| 4.5.4 Ensure 'MSS: (DisableSavePassword) Prevent the dial-up password from being saved (recommended)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.5.8 Ensure 'MSS: (PerformRouterDiscovery) Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.5.10 Ensure 'MSS: (TcpMaxDataRetransmissions IPv6) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 4.6.17.1 Ensure 'Configuration of wireless settings using Windows Connect Now' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.6.17.2 Ensure 'Prohibit access of the Windows Connect Now wizards' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.9.1.1 Ensure 'Prevent installation of devices using drivers that match these device setup classes' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | MEDIA PROTECTION |
| 4.10.9.1.3 Ensure 'Prevent installation of devices using drivers that match these device setup classes: Prevent installation of devices using drivers for these device setup' is set to 'IEEE 1394 device setup classes' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.10.20.1.7 Ensure 'Turn off Registration if URL connection is referring to Microsoft.com' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.23.1 Ensure 'Support device authentication using certificate' is set to 'Enabled: Automatic' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION |
| 4.11.3.2 Ensure 'Block launching Universal Windows apps with Windows Runtime API access from hosted content.' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.7.1.1 Ensure 'Choose how BitLocker-protected fixed drives can be recovered' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.1.4 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent' is set to 'Enabled: True' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.1.5 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS' is set to 'Enabled: Backup recovery passwords and key packages' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.1.6 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives' is set to 'Enabled: False' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.1.7 Ensure 'Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard' is set to 'Enabled: True' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.3 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Recovery Password' is set to 'Enabled: Require 48-digit recovery password' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.4 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent' is set to 'Enabled: False' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.5 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS:' is set to 'Enabled: Store recovery passwords and key packages' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.7 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard' is set to 'Enabled: True' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.8 Ensure 'Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives' is set to 'Enabled: True' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.2.9 Ensure 'Enforce drive encryption type on operating system drives: Select the encryption type: (Device)' is set to 'Enabled: Used Space Only encryption' or 'Enabled: Full encryption' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.7.5 Ensure 'Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for operating system drives' is set to 'XTS-AES 128-bit (default)' or 'XTS-AES 256-bit' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.35.4.3.3 Ensure 'Do not allow LPT port redirection' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.35.4.3.4 Ensure 'Do not allow supported Plug and Play device redirection' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.35.4.10.1 Ensure 'Set time limit for active but idle Remote Desktop Services sessions' is set to 'Enabled: 15 minutes or less, but not Never (0)' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | ACCESS CONTROL |
| 4.11.35.4.10.2 Ensure 'Set time limit for disconnected sessions' is set to 'Enabled: 1 minute' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | ACCESS CONTROL |
| 4.11.41.2 Ensure 'Turn off the Store application' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.48.1 Ensure 'Prevent Internet Explorer security prompt for Windows Installer scripts' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.51.2.1 Ensure 'Prevent Codec Download (User)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.53.2 Ensure 'Turn on PowerShell Transcription' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.11.54.2.2 Ensure 'Allow remote server management through WinRM' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 8.2 Ensure 'Allow Warning For Other Disk Encryption' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 8.3 Ensure 'Allow Warning For Other Disk Encryption: Allow Standard User Encryption' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 BL | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 12.1 Ensure 'Allow Camera' is set to 'Not allowed' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 49.5 Ensure 'Devices: Prevent users from installing printer drivers when connecting to shared printers' is set to 'Enable' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 54.1 Ensure 'Allow Message Sync' is set to 'message sync is not allowed and cannot be changed by the user.' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 55.3 Ensure 'Allow Shared User App Data' is set to 'Block' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | ACCESS CONTROL |
| 69.1 Ensure 'Allow Cross Device Clipboard' is set to 'Block' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 69.3 Ensure 'Disable Advertising ID' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 69.5 Ensure 'Upload User Activities' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 73.1 Ensure 'Allow Cloud Search' is set to 'Not allowed' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 81.2 Ensure 'Allow Location' is set to 'Force Location Off...' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 81.5 Ensure 'Disable One Drive File Sync' is set to 'Sync Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.6 Ensure 'Geolocation Service (lfsvc)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.12 Ensure 'Microsoft iSCSI Initiator Service (MSiSCSI)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.14 Ensure 'Print Spooler (Spooler)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.21 Ensure 'Remote Registry (RemoteRegistry)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.25 Ensure 'SNMP Service (SNMP)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 82.35 Ensure 'Windows Remote Management (WS-Management) (WinRM)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
| 95.1 Ensure 'Allow widgets' is set to 'Not allowed' | CIS Microsoft Intune for Windows 11 v5.0.0 L2 | Windows | CONFIGURATION MANAGEMENT |
