الملاحظات تحرير

Windows 365 Cloud PC security baseline settings for Intune

  • مقالة
  • قراءة خلال 19 دقائق

Note

This security baseline is in public preview.

View the settings that are part of the Windows 365 Cloud PC security baseline that you can deploy with Microsoft Intune. This article details the settings in the available versions of the baseline and the default values for each setting. The default baseline configuration represents the recommended configuration for applicable devices. Defaults for one baseline might not match defaults from other security baselines, or from other versions of this baseline.

Use this baseline to configure Windows 365 devices with a recommended security configuration.

Windows 365 Cloud PC security baseline version 2101

Windows 365 Cloud PC security baseline version 2110

This version of the security baseline replaces previous versions. Profiles that were created prior to the availability of this baseline version:

  • Are now read-only. You can continue to use those profiles, but can't edit them to change their configuration.
  • Can be updated to the latest version. After you update to the current baseline version, you can edit the profile to modify settings.

To understand what's changed with this version of the baseline from previous versions, use the Compare baselines action. This action is available when you view the Versions pane for this baseline. Be sure to select the version of the baseline that you want to view.

To update a security baseline profile to the latest version of that baseline, see Change the baseline version for a profile.

This article is a reference for the settings contained in this baseline. For each setting in this article, the default value identifies the Windows 365 Cloud PC team's recommended configuration for that setting as the setting is represented in the baseline. These defaults aren't meant to identify the default configuration of the underlying CSP. Use the provided links to view content for the setting's policy configuration service provider (CSP) or underlying rules like attack surface reduction rule. The links in this document are the same as the links available from within the baseline configuration UI in the Microsoft Endpoint Manager admin center.

You can choose to deploy this baseline in its default configuration to apply that recommended security configuration to devices. You can also create custom instances of the baseline to meet your own security needs.

Tip

Before using or modifying a setting in this baseline, review the he Information text in the Microsoft Endpoint Manager admin center for the setting to learn about its conditions or limitations and when applicable, the CSP the setting applied so.

Above Lock

App Runtime

Application management

Attack Surface Reduction Rules

For general information, see Learn about attack surface reduction rules.

  • Block Office communication apps from creating child processes:
    Baseline default: Enable
    ASR rule

  • Block Adobe Reader from creating child processes:
    Baseline default: Enable
    ASR rule

  • Block Office applications from injecting code into other processes:
    Baseline default: Block
    ASR rule

  • Block Office applications from creating executable content:
    Baseline default: Block
    ASR rule

  • Block JavaScript or VBScript from launching downloaded executable content:
    Baseline default: Block
    ASR rule

  • Enable network protection:
    Baseline default: Enable
    CSP: Defender/EnableNetworkProtection

  • Block untrusted and unsigned processes that run from USB:
    Baseline default: Block
    ASR rule

  • Block credential stealing from the Windows local security authority subsystem (lsass.exe):
    Baseline default: Enable
    ASR rule

  • Block all Office applications from creating child processes:
    Baseline default: Block
    ASR rule

  • Block execution of potentially obfuscated scripts (js/vbs/ps):
    Baseline default: Block
    ASR rule

  • Block Win32 API calls from Office macro:
    Baseline default: Block
    ASR rule

  • Block executable content download from email and webmail clients:
    Baseline default: Block
    ASR rule

Audit

Audit settings configure the events that are generated for the conditions of the setting.

  • Account Logon Audit Credential Validation (Device):
    Baseline default: Success and Failure

  • Account Logon Audit Kerberos Authentication Service (Device):
    Baseline default: None

  • Account Logon Logoff Audit Account Lockout (Device):
    Baseline default: Failure

  • Account Logon Logoff Audit Group Membership (Device):
    Baseline default: Success

  • Account Logon Logoff Audit Logon (Device):
    Baseline default: Success and Failure

  • Audit Other Logon Logoff Events (Device):
    Baseline default: Success and Failure

  • Audit Special Logon (Device):
    Baseline default: Success

  • Audit Security Group Management (Device):
    Baseline default: Success

  • Audit User Account Management (Device):
    Baseline default: Success and Failure

  • Detailed Tracking Audit PNP Activity (Device):
    Baseline default: Success

  • Detailed Tracking Audit Process Creation (Device):
    Baseline default: Success

  • Object Access Audit Detailed File Share (Device):
    Baseline default: Failure

  • Audit File Share Access (Device):
    Baseline default: Success and Failure

  • Object Access Audit Other Object Access Events (Device):
    Baseline default: Success and Failure

  • Object Access Audit Removable Storage (Device):
    Baseline default: Success and Failure

  • Audit Authentication Policy Change (Device):
    Baseline default: Success

  • Policy Change Audit MPSSVC Rule Level Policy Change (Device):
    Baseline default: Success and Failure

  • Policy Change Audit Other Policy Change Events (Device):
    Baseline default: Failure

  • Audit Changes to Audit Policy (Device):
    Baseline default: Success

  • Privilege Use Audit Sensitive Privilege Use (Device):
    Baseline default: Success and Failure

  • System Audit Other System Events (Device):
    Baseline default: Success and Failure

  • System Audit Security State Change (Device):
    Baseline default: Success

  • Audit Security System Extension (Device):
    Baseline default: Success

  • System Audit System Integrity (Device):
    Baseline default: Success and Failure

Auto Play

Browser

Connectivity

Credentials Delegation

Credentials UI

Device Guard

  • Virtualization based security:
    Baseline default: Enable VBS with secure boot

  • Enable virtualization based security:
    Baseline default: Yes
    CSP DeviceGuard/EnableVirtualizationBasedSecurity

  • Launch system guard:
    Baseline default: Enabled

  • Turn on Credential Guard:
    Baseline default: Enable with UEFI lock
    CSP DeviceGuard

Device Installation

DMA Guard

  • Enumeration of external devices incompatible with Kernel DMA Protection
    Baseline default: Block all

Event Log Service

Experience

File Explorer

Firewall

Internet Explorer

Local Policies Security Options

Microsoft Defender

Microsoft Defender Antivirus Exclusions

  • Defender Processes to exclude
    Baseline defaults:

    • %ProgramFiles%\FSLogix\Apps\frxccd.exe
    • %ProgramFiles%\FSLogix\Apps\frxccds.exe
    • %ProgramFiles%\FSLogix\Apps\frxsvc.exe

  • File extensions to exclude from scans and real-time protection
    Baseline defaults:

    • %ProgramFiles%\FSLogix\Apps\frxdrv.sys
    • %ProgramFiles%\FSLogix\Apps\frxdrvvts.sys
    • %%ProgramFiles%\FSLogix\Apps\frxccd.sys
    • %TEMP%.VHD*
    • %Windir%\TEMP*.VHD
    • %Windir%\TEMP*.VHDX
    • \\storageaccount.file.core.windows.net\share**.VHD
    • \\storageaccount.file.core.windows.net\share**.VHDX

  • Defender Files And Folders To Exclude
    Baseline default:
    This setting has no default entries.

Microsoft Edge

  • Control which extensions cannot be installed
    Baseline default: Enabled

    • Extension IDs the user should be prevented from installing (or * for all)
      Baseline default:
      • *

  • Allow user-level native messaging hosts (installed without admin permissions)
    Baseline default: Disabled

  • Minimum SSL version enabled
    Baseline default: Enabled

    • Minimum SSL version enabled
      Baseline default: TLS 1.2

  • Allow users to proceed from the SSL warning page
    Baseline default: Disabled

  • Configure Microsoft Defender SmartScreen
    Baseline default: Enabled

  • Prevent bypassing Microsoft Defender SmartScreen prompts for sites
    Baseline default: Enabled

  • Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads
    Baseline default: Enabled

  • Configure Microsoft Defender SmartScreen to block potentially unwanted apps
    Baseline default: Enabled

  • Default Adobe Flash setting
    Baseline default: Enabled

    • Default Adobe Flash setting
      Baseline default: Block the Adobe Flash plugin

  • Enable saving passwords to the password manager
    Baseline default: Disabled

  • Enable site isolation for every site
    Baseline default: Enabled

  • Supported authentication schemes
    Baseline default: Enabled

    • Supported authentication schemes
      Baseline defaults:
      • NTLM
      • Negotiate

MS Security Guide

MSS Legacy

Remote Assistance

Remote Desktop Services

Remote Management

Remote Procedure Call

Smart Screen

System

Windows Connection Manager

Windows Ink Workspace

Windows PowerShell

Windows Security