CIS Benchmark Hardening for Windows 11 — Level 1 & 2

Table of Contents

What is the CIS Benchmark?
Level 1 vs Level 2 — Which to Apply
Intune vs GPO for CIS Controls
Account & Password Policies
BitLocker & Encryption
Windows Defender Settings
Attack Surface Reduction Rules
Audit Logging
Rollout Strategy

What is the CIS Benchmark?

The Center for Internet Security (CIS) Benchmark for Windows 11 is a community-driven set of hardening guidelines that defines a security baseline for Windows endpoints. It is organized into two levels:

Level 1: The essential baseline — controls that provide significant security benefit with minimal impact on usability and business functionality.
Level 2: Defence-in-depth additions — appropriate for high-security environments; may impact usability or require testing before broad deployment.

CIS Benchmarks are the closest thing to a universal, vendor-neutral security standard for endpoint hardening. Compliance with CIS L1 is commonly required for ISO 27001, NIS2, and many government frameworks.

Microsoft also publishes their own Intune Security Baselines (under Endpoint Security → Security Baselines). These overlap with CIS L1 but are not identical. Where they diverge, CIS is generally more conservative. For regulated environments, use CIS as the reference.

Level 1 vs Level 2 — Which to Apply

Level	Suitable For	Key Impact Areas
Level 1	All corporate endpoints	Minimal — password policies, Defender basics, audit logging
Level 2	High-security endpoints (exec, finance, legal, privileged admin)	Restricts USB, Bluetooth, Remote Desktop, anonymous auth

Start with Level 1 across all devices, then apply Level 2 as an overlay to your sensitive-role groups.

Intune vs GPO for CIS Controls

In a cloud-managed (Azure AD joined) environment, Intune is the only option. In a hybrid environment, you may have both GPO and Intune. The rule to avoid conflict: one tool owns one setting. Overlapping GPO and Intune policies for the same CSP can cause unpredictable results.

For cloud-native deployments, implement CIS controls using two Intune tools:

Settings Catalog — for the majority of CIS controls (password policy, audit logging, Defender settings)
Custom OMA-URI profiles — for settings not yet surfaced in the Settings Catalog

Account & Password Policies

CIS L1 Requirements

CIS Control	Required Value	Intune Path
Minimum password length	≥ 14 characters	Settings Catalog → Account Policies → Password Policy
Password complexity	Enabled	Settings Catalog → Account Policies → Password Policy
Maximum password age	≤ 365 days	Settings Catalog → Account Policies → Password Policy
Account lockout threshold	≤ 5 attempts	Settings Catalog → Account Policies → Account Lockout
Account lockout duration	≥ 15 minutes	Settings Catalog → Account Policies → Account Lockout
Guest account	Disabled	Settings Catalog → Local Policies → Security Options

If your organization uses Windows Hello for Business (passkeys/PIN), local password policies still apply to the local Windows account. WHfB is separate — configure it via Identity Protection profile in Intune with a minimum PIN length of 8 digits and PIN complexity enabled.

BitLocker & Encryption

BitLocker full-disk encryption is a CIS L1 requirement. In Intune, configure it under Endpoint Security → Disk Encryption → BitLocker.

Key BitLocker settings

Setting	CIS Recommended Value
Require BitLocker	Yes (configure via compliance policy too)
OS Drive: Encryption method	XTS-AES 256-bit
Startup authentication required	Yes (for L2: require PIN)
Recovery key backup	Backup to Azure AD (mandatory)
BitLocker on fixed data drives	Required (L1)
BitLocker on removable drives	Required for write access (L2)
Silent encryption	Enable — allows hands-free BitLocker for Autopilot deployments

Windows Defender Settings

Configure under Endpoint Security → Antivirus → Microsoft Defender Antivirus in Intune.

Setting	CIS Value
Cloud-delivered protection	Enabled
Cloud protection level	High
Automatic sample submission	Send safe samples automatically
Real-time monitoring	Enabled
Potentially unwanted app protection	Block (PUA)
Network protection	Enabled (Block mode)
Signature update interval	≤ 8 hours
Scan type	Quick scan daily + Full scan weekly

Attack Surface Reduction Rules

ASR rules are CIS L1 controls that block specific attack techniques at the kernel level. Configure under Endpoint Security → Attack Surface Reduction.

Deploy ASR rules in Audit mode first for 2–4 weeks before switching to Block. Audit mode logs what would have been blocked without actually blocking — this lets you identify false positives before they impact users.

ASR Rule	Mode	Impact Risk
Block Office from creating child processes	Block	Low — some legacy macros
Block Office from injecting code into processes	Block	Low
Block JavaScript/VBScript from launching downloaded content	Block	Low
Block credential stealing from lsass.exe	Block	Low
Block executable content from email & webmail	Block	Low
Use advanced protection against ransomware	Block	Low
Block untrusted processes from USB	Block	Medium — test with legitimate USB tools
Block Adobe Reader from creating child processes	Block	Medium — test with PDF-launching workflows

Audit Logging

CIS requires specific Windows audit categories to be enabled for forensic readiness. Configure via Settings Catalog → Audit Policy.

Audit Category	Success	Failure
Account Logon / Credential Validation	Yes	Yes
Account Management / User Account	Yes	Yes
Logon/Logoff / Logon	Yes	Yes
Logon/Logoff / Account Lockout	No	Yes
Object Access / Removable Storage	Yes	Yes
Policy Change / Audit Policy Change	Yes	No
Privilege Use / Sensitive Privilege Use	No	Yes
System / Security System Extension	Yes	No

Rollout Strategy

Never deploy hardening settings to production all at once. Use this phased approach:

Ring 0 (IT Admins, ~10 devices): Deploy all Level 1 controls. Monitor for 1 week. Fix any policy conflicts or user-impact issues.

Ring 1 (Pilot group, ~50 devices): Deploy same policies. Run for 2 weeks. Collect helpdesk ticket data — look for patterns indicating broken workflows.

Ring 2 (All standard users): Deploy after Ring 1 sign-off. Keep ASR rules in Audit mode for 2 more weeks.

ASR Block mode: Switch ASR rules to Block after reviewing audit logs. Exclude specific process paths that generate false positives using the ASR exclusion list.

Level 2 overlay: Apply only to high-security device groups (finance, exec, PAW). Test thoroughly before broad deployment.

After full CIS L1 deployment, use the Microsoft Secure Score in the M365 Defender portal and the Intune Compliance reports to quantify your security posture improvement. Typical environments see a 30–40% Secure Score increase from CIS L1 alone.

Badra Ali Diakite

Senior IT Consultant specialising in Microsoft 365, Intune, Zero Trust architecture and network infrastructure. 15+ years across 28+ countries in both military and enterprise environments.