INTUNE ADMIN LAB: FROM TICKET TO RESOLUTION
Three-case lab v1.1 - 7 November 2026

CONTENTS
README.txt: instructions for this kit and the browser exercise.
case-worksheet.txt: a private investigation and handover template.

Use a separate worksheet for each case. The interactive detection model is
inside Case 02 of the course; it is not an executable included in this ZIP.
No PowerShell script, installer or tenant configuration tool is included.

BROWSER DETECTION EXERCISE
Open Case 02, step 3: "Reproduce a false negative safely".
Use a modern browser with JavaScript enabled. No installation, administrator
rights or tenant connection are needed. The marker exists only in page memory.

1. Select version 1.1.0 and choose Prepare marker.
2. Choose Test exact 1.0.0. Record simulated exit 1 and empty output.
3. Choose Test minimum 1.0.0. Record simulated exit 0, a Detected message
   on STDOUT, and empty STDERR.
4. Prepare version 0.9.0. Both rules must return exit 1 and empty output.
5. Optionally compare 1.0.0 and 1.10.0 with the table in the lesson.
6. Choose Remove marker. Confirm "Fictional marker absent".
7. Test both rules again and record each result separately. Both must return
   exit 1, empty STDOUT and empty STDERR. Leave the marker absent.

The result panel replaces the previous result. Record observations before
running the next test. Reloading or leaving the page clears the marker.
Saved learning checkpoints do not save the exercise output.

An equality test can be correct when exactly one version is required.
Use a minimum-version comparison only when later versions are accepted.
The tested browser model demonstrates logic, not a real app deployment.
It does not execute PowerShell, install an app, run as SYSTEM, change Intune,
or demonstrate a production error changing to Installed.

USING YOUR OWN TENANT
Use one authorised pilot and collect equivalent evidence in the worksheet.
For a real app, validate the actual artifact, context, architecture, return
codes, installation completion, fresh IME logs and the updated portal result.
For LAPS, separate policy/account evidence, backup, password-read access and
the Intune rotation permission. Record only the milestones actually tested.

Keep secrets, raw logs and personal identifiers in your approved private
support system. Never include passwords or tokens in a public handover.
This download contains no tenant identifiers or credentials.