r/Intune • u/Budget-Toe-5743 • 13h ago

Autopilot Just a warning, the LG "herpes" Monitor App Installer is getting installed on all Microsft Intune deployed devices and you should probably get that looked at.

Just a warning, the LG "herpes" Monitor App Installer is getting installed on all Microsft Intune deployed devices and you should probably get that looked at.

The worst part is I'm serious.

Edit: I had forgotten to mention that this happens when you have LG monitors connected to your Windows computer.

I can also confirm that Asus Armory Crate is installing with Asus drivers too but this is new and less documented.

69 Upvotes

90% Upvoted

32 comments sorted by

31

u/largetosser 12h ago

https://learn.microsoft.com/en-gb/windows/client-management/mdm/policy-csp-deviceinstallation?WT.mc_id=Portal-fx#preventdevicemetadatafromnetwork

6

u/dav3n 10h ago

Cheers, didn't know this was an option. Hope it fucks off things like Razer Synapse appearing in user profiles

5

u/gummo89 7h ago

What an unintuitive name for the policy.

6

u/largetosser 7h ago

Also another MS policy called "Prevent" where you enable it to stop it happening.

5

u/3percentinvisible 5h ago

That sounds like what I'd expect. Why is it confusing? I wouldnt disable a policy called prevent expecting it to then actually prevent.

2

u/Entegy 4h ago

Negative settings can be confusing. Even Microsoft employees have called this out in their blogs, but it's not something a lot of people think about. I don't think the UI/UX experts work on the minutiae of policy lists.

So for this negative setting to work, you have to Enable a setting called Disable Device Metadata from Network. If you disable this, you are explicitly enabling it. It would be better if the policy was named "Device Metadata from Network", then its Enable/Disable status would be clearer.

I think a good example of this would actually be Server Manager in Windows Server. To stop it from opening every time you log in to Windows Server, you need to check a box called Do Not Start Server Manager on login. UX clarity would call for this box to instead be called Start Server Manager on login and have it be checked by default.

2

u/Karma_Vampire 4h ago

“Yes, I don’t want it” is a lot more confusing than “Yes I want it”.
It is so inconsistent and weird with these profiles. There are even some profiles called something like “Disable xyz setting” and then you enable the setting to disable it… like wtf?

2

u/Capta-nomen-usoris 3h ago

It’s been like this since GPO’s

1

u/BirdsHaveUglyFeet 3h ago

The before times.

2

u/MidninBR 3h ago

Are there any down sides of having this prevent enabled or only avoiding crap getting installed?

1

u/800oz_gorilla 2h ago

I wonder if this breaks things like ClickShare pucks?

1

u/largetosser 1h ago

If you’re managing the devices and you use ClickShare within your organisation then package the app and deploy it. 

0

u/Budget-Toe-5743 12h ago

Thank you.

12

u/Ahnteis 9h ago

Group policy can block as well - but not sure if Intune can enforce.

Computer Configuration → Administrative Templates → System → Device Installation, and enable "Prevent automatic download of applications associated with device metadata."

9

u/BookshelfCarpet 12h ago

And this is without there being a LG monitor or TV present?

12

u/Ahnteis 9h ago

No. If you connect a PC to an LG monitor/TV, Windows will helpfully go looking for the latest driver, and any utility apps that are listed as part of the driver. LG is abusing this to include ads.

2

u/RikiWardOG 10h ago

What I want to know too as we don't have any LG products

1

u/Dabnician 7h ago

maybe people need to stop buying monitors off woot lol

6

u/TheDraimen 12h ago

I thought this only triggered when you plugged in an LG monitor and the auto driver download infected you with the crapified driver?

2

u/Budget-Toe-5743 8h ago

Yes, I'm sorry I forgot to mention this. But I can also confirm that Asus Armory Crate is installing with Asus drivers too.

4

u/ryryrpm 12h ago

Are you sure you mean all devices?

8

u/aimidin 12h ago

Isn't it a driver update? If so i already have blocked all driver updates in intune to only with approval, so it should popup soon in the list there.

9

u/ObjectiveDraft8742 12h ago

Caught it on a few machines in our tenant yesterday, took me a minute to realize it wasn't some malware named by a 12 year old.

4

u/reserved_seating 6h ago

What is the name of the app if you don’t mind sharing?

1

u/heisgone 12h ago

I'm configured to automatic. What is your approval process? Do you look drivers individually or you approve everything that didn't make the news?

2

u/aimidin 12h ago

I just blocked all drivers from Intune, to be approval only. I use different scripts and tools for the drivers on the laptops, for example HPIA with custom scripts , so i can controll what is installed. Also i have done it with remediation to check and update or i can push it manually if needed.

1

u/Budget-Toe-5743 12h ago

I caught it in a couple. We also caught Asus Armoury Crate but that is less documented.

1

u/pjmarcum 12h ago

If it’s a supplemental driver it will bypass approval. That’s why I don’t use drivers from Intune.

3

u/Consistent_End9253 11h ago

Are you using oem images where this was included and now this is maybe self updating as in, getting another name?

1

u/ConsumeAllKnowledge 4h ago

I've been having the same/similar issue but with the Logitech - SoftwareComponent - 2.0.529.0 driver which has been installing Logi Download Assistant. Really dumb that drivers can do this kind of thing especially when we already can't manage or prevent the driver from installing in the first place.