Skip to content

Commit f44f081

Browse files
SkipToTheEndpointSkipToTheEndpoint
authored
Merge pull request #43 from SkipToTheEndpoint/windows-v3.3
Windows-v3.3
2 parents ba05a8c + a0742af commit f44f081

14 files changed

Lines changed: 1044 additions & 719 deletions

‎.github/workflows/main.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@ on:
33
push:
44
branches:
55
- main
6-
pull_request:
7-
branches:
8-
- main
96

107
jobs:
118
contrib-readme-job:

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
## Release
55
**[OIB MacOS v1.0](/MACOS/README.md)**
66
**[OIB Windows 365 v1.0](/WINDOWS365/README.md)**
7+
**[OIB Windows v3.3](/WINDOWS/README.md)**
78

89
# 2024-08-29
910
## Added

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ Each OS will have its own folder, with OS-specific files (readme, changelog, bas
8080
The current OIB versions are:
8181
| OS | Current Release | Change Log |
8282
|--- |--- |---
83-
| [Windows](/WINDOWS/README.md) | [v3.2](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/releases/tag/v3.2) | [Windows Change Log](/WINDOWS/CHANGELOG.md) |
83+
| [Windows](/WINDOWS/README.md) | [v3.3](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/releases/tag/windows-v3.3) | [Windows Change Log](/WINDOWS/CHANGELOG.md) |
8484
| [Windows 365](/WINDOWS365/README.md) | [v1.0](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/releases/tag/win365-v1.0) | [Windows 365 Change Log](/WINDOWS365/CHANGELOG.md) |
8585
| [MacOS](/MACOS/README.md) | [v1.0](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/releases/tag/macos-v1.0) | [MacOS Change Log](/MACOS/CHANGELOG.md) |
8686

‎WINDOWS/BASELINECOMPARISON.md‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
# OIB Baseline Comparisons
2+
3+
Documented below are the results of some tests of other baseline configurations available for Intune-managed devices. I documented the experice seen during an Autopilot deployment, the general post-provisioning user experience, and any policy or security issues identified.
4+
5+
To conduct the tests I took an approach that is widely seen in this space, that being:
6+
* Baselines were imported "as-is" with no modifications made.
7+
* All policies were targeted at devices, rather than users.
8+
9+
OIB data has been presented from **direct feedback from community members** who have implemented the baseline **in their own environments**. Other baseline tests have been conducted to map against those same feedback points to provide a reasonable and unbiased comparison.
10+
11+
---
12+
13+
## OpenIntuneBaseline
14+
### Test Details
15+
* Baseline Version(s) Tested:
16+
* [OpenIntuneBaseline - Windows v3.3](/WINDOWS/README.md)
17+
* Tested on:
18+
* Windows 11 Enterprise 23H2 - 2024.08 B Security Update
19+
20+
### Autopilot User Experience:
21+
* No reboot seen between Device and user Phase.
22+
* User required to pass 2rd MFA challenge to configure WHfB (not seen if skipping user ESP or ESP takes <15 minutes).
23+
24+
### General User Experience:
25+
* Edge automatically configured and signed-in.
26+
* Great productivity experience:
27+
* Outlook auto sign-in using primary SMTP address
28+
* OneDrive KFM automatically configured and signed-in.
29+
* Office apps do not prompt first-run wizard.
30+
31+
### Helpdesk Support Experience:
32+
* UAC allowed within the user session, able to use LAPS to diagnose or resolve issues.
33+
34+
### Policy Issues Seen:
35+
* Two transient policy error due to Defender Additional Configuration & Defender Tamper Protection ([documented here](/WINDOWS/KNOWNISSUES.md)) - Resolved after reboot.
36+
37+
### Security Issues Identified:
38+
* None
39+
40+
### Admin Impact Summary:
41+
* Simple and quick implementation of a secure, "known-good" baseline.
42+
* Known issues are well documented.
43+
* Policies are granular and easy to understand and expand on.
44+
* Community-driven feedback and support available.
45+
46+
---
47+
48+
## Intune Security Baseline
49+
### Comparison Rationale
50+
In blogs, documentation, and presentations, Microsoft regularly states that the Intune Security Baseline is the recommended starting point for securing Windows devices.
51+
52+
### Test Details
53+
* Baseline Version(s) Tested:
54+
* [Security Baseline for Windows 10 and later - Version 23H2](https://learn.microsoft.com/en-gb/mem/intune/protect/security-baseline-settings-mdm-all?pivots=mdm-23h2)
55+
* [Microsoft Defender for Endpoint Security Baseline - Version 24H1](https://learn.microsoft.com/en-gb/mem/intune/protect/security-baseline-settings-defender?pivots=mde-v24h1)
56+
* [Security Baseline for Microsoft Edge - Version 117](https://learn.microsoft.com/en-gb/mem/intune/protect/security-baseline-v2-edge-settings?pivots=edge-v117)
57+
* Tested on:
58+
* Windows 11 Enterprise 23H2 - 2024.08 B Security Update
59+
60+
### Autopilot User Experience:
61+
* Reboot seen between Device and user Phase:
62+
* User needs to re-input user credentials.
63+
* User required to re-pass MFA (if not skipping user ESP).
64+
* User required to pass 3rd MFA challenge to configure WHfB (or 2nd if skipping user ESP).
65+
* Default password length of 14 which also impacts WHfB PIN!
66+
67+
### General User Experience:
68+
* You've been forced to use a 14 character PIN which you've probably set the same as your password.
69+
* Poor initial Edge user experience:
70+
* Account automatically identified but user asked for sign in
71+
* Large amount of initial setup wizard prompts.
72+
* Suboptimal productivity experience:
73+
* Outlook identifies user account but does not get automatically configured.
74+
* No OneDrive configuration, user has to log in and configure manually.
75+
* Prompted by Office first-run wizard to set file types.
76+
77+
### Helpdesk Support Experience:
78+
* UAC blocked within the user session, making it difficult to diagnose or resolve issues.
79+
80+
### Policy Issues Seen:
81+
* Windows and Defender Security Baselines (still) conflict with each other.
82+
83+
### Security Issues Identified:
84+
* No BitLocker configuration, leaving device unencrypted.
85+
86+
### Admin Impact:
87+
* Applying other policies difficult due to monolithic nature of the security baseline.
88+
* Tracking down and resolving conflicts between the security baselines is time-consuming.
89+
* Support relies on Microsoft documentation or available paid support channels.
90+
91+
---
92+
93+
## Center for Internet Security (CIS) Benchmark
94+
### Comparison Rationale
95+
The CIS Benchmarks are widely used across the industry and are considered a "gold standard" for device security configuratio.
96+
97+
### Test Details
98+
* Baseline Version Tested:
99+
* [CIS Microsoft Intune for Windows 11 Benchmark v3.0.1](https://workbench.cisecurity.org/benchmarks/16853) (CIS Workbench login required)
100+
* Note: Build Kit requires CIS SecureSuite subscription
101+
* Tested on:
102+
* Windows 11 Enterprise 23H2 - 2024.08 B Security Update
103+
104+
### Autopilot User Experience:
105+
* Reboot seen between Device and user Phase:
106+
* User had to press CTRL+ALT+DEL.
107+
* User needs to re-input user credentials.
108+
* User required to re-pass MFA (if not skipping user ESP).
109+
* User required to pass 3rd MFA challenge to configure WHfB (or 2nd if skipping user ESP).
110+
111+
### General User Experience:
112+
* Configured to not remember user credentials so every logon requires full credential input even if WHfB is configured.
113+
* Poor initial Edge user experience:
114+
* Account automatically identified but user asked for sign in
115+
* Large amount of initial setup wizard prompts.
116+
* Suboptimal productivity experience:
117+
* Outlook identifies user account but does not get automatically configured.
118+
* No OneDrive configuration, user has to log in and configure manually.
119+
* Prompted by Office first-run wizard to set file types.
120+
121+
### Helpdesk Support Experience:
122+
* UAC blocked within the user session, making it difficult to diagnose or resolve issues.
123+
124+
### Policy Issues Seen:
125+
* **CIS (L1) Section 1 - 3.9.1.1 - Windows 11 Intune 3.0** - _(L1) Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' is set to 'Disabled'_
126+
* Setting completely breaks Autopilot if not removed.
127+
* **CIS (L1) Windows Update - Windows 11 Intune 3.0.1** -
128+
* Conflicted with pre-existing Windows Update for Business Ring settings.
129+
130+
### Security Issues Identified:
131+
* BitLocker policy does not function, leaving device unencrypted.
132+
* Some security gaps without implementing additional benchmarks (e.g. Edge, Internet Explorer).
133+
* Conflicts in Windows Update settings leads to unpredictable update behaviour.
134+
135+
### Admin Impact:
136+
* Does not work out-of-the-box with Autopilot!
137+
* Applying other policies potentially difficult due to haphazard existing policy groupings.
138+
* Tracking down and resolving conflicts between the security baselines is time-consuming.
139+
* Support relies on vendor documentation or available paid support channels.
140+
141+
---

‎WINDOWS/CHANGELOG.md‎

Lines changed: 54 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,55 @@
11
# OIB Windows Change Log
22

3-
# v3.2 - 2024-08-02
3+
# Windows v3.3 - 2024-09-02
4+
## Added
5+
### Endpoint Security
6+
**Win - OIB - Attack Surface Reduction - D - ASR Rules (L2) - v3.3**
7+
* Resolves [#13](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/discussions/13)
8+
* New ASR policy which includes a number of rules that I have had good success with in Block mode.
9+
<br>I don't necessarily want to make Level 1/Level 2 a thing here because I actually care about device usability, but I'm going to refer to this one as such.
10+
11+
> [!WARNING]
12+
> Just because I've had success with these rules, doesn't mean you will!
13+
>
14+
> If you've been running in Audit mode for a while, there's an amazing blog by [Nathan McNulty](https://x.com/NathanMcNulty), [Defender for Endpoint - Implementing ASR Rules](https://blog.nathanmcnulty.com/defender-for-endpoint-implementing-asr-rules/) which has some great Advanced Hunting queries to help validating if these will have an impact.
15+
>
16+
> If you haven't: **Please** run the Audit mode policy for a decent amount of time before applying anything!
17+
>
18+
> Additional Microsoft guidance: [Operationalize attack surface reduction rules - Microsoft Defender for Endpoint | Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-deployment-operationalize)
19+
20+
21+
## Changed/Updated
22+
### Settings Catalog
23+
**Win - OIB - Device Security - D - Security Hardening**
24+
* Fixes [#33](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/discussions/33).
25+
* Removed the ["Allow Device Discovery"](https://learn.microsoft.com/en-gb/windows/client-management/mdm/policy-csp-Experience?WT.mc_id=Portal-Microsoft_Intune_Workflows#allowdevicediscovery) setting which disables the Win+P and Win+K shortcuts, but doesn't actually stop the user from projecting to a device.
26+
* Thanks to the few people who reported this issue, honestly I'm not sure why I had it in there in the first place...
27+
28+
### Endpoint Security
29+
**Win - OIB - Defender Antivirus - D - AV Configuration**
30+
* Fixes [#32](https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/discussions/32).
31+
* Changed the ["Signature Update Interval"](https://learn.microsoft.com/en-gb/windows/client-management/mdm/policy-csp-Defender?WT.mc_id=Portal-fx#signatureupdateinterval) from 4 hours to 1 hour.
32+
* Thanks for bringing to my attention some great work from [Ru Campbell](https://x.com/rucam365) [and Viktor Hedberg](https://x.com/headburgh)'s book, [Mastering Microsoft 365 Defender](https://www.amazon.co.uk/Mastering-Microsoft-365-Defender-Implement-ebook/dp/B0BYZLJFCR?ref_=ast_author_dp), and [Jeffery Appel](https://x.com/jeffreyappel7)'s [blog series](https://jeffreyappel.nl/microsoft-defender-for-endpoint-series-define-the-av-baseline-part4a/) on baselining MDE.
33+
34+
### Policy Descriptions
35+
Aded some additional information to the following policy descriptions to help clarify any issues or hardware/software pre-reqs. Versions have been bumped but no actual policy changes have been made.
36+
37+
* **Win - OIB - Credential Management - D - Passwordless**
38+
* **Win - OIB - Defender Antivirus - D - Security Experience**
39+
* **Win - OIB - Device Security - U - Device Guard, Credential Guard and HVCI**
40+
* **Win - OIB - Microsoft Store - U - Configuration**
41+
42+
43+
## Removed
44+
**Win - OIB - Defender Antivirus - D - Default Exclusions**
45+
46+
Something I'd been curious about for a while was around some (now updated) wording on "built-in exclusions" on the following docs page: [Microsoft Defender Antivirus exclusions on Windows Server - Microsoft Defender for Endpoint | Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus)
47+
<br> I have subsequently had confirmed by Microsoft that the built-in exclusions do indeed already apply by default to Windows *Client* OS's too, and as such I do not feel the need to have a separate policy for.
48+
<br>I had separately added entries for the IME Content and IME Cache folders, but any exclusion is creating a security hole that could be exploited, so I'm getting rid of the whole thing.
49+
50+
---
51+
52+
# Windows v3.2 - 2024-08-02
453
## Added
554
### Settings Catalog
655
**Win - OIB - Device Security - D - Config Refresh - v3.2**
@@ -19,6 +68,7 @@
1968
**Win - OIB - Windows Hello for Business - D - WHfB Configuration - v3.2**
2069
* The last non-Settings Catalog profile type, Account Protection (Preview) has finally been updated to the Settings Catalog format! The policy does have some changes when compared to the previous version and is also using Device scope settings rather than User, so please review the settings. The new template is also (currently) missing the "Allow biometric authentication" setting, so biometrics are enabled by default providing the device has biometric-capable hardware.
2170

71+
2272
## Changed/Updated
2373
### Settings Catalog
2474
**Win - OIB - Device Security - D - Windows Subsystem for Linux**
@@ -40,7 +90,6 @@
4090
* Removed "Require Private Store Only" setting to match the Microsoft recommendation on restricting access to the Microsoft Store:
4191
<br>[Configure access to the Microsoft Store app - Configure Windows | Microsoft Learn](https://learn.microsoft.com/en-us/windows/configuration/store/?tabs=intune)
4292

43-
4493
### Endpoint Security
4594
**Win - OIB - Defender Antivirus - D - AV Configuration**
4695
* Configured "Metered Connection Updates" to "Allowed" to ensure AV updates are still applied on metered connections.
@@ -49,7 +98,6 @@
4998
* Added settings to ensure users are prompted via notifications for any actions taken by Defender Antivirus.
5099
<br>To enhance this policy further, consider enabling the Customized Toasts and in-app Customization settings to give users confidence that notifications are legitimate.
51100

52-
53101
## Removed
54102
**Win - OIB - Microsoft Accounts - U - Configuration**
55103
* Replaced by device-based policy, Win - OIB - Microsoft Accounts - D - Configuration - v3.2.
@@ -59,7 +107,7 @@
59107

60108
---
61109

62-
# v3.1.1 - 2024-04-15
110+
# Windows v3.1.1 - 2024-04-15
63111

64112
## Changed/Updated
65113
### Settings Catalog
@@ -71,7 +119,7 @@
71119

72120
---
73121

74-
# v3.1 - 2024-04-10
122+
# Windows v3.1 - 2024-04-10
75123

76124
## Added
77125
### Settings Catalog
@@ -194,6 +242,6 @@ Added separate compliance policies to allow for much better granularity and cont
194242

195243
---
196244

197-
# v3.0 and Earlier
245+
# Windows v3.0 and Earlier
198246

199247
I'm sorry, but for various reasons I didn't keep a changelog before this point. I'll try to keep one from now on.

0 commit comments

Comments
 (0)