Skip to content
OpenIntuneBaseline

Windows baseline comparison

Documented below are the results of some tests of other baseline configurations available for Intune-managed devices. I documented the experience seen during an Autopilot deployment, the general post-provisioning user experience, and any policy or security issues identified.

To conduct the tests I took an approach that is widely seen in this space, that being:

  • Baselines were imported “as-is” with no modifications made.
  • All policies were targeted at devices, rather than users.

OIB data has been presented from direct feedback from community members who have implemented the baseline in their own environments. Other baseline tests have been conducted to map against those same feedback points to provide a reasonable and unbiased comparison.

OpenIntuneBaseline

Section titled “OpenIntuneBaseline”

Test details

Section titled “Test details”

Autopilot user experience

Section titled “Autopilot user experience”
  • No reboot seen between Device and User phase.
  • User required to pass a 2nd MFA challenge to configure WHfB (not seen if skipping user ESP or ESP takes less than 15 minutes).

General user experience

Section titled “General user experience”
  • Edge automatically configured and signed-in.
  • Great productivity experience:
    • Outlook auto sign-in using primary SMTP address
    • OneDrive KFM automatically configured and signed-in
    • Office apps do not prompt first-run wizard

Helpdesk support experience

Section titled “Helpdesk support experience”
  • UAC allowed within the user session, able to use LAPS to diagnose or resolve issues.

Policy issues seen

Section titled “Policy issues seen”
  • Two transient policy errors due to Defender Additional Configuration and Defender Tamper Protection (see known issues). Resolved after reboot.

Security issues identified

Section titled “Security issues identified”
  • None

Admin impact summary

Section titled “Admin impact summary”
  • Simple and quick implementation of a secure, “known-good” baseline.
  • Known issues are well documented.
  • Policies are granular and easy to understand and expand on.
  • Community-driven feedback and support available.

Intune Security Baseline

Section titled “Intune Security Baseline”

Comparison rationale

Section titled “Comparison rationale”

In blogs, documentation, and presentations, Microsoft regularly states that the Intune Security Baseline is the recommended starting point for securing Windows devices.

Test details

Section titled “Test details”

Autopilot user experience

Section titled “Autopilot user experience”
  • Reboot seen between Device and User phase:
    • User needs to re-input user credentials.
    • User required to re-pass MFA (if not skipping user ESP).
  • User required to pass a 3rd MFA challenge to configure WHfB (or 2nd if skipping user ESP).
  • Default password length of 14, which also impacts the WHfB PIN.

General user experience

Section titled “General user experience”
  • You’ve been forced to use a 14 character PIN which you’ve probably set the same as your password.
  • Poor initial Edge user experience:
    • Account automatically identified but user asked to sign in
    • Large number of initial setup wizard prompts
  • Suboptimal productivity experience:
    • Outlook identifies the user account but does not get automatically configured
    • No OneDrive configuration, user has to sign in and configure manually
    • Prompted by Office first-run wizard to set file types

Helpdesk support experience

Section titled “Helpdesk support experience”
  • UAC blocked within the user session, making it difficult to diagnose or resolve issues.

Policy issues seen

Section titled “Policy issues seen”
  • Windows and Defender Security Baselines (still) conflict with each other.

Security issues identified

Section titled “Security issues identified”
  • No BitLocker configuration, leaving the device unencrypted.

Admin impact

Section titled “Admin impact”
  • Applying other policies is difficult due to the monolithic nature of the security baseline.
  • Tracking down and resolving conflicts between the security baselines is time-consuming.
  • Support relies on Microsoft documentation or available paid support channels.

Center for Internet Security (CIS) Benchmark

Section titled “Center for Internet Security (CIS) Benchmark”

Comparison rationale

Section titled “Comparison rationale”

The CIS Benchmarks are widely used across the industry and are considered a “gold standard” for device security configuration.

Test details

Section titled “Test details”

Autopilot user experience

Section titled “Autopilot user experience”
  • Reboot seen between Device and User phase:
    • User had to press CTRL+ALT+DEL.
    • User needs to re-input user credentials.
    • User required to re-pass MFA (if not skipping user ESP).
  • User required to pass a 3rd MFA challenge to configure WHfB (or 2nd if skipping user ESP).

General user experience

Section titled “General user experience”
  • Configured to not remember user credentials, so every logon requires full credential input even if WHfB is configured.
  • Poor initial Edge user experience:
    • Account automatically identified but user asked to sign in
    • Large number of initial setup wizard prompts
  • Suboptimal productivity experience:
    • Outlook identifies the user account but does not get automatically configured
    • No OneDrive configuration, user has to sign in and configure manually
    • Prompted by Office first-run wizard to set file types

Helpdesk support experience

Section titled “Helpdesk support experience”
  • UAC blocked within the user session, making it difficult to diagnose or resolve issues.

Policy issues seen

Section titled “Policy issues seen”
  • CIS (L1) Section 1 - 3.9.1.1 - Windows 11 Intune 3.0 - (L1) Ensure ‘MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)’ is set to ‘Disabled’
    • Setting completely breaks Autopilot if not removed.
  • CIS (L1) Windows Update - Windows 11 Intune 3.0.1
    • Conflicted with pre-existing Windows Update for Business ring settings.

Security issues identified

Section titled “Security issues identified”
  • BitLocker policy does not function, leaving the device unencrypted.
  • Some security gaps without implementing additional benchmarks (e.g. Edge, Internet Explorer).
  • Conflicts in Windows Update settings lead to unpredictable update behaviour.

Admin impact

Section titled “Admin impact”
  • Does not work out-of-the-box with Autopilot!
  • Applying other policies potentially difficult due to haphazard existing policy groupings.
  • Tracking down and resolving conflicts between the security baselines is time-consuming.
  • Support relies on vendor documentation or available paid support channels.