{"id":3434,"date":"2024-05-06T19:41:04","date_gmt":"2024-05-06T18:41:04","guid":{"rendered":"https:\/\/rolig.dk\/?p=3434"},"modified":"2024-07-07T10:09:20","modified_gmt":"2024-07-07T09:09:20","slug":"modern-management-part-5-basic-compliance-settings","status":"publish","type":"post","link":"https:\/\/rolig.dk\/?p=3434","title":{"rendered":"Modern Management \u2013 Part 5: Basic compliance settings"},"content":{"rendered":"\n

To make sure that Windows clients are compliant, we configure compliance policies. Below I will create two. One without BitLocker + some additional settings and one with BitLocker. The reason for creating the BitLocker compliance policy in a separate policy, is the grace period will be longer, because the PC need to have time to encrypt the storage devices. Otherwise, it will be non-compliant. And if you have Conditional access rules that block non-compliant device, then you could have an issue.<\/p>\n\n\n\n

These are just examples. Be sure to apply setting according to your company policies!<\/p>\n\n\n\n

Compliance with BitLocker<\/strong><\/p>\n\n\n\n

Navigate to Devices<\/strong> -> Windows<\/strong> -> Compliance policies<\/strong> -> Create policy<\/strong><\/td>\"\"<\/td><\/tr>
Choose Windows 10 and later<\/strong> -> Click Create<\/strong><\/td>\"\"<\/td><\/tr>
Enter a name -> Click Next<\/strong><\/td>\"\"<\/td><\/tr>
Set Require encryption of data storage on device<\/strong> to Require<\/strong> -> Click Next<\/strong><\/td>\"\"<\/td><\/tr>
Click Next<\/strong><\/td>\"\"<\/td><\/tr>
Add the Groups<\/strong> that you want this security profile to be applied on.

click Next<\/strong><\/td>		\"\"<\/td><\/tr>
Click Create<\/strong><\/td>\"\"<\/td><\/tr>
Open the policy that you have just created.<\/td>\"\"<\/td><\/tr>
Click Properties<\/strong> -> Edit<\/strong> Actions for noncompliance<\/td>\"\"<\/td><\/tr>
Change Mark device noncompliant<\/strong> from 0 to 1 -> Click Review + save<\/strong><\/td>\"\"<\/td><\/tr>
Click Save<\/strong><\/td>\"\"<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Compliance without BitLocker<\/strong><\/p>\n\n\n\n

Navigate to Devices<\/strong> -> Windows<\/strong> -> Compliance policies<\/strong> -> Create policy<\/strong><\/td>\"\"<\/td><\/tr>
Choose Windows 10 and later<\/strong> -> Click Create<\/strong><\/td>\"\"<\/td><\/tr>
Enter a name -> Click Next<\/strong><\/td>\"\"<\/td><\/tr>
Expand Device Health<\/strong> -> set Secure Boot<\/strong> to Require<\/strong><\/td>\"\"<\/td><\/tr>
Enable the following setting:

– Require a password to unlock mobile devices
— Require

– Simple passwords
— Block

– Password type
— Alphanumeric

– Password Complexity
— Require digits, lowercase and uppercase letters

– Minimum password length
— 8

– Maximum minutes of inactivity before password is required
— 15 minutes

– Password expiration (days)
— 41

– Number of previous passwords to prevent reuse
— 24<\/mark><\/td>		\"\"<\/td><\/tr>
Click Next<\/strong><\/td>\"\"<\/td><\/tr>
Add the Groups<\/strong> that you want this security profile to be applied on.

click Next<\/strong><\/td>		\"\"<\/td><\/tr>
Click Create<\/strong><\/td>\"\"<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Continue to part 6 (Windows Update for Business)<\/a><\/p>\n\"twitter\"<\/a>\"linkedin\"<\/a>","protected":false},"excerpt":{"rendered":"

To make sure that Windows clients are compliant, we configure compliance policies. Below I will create two. One without BitLocker + some additional settings and one with BitLocker. The reason for creating the BitLocker compliance policy in a separate policy, is the grace period will be longer, because the PC need to have time to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[92,72,4],"tags":[82,83,84,91,89,73,74,77,78,54,81],"class_list":["post-3434","post","type-post","status-publish","format-standard","hentry","category-endpoint-manager","category-intune","category-sccm","tag-autopilot","tag-azure","tag-deployment","tag-endpoint-manager","tag-entra","tag-intune","tag-mdm","tag-modern-management","tag-windows","tag-windows-10","tag-windows-11"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/posts\/3434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rolig.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3434"}],"version-history":[{"count":36,"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/posts\/3434\/revisions"}],"predecessor-version":[{"id":3679,"href":"https:\/\/rolig.dk\/index.php?rest_route=\/wp\/v2\/posts\/3434\/revisions\/3679"}],"wp:attachment":[{"href":"https:\/\/rolig.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3434"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rolig.dk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3434"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rolig.dk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}