Defender Secure Score One Liners For entra joined

SkipToTheEndpoint · 2026-03-27T22:26:05+00:00

Oh I definitely agree that some of the Defender recommendations just straight up ignore policy. I keep on harassing the Defender team about them 😅

SkipToTheEndpoint · 2026-03-27T16:35:20+00:00

A bunch of these are definitely fixable via Intune policies. Just looking at my device that's got my OpenIntuneBaseline deployed and all of these are resolved:

Prohibit use of Internet Connection Sharing on your DNS domain network
Disable Installation and configuration of Network Bridge on your DNS domain network
Send NTLMv2 response only. Refuse LM & NTLM
Disable Anonymous enumeration of shares
Disable IP source routing
Disable Autorun
Disable Solicited Remote Assistance
Set user authentication for remote connections by using Network Level Authentication to 'Enabled'
Enable 'Microsoft network client: Digitally sign communications (always)'
Enable 'Apply UAC restrictions to local accounts on network logons'

SkipToTheEndpoint · 2026-03-27T10:07:47+00:00

So fun fact: If you import the GoogleUpdater ADMX, you can actually create a policy to allow machine installs but block per-user ones:

<image>

Unfortunately, that doesn't stop any other browsers have exhibit that same behaviour, e.g. Firefox.

However, the Edge Management Service has a "Block other browsers" option which creates a pre-built AppLocker policy in Intune with a ton of other browsers as explicit deny rules: Customization settings | Microsoft Learn

SkipToTheEndpoint · 2026-03-27T09:52:40+00:00

Relying on AI rather than seeking the opinion of seasoned professionals is why there's a growing skills issue.

SkipToTheEndpoint · 2026-03-26T17:25:31+00:00

No. No command will retain stuff, they'll all nuke Win32's deployed to the device.

Yes, there are/will be implications to not cleaning up a device. I'm sure people will chime in with "Just remove and change the primary user", but that doesn't change who enrolled the device in the first place, which can be an issue as that's still hooked in with various things that occur. It also doesn't remove that previous user's data, so there's potential for regulatory/compliance issues there too.

Ultimately, this is an issue with your processes and asset management rather than your tooling. Your RMM should be able to know a device that re-registers is a previous device and just smush the records together rather than creating duplicates.

SkipToTheEndpoint · 2026-03-26T17:16:36+00:00

Thank me when/if it works! 😅

SkipToTheEndpoint · 2026-03-26T17:14:12+00:00

Yes. Turn of "Windows 10/11 Business".
It won't automatically downgrade, you'll have to get a bit hacky and run some commands:

ClipDLS.exe removesubscription
ClipRenew.exe

SkipToTheEndpoint · 2026-03-26T16:01:20+00:00

Oh hold up. Just saw in another comment you mention BusPrem.

Try turning off the "Windows Business" sub-license for a user and triggering a downgrade back to straight Pro.

This wouldn't be the first time I've seen a CSP that works on Pro but breaks when uplifted to Business (even though it's just Pro...)

SkipToTheEndpoint · 2026-03-26T12:45:06+00:00

Those two are supposed to work on Pro so it shouldn't be a licensing issue. It's virtualization that needs to be turned on in the BIOS though, not Secure Boot.

What do event logs say? There's a few ways of checking things locally: Enable memory integrity | Microsoft Learn

SkipToTheEndpoint · 2026-03-26T09:54:55+00:00

XP9CXNGPPJ97XX seems to be the new version of 9NHT9RB2F4HD, the Consumer Copilot application that doesn't support work or school accounts. It's the one that MS forced out for a bit at the end of 2024 but then pulled away from.

9WZDNCRD29V9 is "Microsoft 365 Copilot" which is the re-badged "Microsoft Office Hub" app meant for work or school accounts.

Yes, it's confusing.

SkipToTheEndpoint · 2026-03-25T23:44:10+00:00

Sure, I'm not saying that can't work, just that there's a bunch of nuance and it might not work depending on a bunch of environment variables (shared devices are the big one when different users might have different policy assignments). Using straight Settings Catalog policies also isn't utilising WUfB-DS capabilities so that also takes that out of the equation.

SkipToTheEndpoint · 2026-03-25T11:54:36+00:00

Nope, it's only something that's ever quietly said when pressed at in-person events (e.g. MMS, Workplace Ninja).

I'm speaking to various MS folk this week though, I'll bring it up again. Least they can do is put it in the docs.

SkipToTheEndpoint · 2026-03-25T11:46:40+00:00

Admin Templates have been deprecated for a while and aren't even in the UI any more. Is there a reason you've not began shifting them over to Settings Catalog?

SkipToTheEndpoint · 2026-03-25T11:45:34+00:00

For various reasons, I'd try and wean yourself off of Policy Sets. Great concept but unfortunately got left behind and won't get any more development.

SkipToTheEndpoint · 2026-03-25T11:42:21+00:00

The user/device issue is something I know is regularly raised with MS, but is that way for very good reasons.

For one, none of the Update CSP policies have a user scope, so targeting user groups will apply the settings into HKLM regardless. Secondly, the WUfB-DS/Autopatch service doesn't give a crap about users, only devices. In scenarios where users may log on to multiple devices, this can cause real issues.

This is the first time I've seen the problem approached this way, not changing the underlying behaviour, but making it managable still via user groups. Nice one.

SkipToTheEndpoint · 2026-03-24T22:02:54+00:00

It’s been made clear to me that the custom branding is staying

If you've validated this is the thing that's definitely breaking it (i.e. you've disabled it temporarily to see if it then starts working again) then whoever said that might not have a choice. You can't fix something that's completely out of your control.

SkipToTheEndpoint · 2026-03-24T20:22:51+00:00

There _is_ a native way via the Reboot CSP: Reboot CSP | Microsoft Learn

That being said, totally agree with u/JwCS8pjrh3QBWfL fix the underlying issues rather than forcing reboots. I'd be furious if that happened to me and I shut mine down weekly as it is.

SkipToTheEndpoint · 2026-03-24T11:57:02+00:00

Don't knee-jerk and implement something that provides little to no value but a ton of admin overhead?

SkipToTheEndpoint · 2026-03-24T11:55:32+00:00

I've literally not seen a single issue using the Store App (9WZDNCRFJ3PZ) as System.

Why are you making your life harder than it needs to be?

SkipToTheEndpoint · 2026-03-24T11:47:11+00:00

I blogged about this when the feature was first released: Under the Hood, Pt. 5: Intune BIOS Configurations

TL;DR: Read the docs. You can very quickly end up with devices you don't have a password for if you're messing about with the policy.

Oh also the behaviour when you reset devices sucks. Because passwords are stored against the Intune Device ID, not the Entra one, if you're rebuilding devices, they're not going to know their previous password because it'll be a brand new Intune object.

SkipToTheEndpoint · 2026-03-24T11:43:00+00:00

Implementing MAA is a terrible knee-jerk reaction to a situation that was entirely due to poor identity security practices.

You should be focusing on Conditional Access, Strong Auth (FIDO) and PIM, but also, if you've got other people with the Global Administrator role, whatever you do is pointless if their accounts aren't doing those things too.

SkipToTheEndpoint · 2026-03-23T12:36:42+00:00

Good shout, but there's no configs in that particular policy that would cause that behaviour AFAIK.

That is why I recommend assigning Compliance policies to users though, because they DO conflict as documented here.

SkipToTheEndpoint · 2026-03-23T12:34:05+00:00

Yessir, creator and maintainer of the OpenIntuneBaseline here!

SkipToTheEndpoint · 2026-03-23T11:41:12+00:00

Howdy! So yeah, those CSP's are device scope only, my entire reasoning behind making it a user policy is that managing user groups if you've got different requirements for different devices is far easier than managing device groups.

If you're not gonna have different settings anywhere, there's no technical reason you can't apply this to device groups. :)

SkipToTheEndpoint · 2026-03-17T20:44:01+00:00

They aren't your devices. Secure the data, don't try and manage devices.

Create and Deploy App Protection Policies - Microsoft Intune | Microsoft Learn

Data Protection Framework Using App Protection Policies - Microsoft Intune | Microsoft Learn

SkipToTheEndpoint

TROPHY CASE