You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Added configuration to enable Config Refresh and re-apply settings on a 30 minute cadence.
8
-
<br> **NOTE:** Please read the article to understand the implications of applying this setting:
9
-
<br>[Intro to Config Refresh – a refreshingly new MDM feature](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/intro-to-config-refresh-a-refreshingly-new-mdm-feature/ba-p/4176921)
8
+
> [!NOTE]
9
+
> Please read the article to understand the implications of applying this setting:
10
+
>
11
+
> [Intro to Config Refresh – a refreshingly new MDM feature](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/intro-to-config-refresh-a-refreshingly-new-mdm-feature/ba-p/4176921)
10
12
11
13
**Win - OIB - Device Security - D - Location and Privacy - v3.2**
12
14
* Added configuration to enable the location service while still allowing users to be in control of their privacy settings, but force allow the Settings App and the new Outlook client to access location data.
@@ -17,60 +19,70 @@
17
19
**Win - OIB - Windows Hello for Business - D - WHfB Configuration - v3.2**
18
20
* The last non-Settings Catalog profile type, Account Protection (Preview) has finally been updated to the Settings Catalog format! The policy does have some changes when compared to the previous version and is also using Device scope settings rather than User, so please review the settings. The new template is also (currently) missing the "Allow biometric authentication" setting, so biometrics are enabled by default providing the device has biometric-capable hardware.
19
21
20
-
### <u>Changed/Updated</u>
21
-
#### <u>Settings Catalog</u>
22
+
##Changed/Updated
23
+
###Settings Catalog
22
24
**Win - OIB - Device Security - D - Windows Subsystem for Linux**
23
25
* Updated the policy to match the Microsoft recommended settings for WSL documented here:
24
26
<br>[Intune Settings for WSL | Microsoft Learn](https://learn.microsoft.com/en-us/windows/wsl/intune#recommended-settings)
25
27
26
28
**Win - OIB - Device Security - U - Power and Device Lock**
27
29
* Changed "Allow Hibernate" from "Enabled" to "Disabled". By having Hibernate enabled, "Require use of fast startup" being set to "Disabled" was not actually being enforced, leading to HiberBoot still working.
28
30
29
-
****Win - OIB - Microsoft OneDrive - D - Configuration**
31
+
**Win - OIB - Microsoft OneDrive - D - Configuration**
30
32
* Added some additional file types to the block list for sync. Rationale for the additions are due to potential file corruption or security risks.
31
33
<br>Added: Access (.accdb, .mdb), Scripts (.bat, .cmd, .vbs), Registry (.reg), Java (.jar), Disk Image (.img, .iso), and Virutal Hard Drive (.vhd, .vhdx, .vmdk).
32
-
<br>**NOTE:** As always, these are purely recommendations and should be adjusted to suit your environment.
33
-
<br>Thanks to [Jóhannes](https://x.com/jgkps) for the suggestion!
34
+
<br>Thanks to [Jóhannes](https://x.com/jgkps) for the suggestions!
35
+
> [!NOTE]
36
+
> As always, these are purely recommendations and should be adjusted to suit your environment.
34
37
35
38
**Win - OIB - Microsoft Store - U - Configuration**
36
39
* Removed "Require Private Store Only" setting to match the Microsoft recommendation on restricting access to the Microsoft Store:
37
40
<br>[Configure access to the Microsoft Store app - Configure Windows | Microsoft Learn](https://learn.microsoft.com/en-us/windows/configuration/store/?tabs=intune)
38
41
39
-
#### <u>Endpoint Security</u>
42
+
43
+
### Endpoint Security
40
44
**Win - OIB - Defender Antivirus - D - AV Configuration**
41
45
* Configured "Metered Connection Updates" to "Allowed" to ensure AV updates are still applied on metered connections.
* Added settings to ensure users are prompted via notifications for any actions taken by Defender Antivirus.
45
49
<br>To enhance this policy further, consider enabling the Customized Toasts and in-app Customization settings to give users confidence that notifications are legitimate.
46
50
47
-
### <u>Removed</u>
51
+
52
+
## Removed
48
53
**Win - OIB - Microsoft Accounts - U - Configuration**
49
54
* Replaced by device-based policy, Win - OIB - Microsoft Accounts - D - Configuration - v3.2.
50
55
51
56
**Win - OIB - Windows Hello for Business - U - WHfB Configuration**
52
57
* Replaced by the newer Settings Catalog policy, Win - OIB - Windows Hello for Business - D - WHfB Configuration - v3.2.
53
58
59
+
---
60
+
54
61
# v3.1.1 - 2024-04-15
55
-
### <u>Changed</u>
56
-
#### <u>Settings Catalog</u>
62
+
63
+
## Changed/Updated
64
+
### Settings Catalog
57
65
**Win - OIB - Internet Explorer (Legacy) - D - Security**
58
66
* Resolved some policies that were mis-aligned with MS Baseline.
59
67
60
68
**Win - OIB - Microsoft OneDrive - D - Configuration**
* Added device policy to enable passwordless & web sign-in experiences, as well as setting WHfB as the default credential provider.
69
-
<br> **NOTE:** This can have an impact on the use of things like Run as Administrator and LAPS, so if you're doing that or not using WHfB (you should be), don't enable this policy.
79
+
> [!WARNING]
80
+
> This can have an impact on the use of things like Run as Administrator and LAPS, so if you're doing that or not using WHfB (you should be), don't enable this policy.
* Added a number of settings not configurable via the Defender Antivirus policy in Endpoint Security.
73
-
<br> **NOTE:** The "Hide Exclusions from Local Admins/Local Users" settings may make it difficult to troubleshoot issues from the endpoint, but ensure an attacker cannot identify any vulnerable excluded locations. Apply with caution.
84
+
> [!NOTE]
85
+
> The "Hide Exclusions from Local Admins/Local Users" settings may make it difficult to troubleshoot issues from the endpoint, but ensure an attacker cannot identify any vulnerable excluded locations. Apply with caution.
74
86
75
87
**Win - OIB - Device Security - D - Windows Subsystem for Linux - v3.1**
76
88
* Added device policy to restrict the use of WSL.
@@ -80,7 +92,8 @@
80
92
81
93
**Win - OIB - Device Security - D - User Rights - v3.1**
82
94
* Added policy to match the CIS L1 Intune Windows 11 baseline settings for User Rights configurations.
83
-
<br> **NOTE:** I'm specifically using the [well-known SIDs](https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids) for the settings to ensure they work correctly regardless of the language of the OS. There is currently a requirement to use `(<![CDATA[]]>)` rather than `S-1-0-0` for a "No One" entry due to the way the CSP processes the policy.
95
+
> [!NOTE]
96
+
> I'm specifically using the [well-known SIDs](https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids) for the settings to ensure they work correctly regardless of the language of the OS. There is currently a requirement to use `(<![CDATA[]]>)` rather than `S-1-0-0` for a "No One" entry due to the way the CSP processes the policy.
* Added setting to enable BITS Peercaching as well as turning on BranchCache and Distributed Cache mode.
@@ -91,11 +104,11 @@
91
104
**Win - OIB - Windows Update for Business - D - Restart Warnings - v3.1**
92
105
* Added policy to extend the scheduled and imminent restart warnings and force the user to manually dismiss them. No more "I didn't see the warning" excuses.
* Added a default AV exclusions policy based on NCSC recommendations.
97
110
98
-
#### <u>Compliance</u>
111
+
###Compliance
99
112
Added separate compliance policies to allow for much better granularity and control over compliance grace periods:
100
113
101
114
**Win - OIB - Compliance - U - Defender for Endpoint - v3.1**
@@ -110,8 +123,9 @@ Added separate compliance policies to allow for much better granularity and cont
110
123
**Win - OIB - Compliance - U - Password - v3.1**
111
124
* No Grace Period/Mark as non-compliant immediately
112
125
113
-
### <u>Changed/Updated</u>
114
-
#### <u>Settings Catalog</u>
126
+
127
+
## Changed/Updated
128
+
### Settings Catalog
115
129
**Win - OIB - Device Security - D - Audit and Event Logging**
116
130
* Aligned settings to match CIS L1.
117
131
@@ -123,8 +137,10 @@ Added separate compliance policies to allow for much better granularity and cont
123
137
124
138
**Win - OIB - Device Security - U - Device Guard, Credential Guard and HVCI**
125
139
* Added "Configure Lsa Protected Process" setting to "Enabled without UEFI lock.". The reasoning for setting this and other settings to **without** UEFI lock is that it allows for easier troubleshooting and rollback if required, documented [here](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#remove-the-lsa-protection-uefi-variable). It can be set to **with** UEFI lock once satisfied with the configuration.
126
-
<br> **NOTE:** Fresh installations of Windows 11 22H2 or later have LSA protection enabled by default:
127
-
<br>[Configure added LSA protection | Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#automatic-enablement)
140
+
> [!IMPORTANT]
141
+
> Fresh installations of Windows 11 22H2 or later have LSA protection enabled by default:
142
+
>
143
+
> [Configure added LSA protection | Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#automatic-enablement)
128
144
129
145
**Win - OIB - Internet Explorer (Legacy) - D - Security**
130
146
* Amended a number of settings to ensure alignment with the Intune Win11 23H2 baseline and changed from a user-based recommendation to a device-based. Why won't Internet Explorer just die already?
@@ -150,7 +166,8 @@ Added separate compliance policies to allow for much better granularity and cont
150
166
**Win - OIB - Windows User Experience - D - Feature Configuration**
151
167
* Added "Disable Consumer Account State Content" setting configured to "Enabled"
152
168
153
-
#### <u>Endpoint Security</u>
169
+
170
+
### Endpoint Security
154
171
**Win - OIB - Defender Antivirus - D - AV Configuration**
Copy file name to clipboardExpand all lines: README.md
+13-9Lines changed: 13 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,8 +18,11 @@
18
18
</p>
19
19
20
20
---
21
-
<sup>**IMPORTANT:-** This has been developed as a starting point or foundation and is not necessarily considered "complete". It is being made available to allow learning, development, and knowledge-sharing amongst communities.<br>
22
-
No liability is assumed for the usage or application of the settings within this project in production tenants.</sup>
21
+
22
+
> [!IMPORTANT]
23
+
> This has been developed as a starting point or foundation and is not necessarily considered "complete". It is being made available to allow learning, development, and knowledge-sharing amongst communities.
24
+
>
25
+
> No liability is assumed for the usage or application of the settings within this project in production tenants.
23
26
24
27
---
25
28
@@ -52,9 +55,7 @@ I would always recommend maintaining GPO for on-prem devices, and using Intune f
52
55
## Baseline Security Posture
53
56
Security frameworks tend to be seen as unmovable hard requirements rather than what they are, which is a set of **recommendations**. In fact, the CIS themselves preface their benchmarks with the following:
54
57
55
-
> It is acceptable if 100% of the benchmark is not applied, as it is the responsibility and
56
-
decision of each organization to determine which settings are applicable to their unique
57
-
needs.
58
+
> **It is acceptable if 100% of the benchmark is not applied, as it is the responsibility and decision of each organization to determine which settings are applicable to their unique needs.**
58
59
59
60
It is impossible to create a true "one-size-fits-all" set of policies due to the massively differing nature of enterprise requirements. There is also a significant amount of "noise" in the security community, with many recommending settings that are not necessarily required or beneficial, such as enforcing default behaviour that a standard user cannot change, or settings that have been included in GPO baselines since the days of Windows 7.
60
61
This baseline is designed to be a starting point or guide, and all configurations applied to an environment regardless of source should be reviewed and adjusted to suit your own business requirements.
@@ -106,8 +107,6 @@ Almost all policies are Settings Catalog-backed and will show in Devices>Configu
106
107
* Windows Hello for Business
107
108
* Windows LAPS
108
109
109
-
Guidance on settings can be found in the [Settings Guidance](/SETTINGSGUIDANCE.md) document.
110
-
111
110
## Limitations:
112
111
Due to the wildly differing nature of environments, it is not possible to create a "baseline" for AppLocker or Windows Defender Application Control (WDAC). While the baseline ensures standard users cannot elevate to install applications, apps that do not require elevation or install to a user's AppData folder may not be blocked.
113
112
@@ -116,16 +115,21 @@ Due to the wildly differing nature of environments, it is not possible to create
116
115
-**Windows Update for Business Reports** - With an appropriate Azure subscription, a Log Analytics Workspace can be created to monitor update compliance of devices. - [Additional information](https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-overview)
117
116
-**M365 Apps Updates** - Enabling [Cloud Update](https://learn.microsoft.com/en-us/deployoffice/admincenter/cloud-update) through [config.office.com](https://config.office.com/officeSettings/serviceprofile) can ensure Office Apps for Business/Enterprise remain up-to-date on the Monthly Enterprise Channel. Settings in the "Office - Update Settings" policy can remain as Cloud Update takes priority over any other Office management. Ensure the [Inventory](https://config.office.com/officeSettings/inventory) is enabled.
118
117
118
+
> [!NOTE]
119
+
> Guidance on this can be found in the [Settings Guidance](/SETTINGSGUIDANCE.md) document.
120
+
119
121
---
120
122
121
123
## Importing the Baseline:
122
124
The baseline was exported using the tool developed by Mikael Karlsson ([GitHub](https://github.com/Micke-K/IntuneManagement) and [Twitter](https://twitter.com/Micke_K_72)), and can be imported in the same way.
123
125
Download or clone this repo, run the IntuneManagement tool and in the tool settings, change the "Root folder" under Import/Export to the appropriate folder of the baseline. Authenticate to a tenant with appropriate credentials, and use the Bulk>Import menu to import the whole baseline. Individual policy imports can be achieved using the "Import" option in the bottom right of the tool.
124
126
125
-
You can choose to import as much or as little of the baseline as you wish, though you will need to change the "Root folder" to the appropriate folder for the policies you wish to import (e.g. Settings Catalog).
127
+
You can choose to import as much or as little of the baseline as you wish, though you will need to change the "Root folder" to the appropriate folder for the platform (e.g. WINDOWS), or policy types (e.g. Settings Catalog) you wish to import.
126
128
127
129
## Post-Import Changes:
128
130
As of v3.1 there are no post-import changes required as the IntuneManagement tool will automatically modify the Tenant GUIDs included in OneDrive policies based on the tenant.
129
131
130
132
## Additional Information:
131
-
Please consult the [FAQ](/FAQ.md)
133
+
134
+
> [!TIP]
135
+
> For further information, please consult the [FAQ](/FAQ.md)
0 commit comments