Here’s what caught my attention this week.
Microsoft made a few changes worth reviewing after this month’s updates, Windows 11 Pro 24H2 has reached end of support, and there are some useful Intune deployment examples for Sysmon and Global Secure Access.
Administrator protection is now enabled by default in Windows security baselines
Microsoft’s October 13 announcement says Administrator protection becomes enabled by default when using the Windows security baselines for Windows 11 24H2, 25H2, and 26H2.
Administrator protection is designed to let users run with standard privileges and elevate when needed, with explicit user approval.
Microsoft’s Windows Message Center announcement
Windows 11 24H2 Pro has reached end of support
October 13 was the final update date for Windows 11 24H2 Pro. Devices on that edition no longer receive monthly security updates. Windows 11 24H2 Enterprise and Education remain supported until October 12, 2027.
Windows 11 release and lifecycle information
ReFS on removable drives is moving toward enforcement
Microsoft is introducing new controls for ReFS volumes mounted from removable or externally attached media. ReFS on removable media isn’t a supported configuration, and the October 13 update starts the audit phase.
For now, Windows logs warning event 524 from the ReFS source when it detects an affected volume. Starting with the January 2027 security update, blocking becomes the default unless an administrator changes the policy. The new RefsRemovableDeviceMountPolicy setting supports Off, Audit, and Block modes.
Microsoft’s ReFS hardening guidance
Sysmon is now an optional Windows feature you can deploy with Intune
Peter van der Woude put together a guide for enabling Sysmon on Windows 11 using Intune. Sysmon has been available as a built-in optional feature since February, but it still needs to be enabled, installed, and configured.
Peter’s approach wraps a PowerShell script in a Win32 app, checks the optional feature’s state, and uses detection logic to verify the result.
Deploying and troubleshooting Global Secure Access with Intune
Andy Kemp has published a two-part series on deploying the Global Secure Access Windows client through Intune and investigating its traffic-forwarding decisions.
The second part gets into a useful troubleshooting question: where is a particular connection actually going? Andy walks through using forwarding rules and connection-level evidence to understand why traffic is tunnelled or sent directly.
Deploying the client with Intune · Understanding traffic forwarding and diagnostics
That’s it for this week.
Do you have a suggestion for this newsletter? Let me know in the comments.