Security Baseline 23H2 issue with Hardened UNC Paths
I am testing the 23H2 Security Baseline and ran the CIS Benchmark assessment. A setting that previously passed with the November 2021 baseline is now failing. It is the Hardened UNC Paths under Administrative Templates - Network - Network Provider. The attached screenshot named Hardened UNC Paths...png shows the setting configured in the baseline. The screenshot named Registry.png shows the registry after the baseline is applied. The entry for \\*\SYSVOL does not show up and the entry for \\*\NETLOGON is wrong. When adding the entry to the registry for this setting, Microsoft swapped the Name and Data values. The screenshot Registry from Nov 2021 baseline.png is what it should look like and this passes the CIS Benchmark assessment. Can anyone else confirm this? I plan to open a ticket for this issue.CIS Benchmark Assessment fails on Defender settings on Security Baseline 23H2
With the November 2021 Security Baseline, my device passed all but one setting on the CIS Benchmark Assessment. After applying Security Baseline 23H2, I am failing all of them. See CIS Benchmark Assessment.png for the comparison. I found that something in the 23H2 Security Baseline is blocking access to the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Windows Defender\Policy Manager folder in the registry. See attached screenshot. Since the CIS Assessment cannot access the settings to verify them, it gives us a fail on all of the Defender settings. When I go back to the November 2021 baseline, I can see all the settings in the folder. I've reviewed every setting in the 23H2 baseline to see what would cause this and cannot find anything. Any suggestions would be greatly appreciated. Right now, it seems safer to stay on the November 2021 baseline.
Security Baselines
Hi, I'm having an issue after enabling the baseline securities. When we connect our laptop to the docking station via the Thunderbolt port, the peripherals (mouse, keyboard, and network connection) get blocked. We suspected the policy "Disable new DMA devices when this computer is locked," but disabling it didn't help. Does any body have any idea, which policy it might be blocking the peripherals ? this is a headache to find.
Security Baselines for Microsoft 365 Apps
I wanted to get a little clarification on some best practices for using Security Baselines in Intune. Primarily in relation to Microsoft Edge and Microsoft 365. There are multiple areas where policies are managed for these apps: Intune Microsoft 365 Apps Admin Center Microsoft Edge (Located in the Microsoft 365 Admin Center) This is made more confusing in that baselines are made available for Microsoft 365 apps in both Intune and the Apps Admin Center. Not only that, but access to the policy area of the Apps Admin Center is also available in the Intune Apps tab. Microsoft does not really provide clear intent on what each section is intended for, but I'm intuiting they are intending the following: Security Baselines for M365 and Edge apps are managed in Intune. For devices not being managed by Intune, these baselines can also be configured for work or school accounts logged in from an Azure registered device, allowing for a separation of work and personal data. Configurations outside of the Security baselines are intended to be configured in the associated admin center for the app. With all that being said, does anyone know if Microsoft intends to continue support for the M365 Apps Admin Center Policy Configurations or Security Baselines in Intune? What is Microsoft's intention behind the variety of Admin Centers that can apply policies for these the M365 and Edge applications? Are there any best practices for where I should be applying configurations from for these apps? JM
