Windows 10: Implementing Security Baseline through Intune

Recently I applied a security base through Intune for my company. The setting was Firewall >> Default Outbound Connection >> Blocked For Domain, Public and Private Profile. As we applied the settings all PCs lost Network Connectivity. They would not connect to Corporate Network, LAN and Home wireless.What did I do wrong? From the Security team, I got the comment that it is Industry Best Practice to keep it Blocked. But that disrupts the Network Connectivity. If we need to keep it Allow for machines to work, What are implications? and Why in first place there will be such a setting?

:)

 

Revert Security Baselines

Hello, StephanHS

Welcome to Microsoft Community.

You're correct, you will have to create another GPO. But unfortunately, there isn’t a comprehensive list of all settings that aren’t reverted automatically by just disabling the GPO. This is because the behavior can vary depending on the specific setting and how it interacts with the system.



This issue may be beyond the scope of issues that Microsoft Community can address. However, you might also find some insights from community discussions and expert advice on platforms like Microsoft Community Hub. These resources often have threads discussing specific GPO settings and their behaviors: Microsoft Security Baselines - Microsoft Community Hub.

I will also keep this question open in Microsoft Community, as someone may have additional insights that could be helpful to you.

Best regards

Yuhao Li

Microsoft Community Technical Support

 

DVR Blocked in Intune - Reasons for security baseline measure?

Hello,

A question has been brought up by one of the employees after integration with Intune, "Why is Block DVR: Enabled is a default setting in the Microsoft Security Baseline?". I would like to know the reason why this was a decision taken by Microsoft. I need to understand the reasoning and the security concerns of this feature before changing the baseline default to allow DVR to be used.

When doing some research I discovered that DVR is considered a vulnerability for CCTV devices and IoT Cameras.

I have also discovered that there are a couple of vulnerability disclosures about .dvr-ms that affected older versions of Microsoft and didn't have mentions of Xbox Game Bar or Windows 10.

MS11-015

MS11-092

CVE-2011-0042

CVE-2011-0032

CVE-2011-3401

I have not found instances where Xbox Game Bar uses the .dvr-ms files therefore I do not yet see the exploit path through the software.

Some of our engineers find the recording feature of the Xbox Game Bar to be beneficial when recording tutorials and instructions to be shared with the rest of the users.

I am not quite sure where to put this under, apologies if this question is in the wrong category.

 

DVR Blocked in Intune - Reasons for security baseline measure?

Thanks Paul,

Posted the question there, thanks for the tip.

https://learn.microsoft.com/en-us/a...security-baseline-what-is-block-dvr-secu.html