Intune on Phillip Büchler

Who Holds the Keys to Your Patching?

Sat, 31 Oct 2026 00:00:00 +0000

On 21 October, details of two critical PHP flaws leaked to VirusTotal at 02:29 UTC. By 07:34, hosting providers were reporting active exploitation, and PHP released the fix at 13:52, according to Recorded Future. Amazon later said the first exploitation attempts started on 17 October, four days before any patch existed.

In Patch Less I argued that the long tail of utilities on user devices should be patched automatically, with a third-party tool or Microsoft’s own catalogue. Timelines like this one are the reason. But that automation raises a question I keep coming back to: when you hand patching to a third-party tool, whose keys are you handing over?

Patch Less

Tue, 27 Oct 2026 00:00:00 +0000

More bugs, found faster

In 2025, 48,185 CVEs were published, about 21% more than in 2024. That’s roughly 130 a day, with a clear preference for Tuesdays. Not all of them are your problem. The biggest single source was a company that reports WordPress plugin bugs, and I’m fairly sure nobody runs WordPress on their CEO’s laptop.¹

The direction matters more than the number, and AI is pushing it from both ends. Google’s Big Sleep agent reported its first 20 vulnerabilities in August 2025, mostly in FFmpeg and ImageMagick. Those aren’t exotic projects. They sit inside a lot of desktop software your users run every day. On the other end, Mandiant’s M-Trends 2026 estimates the mean time to exploit at minus seven days. On average, exploitation now starts before the patch exists. And according to the Verizon 2026 DBIR, organisations took a median of 43 days to fix vulnerabilities, up from 32 the year before.

Newsletter Recommendations

Fri, 02 Dec 2022 00:00:00 +0000

This week I subscribed to a newsletter. The author was hesitant to start one but was worried that his current distribution channel will not be there forever. Guess where he posts today?

Anyway, newsletters had a renaissance for quite some time now. I subscribed and enjoyed a couple of them, related to my current line of work.

Intune Newsletter by Andrew Taylor

Weekly collection of links around all sorts of Cloud based Endpoint Management topics. https://andrewstaylor.com/category/newsletter/

Running Microsoft iOS Applications on an M1 Mac

Thu, 12 May 2022 00:00:00 +0000

With the introduction of the M1 processors for Apple Macs, there came the possibility to run iOS applications on your Mac. Would that allow users to use Microsofts Office applications on their Mac? And if so, would those apps respect App Protection policies that a company defines?

The installation of iOS apps on Macs is straightforward. A good tutorial can be found on the site of document tool creator Readdle.

Application developers can define if their applications should run on Mac, as there are some limitations, which might reflect badly on the users impression of an app. The Office applications, like Teams, Outlook, or OneDrive are not available with this method. Understandably, as Microsoft offers native Mac apps. As with most things, there used to be simple workarounds, but as of now, Apple seems to have pulled the plug on the easy ones.

Was macht den modernen Client denn modern?

Mon, 25 May 2020 00:00:00 +0000

Jede Veränderung in der Informatik¹ wird begleitet von neuen Begrifflichkeiten. Das Heer an Beratern und Produktherstellern muss ja Futter haben um auf Kundenfang zu geben. Ein sehr häufiger Begriff in meinem Alltag ist der “moderne Client”. Sei dies bezogen auf die Verwaltung von Endgeräten, Verteilung von Anwendungen oder die Kontrolle und Durchsetzung von Richtlinien - alles muss heute modern sein. Doch was macht denn den Kübel auf dem Tisch plötzlich modern? Das ich darauf mit einem Stift kritzeln kann? Oder reicht es schon ohne LAN-Kabel mit dem Internet verbunden zu sein? Und wenn ich jetzt meine Geräteflotte mit MobileIron, Airwatch oder Intune verwalte, bin ich dann schon modern?

Windows 10 can't save pictures from the camera.

Tue, 24 Sep 2019 00:00:00 +0000

That was the error that a user reported which eventually landed on my desk. In the project I am responsible for Intune Device Management and so the thinking was, that there must be a policy that blocks the Camera app. There is not. But why this error then?

Error Message with WIP

Let me put the error here for Google to index:

Sorry — we weren’t able to save the photo. If you nee it, here’s the error code: 0xA00F4253 (0x80070005)

Office Custiomization Tool und eine Empfehlung zum Configuration Management

Mon, 15 Apr 2019 00:00:00 +0000

Unternehmen haben beim Umstieg auf moderne Client Verwaltung oftmals Bedenken bei der Anpassung von Office. Klassischerweise werden viele Richtlinien im Office-Paket mitgegeben um es an die Anforderungen der Unternehmen anzupassen.

Dabei gibt es in der modernen Client Verwaltung ein unbekannts Juwel — das “Office Customization Tool”. In der Weboberfläche werden die verschiedenen Konfiguration direkt vorgenommen. Diese Konfigurationen werden in einer XML-Datei gespeichert und können beim Setup so mitgegeben werden.

Schauen wir uns das doch mal näher an. Im Minimum, und dies bietet das Tool schon länger, besteht die Konfiguration aus den Produkten die Office installieren soll (bspw. Access integriert oder nicht, etc.). Dann wählt man die Architektur (32 oder 64bit) und in welcher Häufigkeit die Updates aus welcher Quelle installiert werden sollen.