| 4.5.2 Ensure 'MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.5.3 Ensure 'MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' is set to 'Enabled: Highest protection, source routing is completely disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.5.5 Ensure 'MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.5.7 Ensure 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| 4.6.9.3 Ensure 'Require domain users to elevate when setting a network's location' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 4.7.11 Ensure 'Point and Print Restrictions: When updating drivers for an existing connection' is set to 'Enabled: Show warning and elevation prompt' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.5.2 Ensure 'Remote host allows delegation of non-exportable credentials' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 4.10.13.1 Ensure 'Boot-Start Driver Initialization Policy' is set to 'Enabled: Good, unknown and bad but critical' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.10.19.1 Ensure 'Continue experiences on this device' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.20.1.2 Ensure 'Turn off downloading of print drivers over HTTP' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.26.3 Ensure 'Do not enumerate connected users on domain-joined computers' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 4.10.30.2 Ensure 'Configure Solicited Remote Assistance' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.31.2 Ensure 'Restrict Unauthenticated RPC clients' is set to 'Enabled: Authenticated' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.44.1.2 Ensure 'Enable Windows NTP Server' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.11.6.1 Ensure 'Disallow Autoplay for non-volume devices' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | MEDIA PROTECTION |
| 4.11.6.3 Ensure 'Turn off Autoplay' is set to 'Enabled: All drives' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | MEDIA PROTECTION |
| 4.11.10.3 Ensure 'Enable App Installer ms-appinstaller protocol' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.15.2.1 Ensure 'Control Event Log behavior when the log file reaches its maximum size' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.11.30.1 Ensure 'Prevent users from sharing files within their profile. (User)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 4.11.35.4.9.5 Ensure 'Set client connection encryption level' is set to 'Enabled: High Level' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.36.1 Ensure 'Prevent downloading of enclosures' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.11.41.1 Ensure 'Turn off the offer to update to the latest version of Windows' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.49.1 Ensure 'Enable MPR notifications for the system' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 6.10 Ensure 'Audit File Share Access' is set to 'Success and Failure' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.17 Ensure 'Detailed Tracking Audit Process Creation' is set to include 'Success' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.18 Ensure 'Object Access Audit Detailed File Share' is set to include 'Failure' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.20 Ensure 'Object Access Audit Removable Storage' is set to 'Success and Failure' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.22 Ensure 'Policy Change Audit Other Policy Change Events' is set to include 'Failure' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.26 Ensure 'System Audit Security State Change' is set to include 'Success' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 45.7 Ensure 'Min Smb2 Dialect' is set to '3.1.1' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 49.12 Ensure 'Microsoft network client: Digitally sign communications (always)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 49.25 Ensure 'User Account Control: Behavior of the elevation prompt for administrators' is set to 'Prompt for consent on the secure desktop' or higher | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 49.26 Ensure 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 49.31 Ensure 'User Account Control: Run all administrators in Admin Approval Mode' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 55.1 Ensure 'Allow apps from the Microsoft app store to auto update' is set to 'Allowed' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 55.6 Ensure 'MSI Allow user control over installs' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 77.1.3 Ensure 'Notify Unsafe App' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 77.1.4 Ensure 'Service Enabled' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 81.3 Ensure 'Allow Telemetry' is set to 'Basic' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.3 Ensure 'Computer Browser (Browser)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.20 Ensure 'Remote Procedure Call (RPC) Locator (RpcLocator)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.22 Ensure 'Routing and Remote Access (RemoteAccess)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.28 Ensure 'UPnP Device Host (upnphost)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.38 Ensure 'Xbox Live Auth Manager (XblAuthManager)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.39 Ensure 'Xbox Live Game Save (XblGameSave)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 90.12 Ensure 'Debug Programs' is set to 'Administrators' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.14 Ensure 'Deny Local Log On' to include 'Guests' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.25 Ensure 'Manage auditing and security log' is set to 'Administrators' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.32 Ensure 'Replace Process Level Token' is set to 'LOCAL SERVICE, NETWORK SERVICE' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.33 Ensure 'Restore Files And Directories' is set to 'Administrators' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
