Maester Packs
LowScript packFree

CIS Windows 11 Intune BL

Checks that Intune policies configure the BL recommendations of the CIS Microsoft Intune for Windows 11 Benchmark v5.0.0. One test per setting.

Version
0.1.0
Tests
28
Connectors
0
Published
7 Nov 2026

Pacers31Colts18 · pacers31colts18.cis-win11-intune-bl · 0 stars · Open source · MIT

PowerShell 
Install-MtPack Pacers31Colts18/maester-packs-joeloveless/cis-win11-intune-bl

Install only packs from sources you trust. This pack is made by Pacers31Colts18, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/Pacers31Colts18/maester-packs-joeloveless.

maester-packs.lock.json entry 
{  "Id": "pacers31colts18.cis-win11-intune-bl",  "Source": "Pacers31Colts18/maester-packs-joeloveless/cis-win11-intune-bl",  "Version": "0.1.0",  "Commit": "e9f51edda94c14f105b9079db5525af8814a7118",  "Digest": "sha256:387782b51ae780544ebf49e31018668537fe168c502c98e1580edd01ffcc11ce"}
IDTitleSeverityProduct
MP.JL.CISW11INT.BL.001 Require Device Encryption is set to Enabled High Intune
MP.JL.CISW11INT.BL.002 Allow Warning For Other Disk Encryption is set to Disabled Medium Intune
MP.JL.CISW11INT.BL.003 Allow Warning For Other Disk Encryption: Allow Standard User Encryption is set to Disabled: Enabled Medium Intune
MP.JL.CISW11INT.BL.004 Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for operating system drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bit High Intune
MP.JL.CISW11INT.BL.005 Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for fixed data drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bit High Intune
MP.JL.CISW11INT.BL.006 Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for removable data drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bit High Intune
MP.JL.CISW11INT.BL.007 Prevent installation of devices using drivers that match these device setup classes is set to Enabled Medium Intune
MP.JL.CISW11INT.BL.008 Prevent installation of devices using drivers that match these device setup classes: Also apply to matching devices that are already installed. is set to Enabled: TRUE Medium Intune
MP.JL.CISW11INT.BL.009 Prevent installation of devices using drivers that match these device setup classes: Prevented Classes is set to Enabled: {d48179be-ec20-11d1-b6b8-00c04fa372a7}, {7ebefbc0-3200-11d2-b4c2-00a0C9697d07… Medium Intune
MP.JL.CISW11INT.BL.010 Choose how BitLocker-protected fixed drives can be recovered is set to Enabled Medium Intune
MP.JL.CISW11INT.BL.011 Choose how BitLocker-protected fixed drives can be recovered: Configure user storage of BitLocker recovery information is set to Enabled: Allow 48-digit recovery password Medium Intune
MP.JL.CISW11INT.BL.012 Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives is set to Enabled: FALSE Medium Intune
MP.JL.CISW11INT.BL.013 Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent is set to Enabled: TRUE Medium Intune
MP.JL.CISW11INT.BL.014 Choose how BitLocker-protected fixed drives can be recovered: FDVRecoveryKeyUsageDropDown_Name is set to Enabled: Allow 256-bit recovery key Medium Intune
MP.JL.CISW11INT.BL.015 Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS is set to Enabled: Backup recovery passwords only Medium Intune
MP.JL.CISW11INT.BL.016 Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard is set to Enabled: TRUE Medium Intune
MP.JL.CISW11INT.BL.017 Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives is set to Enabled: FALSE Medium Intune
MP.JL.CISW11INT.BL.018 Choose how BitLocker-protected operating system drives can be recovered is set to Enabled Medium Intune
MP.JL.CISW11INT.BL.019 Choose how BitLocker-protected operating system drives can be recovered: OSRecoveryKeyUsageDropDown_Name is set to Enabled: Do not allow 256-bit recovery key Medium Intune
MP.JL.CISW11INT.BL.020 Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS is set to Enabled: Store recovery passwords and key packages Medium Intune
MP.JL.CISW11INT.BL.021 Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard is set to Enabled: TRUE Medium Intune
MP.JL.CISW11INT.BL.022 Choose how BitLocker-protected operating system drives can be recovered: Configure user storage of BitLocker recovery information is set to Enabled: Require 48-digit recovery password Medium Intune
MP.JL.CISW11INT.BL.023 Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent is set to Enabled: FALSE Medium Intune
MP.JL.CISW11INT.BL.024 Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives is set to Enabled: TRUE Medium Intune
MP.JL.CISW11INT.BL.025 Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives is set to Enabled: TRUE High Intune
MP.JL.CISW11INT.BL.026 Enforce drive encryption type on operating system drives: Select the encryption type is set to Enabled: Full encryption or Used Space Only encryption High Intune
MP.JL.CISW11INT.BL.027 Deny write access to removable drives not protected by BitLocker is set to Enabled Medium Intune
MP.JL.CISW11INT.BL.028 Deny write access to removable drives not protected by BitLocker: Do not allow write access to devices configured in another organization is set to Enabled: FALSE Medium Intune