1.1 (L1) Ensure 'Allow Cortana Above Lock' is set to 'Block'

CSCv7|16.11

4.1.3.1 (L1) Ensure 'Prevent enabling lock screen camera' is set to 'Enabled'

4.1.3.2 (L1) Ensure 'Prevent enabling lock screen slide show' is set to 'Enabled'

4.4.1 (L1) Ensure 'Apply UAC restrictions to local accounts on network logons' is set to 'Enabled'

CSCv7|4.3

4.4.2 (L1) Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)'

CSCv7|9.2

CSCv7|14.3

4.4.3 (L1) Ensure 'Configure SMB v1 server' is set to 'Disabled'

4.4.4 (L1) Ensure 'Enable Structured Exception Handling Overwrite Protection (SEHOP)' is set to 'Enabled'

CSCv7|8.3

4.4.5 (L1) Ensure 'WDigest Authentication' is set to 'Disabled'

CSCv7|16.4

4.5.1 (L1) Ensure 'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)' is set to 'Disabled'

4.5.2 (L1) Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled'

4.5.3 (L1) Ensure 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled'

4.5.5 (L1) Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled'

4.5.7 (L1) Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled'

CSCv7|5.1

4.5.9 (L1) Ensure 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)' is set to 'Enabled'

4.5.10 (L1) Ensure 'MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires (0 recommended)' is set to 'Enabled: 5 or fewer seconds'

4.5.13 (L1) Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less'

CSCv7|6.3

CSCv7|6.4

4.6.4.1 (L1) Ensure 'Turn off multicast name resolution' is set to 'Enabled'

4.6.9.1 (L1) Ensure 'Prohibit installation and configuration of Network Bridge on your DNS domain network' is set to 'Enabled'

CSCv7|11.3

4.6.9.2 (L1) Ensure 'Prohibit use of Internet Connection Sharing on your DNS domain network' is set to 'Enabled'

4.6.9.3 (L1) Ensure 'Require domain users to elevate when setting a network's location' is set to 'Enabled'

4.6.11.1 (L1) Ensure 'Hardened UNC Paths' is set to 'Enabled, with 'Require Mutual Authentication', 'Require Integrity', and 'Require Privacy' set for all NETLOGON and SYSVOL shares'

4.6.18.1 (L1) Ensure 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is set to 'Enabled: 3 = Prevent Wi-Fi when on Ethernet'

CSCv7|15.5

4.6.18.2 (L1) Ensure 'Prohibit connection to non-domain networks when connected to domain authenticated network' is set to 'Enabled'

CSCv7|12.4

4.7.1 (L1) Ensure 'Allow Print Spooler to accept client connections' is set to 'Disabled'

4.7.2 (L1) Ensure 'Configure Redirection Guard: Redirection Guard Options' is set to 'Enabled: Redirection Guard Enabled'

4.7.3 (L1) Ensure 'Configure RPC connection settings: Protocol to use for outgoing RPC connections' is set to 'Enabled: RPC over TCP'

4.7.4 (L1) Ensure 'Configure RPC connection settings: Use authentication for outgoing RPC connections' is set to 'Enabled: Default'

4.7.5 (L1) Ensure 'Configure RPC listener settings: Authentication protocol to use for incoming RPC connections:' is set to 'Enabled: Negotiate' or higher

4.7.6 (L1) Ensure 'Configure RPC listener settings: Protocols to allow for incoming RPC connections' is set to 'Enabled: RPC over TCP'

4.7.7 (L1) Ensure 'Configure RPC over TCP port: RPC over TCP port:' is set to 'Enabled: 0'

4.7.8 (L1) Ensure 'Limits print driver installation to Administrators' is set to 'Enabled'

4.7.9 (L1) Ensure 'Manage processing of Queue-specific files: Manage processing of Queue-Specific files' is set to 'Enabled: Limit Queue-specific files to Color profiles'

4.7.10 (L1) Ensure 'Point and Print Restrictions: When installing drivers for a new connection' is set to 'Enabled: Show warning and elevation prompt'

4.7.11 (L1) Ensure 'Point and Print Restrictions: When updating drivers for an existing connection' is set to 'Enabled: Show warning and elevation prompt'

4.9.1.1 (L1) Ensure 'Turn off toast notifications on the lock screen (User)' is set to 'Enabled'

4.10.4.1 (L1) Ensure 'Include command line in process creation events' is set to 'Enabled'

4.10.5.1 (L1) Ensure 'Encryption Oracle Remediation' is set to 'Enabled: Force Updated Clients'

CSCv7|3.4

4.10.5.2 (L1) Ensure 'Remote host allows delegation of non-exportable credentials' is set to 'Enabled'

CSCv7|16.5

4.10.9.2 (L1) Ensure 'Prevent device metadata retrieval from the Internet' is set to 'Enabled'

4.10.13.1 (L1) Ensure 'Boot-Start Driver Initialization Policy' is set to 'Enabled: Good, unknown and bad but critical'

4.10.19.1 (L1) Ensure 'Continue experiences on this device' is set to 'Disabled'

4.10.19.2 (L1) Ensure 'Turn off background refresh of Group Policy' is set to 'Disabled'

CSCv7|5.4

4.10.20.1.2 (L1) Ensure 'Turn off downloading of print drivers over HTTP' is set to 'Enabled'

CSCv7|2.7

4.10.20.1.5 (L1) Ensure 'Turn off Internet download for Web publishing and online ordering wizards' is set to 'Enabled'

CSCv7|7.4

4.10.26.1 (L1) Ensure 'Block user from showing account details on sign-in' is set to 'Enabled'

4.10.26.2 (L1) Ensure 'Do not display network selection UI' is set to 'Enabled'

4.10.26.3 (L1) Ensure 'Do not enumerate connected users on domain-joined computers' is set to 'Enabled'

4.10.26.4 (L1) Ensure 'Enumerate local users on domain-joined computers' is set to 'Disabled'

4.10.26.5 (L1) Ensure 'Turn off app notifications on the lock screen' is set to 'Enabled'

4.10.26.6 (L1) Ensure 'Turn off picture password sign-in' is set to 'Enabled'

4.10.26.7 (L1) Ensure 'Turn on convenience PIN sign-in' is set to 'Disabled'

4.10.29.5.1 (L1) Ensure 'Require a password when a computer wakes (on battery)' is set to 'Enabled'

4.10.29.5.2 (L1) Ensure 'Require a password when a computer wakes (plugged in)' is set to 'Enabled'

4.10.30.1 (L1) Ensure 'Configure Offer Remote Assistance' is set to 'Disabled'

4.10.30.2 (L1) Ensure 'Configure Solicited Remote Assistance' is set to 'Disabled'

4.10.31.1 (L1) Ensure 'Enable RPC Endpoint Mapper Client Authentication' is set to 'Enabled'

4.10.31.2 (L1) Ensure 'Restrict Unauthenticated RPC clients' is set to 'Enabled: Authenticated'

4.10.44.1.1 (L1) Ensure 'Enable Windows NTP Client' is set to 'Enabled'

CSCv7|6.1

4.10.44.1.2 (L1) Ensure 'Enable Windows NTP Server' is set to 'Disabled'

4.11.3.1 (L1) Ensure 'Allow Microsoft accounts to be optional' is set to 'Enabled'

CSCv7|16.2

4.11.5.1 (L1) Ensure 'Do not preserve zone information in file attachments (User)' is set to 'Disabled'

4.11.5.2 (L1) Ensure 'Notify antivirus programs when opening attachments (User)' is set to 'Enabled'

CSCv7|8.1

4.11.6.1 (L1) Ensure 'Disallow Autoplay for non-volume devices' is set to 'Enabled'

CSCv7|8.5

4.11.6.2 (L1) Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands'

4.11.6.3 (L1) Ensure 'Turn off Autoplay' is set to 'Enabled: All drives'

4.11.8.1 (L1) Ensure 'Do not display the password reveal button' is set to 'Enabled'

4.11.8.2 (L1) Ensure 'Enumerate administrator accounts on elevation' is set to 'Disabled'

4.11.8.3 (L1) Ensure 'Prevent the use of security questions for local accounts' is set to 'Enabled'

4.11.10.1 (L1) Ensure 'Enable App Installer Experimental Features' is set to 'Disabled'

4.11.10.2 (L1) Ensure 'Enable App Installer Hash Override' is set to 'Disabled'

4.11.10.3 (L1) Ensure 'Enable App Installer ms-appinstaller protocol' is set to 'Disabled'

4.11.15.1.1 (L1) Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'

4.11.15.1.2 (L1) Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'

4.11.15.2.1 (L1) Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'

4.11.15.2.2 (L1) Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 196,608 or greater'

4.11.15.3.1 (L1) Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'

4.11.15.3.2 (L1) Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'

4.11.15.4.1 (L1) Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled'

4.11.15.4.2 (L1) Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater'

4.11.18.1 (L1) Ensure 'Configure Windows Defender SmartScreen' is set to 'Enabled: Warn and prevent bypass'

4.11.18.2 (L1) Ensure 'Turn off Data Execution Prevention for Explorer' is set to 'Disabled'

4.11.18.3 (L1) Ensure 'Turn off heap termination on corruption' is set to 'Disabled'

4.11.18.4 (L1) Ensure 'Turn off shell protocol protected mode' is set to 'Disabled'

4.11.27.1 (L1) Ensure 'Block all consumer Microsoft account user authentication' is set to 'Enabled'

CSCv7|16.8

4.11.28.3.1 (L1) Ensure 'Configure local setting override for reporting to Microsoft MAPS' is set to 'Disabled'

4.11.31.1 (L1) Ensure 'Prevent users from sharing files within their profile. (User)' is set to 'Enabled'

CSCv7|14.6

4.11.36.3.2 (L1) Ensure 'Do not allow passwords to be saved' is set to 'Enabled'

4.11.36.4.3.2 (L1) Ensure 'Do not allow drive redirection' is set to 'Enabled'

4.11.36.4.9.1 (L1) Ensure 'Always prompt for password upon connection' is set to 'Enabled'

4.11.36.4.9.2 (L1) Ensure 'Require secure RPC communication' is set to 'Enabled'

4.11.36.4.9.3 (L1) Ensure 'Require use of specific security layer for remote (RDP) connections' is set to 'Enabled: SSL'

4.11.36.4.9.4 (L1) Ensure 'Require user authentication for remote connections by using Network Level Authentication' is set to 'Enabled'

4.11.36.4.9.5 (L1) Ensure 'Set client connection encryption level' is set to 'Enabled: High Level'

4.11.36.4.11.1 (L1) Ensure 'Do not delete temp folders upon exit' is set to 'Disabled'

4.11.37.1 (L1) Ensure 'Prevent downloading of enclosures' is set to 'Enabled'

CSCv7|7.2

4.11.42.1 (L1) Ensure 'Turn off the offer to update to the latest version of Windows' is set to 'Enabled'

4.11.50.1 (L1) Ensure 'Enable MPR notifications for the system' is set to 'Disabled'

4.11.50.2 (L1) Ensure 'Sign-in and lock last interactive user automatically after a restart' is set to 'Disabled'

4.11.55.1.1 (L1) Ensure 'Allow Basic authentication' is set to 'Disabled'

4.11.55.1.2 (L1) Ensure 'Allow unencrypted traffic' is set to 'Disabled'

Detections

Analytics

CIS Microsoft Intune for Windows 11 v4.0.0 L1

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Functional Update

Miscellaneous


Revision 1.3 Aug 18, 2026 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Jun 24, 2025 Miscellaneous Variables updated.
Revision 1.1 Jun 23, 2025 Functional Update CIS_Microsoft_Intune_for_Windows_11_v4.0.0_L1.audit from CIS Microsoft Intune for Windows 11 Benchmark v4.0.0 Miscellaneous Platform check updated.

Detections

Analytics

CIS Microsoft Intune for Windows 11 v4.0.0 L1 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Functional Update

Miscellaneous

CIS Microsoft Intune for Windows 11 v4.0.0 L1