0

As we have moved to Intune, we have "managed" nearly everything. Making Intune the only local administrator needed on most of our PCs.

Reaching the edges of this policy, I would like to make it possible for a technician to customize a PC. While somehow knowing which PCs may have been customized. The assumption being, any PC found to have had an administrator logon and/or elevate should be considered "customized".

I am aware of enabling Sensitive Privilege Use auditing, then watching for Security log event ID 4673. For my purposes, an Azure AD SID (starting S-1-12-1-) is likely a human. However, I only need to find one entry to know this has happened. Besides, the added audit entries are noisy, scanning the Security log is slow and prone to failure due to logs rolling and the entries are not useful, in that they do not capture the information you would expect.

Is there any other way to detect when a human has elevated on a PC?

1 Answer 1

0

DSC - Desired state configuration - might be overkill for what you want but believe it might do the trick. depends on the configured parameters Configuration as code https://learn.microsoft.com/en-us/powershell/dsc/getting-started/wingettingstarted?view=dsc-1.1

2
  • I like the way you are thinking. If only the Intune team had used Desired State Configuration (DSC). Even then, someone granted local admin would have a wide-open playground available to them. My end goal is to give a different level of support to any PC that someone has elevated their credentials on, as it is difficult to know exactly what they did after that. They don't even know. "I ran suchnsuch.exe" May 9, 2023 at 13:52
  • Ideally, no one should have elevated creds. If they need to install something either IT does it, or we upload the app to the company portal so they can do it.
    – GarudaLead
    Jul 15, 2023 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .