[{"data":1,"prerenderedAt":2146},["ShallowReactive",2],{"post:\u002F2026\u002F06\u002F17\u002Fwindows-11-a-debloat-and-hardening-baseline-for-new-deployments\u002F":3},{"post":4,"newer":2095,"older":2105,"related":2115,"series":2144},{"id":5,"title":6,"body":7,"canonical":2075,"categories":2076,"date":2078,"description":2079,"extension":2080,"featured":2081,"hero":2082,"image":2082,"meta":2083,"navigation":319,"path":2084,"readingTime":223,"seo":2085,"series":2082,"seriesOrder":2082,"sites":2086,"source":2082,"stem":2087,"tags":2088,"updated":2082,"url":2093,"__hash__":2094},"blog\u002Fblog\u002F2026\u002F06\u002F17\u002Fwindows-11-a-debloat-and-hardening-baseline-for-new-deployments.md","Windows 11: A Debloat and Hardening Baseline for New Deployments",{"type":8,"value":9,"toc":2066},"minimark",[10,14,28,33,36,39,71,75,98,105,109,112,115,119,125,146,152,158,161,1185,1190,1194,1197,1200,1204,1207,1210,1948,1951,1959,1977,1984,1988,2062],[11,12,13],"p",{},"Every new Windows 11 deployment starts from the same place: an image or a fresh OOBE install carrying a set of consumer-oriented defaults that have no business on a managed business endpoint. Widgets, a taskbar full of pinned consumer apps, Start suggestions, and a handful of provisioned apps nobody in the fleet asked for. None of it is individually a big deal, but treated as a checklist instead of an afterthought, it turns into a baseline that's consistent across every machine that ships, which matters more than any single setting on its own.",[11,15,16,17,22,23,27],{},"This post is the checklist I use, with the scripts behind it. The companion script posts go deeper on the two debloat paths: ",[18,19,21],"a",{"href":20},"\u002F2025\u002F07\u002F16\u002Fpowershell-windows-11-debloat-a-golden-image-before-sysprep\u002F","debloating a golden image before Sysprep"," and ",[18,24,26],{"href":25},"\u002F2025\u002F11\u002F05\u002Fpowershell-windows-11-strip-preinstalled-apps-from-a-deployment-image\u002F","stripping apps from a deployment image",".",[29,30,32],"h2",{"id":31},"decide-what-debloat-actually-means-before-touching-anything","Decide what \"debloat\" actually means before touching anything",[11,34,35],{},"The word gets used loosely enough to mean anything from removing a game bar overlay to disabling Windows Update entirely, and the second interpretation is how debloat scripts turn into support tickets six months later. My working definition is narrower: remove provisioned consumer apps that serve no business purpose, turn off consumer experiences that fight the management stack, and leave anything that's arguably still useful alone: Snipping Tool, Terminal, Calculator, Notepad, Quick Assist if your help desk uses it. A debloat pass that quietly disables Windows Update, removes the Store's ability to service inbox apps, or rips out Defender components because a blog post said so is a hardening regression wearing a hardening costume.",[11,37,38],{},"In practice that's three settings groups:",[40,41,42,50,56],"ol",{},[43,44,45,49],"li",{},[46,47,48],"strong",{},"Provisioned apps."," News, Weather, Solitaire, the Xbox overlays, Clipchamp, Feedback Hub.",[43,51,52,55],{},[46,53,54],{},"Consumer experiences."," The \"Turn off Microsoft consumer experiences\" and \"Do not show Windows tips\" policies under Computer Configuration > Administrative Templates > Windows Components > Cloud Content. Both are honored only on Enterprise and Education; the Experience Policy CSP lists Pro as not applicable.",[43,57,58,61,62,66,67,70],{},[46,59,60],{},"Widgets."," \"Allow widgets\" under Windows Components > Widgets (registry ",[63,64,65],"code",{},"HKLM\\SOFTWARE\\Policies\\Microsoft\\Dsh",", value ",[63,68,69],{},"AllowNewsAndInterests"," = 0). This one does apply to Pro.",[29,72,74],{"id":73},"use-the-policy-for-app-removal-if-your-edition-allows-it","Use the policy for app removal if your edition allows it",[11,76,77,78,81,82,85,86,89,90,93,94,97],{},"For a long time the only way to remove inbox apps was a script: ",[63,79,80],{},"Remove-AppxPackage"," for existing users, ",[63,83,84],{},"Remove-AppxProvisionedPackage"," for future ones, run in the image or at provisioning. That still works, and it's the only option on Pro, but on ",[46,87,88],{},"Windows 11, version 24H2 or later, Enterprise and Education"," there's now a policy: ",[46,91,92],{},"Remove default Microsoft Store packages from the system"," (Group Policy, under Windows Components > App Package Deployment) or ",[63,95,96],{},"ApplicationManagement\u002FRemoveDefaultMicrosoftStorePackages"," in the Policy CSP.",[11,99,100,101,104],{},"What makes it better than a script is the lifecycle. Removal runs at OOBE, at the first sign-in after an OS upgrade, and at the first sign-in after the policy changes, and an app stays blocked from reinstalling (including from the Store) while it's selected. A feature update that would have brought an app back on a scripted device doesn't on a policy-managed one. The documented limits are worth knowing before you commit: it's device-scoped only, multi-session environments aren't supported, existing profiles only lose the app at their next sign-in, and deselecting an app doesn't reinstall it. The strip-apps post has the full OMA-URI payload and the ",[63,102,103],{},"AppXDeploymentServer"," event IDs (606, 614, 762) for verifying it.",[29,106,108],{"id":107},"start-from-microsofts-security-baseline-not-a-blank-page","Start from Microsoft's security baseline, not a blank page",[11,110,111],{},"Microsoft's own guidance is to implement a broadly known, well-tested configuration, such as the Microsoft security baselines, rather than building one yourself. The baselines ship in the Security Compliance Toolkit as GPO backups you can import into GPMC, and as MDM security baselines in Intune. They're designed for organizations where standard users don't have admin rights, and they only enforce a setting when it mitigates a current threat without causing worse operational problems. That design principle is exactly what you want from a baseline: it saves you arguing about three thousand Group Policy settings.",[11,113,114],{},"The baseline covers a lot, but I still verify four things explicitly on a fresh device, because they're the ones that most often end up wrong in practice: disk encryption, Defender's cloud protection, attack surface reduction rules, and Credential Guard.",[29,116,118],{"id":117},"the-four-hardening-settings-i-check-on-every-device","The four hardening settings I check on every device",[11,120,121,124],{},[46,122,123],{},"BitLocker with a backed-up recovery key."," The BitLocker cmdlet reference describes the pattern: add a recovery password protector, back it up, then enable BitLocker with the TPM protector. Enabling without an escrowed recovery password is how a firmware update turns into a data-loss event. XTS-AES-128 is the default; I specify XTS-AES-256 and skip hardware encryption, which Microsoft's reference advises against (security advisory ADV180028).",[11,126,127,130,131,134,135,138,139,141,142,145],{},[46,128,129],{},"Defender cloud-delivered protection and sample submission."," Cloud protection is on by default, but earlier policy can have turned it off (the ",[63,132,133],{},"Set-MpPreference"," reference still lists ",[63,136,137],{},"MAPSReporting"," as defaulting to Disabled), so I set it explicitly: ",[63,140,137],{}," to Advanced, and ",[63,143,144],{},"SubmitSamplesConsent"," to SendSafeSamples. Several ASR rules (obfuscated scripts, ransomware protection, prevalence-based blocking) require cloud-delivered protection to work at all.",[11,147,148,151],{},[46,149,150],{},"ASR rules."," Microsoft groups three rules as \"standard protection\" that you can typically enable in Block mode without an audit period: block abuse of exploited vulnerable signed drivers, block credential stealing from LSASS, and block persistence through WMI event subscription. Everything else goes into Audit first. One nuance from the reference: if LSA protection or Credential Guard is on, the LSASS rule adds nothing and shows as not applicable. And if you use Configuration Manager, test the WMI persistence rule in Audit first, since the ConfigMgr client relies heavily on WMI.",[11,153,154,157],{},[46,155,156],{},"Credential Guard."," On Windows 11 22H2 and later, Credential Guard is enabled by default on Enterprise and Education devices that meet the hardware and license requirements, unless it was explicitly disabled before the upgrade. That \"unless\" is why I check rather than assume. Microsoft also says to enable it before domain join or before the first domain user signs in, so it belongs in provisioning, not in a post-deployment fix. It isn't available on Pro.",[11,159,160],{},"Here's the local script I run in a provisioning step (an Autopilot platform script, a task sequence step, or by hand on a lab device). It's deliberately explicit so you can read exactly what it does:",[162,163,168],"pre",{"className":164,"code":165,"language":166,"meta":167,"style":167},"language-powershell shiki shiki-themes github-dark","\u003C#\n.SYNOPSIS\n    Applies the local hardening defaults for a new Windows 11 device.\n.DESCRIPTION\n    Adds and escrows a BitLocker recovery password, enables BitLocker on the OS drive\n    with the TPM protector (XTS-AES-256, used space only), sets Defender cloud\n    protection and sample submission, puts the three standard-protection ASR rules in\n    Block and a set of other rules in Audit, and reports Credential Guard status.\n    Policy from Intune, ConfigMgr or GPO overrides these local settings, which is the\n    intended end state.\n.PARAMETER KeyBackup\n    Where to escrow the BitLocker recovery password: AD or Entra.\n.EXAMPLE\n    .\\Set-EndpointHardening.ps1 -KeyBackup Entra\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2026-06-17)\n    Requires: Windows 11 Pro\u002FEnterprise\u002FEducation, elevated Windows PowerShell 5.1,\n              BitLocker and Defender modules (in box). ASR rules also need\n              Microsoft Defender Antivirus as the primary antivirus, in Active mode.\n#>\n\n#Requires -RunAsAdministrator\n\n[CmdletBinding()]\nparam (\n    [Parameter(Mandatory = $true)]\n    [ValidateSet(\"AD\", \"Entra\")]\n    [string]$KeyBackup\n)\n\n$osDrive = $env:SystemDrive\n\n# BitLocker: recovery password first, escrow it, then the TPM protector.\n$volume = Get-BitLockerVolume -MountPoint $osDrive\nif ($volume.VolumeStatus -eq \"FullyDecrypted\") {\n    $recovery = $volume.KeyProtector | Where-Object { $_.KeyProtectorType -eq \"RecoveryPassword\" } | Select-Object -First 1\n\n    if (-not $recovery) {\n        Add-BitLockerKeyProtector -MountPoint $osDrive -RecoveryPasswordProtector | Out-Null\n        $recovery = (Get-BitLockerVolume -MountPoint $osDrive).KeyProtector |\n            Where-Object { $_.KeyProtectorType -eq \"RecoveryPassword\" } | Select-Object -First 1\n    }\n\n    if ($KeyBackup -eq \"Entra\") {\n        BackupToAAD-BitLockerKeyProtector -MountPoint $osDrive -KeyProtectorId $recovery.KeyProtectorId | Out-Null\n    } else {\n        Backup-BitLockerKeyProtector -MountPoint $osDrive -KeyProtectorId $recovery.KeyProtectorId | Out-Null\n    }\n\n    Enable-BitLocker -MountPoint $osDrive -TpmProtector -EncryptionMethod XtsAes256 -UsedSpaceOnly | Out-Null\n    Write-Host \"BitLocker enabled on $osDrive; recovery password escrowed to $KeyBackup.\"\n} else {\n    Write-Host \"BitLocker already $($volume.VolumeStatus) on $osDrive; leaving it alone.\"\n}\n\n# Defender cloud-delivered protection and automatic safe-sample submission.\nSet-MpPreference -MAPSReporting Advanced -SubmitSamplesConsent SendSafeSamples -PUAProtection Enabled\n\n# ASR: standard protection rules in Block.\n$blockRules = @(\n    # Block abuse of exploited vulnerable signed drivers\n    \"56a863a9-875e-4185-98a7-b882c64b5ce5\",\n    # Block credential stealing from LSASS\n    \"9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2\",\n    # Block persistence through WMI event subscription\n    \"e6db77e5-3df2-4cf1-b95a-636979351e5b\"\n)\n\n# ASR: other rules in Audit until the event data says they're safe to block.\n$auditRules = @(\n    # Block executable content from email client and webmail\n    \"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550\",\n    # Block all Office applications from creating child processes\n    \"d4f940ab-401b-4efc-aadc-ad5f3c50688a\",\n    # Block Office applications from creating executable content\n    \"3b576869-a4ec-4529-8536-b80a7769e899\",\n    # Block Office applications from injecting code into other processes\n    \"75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84\",\n    # Block JavaScript or VBScript from launching downloaded executable content\n    \"d3e037e1-3eb8-44c8-a917-57927947596d\",\n    # Block execution of potentially obfuscated scripts\n    \"5beb7efe-fd9a-4556-801d-275e5ffc04cc\",\n    # Block Win32 API calls from Office macros\n    \"92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b\",\n    # Use advanced protection against ransomware\n    \"c1db55ab-c21a-4637-bb3f-a12568109d35\"\n)\n\nAdd-MpPreference -AttackSurfaceReductionRules_Ids $blockRules -AttackSurfaceReductionRules_Actions (@(\"Enabled\") * $blockRules.Count)\nAdd-MpPreference -AttackSurfaceReductionRules_Ids $auditRules -AttackSurfaceReductionRules_Actions (@(\"AuditMode\") * $auditRules.Count)\n\n# Credential Guard: report only; enable it through policy before domain join.\n$deviceGuard = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace \"root\\Microsoft\\Windows\\DeviceGuard\"\n$cgRunning = @($deviceGuard.SecurityServicesRunning) -contains 1\nWrite-Host \"Credential Guard running: $cgRunning\"\n","powershell","",[63,169,170,179,189,195,203,209,215,221,227,233,239,250,256,264,270,278,284,290,296,302,308,314,321,330,335,348,357,382,404,415,421,426,444,449,455,472,490,537,542,557,579,600,628,634,639,653,677,689,707,712,717,746,767,777,804,810,815,821,841,846,852,866,872,881,887,895,901,907,912,917,923,935,941,949,955,963,969,977,983,991,997,1005,1011,1019,1025,1033,1039,1045,1050,1055,1088,1116,1121,1127,1151,1170],{"__ignoreMap":167},[171,172,175],"span",{"class":173,"line":174},"line",1,[171,176,178],{"class":177},"sAwPA","\u003C#\n",[171,180,182,185],{"class":173,"line":181},2,[171,183,27],{"class":184},"sDLfK",[171,186,188],{"class":187},"snl16","SYNOPSIS\n",[171,190,192],{"class":173,"line":191},3,[171,193,194],{"class":177},"    Applies the local hardening defaults for a new Windows 11 device.\n",[171,196,198,200],{"class":173,"line":197},4,[171,199,27],{"class":184},[171,201,202],{"class":187},"DESCRIPTION\n",[171,204,206],{"class":173,"line":205},5,[171,207,208],{"class":177},"    Adds and escrows a BitLocker recovery password, enables BitLocker on the OS drive\n",[171,210,212],{"class":173,"line":211},6,[171,213,214],{"class":177},"    with the TPM protector (XTS-AES-256, used space only), sets Defender cloud\n",[171,216,218],{"class":173,"line":217},7,[171,219,220],{"class":177},"    protection and sample submission, puts the three standard-protection ASR rules in\n",[171,222,224],{"class":173,"line":223},8,[171,225,226],{"class":177},"    Block and a set of other rules in Audit, and reports Credential Guard status.\n",[171,228,230],{"class":173,"line":229},9,[171,231,232],{"class":177},"    Policy from Intune, ConfigMgr or GPO overrides these local settings, which is the\n",[171,234,236],{"class":173,"line":235},10,[171,237,238],{"class":177},"    intended end state.\n",[171,240,242,244,247],{"class":173,"line":241},11,[171,243,27],{"class":184},[171,245,246],{"class":187},"PARAMETER",[171,248,249],{"class":187}," KeyBackup\n",[171,251,253],{"class":173,"line":252},12,[171,254,255],{"class":177},"    Where to escrow the BitLocker recovery password: AD or Entra.\n",[171,257,259,261],{"class":173,"line":258},13,[171,260,27],{"class":184},[171,262,263],{"class":187},"EXAMPLE\n",[171,265,267],{"class":173,"line":266},14,[171,268,269],{"class":177},"    .\\Set-EndpointHardening.ps1 -KeyBackup Entra\n",[171,271,273,275],{"class":173,"line":272},15,[171,274,27],{"class":184},[171,276,277],{"class":187},"NOTES\n",[171,279,281],{"class":173,"line":280},16,[171,282,283],{"class":177},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[171,285,287],{"class":173,"line":286},17,[171,288,289],{"class":177},"    Version : 1.0 (2026-06-17)\n",[171,291,293],{"class":173,"line":292},18,[171,294,295],{"class":177},"    Requires: Windows 11 Pro\u002FEnterprise\u002FEducation, elevated Windows PowerShell 5.1,\n",[171,297,299],{"class":173,"line":298},19,[171,300,301],{"class":177},"              BitLocker and Defender modules (in box). ASR rules also need\n",[171,303,305],{"class":173,"line":304},20,[171,306,307],{"class":177},"              Microsoft Defender Antivirus as the primary antivirus, in Active mode.\n",[171,309,311],{"class":173,"line":310},21,[171,312,313],{"class":177},"#>\n",[171,315,317],{"class":173,"line":316},22,[171,318,320],{"emptyLinePlaceholder":319},true,"\n",[171,322,324,327],{"class":173,"line":323},23,[171,325,326],{"class":177},"#",[171,328,329],{"class":187},"Requires -RunAsAdministrator\n",[171,331,333],{"class":173,"line":332},24,[171,334,320],{"emptyLinePlaceholder":319},[171,336,338,342,345],{"class":173,"line":337},25,[171,339,341],{"class":340},"s95oV","[",[171,343,344],{"class":184},"CmdletBinding",[171,346,347],{"class":340},"()]\n",[171,349,351,354],{"class":173,"line":350},26,[171,352,353],{"class":187},"param",[171,355,356],{"class":340}," (\n",[171,358,360,363,366,369,373,376,379],{"class":173,"line":359},27,[171,361,362],{"class":340},"    [",[171,364,365],{"class":184},"Parameter",[171,367,368],{"class":340},"(",[171,370,372],{"class":371},"s9osk","Mandatory",[171,374,375],{"class":187}," =",[171,377,378],{"class":184}," $true",[171,380,381],{"class":340},")]\n",[171,383,385,387,390,392,396,399,402],{"class":173,"line":384},28,[171,386,362],{"class":340},[171,388,389],{"class":184},"ValidateSet",[171,391,368],{"class":340},[171,393,395],{"class":394},"sU2Wk","\"AD\"",[171,397,398],{"class":187},",",[171,400,401],{"class":394}," \"Entra\"",[171,403,381],{"class":340},[171,405,407,409,412],{"class":173,"line":406},29,[171,408,362],{"class":340},[171,410,411],{"class":187},"string",[171,413,414],{"class":340},"]$KeyBackup\n",[171,416,418],{"class":173,"line":417},30,[171,419,420],{"class":340},")\n",[171,422,424],{"class":173,"line":423},31,[171,425,320],{"emptyLinePlaceholder":319},[171,427,429,432,435,438,441],{"class":173,"line":428},32,[171,430,431],{"class":340},"$osDrive ",[171,433,434],{"class":187},"=",[171,436,437],{"class":340}," $",[171,439,440],{"class":184},"env:",[171,442,443],{"class":340},"SystemDrive\n",[171,445,447],{"class":173,"line":446},33,[171,448,320],{"emptyLinePlaceholder":319},[171,450,452],{"class":173,"line":451},34,[171,453,454],{"class":177},"# BitLocker: recovery password first, escrow it, then the TPM protector.\n",[171,456,458,461,463,466,469],{"class":173,"line":457},35,[171,459,460],{"class":340},"$volume ",[171,462,434],{"class":187},[171,464,465],{"class":184}," Get-BitLockerVolume",[171,467,468],{"class":187}," -",[171,470,471],{"class":340},"MountPoint $osDrive\n",[171,473,475,478,481,484,487],{"class":173,"line":474},36,[171,476,477],{"class":187},"if",[171,479,480],{"class":340}," ($volume.VolumeStatus ",[171,482,483],{"class":187},"-eq",[171,485,486],{"class":394}," \"FullyDecrypted\"",[171,488,489],{"class":340},") {\n",[171,491,493,496,498,501,504,507,510,513,516,518,521,524,526,529,531,534],{"class":173,"line":492},37,[171,494,495],{"class":340},"    $recovery ",[171,497,434],{"class":187},[171,499,500],{"class":340}," $volume.KeyProtector ",[171,502,503],{"class":187},"|",[171,505,506],{"class":184}," Where-Object",[171,508,509],{"class":340}," { ",[171,511,512],{"class":184},"$_",[171,514,515],{"class":340},".KeyProtectorType ",[171,517,483],{"class":187},[171,519,520],{"class":394}," \"RecoveryPassword\"",[171,522,523],{"class":340}," } ",[171,525,503],{"class":187},[171,527,528],{"class":184}," Select-Object",[171,530,468],{"class":187},[171,532,533],{"class":340},"First ",[171,535,536],{"class":184},"1\n",[171,538,540],{"class":173,"line":539},38,[171,541,320],{"emptyLinePlaceholder":319},[171,543,545,548,551,554],{"class":173,"line":544},39,[171,546,547],{"class":187},"    if",[171,549,550],{"class":340}," (",[171,552,553],{"class":187},"-not",[171,555,556],{"class":340}," $recovery) {\n",[171,558,560,563,565,568,571,574,576],{"class":173,"line":559},40,[171,561,562],{"class":184},"        Add-BitLockerKeyProtector",[171,564,468],{"class":187},[171,566,567],{"class":340},"MountPoint $osDrive ",[171,569,570],{"class":187},"-",[171,572,573],{"class":340},"RecoveryPasswordProtector ",[171,575,503],{"class":187},[171,577,578],{"class":184}," Out-Null\n",[171,580,582,585,587,589,592,594,597],{"class":173,"line":581},41,[171,583,584],{"class":340},"        $recovery ",[171,586,434],{"class":187},[171,588,550],{"class":340},[171,590,591],{"class":184},"Get-BitLockerVolume",[171,593,468],{"class":187},[171,595,596],{"class":340},"MountPoint $osDrive).KeyProtector ",[171,598,599],{"class":187},"|\n",[171,601,603,606,608,610,612,614,616,618,620,622,624,626],{"class":173,"line":602},42,[171,604,605],{"class":184},"            Where-Object",[171,607,509],{"class":340},[171,609,512],{"class":184},[171,611,515],{"class":340},[171,613,483],{"class":187},[171,615,520],{"class":394},[171,617,523],{"class":340},[171,619,503],{"class":187},[171,621,528],{"class":184},[171,623,468],{"class":187},[171,625,533],{"class":340},[171,627,536],{"class":184},[171,629,631],{"class":173,"line":630},43,[171,632,633],{"class":340},"    }\n",[171,635,637],{"class":173,"line":636},44,[171,638,320],{"emptyLinePlaceholder":319},[171,640,642,644,647,649,651],{"class":173,"line":641},45,[171,643,547],{"class":187},[171,645,646],{"class":340}," ($KeyBackup ",[171,648,483],{"class":187},[171,650,401],{"class":394},[171,652,489],{"class":340},[171,654,656,659,661,664,666,668,670,673,675],{"class":173,"line":655},46,[171,657,658],{"class":340},"        BackupToAAD",[171,660,570],{"class":187},[171,662,663],{"class":340},"BitLockerKeyProtector ",[171,665,570],{"class":187},[171,667,567],{"class":340},[171,669,570],{"class":187},[171,671,672],{"class":340},"KeyProtectorId $recovery.KeyProtectorId ",[171,674,503],{"class":187},[171,676,578],{"class":184},[171,678,680,683,686],{"class":173,"line":679},47,[171,681,682],{"class":340},"    } ",[171,684,685],{"class":187},"else",[171,687,688],{"class":340}," {\n",[171,690,692,695,697,699,701,703,705],{"class":173,"line":691},48,[171,693,694],{"class":184},"        Backup-BitLockerKeyProtector",[171,696,468],{"class":187},[171,698,567],{"class":340},[171,700,570],{"class":187},[171,702,672],{"class":340},[171,704,503],{"class":187},[171,706,578],{"class":184},[171,708,710],{"class":173,"line":709},49,[171,711,633],{"class":340},[171,713,715],{"class":173,"line":714},50,[171,716,320],{"emptyLinePlaceholder":319},[171,718,720,723,725,727,729,732,734,737,739,742,744],{"class":173,"line":719},51,[171,721,722],{"class":184},"    Enable-BitLocker",[171,724,468],{"class":187},[171,726,567],{"class":340},[171,728,570],{"class":187},[171,730,731],{"class":340},"TpmProtector ",[171,733,570],{"class":187},[171,735,736],{"class":340},"EncryptionMethod XtsAes256 ",[171,738,570],{"class":187},[171,740,741],{"class":340},"UsedSpaceOnly ",[171,743,503],{"class":187},[171,745,578],{"class":184},[171,747,749,752,755,758,761,764],{"class":173,"line":748},52,[171,750,751],{"class":184},"    Write-Host",[171,753,754],{"class":394}," \"BitLocker enabled on ",[171,756,757],{"class":340},"$osDrive",[171,759,760],{"class":394},"; recovery password escrowed to ",[171,762,763],{"class":340},"$KeyBackup",[171,765,766],{"class":394},".\"\n",[171,768,770,773,775],{"class":173,"line":769},53,[171,771,772],{"class":340},"} ",[171,774,685],{"class":187},[171,776,688],{"class":340},[171,778,780,782,785,788,790,793,796,799,801],{"class":173,"line":779},54,[171,781,751],{"class":184},[171,783,784],{"class":394}," \"BitLocker already ",[171,786,787],{"class":187},"$",[171,789,368],{"class":394},[171,791,792],{"class":340},"$volume.VolumeStatus",[171,794,795],{"class":394},")",[171,797,798],{"class":394}," on ",[171,800,757],{"class":340},[171,802,803],{"class":394},"; leaving it alone.\"\n",[171,805,807],{"class":173,"line":806},55,[171,808,809],{"class":340},"}\n",[171,811,813],{"class":173,"line":812},56,[171,814,320],{"emptyLinePlaceholder":319},[171,816,818],{"class":173,"line":817},57,[171,819,820],{"class":177},"# Defender cloud-delivered protection and automatic safe-sample submission.\n",[171,822,824,826,828,831,833,836,838],{"class":173,"line":823},58,[171,825,133],{"class":184},[171,827,468],{"class":187},[171,829,830],{"class":340},"MAPSReporting Advanced ",[171,832,570],{"class":187},[171,834,835],{"class":340},"SubmitSamplesConsent SendSafeSamples ",[171,837,570],{"class":187},[171,839,840],{"class":340},"PUAProtection Enabled\n",[171,842,844],{"class":173,"line":843},59,[171,845,320],{"emptyLinePlaceholder":319},[171,847,849],{"class":173,"line":848},60,[171,850,851],{"class":177},"# ASR: standard protection rules in Block.\n",[171,853,855,858,860,863],{"class":173,"line":854},61,[171,856,857],{"class":340},"$blockRules ",[171,859,434],{"class":187},[171,861,862],{"class":187}," @",[171,864,865],{"class":340},"(\n",[171,867,869],{"class":173,"line":868},62,[171,870,871],{"class":177},"    # Block abuse of exploited vulnerable signed drivers\n",[171,873,875,878],{"class":173,"line":874},63,[171,876,877],{"class":394},"    \"56a863a9-875e-4185-98a7-b882c64b5ce5\"",[171,879,880],{"class":187},",\n",[171,882,884],{"class":173,"line":883},64,[171,885,886],{"class":177},"    # Block credential stealing from LSASS\n",[171,888,890,893],{"class":173,"line":889},65,[171,891,892],{"class":394},"    \"9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2\"",[171,894,880],{"class":187},[171,896,898],{"class":173,"line":897},66,[171,899,900],{"class":177},"    # Block persistence through WMI event subscription\n",[171,902,904],{"class":173,"line":903},67,[171,905,906],{"class":394},"    \"e6db77e5-3df2-4cf1-b95a-636979351e5b\"\n",[171,908,910],{"class":173,"line":909},68,[171,911,420],{"class":340},[171,913,915],{"class":173,"line":914},69,[171,916,320],{"emptyLinePlaceholder":319},[171,918,920],{"class":173,"line":919},70,[171,921,922],{"class":177},"# ASR: other rules in Audit until the event data says they're safe to block.\n",[171,924,926,929,931,933],{"class":173,"line":925},71,[171,927,928],{"class":340},"$auditRules ",[171,930,434],{"class":187},[171,932,862],{"class":187},[171,934,865],{"class":340},[171,936,938],{"class":173,"line":937},72,[171,939,940],{"class":177},"    # Block executable content from email client and webmail\n",[171,942,944,947],{"class":173,"line":943},73,[171,945,946],{"class":394},"    \"be9ba2d9-53ea-4cdc-84e5-9b1eeee46550\"",[171,948,880],{"class":187},[171,950,952],{"class":173,"line":951},74,[171,953,954],{"class":177},"    # Block all Office applications from creating child processes\n",[171,956,958,961],{"class":173,"line":957},75,[171,959,960],{"class":394},"    \"d4f940ab-401b-4efc-aadc-ad5f3c50688a\"",[171,962,880],{"class":187},[171,964,966],{"class":173,"line":965},76,[171,967,968],{"class":177},"    # Block Office applications from creating executable content\n",[171,970,972,975],{"class":173,"line":971},77,[171,973,974],{"class":394},"    \"3b576869-a4ec-4529-8536-b80a7769e899\"",[171,976,880],{"class":187},[171,978,980],{"class":173,"line":979},78,[171,981,982],{"class":177},"    # Block Office applications from injecting code into other processes\n",[171,984,986,989],{"class":173,"line":985},79,[171,987,988],{"class":394},"    \"75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84\"",[171,990,880],{"class":187},[171,992,994],{"class":173,"line":993},80,[171,995,996],{"class":177},"    # Block JavaScript or VBScript from launching downloaded executable content\n",[171,998,1000,1003],{"class":173,"line":999},81,[171,1001,1002],{"class":394},"    \"d3e037e1-3eb8-44c8-a917-57927947596d\"",[171,1004,880],{"class":187},[171,1006,1008],{"class":173,"line":1007},82,[171,1009,1010],{"class":177},"    # Block execution of potentially obfuscated scripts\n",[171,1012,1014,1017],{"class":173,"line":1013},83,[171,1015,1016],{"class":394},"    \"5beb7efe-fd9a-4556-801d-275e5ffc04cc\"",[171,1018,880],{"class":187},[171,1020,1022],{"class":173,"line":1021},84,[171,1023,1024],{"class":177},"    # Block Win32 API calls from Office macros\n",[171,1026,1028,1031],{"class":173,"line":1027},85,[171,1029,1030],{"class":394},"    \"92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b\"",[171,1032,880],{"class":187},[171,1034,1036],{"class":173,"line":1035},86,[171,1037,1038],{"class":177},"    # Use advanced protection against ransomware\n",[171,1040,1042],{"class":173,"line":1041},87,[171,1043,1044],{"class":394},"    \"c1db55ab-c21a-4637-bb3f-a12568109d35\"\n",[171,1046,1048],{"class":173,"line":1047},88,[171,1049,420],{"class":340},[171,1051,1053],{"class":173,"line":1052},89,[171,1054,320],{"emptyLinePlaceholder":319},[171,1056,1058,1061,1063,1066,1068,1071,1074,1076,1079,1082,1085],{"class":173,"line":1057},90,[171,1059,1060],{"class":184},"Add-MpPreference",[171,1062,468],{"class":187},[171,1064,1065],{"class":340},"AttackSurfaceReductionRules_Ids $blockRules ",[171,1067,570],{"class":187},[171,1069,1070],{"class":340},"AttackSurfaceReductionRules_Actions (",[171,1072,1073],{"class":187},"@",[171,1075,368],{"class":340},[171,1077,1078],{"class":394},"\"Enabled\"",[171,1080,1081],{"class":340},") ",[171,1083,1084],{"class":187},"*",[171,1086,1087],{"class":340}," $blockRules.Count)\n",[171,1089,1091,1093,1095,1098,1100,1102,1104,1106,1109,1111,1113],{"class":173,"line":1090},91,[171,1092,1060],{"class":184},[171,1094,468],{"class":187},[171,1096,1097],{"class":340},"AttackSurfaceReductionRules_Ids $auditRules ",[171,1099,570],{"class":187},[171,1101,1070],{"class":340},[171,1103,1073],{"class":187},[171,1105,368],{"class":340},[171,1107,1108],{"class":394},"\"AuditMode\"",[171,1110,1081],{"class":340},[171,1112,1084],{"class":187},[171,1114,1115],{"class":340}," $auditRules.Count)\n",[171,1117,1119],{"class":173,"line":1118},92,[171,1120,320],{"emptyLinePlaceholder":319},[171,1122,1124],{"class":173,"line":1123},93,[171,1125,1126],{"class":177},"# Credential Guard: report only; enable it through policy before domain join.\n",[171,1128,1130,1133,1135,1138,1140,1143,1145,1148],{"class":173,"line":1129},94,[171,1131,1132],{"class":340},"$deviceGuard ",[171,1134,434],{"class":187},[171,1136,1137],{"class":184}," Get-CimInstance",[171,1139,468],{"class":187},[171,1141,1142],{"class":340},"ClassName Win32_DeviceGuard ",[171,1144,570],{"class":187},[171,1146,1147],{"class":340},"Namespace ",[171,1149,1150],{"class":394},"\"root\\Microsoft\\Windows\\DeviceGuard\"\n",[171,1152,1154,1157,1159,1161,1164,1167],{"class":173,"line":1153},95,[171,1155,1156],{"class":340},"$cgRunning ",[171,1158,434],{"class":187},[171,1160,862],{"class":187},[171,1162,1163],{"class":340},"($deviceGuard.SecurityServicesRunning) ",[171,1165,1166],{"class":187},"-contains",[171,1168,1169],{"class":184}," 1\n",[171,1171,1173,1176,1179,1182],{"class":173,"line":1172},96,[171,1174,1175],{"class":184},"Write-Host",[171,1177,1178],{"class":394}," \"Credential Guard running: ",[171,1180,1181],{"class":340},"$cgRunning",[171,1183,1184],{"class":394},"\"\n",[11,1186,1187,1189],{},[63,1188,133],{}," has the lowest precedence of any ASR configuration method. Group Policy and MDM overwrite it at startup. That's fine: the script gives a lab or pilot device a sane state on day one, and the real baseline lives in policy.",[29,1191,1193],{"id":1192},"bake-it-into-provisioning-not-into-a-post-deployment-script","Bake it into provisioning, not into a post-deployment script",[11,1195,1196],{},"The version of this baseline that actually holds up over time lives in the provisioning pipeline: an Autopilot profile with the app removal policy, security baseline and endpoint security profiles assigned to device groups, or GPOs linked to the workstation OU. Not a PowerShell script run once by hand on day one. A script run once drifts the moment someone reimages a machine outside the documented path or restores from an older image during a break-fix. A baseline enforced through the same mechanism that provisions every machine self-heals on the next sync, which is the difference between a policy and a one-time favor to your future self.",[11,1198,1199],{},"For Autopilot specifically, Microsoft recommends configuring the Enrollment Status Page to block until device configuration completes so the app removal policy lands before the user reaches the desktop. If it arrives late, apps can appear until the following sign-in.",[29,1201,1203],{"id":1202},"measure-what-the-baseline-actually-enforces","Measure what the baseline actually enforces",[11,1205,1206],{},"The debloat half is easy to verify (a provisioned app is either gone or it isn't), but the hardening half needs an audit trail. Pull BitLocker status, Defender configuration, ASR rule state and Credential Guard across the fleet on a schedule, not just at image-build time. A setting that's correct in the base image but gets overridden by a conflicting GPO six months later is functionally the same as never having set it, and the only way to catch that kind of regression is to keep checking.",[11,1208,1209],{},"This is the audit I schedule weekly. It fans out over PowerShell remoting, so it needs WinRM on the targets and an account in the Administrators group (or Remote Management Users with a suitably configured endpoint):",[162,1211,1213],{"className":164,"code":1212,"language":166,"meta":167,"style":167},"\u003C#\n.SYNOPSIS\n    Reports BitLocker, Defender, ASR, Credential Guard and provisioned-app state across\n    a list of Windows 11 computers.\n.PARAMETER ComputerName\n    Computers to audit.\n.PARAMETER OutputPath\n    CSV to write. Defaults to .\\baseline-audit.csv.\n.EXAMPLE\n    .\\Get-BaselineCompliance.ps1 -ComputerName (Get-Content .\\workstations.txt)\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2026-06-17)\n    Requires: PowerShell remoting on targets; admin rights on targets\n#>\n[CmdletBinding()]\nparam (\n    [Parameter(Mandatory = $true)]\n    [string[]]$ComputerName,\n\n    [string]$OutputPath = \".\\baseline-audit.csv\"\n)\n\n$auditScript = {\n    $os = Get-BitLockerVolume -MountPoint $env:SystemDrive\n    $status = Get-MpComputerStatus\n    $prefs = Get-MpPreference\n    $deviceGuard = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace \"root\\Microsoft\\Windows\\DeviceGuard\"\n\n    # Pair each ASR rule GUID with its action (0 off, 1 block, 2 audit, 6 warn).\n    $asr = @()\n    for ($i = 0; $i -lt @($prefs.AttackSurfaceReductionRules_Ids).Count; $i++) {\n        $asr += \"$($prefs.AttackSurfaceReductionRules_Ids[$i])=$($prefs.AttackSurfaceReductionRules_Actions[$i])\"\n    }\n\n    $consumerApps = @(Get-AppxProvisionedPackage -Online | Where-Object {\n        $_.DisplayName -match \"BingNews|BingWeather|SolitaireCollection|GamingApp|Clipchamp\"\n    })\n\n    [pscustomobject]@{\n        ComputerName         = $env:COMPUTERNAME\n        BitLockerStatus      = \"$($os.VolumeStatus)\"\n        BitLockerProtection  = \"$($os.ProtectionStatus)\"\n        EncryptionMethod     = \"$($os.EncryptionMethod)\"\n        HasRecoveryPassword  = [bool]($os.KeyProtector | Where-Object { $_.KeyProtectorType -eq \"RecoveryPassword\" })\n        DefenderService      = $status.AMServiceEnabled\n        RealTimeProtection   = $status.RealTimeProtectionEnabled\n        SignaturesUpdated    = $status.AntivirusSignatureLastUpdated\n        MAPSReporting        = $prefs.MAPSReporting\n        AsrRules             = ($asr -join \";\")\n        CredentialGuard      = @($deviceGuard.SecurityServicesRunning) -contains 1\n        ConsumerAppsRemaining = $consumerApps.Count\n    }\n}\n\n$results = Invoke-Command -ComputerName $ComputerName -ScriptBlock $auditScript -ErrorAction SilentlyContinue -ErrorVariable remoteErrors\n\n$results | Select-Object -Property * -ExcludeProperty PSComputerName, RunspaceId, PSShowComputerName |\n    Export-Csv -Path $OutputPath -NoTypeInformation\n\nWrite-Host \"Audited $(@($results).Count) of $($ComputerName.Count) computers; results in $OutputPath\"\nforeach ($err in $remoteErrors) {\n    Write-Warning $err.Exception.Message\n}\n",[63,1214,1215,1219,1225,1230,1235,1244,1249,1258,1263,1269,1274,1280,1284,1288,1293,1297,1305,1311,1327,1338,1342,1356,1360,1364,1373,1391,1401,1411,1430,1434,1439,1451,1480,1523,1527,1531,1556,1570,1575,1579,1594,1608,1628,1648,1668,1701,1711,1721,1731,1741,1759,1774,1784,1788,1792,1796,1826,1830,1862,1877,1881,1922,1936,1944],{"__ignoreMap":167},[171,1216,1217],{"class":173,"line":174},[171,1218,178],{"class":177},[171,1220,1221,1223],{"class":173,"line":181},[171,1222,27],{"class":184},[171,1224,188],{"class":187},[171,1226,1227],{"class":173,"line":191},[171,1228,1229],{"class":177},"    Reports BitLocker, Defender, ASR, Credential Guard and provisioned-app state across\n",[171,1231,1232],{"class":173,"line":197},[171,1233,1234],{"class":177},"    a list of Windows 11 computers.\n",[171,1236,1237,1239,1241],{"class":173,"line":205},[171,1238,27],{"class":184},[171,1240,246],{"class":187},[171,1242,1243],{"class":187}," ComputerName\n",[171,1245,1246],{"class":173,"line":211},[171,1247,1248],{"class":177},"    Computers to audit.\n",[171,1250,1251,1253,1255],{"class":173,"line":217},[171,1252,27],{"class":184},[171,1254,246],{"class":187},[171,1256,1257],{"class":187}," OutputPath\n",[171,1259,1260],{"class":173,"line":223},[171,1261,1262],{"class":177},"    CSV to write. Defaults to .\\baseline-audit.csv.\n",[171,1264,1265,1267],{"class":173,"line":229},[171,1266,27],{"class":184},[171,1268,263],{"class":187},[171,1270,1271],{"class":173,"line":235},[171,1272,1273],{"class":177},"    .\\Get-BaselineCompliance.ps1 -ComputerName (Get-Content .\\workstations.txt)\n",[171,1275,1276,1278],{"class":173,"line":241},[171,1277,27],{"class":184},[171,1279,277],{"class":187},[171,1281,1282],{"class":173,"line":252},[171,1283,283],{"class":177},[171,1285,1286],{"class":173,"line":258},[171,1287,289],{"class":177},[171,1289,1290],{"class":173,"line":266},[171,1291,1292],{"class":177},"    Requires: PowerShell remoting on targets; admin rights on targets\n",[171,1294,1295],{"class":173,"line":272},[171,1296,313],{"class":177},[171,1298,1299,1301,1303],{"class":173,"line":280},[171,1300,341],{"class":340},[171,1302,344],{"class":184},[171,1304,347],{"class":340},[171,1306,1307,1309],{"class":173,"line":286},[171,1308,353],{"class":187},[171,1310,356],{"class":340},[171,1312,1313,1315,1317,1319,1321,1323,1325],{"class":173,"line":292},[171,1314,362],{"class":340},[171,1316,365],{"class":184},[171,1318,368],{"class":340},[171,1320,372],{"class":371},[171,1322,375],{"class":187},[171,1324,378],{"class":184},[171,1326,381],{"class":340},[171,1328,1329,1331,1333,1336],{"class":173,"line":298},[171,1330,362],{"class":340},[171,1332,411],{"class":187},[171,1334,1335],{"class":340},"[]]$ComputerName",[171,1337,880],{"class":187},[171,1339,1340],{"class":173,"line":304},[171,1341,320],{"emptyLinePlaceholder":319},[171,1343,1344,1346,1348,1351,1353],{"class":173,"line":310},[171,1345,362],{"class":340},[171,1347,411],{"class":187},[171,1349,1350],{"class":340},"]$OutputPath ",[171,1352,434],{"class":187},[171,1354,1355],{"class":394}," \".\\baseline-audit.csv\"\n",[171,1357,1358],{"class":173,"line":316},[171,1359,420],{"class":340},[171,1361,1362],{"class":173,"line":323},[171,1363,320],{"emptyLinePlaceholder":319},[171,1365,1366,1369,1371],{"class":173,"line":332},[171,1367,1368],{"class":340},"$auditScript ",[171,1370,434],{"class":187},[171,1372,688],{"class":340},[171,1374,1375,1378,1380,1382,1384,1387,1389],{"class":173,"line":337},[171,1376,1377],{"class":340},"    $os ",[171,1379,434],{"class":187},[171,1381,465],{"class":184},[171,1383,468],{"class":187},[171,1385,1386],{"class":340},"MountPoint $",[171,1388,440],{"class":184},[171,1390,443],{"class":340},[171,1392,1393,1396,1398],{"class":173,"line":350},[171,1394,1395],{"class":340},"    $status ",[171,1397,434],{"class":187},[171,1399,1400],{"class":184}," Get-MpComputerStatus\n",[171,1402,1403,1406,1408],{"class":173,"line":359},[171,1404,1405],{"class":340},"    $prefs ",[171,1407,434],{"class":187},[171,1409,1410],{"class":184}," Get-MpPreference\n",[171,1412,1413,1416,1418,1420,1422,1424,1426,1428],{"class":173,"line":384},[171,1414,1415],{"class":340},"    $deviceGuard ",[171,1417,434],{"class":187},[171,1419,1137],{"class":184},[171,1421,468],{"class":187},[171,1423,1142],{"class":340},[171,1425,570],{"class":187},[171,1427,1147],{"class":340},[171,1429,1150],{"class":394},[171,1431,1432],{"class":173,"line":406},[171,1433,320],{"emptyLinePlaceholder":319},[171,1435,1436],{"class":173,"line":417},[171,1437,1438],{"class":177},"    # Pair each ASR rule GUID with its action (0 off, 1 block, 2 audit, 6 warn).\n",[171,1440,1441,1444,1446,1448],{"class":173,"line":423},[171,1442,1443],{"class":340},"    $asr ",[171,1445,434],{"class":187},[171,1447,862],{"class":187},[171,1449,1450],{"class":340},"()\n",[171,1452,1453,1456,1459,1461,1464,1467,1470,1472,1475,1478],{"class":173,"line":428},[171,1454,1455],{"class":187},"    for",[171,1457,1458],{"class":340}," ($i ",[171,1460,434],{"class":187},[171,1462,1463],{"class":184}," 0",[171,1465,1466],{"class":340},"; $i ",[171,1468,1469],{"class":187},"-lt",[171,1471,862],{"class":187},[171,1473,1474],{"class":340},"($prefs.AttackSurfaceReductionRules_Ids).Count; $i",[171,1476,1477],{"class":187},"++",[171,1479,489],{"class":340},[171,1481,1482,1485,1488,1491,1493,1495,1498,1500,1503,1506,1508,1510,1512,1515,1517,1519,1521],{"class":173,"line":446},[171,1483,1484],{"class":340},"        $asr ",[171,1486,1487],{"class":187},"+=",[171,1489,1490],{"class":394}," \"",[171,1492,787],{"class":187},[171,1494,368],{"class":394},[171,1496,1497],{"class":340},"$prefs.AttackSurfaceReductionRules_Ids",[171,1499,341],{"class":394},[171,1501,1502],{"class":340},"$i",[171,1504,1505],{"class":394},"])",[171,1507,434],{"class":394},[171,1509,787],{"class":187},[171,1511,368],{"class":394},[171,1513,1514],{"class":340},"$prefs.AttackSurfaceReductionRules_Actions",[171,1516,341],{"class":394},[171,1518,1502],{"class":340},[171,1520,1505],{"class":394},[171,1522,1184],{"class":394},[171,1524,1525],{"class":173,"line":451},[171,1526,633],{"class":340},[171,1528,1529],{"class":173,"line":457},[171,1530,320],{"emptyLinePlaceholder":319},[171,1532,1533,1536,1538,1540,1542,1545,1547,1550,1552,1554],{"class":173,"line":474},[171,1534,1535],{"class":340},"    $consumerApps ",[171,1537,434],{"class":187},[171,1539,862],{"class":187},[171,1541,368],{"class":340},[171,1543,1544],{"class":184},"Get-AppxProvisionedPackage",[171,1546,468],{"class":187},[171,1548,1549],{"class":340},"Online ",[171,1551,503],{"class":187},[171,1553,506],{"class":184},[171,1555,688],{"class":340},[171,1557,1558,1561,1564,1567],{"class":173,"line":492},[171,1559,1560],{"class":184},"        $_",[171,1562,1563],{"class":340},".DisplayName ",[171,1565,1566],{"class":187},"-match",[171,1568,1569],{"class":394}," \"BingNews|BingWeather|SolitaireCollection|GamingApp|Clipchamp\"\n",[171,1571,1572],{"class":173,"line":539},[171,1573,1574],{"class":340},"    })\n",[171,1576,1577],{"class":173,"line":544},[171,1578,320],{"emptyLinePlaceholder":319},[171,1580,1581,1583,1586,1589,1591],{"class":173,"line":559},[171,1582,362],{"class":340},[171,1584,1585],{"class":187},"pscustomobject",[171,1587,1588],{"class":340},"]",[171,1590,1073],{"class":187},[171,1592,1593],{"class":340},"{\n",[171,1595,1596,1599,1601,1603,1605],{"class":173,"line":581},[171,1597,1598],{"class":340},"        ComputerName         ",[171,1600,434],{"class":187},[171,1602,437],{"class":340},[171,1604,440],{"class":184},[171,1606,1607],{"class":340},"COMPUTERNAME\n",[171,1609,1610,1613,1615,1617,1619,1621,1624,1626],{"class":173,"line":602},[171,1611,1612],{"class":340},"        BitLockerStatus      ",[171,1614,434],{"class":187},[171,1616,1490],{"class":394},[171,1618,787],{"class":187},[171,1620,368],{"class":394},[171,1622,1623],{"class":340},"$os.VolumeStatus",[171,1625,795],{"class":394},[171,1627,1184],{"class":394},[171,1629,1630,1633,1635,1637,1639,1641,1644,1646],{"class":173,"line":630},[171,1631,1632],{"class":340},"        BitLockerProtection  ",[171,1634,434],{"class":187},[171,1636,1490],{"class":394},[171,1638,787],{"class":187},[171,1640,368],{"class":394},[171,1642,1643],{"class":340},"$os.ProtectionStatus",[171,1645,795],{"class":394},[171,1647,1184],{"class":394},[171,1649,1650,1653,1655,1657,1659,1661,1664,1666],{"class":173,"line":636},[171,1651,1652],{"class":340},"        EncryptionMethod     ",[171,1654,434],{"class":187},[171,1656,1490],{"class":394},[171,1658,787],{"class":187},[171,1660,368],{"class":394},[171,1662,1663],{"class":340},"$os.EncryptionMethod",[171,1665,795],{"class":394},[171,1667,1184],{"class":394},[171,1669,1670,1673,1675,1678,1681,1684,1686,1688,1690,1692,1694,1696,1698],{"class":173,"line":641},[171,1671,1672],{"class":340},"        HasRecoveryPassword  ",[171,1674,434],{"class":187},[171,1676,1677],{"class":340}," [",[171,1679,1680],{"class":187},"bool",[171,1682,1683],{"class":340},"]($os.KeyProtector ",[171,1685,503],{"class":187},[171,1687,506],{"class":184},[171,1689,509],{"class":340},[171,1691,512],{"class":184},[171,1693,515],{"class":340},[171,1695,483],{"class":187},[171,1697,520],{"class":394},[171,1699,1700],{"class":340}," })\n",[171,1702,1703,1706,1708],{"class":173,"line":655},[171,1704,1705],{"class":340},"        DefenderService      ",[171,1707,434],{"class":187},[171,1709,1710],{"class":340}," $status.AMServiceEnabled\n",[171,1712,1713,1716,1718],{"class":173,"line":679},[171,1714,1715],{"class":340},"        RealTimeProtection   ",[171,1717,434],{"class":187},[171,1719,1720],{"class":340}," $status.RealTimeProtectionEnabled\n",[171,1722,1723,1726,1728],{"class":173,"line":691},[171,1724,1725],{"class":340},"        SignaturesUpdated    ",[171,1727,434],{"class":187},[171,1729,1730],{"class":340}," $status.AntivirusSignatureLastUpdated\n",[171,1732,1733,1736,1738],{"class":173,"line":709},[171,1734,1735],{"class":340},"        MAPSReporting        ",[171,1737,434],{"class":187},[171,1739,1740],{"class":340}," $prefs.MAPSReporting\n",[171,1742,1743,1746,1748,1751,1754,1757],{"class":173,"line":714},[171,1744,1745],{"class":340},"        AsrRules             ",[171,1747,434],{"class":187},[171,1749,1750],{"class":340}," ($asr ",[171,1752,1753],{"class":187},"-join",[171,1755,1756],{"class":394}," \";\"",[171,1758,420],{"class":340},[171,1760,1761,1764,1766,1768,1770,1772],{"class":173,"line":719},[171,1762,1763],{"class":340},"        CredentialGuard      ",[171,1765,434],{"class":187},[171,1767,862],{"class":187},[171,1769,1163],{"class":340},[171,1771,1166],{"class":187},[171,1773,1169],{"class":184},[171,1775,1776,1779,1781],{"class":173,"line":748},[171,1777,1778],{"class":340},"        ConsumerAppsRemaining ",[171,1780,434],{"class":187},[171,1782,1783],{"class":340}," $consumerApps.Count\n",[171,1785,1786],{"class":173,"line":769},[171,1787,633],{"class":340},[171,1789,1790],{"class":173,"line":779},[171,1791,809],{"class":340},[171,1793,1794],{"class":173,"line":806},[171,1795,320],{"emptyLinePlaceholder":319},[171,1797,1798,1801,1803,1806,1808,1811,1813,1816,1818,1821,1823],{"class":173,"line":812},[171,1799,1800],{"class":340},"$results ",[171,1802,434],{"class":187},[171,1804,1805],{"class":184}," Invoke-Command",[171,1807,468],{"class":187},[171,1809,1810],{"class":340},"ComputerName $ComputerName ",[171,1812,570],{"class":187},[171,1814,1815],{"class":340},"ScriptBlock $auditScript ",[171,1817,570],{"class":187},[171,1819,1820],{"class":340},"ErrorAction SilentlyContinue ",[171,1822,570],{"class":187},[171,1824,1825],{"class":340},"ErrorVariable remoteErrors\n",[171,1827,1828],{"class":173,"line":817},[171,1829,320],{"emptyLinePlaceholder":319},[171,1831,1832,1834,1836,1838,1840,1843,1845,1847,1850,1852,1855,1857,1860],{"class":173,"line":823},[171,1833,1800],{"class":340},[171,1835,503],{"class":187},[171,1837,528],{"class":184},[171,1839,468],{"class":187},[171,1841,1842],{"class":340},"Property ",[171,1844,1084],{"class":187},[171,1846,468],{"class":187},[171,1848,1849],{"class":340},"ExcludeProperty PSComputerName",[171,1851,398],{"class":187},[171,1853,1854],{"class":340}," RunspaceId",[171,1856,398],{"class":187},[171,1858,1859],{"class":340}," PSShowComputerName ",[171,1861,599],{"class":187},[171,1863,1864,1867,1869,1872,1874],{"class":173,"line":843},[171,1865,1866],{"class":184},"    Export-Csv",[171,1868,468],{"class":187},[171,1870,1871],{"class":340},"Path $OutputPath ",[171,1873,570],{"class":187},[171,1875,1876],{"class":340},"NoTypeInformation\n",[171,1878,1879],{"class":173,"line":848},[171,1880,320],{"emptyLinePlaceholder":319},[171,1882,1883,1885,1888,1890,1892,1894,1896,1899,1902,1905,1907,1909,1912,1914,1917,1920],{"class":173,"line":854},[171,1884,1175],{"class":184},[171,1886,1887],{"class":394}," \"Audited ",[171,1889,787],{"class":187},[171,1891,368],{"class":394},[171,1893,1073],{"class":187},[171,1895,368],{"class":394},[171,1897,1898],{"class":340},"$results",[171,1900,1901],{"class":394},").Count)",[171,1903,1904],{"class":394}," of ",[171,1906,787],{"class":187},[171,1908,368],{"class":394},[171,1910,1911],{"class":340},"$ComputerName.Count",[171,1913,795],{"class":394},[171,1915,1916],{"class":394}," computers; results in ",[171,1918,1919],{"class":340},"$OutputPath",[171,1921,1184],{"class":394},[171,1923,1924,1927,1930,1933],{"class":173,"line":868},[171,1925,1926],{"class":187},"foreach",[171,1928,1929],{"class":340}," ($err ",[171,1931,1932],{"class":187},"in",[171,1934,1935],{"class":340}," $remoteErrors) {\n",[171,1937,1938,1941],{"class":173,"line":874},[171,1939,1940],{"class":184},"    Write-Warning",[171,1942,1943],{"class":340}," $err.Exception.Message\n",[171,1945,1946],{"class":173,"line":883},[171,1947,809],{"class":340},[11,1949,1950],{},"Sample row from a device that drifted:",[162,1952,1957],{"className":1953,"code":1955,"language":1956,"meta":167},[1954],"language-text","ComputerName          : WKS-0142\nBitLockerStatus       : FullyEncrypted\nBitLockerProtection   : Off\nEncryptionMethod      : XtsAes256\nHasRecoveryPassword   : True\nDefenderService       : True\nRealTimeProtection    : True\nSignaturesUpdated     : 6\u002F15\u002F2026 3:12:44 AM\nMAPSReporting         : 2\nAsrRules              : 56a863a9-875e-4185-98a7-b882c64b5ce5=1;9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2=1;...\nCredentialGuard       : False\nConsumerAppsRemaining : 0\n","text",[63,1958,1955],{"__ignoreMap":167},[11,1960,1961,1964,1965,1968,1969,1972,1973,1976],{},[63,1962,1963],{},"BitLockerProtection : Off"," on a fully encrypted volume means the keys are not currently protected, most often because protection was suspended (for example with ",[63,1966,1967],{},"Suspend-BitLocker"," ahead of a firmware update) and never resumed; ",[63,1970,1971],{},"Resume-BitLocker"," turns it back on. ",[63,1974,1975],{},"CredentialGuard : False"," on an Enterprise device is worth checking against msinfo32 and the WinInit events 13 through 17 in the System log that Microsoft documents for Credential Guard.",[11,1978,1979,1980,27],{},"If you'd rather not run anything, the same questions can be answered by the Intune security baseline and endpoint security reports. I still like having the CSV, because it's the same shape for every device regardless of which management channel it's in, and it feeds straight into the ",[18,1981,1983],{"href":1982},"\u002F2026\u002F09\u002F02\u002Fwindows-management-building-a-discovery-inventory-nobody-has-to-maintain-by-hand\u002F","discovery inventory",[29,1985,1987],{"id":1986},"references","References",[1989,1990,1991,1999,2011,2018,2030,2036,2043,2050],"ul",{},[43,1992,1993],{},[18,1994,1998],{"href":1995,"rel":1996},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fconfiguration\u002Fpolicy-based-inbox-app-removal\u002Fpolicy-based-inbox-app-removal",[1997],"nofollow","Policy-based in-box app removal",[43,2000,2001,22,2006],{},[18,2002,2005],{"href":2003,"rel":2004},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-experience",[1997],"Experience Policy CSP",[18,2007,2010],{"href":2008,"rel":2009},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm\u002Fpolicy-csp-newsandinterests",[1997],"NewsAndInterests Policy CSP",[43,2012,2013],{},[18,2014,2017],{"href":2015,"rel":2016},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Foperating-system-security\u002Fdevice-management\u002Fwindows-security-configuration-framework\u002Fwindows-security-baselines",[1997],"Security baselines guide",[43,2019,2020,22,2025],{},[18,2021,2024],{"href":2022,"rel":2023},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fbitlocker\u002Fenable-bitlocker",[1997],"Enable-BitLocker",[18,2026,2029],{"href":2027,"rel":2028},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fbitlocker\u002Fbackuptoaad-bitlockerkeyprotector",[1997],"BackupToAAD-BitLockerKeyProtector",[43,2031,2032],{},[18,2033,133],{"href":2034,"rel":2035},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fdefender\u002Fset-mppreference",[1997],[43,2037,2038],{},[18,2039,2042],{"href":2040,"rel":2041},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-reference",[1997],"ASR rules reference",[43,2044,2045],{},[18,2046,2049],{"href":2047,"rel":2048},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-endpoint\u002Fattack-surface-reduction-rules-configure",[1997],"Configure ASR rules and exclusions",[43,2051,2052,22,2057],{},[18,2053,2056],{"href":2054,"rel":2055},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fidentity-protection\u002Fcredential-guard\u002F",[1997],"Credential Guard overview",[18,2058,2061],{"href":2059,"rel":2060},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fidentity-protection\u002Fcredential-guard\u002Fconfigure",[1997],"Configure Credential Guard",[2063,2064,2065],"style",{},"html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .s9osk, html code.shiki .s9osk{--shiki-default:#FFAB70}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":167,"searchDepth":181,"depth":181,"links":2067},[2068,2069,2070,2071,2072,2073,2074],{"id":31,"depth":181,"text":32},{"id":73,"depth":181,"text":74},{"id":107,"depth":181,"text":108},{"id":117,"depth":181,"text":118},{"id":1192,"depth":181,"text":1193},{"id":1202,"depth":181,"text":1203},{"id":1986,"depth":181,"text":1987},"techcolumnist",[2077],"engineering","2026-06-17T14:00:00Z","A repeatable Windows 11 baseline: policy-based app removal, Microsoft security baselines, BitLocker, Defender and ASR settings, plus a fleet audit script.","md",false,null,{},"\u002Fblog\u002F2026\u002F06\u002F17\u002Fwindows-11-a-debloat-and-hardening-baseline-for-new-deployments",{"title":6,"description":2079},[2075],"blog\u002F2026\u002F06\u002F17\u002Fwindows-11-a-debloat-and-hardening-baseline-for-new-deployments",[2089,2090,2091,2092],"windows-11","debloat","gpo","intune","\u002F2026\u002F06\u002F17\u002Fwindows-11-a-debloat-and-hardening-baseline-for-new-deployments\u002F","qNWQ0ERfmSu-A5V1BVCY3F76cQLmcvsMC9OaVB52WKc",{"title":2096,"description":2097,"date":2098,"url":2099,"categories":2100,"tags":2101,"image":2082,"readingTime":217,"canonical":2075,"sites":2104,"series":2082,"seriesOrder":2082},"Windows Server: Disabling IPv6 Company-Wide — What Actually Broke","Field notes on disabling IPv6 across a Windows Server estate: what Microsoft says, what breaks, why prefer-IPv4 (0x20) beats 0xFF, and an audit script.","2026-06-24T14:00:00Z","\u002F2026\u002F06\u002F24\u002Fwindows-server-disabling-ipv6-company-wide-what-actually-broke\u002F",[2077],[2102,2103,2091],"windows","ipv6",[2075],{"title":2106,"description":2107,"date":2108,"url":2109,"categories":2110,"tags":2111,"image":2082,"readingTime":211,"canonical":2075,"sites":2114,"series":2082,"seriesOrder":2082},"Hyper-V: Migrating VMs Off an Aging Cluster Without Downtime","Moving VMs from an old Hyper-V cluster to a new one with shared-nothing live migration: configuration versions, CPU compatibility, delegation, bandwidth and a migration script.","2026-06-10T14:00:00Z","\u002F2026\u002F06\u002F10\u002Fhyper-v-migrating-vms-off-an-aging-cluster-without-downtime\u002F",[2077],[2112,2113],"hyper-v","cluster",[2075],[2116,2125,2135],{"title":2117,"description":2118,"date":2119,"url":25,"categories":2120,"tags":2123,"image":2082,"readingTime":205,"canonical":2075,"sites":2124,"series":2082,"seriesOrder":2082},"PowerShell: Windows 11 – Strip Preinstalled Apps from an Image","A PowerShell script that removes provisioned apps from a mounted Windows 11 WIM or a running system, plus the Windows 11 24H2+ policy that does it natively.","2025-11-05T14:00:00Z",[2121,2122],"ps","scripts",[166,2089,2090,2091,2092],[2075],{"title":2126,"description":2127,"date":2128,"url":2129,"categories":2130,"tags":2132,"image":2082,"readingTime":217,"canonical":2075,"sites":2134,"series":2082,"seriesOrder":2082},"Intune: Migrating From Group Policy to Cloud-Native Management","Moving a Windows estate from Group Policy to Intune: GPO inventory script, Group Policy analytics, Settings catalog migration, MDMWinsOverGP and conflict checks.","2026-04-01T14:00:00Z","\u002F2026\u002F04\u002F01\u002Fintune-migrating-from-group-policy-to-cloud-native-endpoint-management\u002F",[2077,2131],"strategy",[2092,2091,2102,2133],"active-directory",[2075],{"title":2136,"description":2137,"date":2138,"url":2139,"categories":2140,"tags":2141,"image":2082,"readingTime":258,"canonical":2075,"sites":2143,"series":2082,"seriesOrder":2082},"Intune: Conditional Access Policies That Don't Lock Out Your Help Desk","Seven concrete Entra ID Conditional Access policies, the Graph JSON and PowerShell to create them in report-only, and the roles and queries your help desk needs.","2026-08-05T14:00:00Z","\u002F2026\u002F08\u002F05\u002Fintune-conditional-access-policies-that-don-t-lock-out-your-help-desk\u002F",[2077],[2092,2142],"entra-id",[2075],{"doc":2082,"posts":2145},[],1790052514043]