# Mixed paste — Intune profile excerpt + Jamf policy excerpt + osquery system_info # ── Intune Configuration Profile (Windows 11 corp laptop) ── { "displayName": "Corp-Win11-Baseline-2026Q1", "platforms": "windows10", "settings": { "BitLocker_OSDriveRecoveryKey_BackupToAAD": "notConfigured", "BitLocker_OSDriveEncryption_Method": "aes256", "Defender_TamperProtection": "disabled", "Defender_RealtimeMonitoring": "enabled", "WindowsHelloForBusiness_RequirePinAtLogin": "enabled", "SMB1Protocol_Enabled": "true", "RDP_AllowFromAnyNetwork": "true", "AllowAutoUpdate_Notifications": "deferUpToDays:90", "Browser_AllowExtensionsFromAnySource": "enabled", "ExploitProtection_Enabled": "true" } } # ── Jamf policy excerpt (macOS Sonoma fleet) ── macOS-Corp-Baseline truejamf_managed false true true trueallowed # ── osquery autoruns dump (~32 LaunchAgents observed) ── LaunchAgent: /Library/LaunchAgents/com.unknown.helper.plist (signature: ad-hoc, signer: ) LaunchAgent: /Library/LaunchAgents/com.zoom.us.plist (signed, Apple-notarized) LaunchAgent: /Users/staff/Library/LaunchAgents/com.local.thingy.plist (unsigned) ... 29 more agents listed ... # ── Windows scheduled tasks excerpt ── Task: \\Microsoft\\Windows\\CurrentVersion\\Run\\quickbeep.exe RunAs: NT AUTHORITY\\SYSTEM Path: C:\\Users\\Public\\quickbeep.exe (path is user-writeable!)

Endpoint Posture Review