das BulkEnrollment-Tool (MDE-AutoAADjoin.exe), das den Sophos deinstalliert, AAD-Join durchführt und Defender4Endpoint aktiviert wurde aktualisiert.

Wir haben die Dateien am Webserver (https://go.ur.de/mde-autoaadjoin-x64) und im Softwarekatalog aktualisiert, da ein hinterlegtes Zertifikat/Schlüssel abgelaufen ist.

Bitte verwenden Sie keine älteren Kopien, sondern laden Sie die aktuelle Version herunter.

Sophos will no longer be supported by the RZ as of 26 July 2023!

Unfortunately, this has significant consequences.
ALL service devices and PCs must be "joined".   ( PC, notebook, etc. )
Who still has Sophos then, will be disconnected from the network from 26 July by the RZ.   (says the RZ!...robust).

Why and what is it?
To keep the Bitdefender from Microsoft DSGVO compliant the RZ needs a changeover for ALL PCs and thus {quasi} access.
To do this EVERY PC needs to be joined.

This can be done with this SKRIPT for extensive automatic AAD Join :
( Copy to local harddisk and execute there )
  ( But I still don't quite see through why this circus is necessary )
Laufwerk W:\   ../FILEs/MDE-AutoAADJoin_x64/MDE-AutoAADJoin_x64.exe         ( Auf Lokale Festplatte kopieren und dort ausführen )

Consequences:
1. the RZ demands a considerable intervention in the login procedure of the PC.
Beside the (normal LocalAdmin login there is an additional login ( without admin rights )
The RZ wants that one uses rather this.   (probably rather for future installations)
But the old "Local Admin" user remains.

2. WICHTG is a RZ compliant naming of the PC. in the field computer name --> "computer description".
PC1011405678 = device number ) RZ name conformity rules!  ??
See "Full computer name"
so in the form like:    PC1011901110 or PC1011235024X
If this is not the case, PC as mentioned on the RZ sticker then, change before joining!!!
Otherwise the join process simply aborts without completion message.
--> Search for "Advanced System Properties


3. private PCs should not be joined
...  Here can be uninstalled possibly only Sophops: with sophos-uninstall-zap.exe

The following instructions describe how to perform bulk enrollment for Windows devices in Microsoft Intune.
This connects the devices to Azure AD, Microsoft's cloud-based directory service,
integrated with Intune device management, and
Included in the Defender for Endpoint portal.
It also removes the Sophos Endpoint Protection virus scanner.
This is actually for admins.  Instructions MDE_Intune_BulkEnrollment.pdf
......Simplified instructions are still to come via RZ Mail.

Unlike manual enrollment, bulk enrollment does not join an administrative Azure account.
The login after the join is done differently than before:
Local accounts instead of LocalUsername now with .\LocalUsername and Azure accounts with vip12345@ads.uni-regensburg.de.
The package has an expiration date after which it can no longer be used.