Wesley van TilburgandClaude Opus 5.5
3df9ce77d6
Behavior monitoring is off by default and the repair script never checked it, so on devices without the image's managed config (another distro, a plain install) it stayed off and the compliance rule failed. Enable it, and cloud-delivered protection, when they're off and not managed. Only start mdatp-firstboot where the image installed it; elsewhere every run logged that first-boot setup hadn't completed and tried to start a unit that doesn't exist. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>