Windows 10: DVR Blocked in Intune - Reasons for security baseline measure?

Ana Ta · Nov 7, 2022

Hello,A question has been brought up by one of the employees after integration with Intune, "Why is Block DVR: Enabled is a default setting in the Microsoft Security Baseline?". I would like to know the reason why this was a decision taken by Microsoft. I need to understand the reasoning and the security concerns of this feature before changing the baseline default to allow DVR to be used.When doing some research I discovered that DVR is considered a vulnerability for CCTV devices and IoT Cameras. I have also discovered that there are a couple of vulnerability disclosures about .dvr-ms that af

:)

Brink · Nov 7, 2022

Security baseline (DRAFT) release for Chromium-based Microsoft Edge 79

We are pleased to announce the draft security baseline for the initial stable release of the new Microsoft Edge! Please review the security baseline (DRAFT) for Microsoft Edge version 79, and send us your feedback through the Baselines Discussion site.

What are security baselines?

Every organization faces security threats. However, the types of security threats that are of most concern to one organization can be completely different from another organization. For example, an e-commerce company may focus on protecting its Internet-facing web apps, while a hospital may focus on protecting confidential patient information. The one thing that all organizations have in common is a need to keep their apps and devices secure.

A security baseline is a group of Microsoft-recommended configuration settings that explains their security impact. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers.

Why are security baselines needed?

Security baselines are an essential benefit to your organization because they bring together expert knowledge from Microsoft, partners, and customers.

For example, there are 200+ Microsoft Edge Group Policy settings for Windows. Of these settings, only some are security-related. Although Microsoft provides extensive guidance on these policies, exploring each one can take a long time. You would have to determine the security impact of each setting on your own. Then, you would still need to determine the appropriate value for each setting.

In modern organizations, the security threat landscape is constantly evolving, and IT administrators and policy-makers must keep up with security threats and make required changes to Microsoft Edge security settings to help mitigate these threats. To enable faster deployments and make managing Microsoft Edge easier, Microsoft provides customers with security baselines that are available in consumable formats, such as Group Policy Objects backups.

Security baseline principles

As with our current Windows and Office security baselines, our recommendations for Microsoft Edge configuration follow a streamlined and efficient approach to baseline definition when compared with the baselines we published before Windows 10. The foundation of that approach is essentially this:

The baselines are designed for well-managed, security-conscious organizations in which standard end users do not have administrative rights.

A baseline enforces a setting only if it mitigates a contemporary security threat and does not cause operational issues that are worse than the risks they mitigate.

A baseline enforces a default only if it is otherwise likely to be set to an insecure state by an authorized user:

If a non-administrator can set an insecure state, enforce the default.

If setting an insecure state requires administrative rights, enforce the default only if it is likely that a misinformed administrator will otherwise choose poorly.

(For further explanation, see the “Why aren’t we enforcing more defaults?” section in this blog post.)

How can you use security baselines?

You can use security baselines to:

Ensure that user and device configuration settings are compliant with the baseline.

Set configuration settings. For example, you can use Group Policy, System Center Configuration Manager, or Microsoft Intune to configure a device with the setting values specified in the baseline.

Download the security baselines

For version 78, see Security baseline (DRAFT) for Chromium-based Microsoft Edge, version 78.

For version 79, see Security baseline (DRAFT) for Chromium-based Microsoft Edge, version 79.

Future draft security baselines versions will be posted to the Microsoft Security Baselines Blog, and final security baselines will be available in the Security Compliance Toolkit (SCT).

Learn about Microsoft Edge in the enterprise

Check out our Microsoft Edge enterprise documentation to learn more about deploying and managing the next version of Microsoft Edge.

– Forbes Higman, Program Manager, Microsoft Edge enterprise security
– Brian Altman, Program Manager, Microsoft Edge manageability
Click to expand...

Source: https://blogs.windows.com/msedgedev/...draft-edge-79/

Tweet

— Twitter API (@User) View on Twitter

Prakhar_Khare · Nov 7, 2022

Microsoft Security Compliance Toolkit | Security Baseline | Challenge Question

Hi,

Thank you for writing to Microsoft Community Forums.

I understand your query related to removing Microsoft Security Baseline on Windows 10 IoT.

We do have a dedicated forum, where you should be able to find support for your query.
Let me help in pointing you in the right direction, I would suggest you to post your query on

TechNet forums, where we have support professionals with expertise on GPO and Microsoft Security Baseline to assist you with your query.

Regards,

Prakhar Khare

Microsoft Community – Moderator

Brink · Nov 7, 2022

Security baseline for Microsoft Edge v95 available

We have reviewed the settings in Microsoft Edge version 95 and updated our guidance with the addition of 2 settings. A new Microsoft Edge security baseline package was just released to the Download Center. You can download the version 95 package from the Security Compliance Toolkit.

Enable browser legacy extension point blocking
To improve reliability and security, this new setting blocks certain code injections from legacy third-party utilities. This setting is enabled by default and will be enforced with a value of ‘enabled’ in the baseline.

Specifies whether the display-capture permissions-policy is checked or skipped
This setting exists as a temporary compatibility mitigation to allow web applications using the getDisplayMedia() API to bypass a permission policy check required by the API specification. This setting is enabled by default and will be enforced with a value of ‘enabled’ in the baseline until version 100, when this setting will become deprecated and the setting will be permanently enabled.

Microsoft Edge version 95 introduced 11 new computer settings, 11 new user settings, and removed 3 settings. We have included a spreadsheet listing the new settings in the release to make it easier for you to find them.

As a friendly reminder, all available settings for Microsoft Edge are documented here, and all available settings for Microsoft Edge Update are documented here.

Please continue to give us feedback through the Security Baseline Community or this post.
Click to expand...

Source: https://techcommunity.microsoft.com/...5/ba-p/2897269

Windows 10: DVR Blocked in Intune - Reasons for security baseline measure?

DVR Blocked in Intune - Reasons for security baseline measure?

DVR Blocked in Intune - Reasons for security baseline measure?

DVR Blocked in Intune - Reasons for security baseline measure?

DVR Blocked in Intune - Reasons for security baseline measure? - Similar Threads - DVR Blocked Intune

Intune and Security Baseline for Windows 10 and later prevents Reset PC

Intune and Security Baseline for Windows 10 and later prevents Reset PC

Implementing Security Baseline through Intune

Implementing Security Baseline through Intune

Implementing Security Baseline through Intune

Computer blocked for security reasons

Computer blocked for security reasons

DVR Blocked in Intune - Reasons for security baseline measure?

DVR Blocked in Intune - Reasons for security baseline measure?