Windows v3.5 - 2025-02-20 - 24H2 Baseline Edition (Mostly)

Added

Settings Catalog

Win - OIB - SC - Device Security - D - Windows Package Manager - v3.5

• Added configuration that will be being added to the CIS Benchmark, as well as some additional, non-impacting restrictions to the Desktop App Installer (winget):
  • Enable App Installer Experimental Features - Disabled
  • Enable App Installer Hash Override - Disabled
  • Enable App Installer Local Manifest Files - Disabled
  • Enable App Installer ms-appinstaller protocol - Disabled
  • Enable App Installer Settings - Disabled

Changed/Updated

Settings Catalog

Win - OIB - SC - Defender Antivirus - D - Additional Configuration

• Added the following settings from the 24H2 Baseline:
  • Enable Convert Warn To Block - Warn verdicts are converted to block
  • Passive Remediation - 1: Passive Remediation Sense AutoRemediation
  • Quick Scan Include Exclusions - 1: All files and directories that are excluded from real-time protection using contextual exclusions are scanned during a quick scan.

Win - OIB - SC - Device Security - D - Security Hardening

• Added the following settings from the 24H2 Baseline:
  • PK Init Hash Algorithm Configuration - Enabled
    • PK Init Hash Algorithm SHA1 - Not Supported
  • Enable Sudo - Sudo is disabled

Win - OIB - SC - Device Security - D - User Rights

• Removed S-1-2-0 (Local) from "Deny Remote Desktop Services Log On" as this breaks Windows 365 access. Resolves #69

Win - OIB - SC - Device Security - U - Device Guard, Credential Guard and HVCI

• Added the following setting from the 24H2 Baseline:
  • Machine Identity Isolation - 0: (Disabled) Machine password is only LSASS-bound and stored in $MACHINE.ACC registry key.

Win - OIB - SC - Microsoft Office - U - Config and Experience

• Added a recently added setting to make files clicked in Teams open in the desktop apps rather than in SPO:
  • File links open preference default selection as Desktop App (User) - Enabled
• Added a setting to remove some options from the save locations available. The tooltip is confusing but 137 restricts OneDrive Personal, SharePoint OnPrem and (most importantly) Third-party Services (e.g Box, Dropbox, Egnyte, ShareFile) from the "Add a place" in the Save As menu.
  • Hide Microsoft cloud-based file locations in the Backstage view (User) - 137

Win - OIB - SC - Windows Hello for Business - D - Cloud Kerberos Trust - v3.5

• Added "Cloud Kerberos Ticket Retrieval Enabled" set to Enabled.