Wesley van TilburgandClaude Opus 5.5
5504f4e7aa
The managed config shipped in /etc never reached updated devices: mdatp-firstboot creates /etc/opt/microsoft/mdatp on the device, so ostree's /etc merge treats that directory as local and doesn't add new image files under it. VM 123 had the file in /usr/etc but not in /etc, and Defender kept its defaults. Ship it in /usr/share/mdatp-managed/ and install it into /etc/opt/microsoft/mdatp/managed/ from an ExecStartPre in mdatp.service. This also applies changes from newer images and undoes local edits. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
8 lines
530 B
Plaintext
8 lines
530 B
Plaintext
# Install the image's enforced Defender settings each time Defender starts.
|
|
# The image can't ship them in /etc directly: mdatp-firstboot creates
|
|
# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts
|
|
# as local and ostree's /etc merge never adds new files under it. Copying on
|
|
# every start also picks up changes from newer images and undoes local edits.
|
|
[Service]
|
|
ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json
|