Knowledge Base

Find answers to common questions and learn more about our services

Email link sandboxing expectations for clients

## Overview Defender for Office 365 Safe Links rewrites URLs and scans at click-time. Clients need realistic expectations about delays and rare break...
security-endpoint-protection msp seed-library
Jan 17, 2024 Read more →

Chrome/Edge extension allowlist policy

## Overview Malicious extensions steal cookies and session tokens. Allowlisting reduces risk; balance against user demand. ## Build the catalog 1....
security-endpoint-protection msp seed-library
Jan 16, 2024 Read more →

Local admin rights: just-in-time elevation patterns

## Overview Standing local admin for all users increases malware blast radius. JIT elevation grants temporary admin for approved tasks. ## Patterns...
security-endpoint-protection msp seed-library
Jan 15, 2024 Read more →

Securing RDP: gateway vs VPN vs Private Access

## Overview Exposed RDP is one of the top ransomware vectors. Present three patterns to clients with clear tradeoffs. ## Option comparison | Patter...
security-endpoint-protection msp seed-library
Jan 14, 2024 Read more →

LAPS deployment and troubleshooting

## Overview Local Administrator Password Solution (Windows LAPS) rotates local Administrator passwords and stores them in Entra ID or AD for retrieva...
security-endpoint-protection msp seed-library
Jan 13, 2024 Read more →

PowerShell Constrained Language mode considerations

## Overview Constrained Language (CL) mode limits PowerShell to approved cmdkits—useful for hardening but it breaks many RMM scripts and installer wr...
security-endpoint-protection msp seed-library
Jan 12, 2024 Read more →

Managing third-party antivirus transition to MDE

## Overview Moving from legacy AV to Microsoft Defender for Endpoint needs a coexistence and cutover plan to avoid coverage gaps. ## Discovery 1. I...
security-endpoint-protection msp seed-library
Jan 11, 2024 Read more →

Credential theft warnings: what to check first

## Overview Alerts mentioning LSASS access, token theft, or Mimikatz-like behavior require fast triage. This checklist reduces false positives and ca...
security-endpoint-protection msp seed-library
Jan 10, 2024 Read more →

Deploying Defender offline scan after malware detection

## Overview Microsoft Defender Offline (boot-level scan) helps remove persistent threats that resist normal cleaning. Use when layered detections sug...
security-endpoint-protection msp seed-library
Jan 9, 2024 Read more →

Security baselines: CIS vs Microsoft Secure Score

## Overview Clients compare you to benchmarks. CIS (Center for Internet Security) and Microsoft Secure Score measure different things—know how to exp...
security-endpoint-protection msp seed-library
Jan 8, 2024 Read more →

Isolating a compromised endpoint: standard play

## Overview Fast containment limits lateral movement. This is a field-tested sequence; adapt to your SOC runbooks and insurance requirements. ## Imm...
security-endpoint-protection msp seed-library
Jan 7, 2024 Read more →

Managing Tamper Protection across tenants

## Overview Tamper Protection prevents local admins (and malware) from disabling Microsoft Defender features. MSPs must standardize enforcement while...
security-endpoint-protection msp seed-library
Jan 6, 2024 Read more →