Intune Support

[nitzpo]

Hi!
Super appriciative of this repo. Very good work!

I've been looking at the intune support you've added recently.

1. question - what are your sources for including this information? Is it tested in some way?
2. I already found in the MSFT CSP documentation some items you are missing. How do I contribute them back into the repo? Which listing should I edit?
3. In relation to 2 - do you have an "all" listing, which is used to generate all the others?

Cheers

[0x6d69636b]

Hi Nitzan,

Thank you very much for your feedback and questions.

1. My main source is the Microsoft Policy CSP documentation. I configure the settings in Intune and double check them in the registry
2. I have made a new list with all the findings and all the information I have at the moment. There is still some work to do on Intune ;-) It would be great if you could edit this list: https://github.com/0x6d69636b/windows_hardening/blob/master/lists/finding_list_intune.csv
3. See 2. :-)

Best, Mick

[nitzpo]

Cool! I'll look into it. Thanks for the quick reply.

If we're already at it -
How do you decide for a setting to collect using registry vs using wmi or maybe a powershell cmdlet?
Do you know (or have a reference for) the precedence order?
In theory instead of getting all the registry keys for PolicyManager, we could just query the WMI

Cheers

[0x6d69636b]

How do you decide for a setting to collect using registry vs using wmi or maybe a powershell cmdlet?

The benchmark defines how to configure a setting, for example CIS or Microsoft document the GPO setting and/or registry key that needs to be configured. I also want to know if a setting is set by a policy or not. For example, a patch disables the use of the WDigest security module, but if someone controls the registry, then it can still be enabled. This would be much more difficult if the corresponding group policy was also used. Therefore, I also check the registry setting of that policy

Do you know (or have a reference for) the precedence order?

I prefer the registry, as it is easy to get the values and maintain them in finding lists, I usually don't have to parse the output. Secondly, the group policy settings (and Intune) are stored in the registry, so I need that as a source. I use other modules as cross-checks or in case the data is not available in the registry

[nitzpo]

Continuing this discussion
The essence of the values can be different for Intune vs Local values
Example from Defender CSP:
DisableScriptScanning locally, but AllowScriptScanning in the CSP (intune)
How would you handle that? @0x6d69636b

[0x6d69636b]

There will be two RecommendValues, one for GPO and one for Intune, the header of the finding list is now:

ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity

[nitzpo]

You updated many files, but not the intune file: https://github.com/0x6d69636b/windows_hardening/blob/master/lists/finding_list_intune.csv

[0x6d69636b]

I use two tables/lists, the general findings and the individual finding lists (like CIS, MSFT, etc). The RecommendedValue is only for finding lists (as there is no general recommended value for all lists). The Intune List only covers the general findings, I put the RecommendedValueIntune in each finding list. Does that make sense?