Windows 11 Security Baseline

Windows 11 Security Baseline

The Windows 11 security baseline is Microsoft's curated set of recommended security settings — hundreds of policies vetted for both security value and compatibility. The baseline is delivered as Intune security baselines (settings catalog edition) or GPO templates from the Microsoft Security Compliance Toolkit.

This skill covers what to enable, the Windows 11-specific controls (LAPS, VBS/HVCI, Credential Guard, Smart App Control, PDE), and the rollout pattern.

When to use

Hardening a Windows 11 fleet with Intune (or GPO for legacy estates), with focus on the hardware-rooted and identity-protection capabilities specific to modern Windows.

Do not use this skill for MDE policy authoring (defender-for-endpoint), generic Intune device management (intune-device-mgmt), or BitLocker-only design (bitlocker-design).

Core controls — turn on, in this order

Approach

1. Apply the Microsoft security baseline via Intune at the device level. Use the Settings catalog version (newer) or the named "Windows 11 security baseline" — the newer Settings catalog is the forward-looking option.

2. Pilot ring methodology.

   • Ring 0 (50 IT devices): all baseline + new controls.
   • Ring 1 (5% representative): same.
   • Ring 2 (rest): after compatibility validation. Don't treat the baseline as a one-shot deployment; some controls (Smart App Control, WDAC, PDE) need staged rollout.

3. Hardware-rooted identity stack.

   • Verify TPM 2.0 + Secure Boot at provisioning (Autopilot precondition).
   • Enable VBS + HVCI / Memory Integrity via baseline; expect older drivers to break — use the Driver Compatibility tool to find blockers pre-rollout.
   • Enable Credential Guard + LSA Protection — together they end most Mimikatz-style attacks against managed devices.

4. Windows LAPS (the new built-in product, separate from legacy LAPS):

   • Entra-joined: passwords stored in Entra ID, rotated via Intune policy.
   • Hybrid / AD-joined: passwords stored in AD, schema extension required. Migrate off legacy LAPS (deprecated). Cap password age 30 days.

5. Smart App Control is only available on clean-installed Win11 (kicks in after a learning phase). For existing devices, use WDAC / App Control for Business — bigger investment but works on upgraded fleets. Phase: audit-only policy → enforce per device group → expand.

6. Personal Data Encryption (PDE) requires Windows Hello for Business and modern auth. Roll out with WHfB; not a replacement for BitLocker — it's per-file encryption layered on top.

7. Windows Hello for Business as the local sign-in (cert-trust or cloud Kerberos trust). Pair with passkeys-fido2 for the broader phishing-resistant strategy.

8. Controlled Folder Access + Exploit Protection. CFA in audit mode for 14 days; then enforce on user workstations only (not servers — breaks app file writes). Exploit Protection profile from Microsoft baseline applied tenant-wide.

9. Removable storage controls. Block writable USB by default for general workforce; allowlist by hardware ID for legitimate use cases (designers, AV teams). Combine with Defender for Endpoint device control for granular policies.

10. Compliance + Conditional Access. Mark devices as compliant only when:

    • BitLocker on, TPM healthy, Secure Boot on, Defender real-time on.
    • Device risk = low (MDE).
    • Baseline applied = Yes (via Intune compliance). Tie compliance to Conditional Access for resource access.

Guardrails

• Don't enable Memory Integrity / HVCI without driver compatibility check. Old printer / VPN / endpoint drivers break boot.
• Smart App Control cannot be enabled on upgraded Win11. Use WDAC for those devices.
• WDAC is high-value but operationally heavy. Plan for the policy-management function; this is not "set and forget."
• Legacy LAPS is deprecated; new Windows LAPS is the path. Don't deploy legacy LAPS on greenfield Win11.
• Credential Guard breaks some legacy auth scenarios (Wi-Fi 802.1x with certain TPM configs, third-party credential providers). Validate.
• Don't run unsupported drivers / kernel-mode software alongside Memory Integrity.
• PDE requires WHfB. Without Hello, PDE doesn't engage; data isn't protected at the file level.
• Intune Settings catalog vs classic baseline: forward-looking is Settings catalog. Don't run both for the same setting — conflicts.
• CFA on servers breaks workloads. Workstations only.
• Removable storage block-all without allowlist breaks legitimate users; have a request workflow.

Common anti-patterns

• "Applied baseline once, never updated" — baseline updates ship quarterly; new attacks add new settings. Re-baseline annually.
• "Memory Integrity off because one driver complained" — keep it on, replace the driver.
• "Legacy LAPS still running on Win11" — deprecated; migrate to Windows LAPS.
• "WDAC in audit forever" — never enforced; not protecting anything.
• "Smart App Control on upgraded devices" — silently does nothing.
• "Credential Guard off because of a 2018 third-party VPN" — replace the VPN.
• "USB block-all, no exceptions" — engineering revolts and finds workarounds. Allowlist legitimate use.
• "Compliance signal not in Conditional Access" — devices "compliant" but no enforcement at access.
• "Settings catalog and classic baseline both targeted at the same group" — policy conflicts; unpredictable enforcement.

Example prompts

• Roll out the Windows 11 security baseline to a 30,000-device Intune-managed estate with a 3-ring pilot.
• Migrate from legacy LAPS to Windows LAPS for a hybrid (Entra-joined + AD-joined) estate.
• Driver compatibility readiness for VBS / HVCI / Memory Integrity rollout.
• WDAC policy authoring strategy: managed installer vs explicit allowlist; phased enforcement.
• Personal Data Encryption rollout aligned with Windows Hello for Business and passkey strategy.
• Removable storage policy: block USB write tenant-wide, allowlist by hardware ID for designated groups, request workflow.
• Compliance policy + Conditional Access: bind the security baseline to access for Microsoft 365 and Azure portal.
• Audit Smart App Control eligibility across the fleet and identify devices where WDAC is the only viable path.

Microsoft Learn

• Windows 11 security book: https://learn.microsoft.com/windows/security/book/
• Security baselines for Windows 11: https://learn.microsoft.com/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines
• Intune security baselines: https://learn.microsoft.com/intune/intune-service/protect/security-baselines
• VBS / HVCI / Memory Integrity: https://learn.microsoft.com/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity
• Credential Guard: https://learn.microsoft.com/windows/security/identity-protection/credential-guard/
• LSA protection: https://learn.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
• Windows LAPS: https://learn.microsoft.com/windows-server/identity/laps/laps-overview
• Smart App Control: https://learn.microsoft.com/windows/security/application-security/application-control/app-control-for-business/
• WDAC / App Control for Business: https://learn.microsoft.com/windows/security/application-security/application-control/app-control-for-business/
• Personal Data Encryption: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/personal-data-encryption/
• Controlled folder access: https://learn.microsoft.com/defender-endpoint/controlled-folders
• Microsoft Security Compliance Toolkit (GPO baselines): https://www.microsoft.com/download/details.aspx?id=55319