Security Baselines: What IT Has Configured
Security Baselines: Your Device's Foundation
Security baselines are pre-configured sets of security settings that IT applies to your device. Think of them as the "building code" for your device — just as buildings must meet structural safety standards, your device must meet IT's security baseline.
What Security Baselines Include
Microsoft provides several baseline templates that IT can apply. The most common settings include:
Windows Security Baseline
| Setting | What It Does |
|---|---|
| BitLocker enabled | Encrypts your entire drive — if someone steals your laptop, they can't read your data without the key |
| Windows Defender enabled | Real-time antivirus protection is always running |
| Firewall enabled | Blocks unauthorized incoming network connections |
| SmartScreen enabled | Warns you before downloading or running potentially malicious files |
| UAC (User Account Control) | Prompts for permission before apps make system changes |
| Remote desktop restrictions | Limits who can remotely connect to your PC |
| Password complexity | Requires strong passwords or PINs |
| Screen timeout | Device locks after a period of inactivity (e.g., 5 minutes) |
Microsoft Defender for Endpoint
If your company uses Defender for Endpoint (the advanced version), additional protections include:
- Cloud-delivered protection — Threat data is sent to Microsoft's cloud for real-time analysis
- Automatic sample submission — Suspicious files are sent to Microsoft for analysis
- Attack surface reduction — Blocks risky activities like running scripts from email attachments
- Controlled folder access — Prevents unauthorized apps from modifying your files (ransomware protection)
Microsoft Edge Baseline
If IT applies the Edge baseline, your Edge browser will have:
- Site isolation — Each website runs in its own process for security
- Phishing protection — Blocks known phishing sites
- Extension restrictions — IT may block certain extensions or require pre-approval
- Sync settings — IT may control what browser data syncs to your work account
What You'll Notice
Most security baseline settings are invisible — they run in the background. But you might notice:
- Windows Security shows "Managed by your organization" — This appears when IT controls settings like Defender, firewall, and SmartScreen. It's expected.
- Screen locks quickly — If you walk away from your PC, it might lock after 5 minutes instead of 15. This is a security measure.
- Can't disable antivirus — Microsoft Defender settings are greyed out. You can't turn off real-time protection.
- Some websites are blocked — SmartScreen or web content filtering might block known dangerous sites.
- Can't install certain software — Attack surface reduction might block installation of untrusted software.
Why These Settings Matter
Security baselines aren't just about IT being controlling — they protect you and the company:
| Threat | How Baselines Prevent It |
|---|---|
| Ransomware | Controlled folder access + Defender real-time scanning |
| Phishing | SmartScreen + Edge phishing protection |
| Data theft from lost device | BitLocker encryption + screen lock |
| Malware infection | Defender + attack surface reduction + firewall |
| Unauthorized access | Password complexity + UAC + screen timeout |
What You Can't Change (And Why)
When a security baseline is applied, certain settings become locked:
- Turning off BitLocker — Your data needs to be encrypted at all times
- Disabling Windows Defender — Real-time protection must always run
- Disabling the firewall — Network protection is mandatory
- Changing UAC level to "Never notify" — System changes need approval
- Extending screen timeout beyond IT's limit — Devices must auto-lock for security
If you try to change one of these settings, it will either be greyed out or will revert after the next Intune sync.
What You CAN Still Change
Security baselines don't lock everything. You still control:
- Wallpaper, themes, and desktop appearance
- Browser bookmarks and personal settings
- Personal app installation (unless IT has app restrictions)
- Display brightness, sound settings, and notifications
- Personal files and folders
Beawit Consulting implements Microsoft security baselines and Defender for Endpoint for small-to-medium businesses. Contact us for security configuration and threat protection.
Next, we'll cover what to do when things go wrong on your managed device.
There are no comments for now.