MD-102: Endpoint Security, Updates, and Device Health

A laptop that received yesterday’s security update is not necessarily secure today. Its antivirus service may be disabled, its disk recovery key may be inaccessible, or a compromised account may still have local administrator privileges. Another laptop may be fully protected but suffer unacceptable startup times after a software rollout. The Microsoft MD-102 exam brings protection and operations together: administrators need to manage endpoint defenses, deliver supported updates, measure health, and restore affected devices without disabling safeguards to make alerts disappear.

The 2026 objectives include Intune antivirus, disk encryption, firewall, attack-surface reduction, security baselines, Defender for Endpoint integration, App Control for Business, Windows update policies, supported mobile updates, PowerShell and Graph automation, endpoint analytics, and proactive remediation. These features are most useful when managed as a service with clear control owners. The right preparation asks what each defense protects, what evidence proves it is working, and what action should follow a failure. Merely knowing the product names does not answer an incident scenario.

Build defenses in layers instead of relying on one status

A secure endpoint has several mutually supporting controls. Disk encryption protects data when storage is stolen or removed; it does not prevent malicious code from reading data in an authorized active session. Antivirus and endpoint detection tools can inspect suspicious activity; they do not decide every authentication or privilege question. Windows firewall policy limits relevant traffic paths; it does not substitute for application hardening. Attack-surface reduction and application-control policies constrain particular behaviors and execution paths, but overly broad exclusions may neutralize their benefit. Understand the purpose and limitations of each protection before treating a ‘green’ dashboard as an assurance of overall security.

Intune can distribute security configurations to supported endpoints, while Microsoft Defender for Endpoint supplies relevant threat detection and response capabilities through integration. The platform boundary matters when a device reports a high-risk signal: Intune may act on device status and compliance rules, but investigation of suspicious execution belongs in the appropriate security telemetry and response workflow. An endpoint administrator should know how to preserve evidence, who is authorized to contain a device, and when to involve a security operations specialist. The broader security-design concerns represented by SC-100 cybersecurity architecture are related, but MD-102 concentrates on putting workable defenses onto fleets of endpoints.

Treat encryption recovery as part of security engineering

BitLocker policy design requires more than turning encryption on. Administrators need to plan supported encryption settings, recovery-key backup and access, rotation where supported, device replacement, and a recovery process that does not bypass organizational controls. An encrypted laptop with an inaccessible recovery key can become a business continuity incident after a hardware change. A recovery process that freely exposes keys to broad support groups is also a security weakness. Separate authorization to view a recovery key from authorization to perform unrelated administrative operations, and record how both are audited.

Consider a traveling employee whose TPM-related change produces a BitLocker recovery prompt. A well-run service verifies the device and user, retrieves the correct authorized recovery information, records access, restores work, and decides whether key rotation is needed under the organization’s procedures. It does not ask users to disable encryption for convenience. Likewise, Windows LAPS addresses local administrator password management, not drive recovery. Confusing the two can lead teams to store powerful credentials in tickets or to assume that password rotation and disk access recovery solve the same problem. Review these controls as separate identities and secrets with different lifecycles.

Make baselines, ASR, and application control deployable

Security baselines offer useful starting configurations, but a business must test them against its hardware, applications, and operational requirements. Attack-surface reduction rules may initially be evaluated in supported audit modes to understand likely impact before broad enforcement. Application control may restrict software execution based on the selected policy strategy. Endpoint Privilege Management, where licensed and supported, helps define exceptional elevation for particular tasks without giving everyone standing administrative rights. Each control can improve posture if its assignments, exceptions, and monitoring are maintained.

A careful rollout starts with a representative pilot, not only the IT team’s devices. Include a finance application with older components, a developer workstation with signed tools, a shared device, and ordinary employee laptops. Observe blocked behavior and determine whether it is genuinely malicious, an expected business dependency, or a faulty package. Write a narrow exception with an owner and review date when justified. Broadly excluding a folder or switching off the policy because one tool fails is rarely a defensible outcome. The operational goal is to preserve intended controls while enabling supported business tasks.

Build a realistic update deployment strategy

Windows update rings, feature-update policies, quality updates, Windows Autopatch, hotpatch configurations where supported, and Delivery Optimization address different aspects of an update service. Update rings express rollout behavior for classes of updates; feature-update policies can manage target feature versions; quality update mechanisms handle servicing details; Delivery Optimization influences content distribution. Mobile platforms have platform-specific update-policy capabilities. Administrators must match the available mechanism to the organization and device eligibility rather than assuming one set of settings governs every operating system and update category.

Start with a small test cohort that reflects real applications and hardware, widen to a limited production ring, and then move to broad deployment after inspecting failures. A critical security update may justify an accelerated route, but even urgent releases need evidence that a proposed remediation works. Record update age, reboot behavior, installation errors, and the impact of safeguard holds or compatibility issues. If a Windows upgrade breaks an essential client, isolate the affected device models and software versions instead of halting all endpoint patching indefinitely. Good rollouts balance exposure time with operational stability using data that support a decision.

Use telemetry that answers user-experience questions

Device health is not a single CPU percentage. Endpoint Analytics and related Intune capabilities can provide information about startup performance, application reliability, device scores, and proactive remediation opportunities. Intune reporting and service-health views help distinguish individual endpoint issues from tenant-level incidents. When a device becomes slow after a policy change, check when the problem began, which population was affected, what changed, and whether the cause is software, hardware, update status, or connectivity. Monitoring should make the next diagnostic step more obvious, not fill another dashboard with unowned warnings.

Traditional Windows telemetry still matters when a specific operating-system bottleneck needs explanation. Counters for memory pressure, disk activity, process behavior, and other performance characteristics can help test a hypothesis. The techniques in Windows performance monitoring with PowerShell are useful at that level, while Endpoint Analytics provides a broader managed-fleet view. Neither should be treated as a replacement for the other. A single laptop with high disk utilization can be a device issue; an entire ring showing longer startup times after the same update is an operational change problem.

Automate narrow corrections and verify the outcome

PowerShell scripts, Microsoft Graph, device queries, and proactive remediations can reduce repetitive endpoint work. A remediation can detect a specific state and repair it if permitted, but the script’s assignment, privilege, logging, idempotency, and rollback behavior deserve attention. A detection script that always returns failure may cause repeated unnecessary work; a remediation that does not check whether a setting is already correct can generate side effects at scale. Privileged service credentials embedded in a script create a different risk that is unrelated to whether the script technically functions.

For a typical example, suppose a required service repeatedly stops after a known application update. First establish the failure population and root cause. Pilot a detection that accurately identifies the affected version and service state, then a remediation that restores the correct behavior without hiding evidence of an underlying product defect. Log the actions, test multiple reruns, and specify how the fix will be retired when the vendor issues a permanent patch. Treat automation as a controlled change process rather than a convenient method of deleting troublesome alerts. Security Copilot agent recommendations may assist investigation, but an administrator remains responsible for validating the evidence and effect of actions.

Investigate remotely without losing control of the device

Intune remote actions include supported operations such as synchronization, restart, retirement, wipe, rotating eligible recovery material, collecting diagnostics, and device query. Their safety and availability depend on platform, permissions, enrollment state, and feature support. The correct action is based on an incident’s objective. During a routine policy delay, a sync and status review may suffice. During device loss, a risk-based containment process may lead to stronger actions. During an application failure, a forced wipe is usually disproportionate and destroys evidence without diagnosing the issue.

Multi-admin approval, role-based permissions, and scope tags can strengthen operational control over sensitive tasks where configured. Administrators should document what an action changes, what it cannot reverse, who can authorize it, and which evidence it leaves behind. If an employee’s device is personally owned, review the appropriate managed-data removal options rather than assuming a corporate-device wipe is always authorized or technically supported. The correct response to a suspicious endpoint is not necessarily the most dramatic remote command. It is the narrowest justified action that reduces risk while preserving recovery and accountability.

Measure improvements with meaningful cohorts

A useful endpoint-health report might combine supported device count, last check-in age, encryption coverage, active protection state, update compliance, startup performance, and unresolved remediation failures. But its measurements need denominators and timing. If only regularly reporting Windows laptops appear in a dashboard, the report must not be presented as proof that all devices—including infrequently connected kiosks and mobile endpoints—are healthy. Partition the results by ownership, platform, deployment group, and business criticality. Track whether improved averages hide a worsening subset.

Rehearse a change from beginning to end. Create a pilot update ring, observe deployment, introduce a controlled failure, collect evidence, remediate, and inspect user experience afterward. Then document whether the next fleet-wide rollout should proceed and why. MD-102 security and operations are inseparable because a control that cannot be safely deployed, monitored, or recovered from is not dependable. The strongest endpoint administrator can explain both how a protective setting reduces risk and how the organization will know when that setting causes—or fails to prevent—a real problem.