Knowledge Base

Find answers to common questions and learn more about our services

Clear

PowerShell Constrained Language mode considerations

## Overview Constrained Language (CL) mode limits PowerShell to approved cmdkits—useful for hardening but it breaks many RMM scripts and installer wr...
security-endpoint-protection msp seed-library
Jan 12, 2024 Read more →

Managing third-party antivirus transition to MDE

## Overview Moving from legacy AV to Microsoft Defender for Endpoint needs a coexistence and cutover plan to avoid coverage gaps. ## Discovery 1. I...
security-endpoint-protection msp seed-library
Jan 11, 2024 Read more →

Credential theft warnings: what to check first

## Overview Alerts mentioning LSASS access, token theft, or Mimikatz-like behavior require fast triage. This checklist reduces false positives and ca...
security-endpoint-protection msp seed-library
Jan 10, 2024 Read more →

Deploying Defender offline scan after malware detection

## Overview Microsoft Defender Offline (boot-level scan) helps remove persistent threats that resist normal cleaning. Use when layered detections sug...
security-endpoint-protection msp seed-library
Jan 9, 2024 Read more →

Security baselines: CIS vs Microsoft Secure Score

## Overview Clients compare you to benchmarks. CIS (Center for Internet Security) and Microsoft Secure Score measure different things—know how to exp...
security-endpoint-protection msp seed-library
Jan 8, 2024 Read more →

Isolating a compromised endpoint: standard play

## Overview Fast containment limits lateral movement. This is a field-tested sequence; adapt to your SOC runbooks and insurance requirements. ## Imm...
security-endpoint-protection msp seed-library
Jan 7, 2024 Read more →

Managing Tamper Protection across tenants

## Overview Tamper Protection prevents local admins (and malware) from disabling Microsoft Defender features. MSPs must standardize enforcement while...
security-endpoint-protection msp seed-library
Jan 6, 2024 Read more →

USB device control policies for regulated clients

## Overview USB removable media is a common data exfiltration and malware vector. Regulated clients often require deny-by-default with narrow excepti...
security-endpoint-protection msp seed-library
Jan 5, 2024 Read more →

BitLocker recovery key escrow in Azure AD

## Overview BitLocker keys must be escrowed to avoid permanent data loss. For Entra ID–joined devices, keys can be stored in Azure AD / Intune so aut...
security-endpoint-protection msp seed-library
Jan 4, 2024 Read more →

Application allowlisting with Windows Defender ASR rules

## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macros, script execution, and credential theft behavio...
security-endpoint-protection msp seed-library
Jan 3, 2024 Read more →

Handling Defender for Business false positives

## Overview False positives waste analyst time and train users to ignore alerts. This article standardizes how technicians triage Microsoft Defender...
security-endpoint-protection msp seed-library
Jan 2, 2024 Read more →

EDR deployment checklist for new workstations

## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that must join a managed tenant with Microsoft Defender...
security-endpoint-protection msp seed-library
Jan 1, 2024 Read more →