1d7 100644 --- a/images/fedora-intune/files/mdatp-health-snapshot +++ b/images/fedora-intune/files/mdatp-health-snapshot @@ -24,6 +24,13 @@ FIELDS=( app_version ) +# Right after boot the daemon may not answer yet; give it up to 2 minutes so +# the first snapshot isn't a false "not running". +for _ in $(seq 1 24); do + [[ "$("${MDATP}" health --field healthy 2>/dev/null | tail -n1)" =~ ^(true|false)$ ]] && break + sleep 5 +done + tmp="$(mktemp -d "${DEST}.XXXXXX")" trap 'rm -rf "${tmp}"' EXIT for field in "${FIELDS[@]}"; do diff --git a/images/fedora-intune/files/mdatp-health-snapshot.timer b/images/fedora-intune/files/mdatp-health-snapshot.timer index 0d934e1..4e41c50 100644 --- a/images/fedora-intune/files/mdatp-health-snapshot.timer +++ b/images/fedora-intune/files/mdatp-health-snapshot.timer @@ -2,7 +2,9 @@ Description=Save Microsoft Defender health every 5 minutes [Timer] -OnBootSec=2min +# Early, so the compliance check at the first sign-in after boot finds a +# snapshot; Himmelblau doesn't check again for 8 hours. +OnBootSec=20s OnUnitActiveSec=5min [Install] -- 2.54.0