Windows 11 Security Baseline: What It Is and How to Deploy It

The Windows 11 security baseline is Microsoft’s own set of recommended configuration settings for hardening Windows 11 devices, published with an explanation of the security impact of each one. You download it free from the Microsoft Security Compliance Toolkit and apply it through Group Policy or Microsoft Intune. Applied without testing, it can break line-of-business software. Applied through a pilot, it is one of the fastest ways to raise the floor on every endpoint you manage.

This guide explains what the baseline contains, what changed in recent releases, how it differs from a CIS Benchmark, and how a small or mid-sized Canadian organization can roll it out safely.

TL;DR

• A security baseline is a group of Microsoft-recommended settings, built from feedback by Microsoft security engineering teams, product groups, partners and customers.
• Download the current package from the Security Compliance Toolkit page, then deploy it with Group Policy (GPO backups) or Intune (Endpoint security > Security baselines).
• Never push it to every device at once: Intune applies a profile to its assigned group immediately, so pilot on a small test group first.
• The baseline is a technical control, not a compliance certificate. Privacy and security duties in Canada still call for risk assessments, access reviews, MFA and tested backups.
• If you do not have an in-house administrator, a managed IT provider can run the pilot, exceptions and ongoing drift checks for you.

Table of Contents

• What the Windows 11 security baseline is
• Which settings it recommends and what risks they address
• Where to download the current baseline
• Deploying the baseline with Group Policy or Intune
• Microsoft baseline versus CIS Benchmark
• What the baseline does and does not do for compliance
• Keeping the baseline working after rollout
• Let us run it for you
• FAQ
• Sources

What the Windows 11 security baseline is

Microsoft describes a security baseline as a group of recommended configuration settings that also explains the security implications of each one. The settings come from feedback by Microsoft security engineering teams, product groups, partners and customers.

Two design decisions matter for a small business:

• The target is a well-managed, security-conscious organization in which standard users do not have administrator rights. If your staff still run as local admins, fixing that comes before the baseline.
• A setting is enforced only when it mitigates a contemporary threat without creating worse operational risk. That is why some presets are set to audit rather than block, and why Microsoft expects you to review each one.

In practice the baseline is a bundle of Group Policy settings covering things such as password and account policy, user rights assignments, Microsoft Defender Antivirus, attack surface reduction rules, legacy protocol exposure, credential protection and auditing. It is not a product you install. It is a configuration you apply, and you own the exceptions.

Which settings it recommends and what risks they address

The clearest way to see what the baseline does is to read what changed in a recent release. In the Windows 11, version 25H2 baseline announcement, Microsoft listed these changes:

Two patterns stand out. First, Microsoft keeps retiring legacy exposure (NetBIOS, NTLM, Internet Explorer components) that attackers use to move between machines once they have one foothold. Second, it ships new detections in audit mode first. That is the baseline’s philosophy in miniature: observe, then enforce.

The settings fall into a handful of risk themes:

1. Credential theft and reuse. Settings around authentication protocols and credential protection make captured hashes less useful. If an attacker obtains credential material from a workstation, weak protocol settings let them replay or crack it offline. Tightening these settings is about not leaving the keys on the table.
2. Lateral movement. Blocking or auditing PSExec and WMI-launched processes, and disabling NetBIOS, narrows the paths from one compromised endpoint to the next.
3. Malware and script execution. Microsoft Defender Antivirus and attack surface reduction rules are configured to blunt common delivery techniques.
4. Detection and forensics. Command-line logging and NTLM auditing do not stop an attack, but they decide whether you can reconstruct one.

Where to download the current baseline

Baselines are distributed through the Microsoft Security Compliance Toolkit download page, where the Windows 11 package is listed as a small zip file (about 1.3 MB). The package contains documentation, GPO backups and the supporting spreadsheets. Microsoft publishes a new Windows 11 baseline alongside each feature release, so always confirm on that page that you are pulling the version that matches the build your devices run, and read the change summary before you import anything.

The same toolkit includes the tools you need to work with the package. According to Microsoft’s Security Compliance Toolkit guide, you can compare your current GPOs against the Microsoft baselines, edit them, store the settings in GPO-backup format, and apply them through Active Directory or local policy.

Deploying the baseline with Group Policy or Intune

Which route you take depends on where your devices are managed. Domain-joined machines usually take Group Policy. Cloud-managed fleets, which describes most small Canadian offices running Microsoft 365, usually take Intune.

Group Policy path

1. Download and extract the package for your Windows 11 version.
2. Use Policy Analyzer from the toolkit to compare the baseline with your existing GPOs. This shows where you already differ and where a new setting would collide with something you set deliberately.
3. Import the baseline GPO backup into a test organizational unit, not the root of the domain.
4. Link it to a small group of pilot devices and watch for failures.
5. Document every setting you change from the preset, with the business reason.
6. Widen the scope in rings once the pilot is quiet.

Intune path

Microsoft’s instructions for configuring security baseline policies in Intune run as follows: open Endpoint security > Security baselines, select the baseline, choose Create policy, review the settings, configure scope tags, assign user or device groups, review, and select Create.

The warning that matters is in the same guidance: Intune applies the created profile to its assigned group immediately. Microsoft recommends reviewing each preset and changing it where your business requirements justify a different configuration. Do not assign a new profile to “All devices” on the first try.

Pilot first, in isolation

Microsoft’s cloud-native endpoint guidance says to test baselines first on a selective group of test endpoints, in isolation and without other configuration profiles, because settings can conflict with applications and services. Isolation is what lets you attribute a failure to the baseline rather than to some other policy.

A workable pilot for a 20 to 100 seat office looks like this:

• Ring 0: two or three IT-owned devices for the first week.
• Ring 1: one volunteer per department, including the person who uses the oldest software (the accounting package, the practice management system, the label printer).
• Ring 2: everyone else, in waves, after Ring 1 has run through a full month-end or billing cycle.

If you are standing up this process for the first time, our Intune pilot-first playbook walks through the ring structure in more detail.

Where baselines usually break things

The same few categories cause most pilot tickets:

• Older line-of-business applications that depend on NTLM, NetBIOS or legacy authentication.
• Scripts and macros that call Internet Explorer components.
• Scanners and multifunction printers that use legacy SMB or authentication settings.
• Remote access tools. If you manage remote desktop, review our guide to deploying secure remote desktop before tightening related policies, so that you do not lock administrators out.

When a preset conflicts with a real business need, the answer is a documented exception for a defined group, not abandoning the baseline. Weigh each exception as threat mitigation against operational cost, and revisit it whenever the application is updated.

Microsoft baseline versus CIS Benchmark

The two are often confused because both are “hardening guides”. CIS describes its Windows desktop benchmarks as secure-configuration guidelines developed through a community consensus process, and it lists Windows 11 Enterprise releases separately. Microsoft’s baseline, by contrast, is authored by Microsoft and comes with deployable GPO backups and tooling in the Security Compliance Toolkit.

In practice:

• Microsoft baseline: the natural starting point for a Microsoft 365 and Intune shop, with first-party tooling and a change summary on each release.
• CIS Benchmark: a consensus-developed reference many auditors and insurers recognize, often used where a customer or regulator asks for an independent standard.

They overlap heavily and you can use one as a cross-check on the other. For a closer look at Windows secure-configuration benchmarks set beside Microsoft baselines, that page gives a short orientation. Whichever you choose, pick one as your primary standard so exceptions are tracked against a single reference.

What the baseline does and does not do for compliance

A baseline hardens the operating system. It does not, on its own, make an organization compliant with a privacy law or a healthcare regulation.

On the US side, HHS states that the HIPAA Security Rule does not specify minimum operating system requirements for personal computers. Safeguards apply to systems containing electronic protected health information, and known operating-system vulnerabilities belong in your risk analysis. HIPAA is a US law, so it matters to Canadian providers only where they handle US patient data or serve US-regulated clients.

In Canada, the picture is made of other obligations. The healthcare cybersecurity standard CAN/DGSI 118:2023 says organizations shall conduct a cybersecurity risk assessment, document data flows for personal health information, restrict administrator privileges to what is required, implement MFA or document exceptions, and protect sensitive data with encryption. A baseline contributes directly to some of those (privilege restriction, encryption settings, logging), but MFA, risk assessment and data-flow documentation sit outside it.

In British Columbia, a Doctors of BC security guide notes that physician offices are subject to PIPA, and that section 34 requires reasonable security arrangements against unauthorized access, use, disclosure and similar risks. A documented, tested configuration baseline is a sensible part of showing reasonable arrangements. For legal conclusions about your own obligations, speak to your privacy officer or counsel.

How we approach baselines at 247Techify

We treat the security baseline as the starting line for endpoint hardening, never the finish. Our approach is cybersecurity-first: the baseline sets a defensible configuration, threat monitoring tells you whether it is holding, and incident response covers the day it is not.

The failure we see most often is not a missing baseline. It is a baseline pushed to every device on a Friday afternoon, followed by a Monday of locked-out staff and a quiet rollback. That is why our process is pilot first, exceptions documented, drift checked. A hardened Windows 11 fleet that people can still work on is the only kind that stays hardened.

For regulated clients in healthcare and finance, we map baseline settings into the wider evidence a risk assessment needs: admin rights, MFA, encryption and backups that have actually been restored. Our technicians are Microsoft-certified, our support is live 24/7, and we aim for an average response time under 30 minutes, so a policy conflict on a clinic workstation is handled the same hour, not the same week.

247techify Team

Keeping the baseline working after rollout

Deployment is a one-time project. Staying aligned is a recurring task, and it is where most small organizations drift.

• Review every new release. When Microsoft publishes a baseline for a new Windows 11 version, read the change summary and compare it with what you run. Pilot the delta the same way you piloted the original.
• Move audit rules to enforcement deliberately. A rule set to Audit, such as the PSExec and WMI rule above, is a prompt to review logs for a few weeks, then decide whether to enforce.
• Keep the exceptions register current. Each exception should have an owner, a reason and a review date.
• Pair it with patching. Configuration hardening does not replace updates. Our note on what a record-sized Patch Tuesday means for IT teams shows how quickly the update workload can spike.
• Back up before you change policy at scale. A tested restore is cheaper than a rebuild. See our backup and disaster recovery service.
• Extend the same discipline to Microsoft 365. Endpoint hardening is only part of the picture, and our guides on securing Microsoft Copilot and SharePoint security cover the data layer.

Let us run it for you

If you do not have a dedicated administrator, baseline rollout is the kind of work that slips behind daily tickets. 247Techify provides managed IT with a cybersecurity-first approach for Canadian businesses: endpoint protection, device management, Microsoft 365 management, threat monitoring and incident response, with 24/7 helpdesk support. Business managed IT plans are published at $1,099 to $2,499 CAD per month on our GTA managed IT price index, and our cybersecurity services include Managed Detection & Response and penetration testing.

If your offices are in the Toronto area, see our managed IT services in Toronto, or start from the 247Techify home page and tell us what you run today.

FAQ

Is the Windows 11 security baseline free?

Yes. Microsoft distributes the baseline packages through the Security Compliance Toolkit download page, and the Intune baseline profiles are part of the Endpoint security area of the admin center. The cost is the staff time to pilot, document exceptions and maintain it. Intune itself requires an appropriate Microsoft licence.

Will the baseline break my applications?

It can, which is why Microsoft advises testing on a selective group of devices in isolation, because settings can conflict with applications and services. Legacy authentication, old scripts and older printers are the usual suspects. Review each preset, document an exception where the business needs one, and widen the rollout in rings.

Do I need Group Policy or Intune?

Use Group Policy if your devices are domain-joined and managed through Active Directory. Use Intune if they are cloud-managed. Microsoft provides the baseline for both: GPO backups in the toolkit and a ready-made baseline profile in Intune.

Does the baseline make us HIPAA or PIPA compliant?

No single configuration does. HHS says HIPAA does not set minimum operating system requirements and expects risk analysis to consider known vulnerabilities. Canadian healthcare guidance also calls for risk assessments, MFA, access reviews and tested backups, so treat the baseline as one control inside a wider program.

Sources

• Security baselines guide, Microsoft Learn
• Windows 11, version 25H2 security baseline, Microsoft Tech Community
• Microsoft Security Compliance Toolkit download
• Microsoft Security Compliance Toolkit guide, Microsoft Learn
• Configure security baseline policies in Microsoft Intune
• Set up cloud-native Windows endpoints with Intune
• CIS Microsoft Windows Desktop Benchmarks
• HHS: Does the Security Rule mandate minimum operating system requirements?
• CAN/DGSI 118:2023 Cyber resiliency in healthcare
• Doctors of BC: Physician Office IT security guide

Recommended

• 7 Step Deployment to Secure Remote Desktop for Admins Without Lockouts
• Application Whitelisting Policy: How to Write One That Holds
• Network Security Checklist for Small Business: 2026 Guide
• Stop Ransomware: Upgrade the 3-2-1 Backup Rule to 3-2-1-1-0