The ShadowAdminPairs: A Deep Dive into Administrator Protection

This blog will take you on a little journey into a discovery I made while exploring the new Administrator Protection feature in Windows 11. If you’ve been keeping up with my posts, you already know how exciting this feature is, but what I stumbled upon might just blow your mind. While digging around, I uncovered something that isn’t immediately obvious: the ShadowAdminPairs registry key. Let me tell you how it works and why you should care.

Dual Enrollment / MMP-C Light for Workplace Joined Devices?

wp:heading

Introduction:

While scrolling through dmenrollengine.dll, I stumbled across something that caught my eye: a function related to Dual enrollment. This got me thinking: Could this be the key to fixing some known limitations? Specifically, Endpoint Privilege Management (EPM) does not work on Workplace Join devices.

Kung Fu MMP-C Onboarding

This blog will show how I onboarded multiple Microsoft 365 Tenants to the new MMP-C infrastructure (Microsoft Management Platform – Cloud) and explain why this is going to be huge!

From the old school MDM stack to MMP-C: What’s going to change in 2025

This blog will focus on how Wi-Fi and VPN resource access policies are being transferred (Authority change) from the old-school MDM stack to the MMP-C Infra (MDM to MMP-C), with examples from Microsoft documentation and a visual guide showing how devices can work in both Intune and MMP-C environments to handle the authority change!

Troubleshooting the Properties Catalog Error 2147749902:

Troubleshooting error 2147749902 (WBEM_E_INVALID_NAMESPACE) isn’t always straightforward. What started as a simple Intune error turned into a Device Inventory deep dive involving an empty SQLite database, a failing Device Inventory Agent service, and a missing CIM namespace. This blog retraces my steps, tools, and solutions to get everything back on track.