mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
d3a00310d9
Apple Intelligence policy-profile alignment (HIGH): - Fix 3/4 policy queries that checked fabricated MDM keys which would never match the corrected profiles: - extensions: allowIntelligenceExtensions -> allowExternalIntelligenceIntegrations - mail: com.apple.mail/allowMailIntelligence -> com.apple.applicationaccess/allowMailSummary - notes: com.apple.mobilenotes/allowNotesIntelligence -> com.apple.applicationaccess/allowNotesTranscriptionSummary - Update resolution text to reference correct keys and domains - Fix Title Case in policy names (MDM Required, not MDM required) Spelling fixes across all macOS and Windows YAML (14 corrections): - existance -> existence, Extention -> Extension, recomendation -> recommendation, bellow -> below, enableds -> enables, addess -> address - Missing spaces: SelectGeneral, SelectSharing, OpenSystemSettings - Grammar: "is not Activate" -> "is not Active" - Doubled word: "Computer Computer Configuration" - Missing space: "thatis" -> "that is" Naming consistency: - Rename 2.8.1.disable/enable -> 2.8.1-disable/enable (match dash convention used by all other suffixed profiles) - Fix win-10 local-security-options.xml header: Section 2.3.1 -> 2.3 - Add CIS control numbers to win-11-intune local-security-options.xml comments (was missing, unlike all other XML files) - Fix win-10/win-11 PS1: add S-1-5-113 (Local account) to CIS 2.2.16 and 2.2.20 deny entries to match XML profiles https://claude.ai/code/session_01DUqJK6iJ8MWMdz2d25ZTNW
57 lines
1.7 KiB
XML
57 lines
1.7 KiB
XML
<!-- CIS Windows 11 Enterprise v4.0.0 – Local Security Options (Section 2.3) -->
|
||
<Replace>
|
||
<!-- 2.3.1.1: Accounts – Administrator account status = Disabled -->
|
||
<Item>
|
||
<Meta>
|
||
<Format xmlns="syncml:metinf">int</Format>
|
||
</Meta>
|
||
<Target>
|
||
<LocURI>./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus</LocURI>
|
||
</Target>
|
||
<Data>0</Data>
|
||
</Item>
|
||
</Replace>
|
||
<Replace>
|
||
<!-- 2.3.1.3: Accounts – Guest account status = Disabled -->
|
||
<Item>
|
||
<Meta>
|
||
<Format xmlns="syncml:metinf">int</Format>
|
||
</Meta>
|
||
<Target>
|
||
<LocURI>./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus</LocURI>
|
||
</Target>
|
||
<Data>0</Data>
|
||
</Item>
|
||
</Replace>
|
||
<Replace>
|
||
<!--
|
||
2.3.1.5: Accounts – Rename administrator account
|
||
Change "AdminAcct" to your organization's preferred name.
|
||
Must NOT be "Administrator" to satisfy CIS requirements.
|
||
-->
|
||
<Item>
|
||
<Meta>
|
||
<Format xmlns="syncml:metinf">chr</Format>
|
||
</Meta>
|
||
<Target>
|
||
<LocURI>./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount</LocURI>
|
||
</Target>
|
||
<Data>AdminAcct</Data>
|
||
</Item>
|
||
</Replace>
|
||
<Replace>
|
||
<!--
|
||
2.3.1.6: Accounts – Rename guest account
|
||
Change "GuestAcct" to your organization's preferred name.
|
||
Must NOT be "Guest" to satisfy CIS requirements.
|
||
-->
|
||
<Item>
|
||
<Meta>
|
||
<Format xmlns="syncml:metinf">chr</Format>
|
||
</Meta>
|
||
<Target>
|
||
<LocURI>./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount</LocURI>
|
||
</Target>
|
||
<Data>GuestAcct</Data>
|
||
</Item>
|
||
</Replace>
|