# Windows - A security baseline is configured and assigned
Without properly configured and assigned Intune security baselines for Windows, devices remain vulnerable to a wide array of attack vectors that threat…
Source: https://maester.dev/docs/tests/ZTA.24573
## Overview
Without properly configured and assigned Intune security baselines for Windows, devices remain vulnerable to a wide array of attack vectors that threat actors exploit to gain persistence and escalate privileges. Adversaries leverage default Windows configurations that lack hardened security settings to perform lateral movement using techniques like credential dumping, privilege escalation via unpatched vulnerabilities, and exploitation of weak authentication mechanisms. In the absence of enforced security baselines, threat actors can bypass critical security controls, maintain persistence through registry modifications, and exfiltrate sensitive data through unmonitored channels. Failing to implement a defense-in-depth strategy makes devices easier to exploit as attackers progress through the attack chain—from initial access to data exfiltration—ultimately compromising the organization’s security posture and increasing the risk of compliance violations.
Applying security baselines ensures Windows devices are configured with hardened settings, reducing attack surface, enforcing defense-in-depth, and supporting Zero Trust by standardizing security controls across the environment.
## Remediation
Configure and assign Intune security baselines to Windows devices to enforce standardized security settings and monitor compliance:
- [Deploy security baselines to help secure Windows devices](https://learn.microsoft.com/intune/device-security/security-baselines/configure-baselines?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-a-profile-for-a-security-baseline)
- [Monitor security baseline compliance](https://learn.microsoft.com/intune/device-security/security-baselines/monitor-baselines?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | High |
| Impact on users | Low |
| Pillar | Devices |
| Category | Device management |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Endpoint security |
| Area | Devices and endpoints |
| ATT&CK | [T1003](/docs/tests?mitre=T1003) OS Credential Dumping, [T1068](/docs/tests?mitre=T1068) Exploitation for Privilege Escalation |
| Licence | Intune |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.