Skip to content

eneerge/CIS-Microsoft-Intune-For-Windows-IntuneProfile

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

alt text

July 5, 2024

CIS-Microsoft-Intune-For-Windows-IntuneProfile

This repository houses prebuilt Microsoft Intune configuration profiles in JSON format for Windows 10 and Windows 11 that can be imported into Microsoft Intune. (https://intune.microsoft.com).

Implemented using OMA-URI

The profiles are all configured using OMA-URI. There are a few reasons for this approach:

  • Each configuration can be named according the section and name provided by CIS. EG: 1.1.1
  • It is clear what CIS option a particular configuration is addressing
  • When CIS recommendations change, it will be easy to make changes to align with the new recommendation
  • OMA-URIs allow for a "description". This description can be used to note configurations that differ from CIS and provide a reason for the difference. If you use Risk Acceptance Forms (RAF) in your environment, you can also note a RAF # to address the difference.

A lot of the OMA-URIs in these configuration profiles are not published by CIS. The OMA-URIs were found here: https://learn.microsoft.com/en-us/windows/client-management/mdm/ Some configuration options were found by finding corresponding ADMX Group Policy files and locating their xml element ids. These are specified using the SyncML syntax as documented here: https://learn.microsoft.com/en-us/windows/client-management/understanding-admx-backed-policies#enabling-a-policy If you need to implement your own configurations, open the admx file (located at C:\windows\policydefintions) and locate the policy and the corresponding element you want to configure and follow the syntax.

Importing

To import a profile:

  1. Download this Powershell Script: IntuneConfiguration_ImportCustomConfig.ps1
  2. Download the JSON configuration file of your choosing (either Win11 or Win10)
  3. Run the powershell script
  4. Enter the location to the JSON file when prompted

NOTE: To use the new Import script, you may need to "Approve" the requested app access. This is done in the Azure Portal under Enterprise Applications -> Admin consent Requests

Windows 11

New script added July 5, 2024 with multiple audit results.

Windows 10 CIS Gaps / Unimplemented Configurations

The Windows 10 template has a few gaps that I have addressed manually in my environment. Please refer to the Audit results to to see if there's anything you should address. This configuration is currently running in an active production environment without any issue.

Known Issues / Troubleshooting

To verify a configuration applied:

Extras

Firefox can be a pain to work with OMA-URIs. I created a stylesheet to make it a lot easier and that can be seen in the screenshot above. To install, go into the "Extras" folder for instructions.

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published