Selected CIS Windows 11 Level 1 Controls: Pilot, Apply, Validate

What the CIS Benchmark Is (and Isn't)

The CIS Windows 11 Benchmark is a prescriptive set of configuration recommendations developed by the Center for Internet Security. Level 1 is designed to be deployable in most enterprise environments without significant operational disruption. Level 2 adds additional restrictions that may require more testing and exception management.

What it is: A defensible, auditable baseline. It documents your organisation's intent to apply a recognised hardening standard.

What it isn't: A guarantee of security. It addresses known configuration weaknesses but does not substitute for patch management, EDR, identity controls, or monitoring.

This page covers selected Level 1 controls only: account and lockout settings, a short audit-policy set, Defender and PUA settings, NTLMv2 / SMBv1 / firewall, and Credential Guard. It is not a complete CIS Windows 11 Level 1 implementation and it is not a substitute for the official CIS benchmark catalogue.

Scope and verification basis: the control list was reviewed against the CIS Windows 11 Benchmark v3.0.0 and against current Microsoft documentation for Windows 11 22H2 and 24H2, Group Policy on Windows Server 2022 domain controllers, and Microsoft Intune. Commands in later sections are example validation checks unless an individual section says they were executed.

When I Would Not Apply This As-Is

Do not apply a full CIS Level 1 baseline unchanged to every endpoint type. Shared kiosks, developer workstations, lab devices, manufacturing PCs, and machines with older VPN or printing dependencies often need a separate profile with documented exceptions.

I would also avoid using this baseline as the first security control in an unmanaged estate. Get patching, Defender, BitLocker key escrow, local admin password management, and basic monitoring working first. A hardening baseline is easier to defend when the core management plumbing is already reliable.

For Level 2 settings, create a separate project. Level 2 can be appropriate, but it changes the exception workload and support model. Treat it as a higher assurance profile rather than a quiet upgrade to Level 1.

Prerequisites

• A currently supported Windows 11 release and edition, with a matching benchmark revision. Historical 22H2 examples are not a recommendation to deploy an unsupported release; check Microsoft servicing dates
• PolicyAnalyzer from Microsoft's Security Compliance Toolkit (for validation)
• Intune Settings Catalog or Group Policy for automated application
• Group Policy Management Console or Intune admin access
• A pilot OU or pilot device group containing 5–10 representative machines before broad deployment — do not skip this step

Pilot Deployment: Do This Before Broad Rollout

Applying a hardening baseline to production endpoints without testing is the fastest way to create a support incident. Use this pilot process:

1. Create a dedicated pilot OU (or Entra ID device group for Intune) containing representative machines across your hardware models and OS build versions.
2. Apply the CIS baseline to the pilot scope only.
3. Let the policy process for at least 48 hours and through at least one logon for each test user.
4. Test the following before broader rollout:
   • All critical line-of-business applications launch and function correctly
   • Network access (shared drives, print servers) works under NTLMv2-only restrictions
   • NTLM-dependent legacy applications are identified (see Known Conflicts section)
   • PowerShell script execution policy is acceptable for your environment
   • VPN client connects without friction
5. Document any exceptions required and create a separate GPO or Intune profile for those exceptions — do not weaken the main baseline.

Applying via Group Policy

Use the benchmark for the exact OS and revision you are assessing. The downloadable CIS benchmark document and CIS Build Kits are different resources; do not assume the free PDF includes an importable GPO package. Confirm access and licensing at CIS Build Kits.

1. Back up the existing baseline and record effective settings on representative devices.
2. Create an unlinked pilot GPO. Configure the selected settings, or import an authorised, reviewed GPO backup using GPMC Import Settings or Import-GPO. An arbitrary XML or PolicyAnalyzer file is not a GPO backup.
3. ADMX/ADML files define editor settings; copying them does not apply a baseline. Update the Central Store only through the domain change process.
4. Link to the pilot OU, check gpresult and functional tests, then expand only after the agreed results pass.

Applying via Microsoft Intune

For Intune-managed devices, use a combination of Settings Catalog and Endpoint Security profiles:

Settings Catalog

1. Navigate to Devices > Configuration profiles > Create profile.
2. Select Windows 10 and later and Settings catalog.
3. Search for settings by their CIS benchmark references. Key categories to configure:
   • Windows Security > App and browser protection
   • Windows Firewall > Domain Profile
   • User Rights Assignment (via Settings Catalog)
   • Credential Guard > Enable Credential Guard

Security Baseline

Microsoft provides a Windows 11 Security Baseline in Intune that covers many of the same areas as CIS Level 1. It is not identical but is a defensible starting point. Apply it first, then use Settings Catalog to close gaps.

Conflict warning: If you apply both the Microsoft Security Baseline and a CIS-aligned Settings Catalog profile, check for conflicting settings. Intune does not provide a general priority slider for these configuration profiles. Resolve conflicting values or set the redundant setting to Not configured in its source policy. Check per-setting status and effective endpoint state. Microsoft endpoint-security conflict handling.

Key Controls at Level 1

The following settings are the highest value in terms of risk reduction:

Account Controls

• Minimum password length: 14 characters
• Account lockout threshold: 5 invalid attempts
• Administrator account: Renamed and disabled where possible (use LAPS for the local admin)
• Guest account: Disabled

Audit Policy

Enable the following audit subcategories at a minimum:

Audit Credential Validation: Success and Failure
Audit Logon: Success and Failure  
Audit Account Lockout: Success and Failure
Audit Process Creation: Success
PowerShell Script Block Logging: enabled separately through its Administrative Template policy

Windows Defender Settings

• Real-time monitoring: Enabled
• Cloud-delivered protection: Enabled
• Potentially unwanted application (PUA) protection: Block
• Tamper protection: Enabled (via Intune Security Experience profile — cannot be set via Group Policy on enrolled devices)

Network Security

• LAN Manager Authentication Level: Send NTLMv2 response only, refuse LM and NTLM
• Minimum session security for NTLM SSP: Require NTLMv2 and 128-bit encryption
• SMB v1: Disabled (verify and disable via PowerShell)
• Windows Firewall: All three profiles (Domain, Private, Public) set to On with default inbound block

Disabling SMBv1

SMBv1 should be disabled before applying the broader baseline. Verify it is not in use first:

# Check current SMBv1 state
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

# Check for active SMBv1 sessions (run during business hours)
Get-SmbSession | Where-Object { $_.Dialect -eq '1.0' }

A quiet snapshot does not prove SMBv1 is unused. Collect SMBv1 audit events and feature state over a representative business cycle and test application dependencies. The following changes the SMB server setting on one authorised pilot; it does not remove every SMBv1 client component:

Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

Confirm the change:

Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
# Expected: EnableSMB1Protocol : False

Credential Guard

Credential Guard isolates LSASS in a virtualisation-based security environment. Verify it is active after applying the baseline:

# Check Credential Guard status
(Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard -ClassName Win32_DeviceGuard).SecurityServicesRunning

The returned array contains 1 when Credential Guard is running; 2 denotes memory integrity. Check for membership, not equality of the whole array. If 1 is absent, inspect policy, OS/hardware prerequisites and VBS state. Microsoft Win32_DeviceGuard value definitions.

Validating Compliance

After applying the baseline, validate with PolicyAnalyzer:

1. Download PolicyAnalyzer from the Microsoft Security Compliance Toolkit.
2. Open PolicyAnalyzer and click Add > Files from GPO Backup for your CIS GPO.
3. Add the CIS benchmark .PolicyRules file as a reference.
4. Compare and identify gaps or conflicts.

For Intune-managed devices, compare per-setting reports with the effective endpoint settings below. Invoke-WindowsHardening is not a released downloadable tool on this site and is not required for these checks. Retain your approved policy export and validation results with the change record.

Spot-checking critical settings

# Verify NTLMv2 enforcement
(Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa").LmCompatibilityLevel
# Expected: 5 (Send NTLMv2 response only, refuse LM and NTLM)

# Verify PowerShell Script Block Logging
(Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -ErrorAction SilentlyContinue).EnableScriptBlockLogging
# Expected: 1

# Verify Windows Firewall domain profile is on
(Get-NetFirewallProfile -Profile Domain).Enabled
# Expected: True

Common Conflicts and Exceptions

LOB Application Conflicts

The CIS benchmark restricts NTLM and disables older TLS cipher suites. Older line-of-business applications may break. Common symptoms:

BYOD and Guest Access Scenarios

CIS Level 1 disables guest network access and restricts many network features. Review whether your guest Wi-Fi or BYOD workflows depend on settings that Level 1 restricts.

Developer Workstations

Developer machines may require exceptions for settings like Prevent access to registry editing tools or Script Execution Policy. Consider a separate CIS-compliant profile with an approved exceptions list for developer endpoints — document each exception with a business justification.

Rollback Procedure

If the baseline causes production issues, roll back cleanly:

GPO rollback

1. Remove the link from the affected OU in GPMC (do not delete the GPO — just unlink it).
2. Run gpupdate /force on affected machines or wait for the next background refresh cycle.
3. Investigate the issue using the Group Policy not applying diagnosis.
4. Restore the previous GPO state from backup if needed: Restore-GPO -Name "CIS-Win11-Level1-Computer" -Path C:\GPOBackups\PreCIS

Intune rollback

1. Navigate to the Settings Catalog or Security Baseline profile in Intune.
2. Remove the assignment from the affected device group.
3. Devices will receive the "remove settings" signal on the next sync cycle — note that some settings (like BitLocker and Credential Guard) do not reverse on profile removal.

Settings that do not revert automatically

• BitLocker: Once enabled, removing the policy does not decrypt the drive. This is intentional.
• Credential Guard: Recovery differs depending on whether UEFI lock was enabled. Follow the complete Microsoft disable procedure, including physical confirmation where required. Do not run an isolated BCDEdit fragment as a rollback.
• Audit policy: Check resultant policy after removal and explicitly restore approved values where necessary. Unlinking a GPO is not proof that every setting reverted.

Related Resources

• Endpoint Security hub
• Group Policy hub
• Group Policy not applying: RSoP and gpresult diagnosis
• Deploying Windows LAPS with Microsoft Intune
• BitLocker Recovery Key Not Backed Up to Entra ID
• CIS Windows 11 Benchmark
• Microsoft Security Compliance Toolkit

Correction Record

10 September 2026: Corrected Intune conflict precedence, Credential Guard values and rollback, GPO import assumptions, SMBv1 validation and the reference to an unreleased hardening tool. Examples are documentation-reviewed, not executed here.