hemaurer / MDATP_PoSh_Scripts

37 stars 8 forks source link

Having trouble getting this set up and would love the creators help #4

Open Gannan307 opened 1 year ago

Gannan307 commented 1 year ago

Hello, I need to implement some ASR rules on some VMs in our Azure environment. I am not very familiar with powershell so I think this tool could really help me. I'm just not sure how to use it.

I ran the powershell script as an admin and the application opened up, but how do I link it to our Azure VM's? Sure I can fill in the Enable bubble, but I never linked it to anything. Same thing when just running the .exe as an admin.

I was hoping you could help me make the connection between the application and our Azure VM's. Maybe I'm just being stupid and missing something, but I'm not familiar with this sort of stuff and am still learning. I would love your help.

hemaurer commented 9 months ago

Hello @Gannan307, sorry for the very late response! The GUI and the underlying script enables the ASR rules on the current machine. So you would have to open the script on every Azure VM and then enable them. Depending on how many Azure VMs you have maybe it makes more sense to use a central management tool or something like this: https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-to-deploy-attack-surface-reduction-rules-to-azure-vms-using/ba-p/3602433