Applying Both Windows Intune and Enterprise Benchmarks

Problem

Solution

Both Intune and traditional GP can be applied, but there cannot be any overlapping policies. So, if it’s set through Intune, then don’t set it via GPO. If there is overlapping, it could cause issues in the environment. Extensive testing needs to be done before pushing to production. One possible away to avoid overlapping is to only apply the policies that are NOT included in the Intune to on-prem (GPO), then do the rest through Intune. The Intune to Group Policy mapping spreadsheet can be used as a reference, which is available for download from WorkBench: https://workbench.cisecurity.org/files?q=mapping+document&tags=&visibility=all

For scanning a hybrid machine, the recommendation is to create a custom benchmark for policies not available in the other Benchmark. Guidance on creating a custom Benchmark can be found here:

• Quick Start Guide: Tailoring Benchmarks

• How to skip a check when running an CIS-CAT Pro assessment

Keywords; Hybrid Windows Intune

Content by Label