Maester 
MP.JL.CISW11INT.L1.239 Deny Remote Desktop Services Log On includes *S-1-5-32-546, *S-1-5-113
Description
CIS Microsoft Intune for Windows 11 Benchmark, recommendation 90.17 (Level 1).
The test passes when an assigned settings catalog policy for Windows sets User Rights > Deny Remote Desktop Services Log On to a list that includes *S-1-5-32-546, *S-1-5-113, and no other assigned policy sets it to something else.
Remediation action
- In the Microsoft Intune admin center, go to Devices > Configuration and open (or create) a settings catalog policy for Windows 10 and later.
- Add User Rights > Deny Remote Desktop Services Log On and set it to a list that includes *S-1-5-32-546, *S-1-5-113.
- Assign the policy to your Windows devices, and remove any other assigned policy that sets it to something else.
Related links
%TestResult%