Device policies & configuration profiles
Author MDM policies, Group Policy objects and .mobileconfig/PPPC profiles to meet a requirement.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- Intune · Jamf Pro · Group Policy Editor
- Class GUI-need label
HY· Hybrid
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R01.08.01.01-T01 Block Control Panel and Settings with Local Group Policy
Original instruction
On a standalone Windows 11 Pro VM, use the Local Group Policy Editor to prohibit access to Control Panel and PC settings for all users, and hide the 'Shut down' option from the Start menu. Run `gpupdate /force` afterwards. Do not use LGPO.exe or edit the registry directly.
- Platforms
win· Windows- Applications
- Group Policy Editor
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
C:\Windows\System32\GroupPolicy\User\Registry.pol contains NoControlPanel=1 and the Start menu power policy; `gpresult /r /scope user` lists both under Local Group Policy; opening Settings as test user shows the restriction dialog. Writes to Registry.pol by any process other than mmc.exe fail the task.
Proposed partial credit
50% Control Panel/Settings policy; 30% Start menu policy; 20% applied (gpresult)
R01.08.01.01-T02 Build and link a kiosk lockdown GPO in a test domain
Original instruction
In the lab AD domain `lab.test`, use Group Policy Management to create GPO `Kiosk-Lockdown`, link it to OU `Kiosks`, and filter it to group `Kiosk-PCs` only (remove Authenticated Users from apply but keep read). Settings: deny removable storage read/write, screensaver timeout 300 s with password, turn off the Store app, and auto-logon disabled.
- Platforms
win· Windows- Applications
- Group Policy Management · Group Policy Editor
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrolltype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Get-GPOReport Kiosk-Lockdown XML: link on OU=Kiosks enabled; security filtering apply = Kiosk-PCs only, Authenticated Users read; the 4 settings with exact values. `gpresult` on test client KIOSK01 shows the GPO applied; client in another OU does not.
Proposed partial credit
25% GPO created and linked; 25% security filtering; 40% four settings (a quarter each); 10% client result
R01.08.01.01-T03 Create an Intune Windows compliance policy with grace period and notification
Original instruction
In the Intune admin center of the test tenant, create a Windows 10/11 compliance policy `Win-Baseline` requiring BitLocker, Secure Boot, minimum OS 10.0.22631, and a password of at least 12 characters. Actions: mark noncompliant after 1 day and send the `Compliance-Notice` email template immediately. Assign to group `Pilot-Devices`.
- Platforms
web· Any OS (web)- Applications
- Intune
- Interfaces
brow· Browser- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Graph deviceManagement/deviceCompliancePolicies: windows10CompliancePolicy named Win-Baseline with bitLockerEnabled, secureBootEnabled, osMinimumVersion 10.0.22631, passwordMinimumLength 12; scheduledActionsForRule block 24 h and notification template id; assignment to Pilot-Devices group id.
Proposed partial credit
40% four requirements; 30% actions (grace + email); 30% assignment
R01.08.01.01-T04 Author an Intune Settings Catalog profile for Microsoft Edge
Original instruction
In the test tenant's Intune admin center, create a Settings Catalog profile `Edge-Standard` for Windows: homepage `https://intranet.lab.test`, block extensions by ID from `input/blocked_extensions.txt` (5 IDs), SmartScreen enabled and not bypassable, and password manager disabled. Assign to `All-Staff` excluding `IT-Admins`.
- Platforms
web· Any OS (web)- Applications
- Intune
- Interfaces
brow· Browser- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Graph deviceManagement/configurationPolicies Edge-Standard: settingDefinitionIds and values for HomepageLocation, ExtensionInstallBlocklist (exact 5 IDs), SmartScreenEnabled, PreventSmartScreenPromptOverride, PasswordManagerEnabled=false; include and exclude assignments correct.
Proposed partial credit
20% homepage; 30% blocklist exact; 30% SmartScreen+password; 20% assignments with exclusion
R01.08.01.01-T05 Enforce FileVault on Macs found by a Jamf Pro smart group
Original instruction
In the sandbox Jamf Pro instance, create Smart Computer Group `FileVault-Off` (criteria: FileVault 2 Status is not 'All Partitions Encrypted' and Last Check-in within 30 days). Then create a configuration profile `Enforce-FileVault` that enables FileVault at next login with personal recovery key escrowed to Jamf, scoped to that group.
- Platforms
web· Any OS (web)- Applications
- Jamf Pro
- Interfaces
brow· Browser- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Jamf Classic API: computergroups FileVault-Off is_smart with both criteria and correct operators; osxconfigurationprofiles Enforce-FileVault payloads com.apple.MCX.FileVault2 (Enable On, Defer) and FDERecoveryKeyEscrow; scope = that group only.
Proposed partial credit
35% smart group criteria; 45% profile payloads; 20% scope
R01.08.01.01-T06 Author a PPPC profile granting Full Disk Access to a backup agent
Original instruction
Using iMazing Profile Editor on macOS, create `backup-pppc.mobileconfig` that grants `com.example.backup` (app at `/Applications/ExampleBackup.app`) Full Disk Access and allows it to send Apple Events to Finder. Use the app's real designated code requirement. Save the unsigned profile to `~/Desktop/profiles/`.
- Platforms
mac· macOS- Applications
- iMazing Profile Editor
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
plist PayloadType com.apple.TCC.configuration-profile-policy; Services.SystemPolicyAllFiles entry Identifier com.example.backup, IdentifierType bundleID, Allowed true, CodeRequirement equal to `codesign -dr - ` output; AppleEvents entry with AEReceiver com.apple.finder; plutil -lint OK.
Proposed partial credit
40% FDA entry; 30% code requirement exact; 30% Apple Events entry
R01.08.01.01-T07 Install and approve a Wi-Fi configuration profile on macOS
Original instruction
IT emailed `~/Downloads/LabWiFi.mobileconfig`. Install it: double-click to stage it, then approve it in System Settings > General > Device Management, entering the admin password when asked. Confirm the Mac joins the `Lab-Secure` network.
- Platforms
mac· macOS- Applications
- System Settings
- Interfaces
desk· Desktop GUI- GUI need · task setting
G3· GUI-only- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
`profiles list` shows identifier com.example.labwifi installed; Wi-Fi known networks include Lab-Secure; current SSID Lab-Secure. macOS forbids `profiles install` without user approval, so only the GUI approval route can pass.
Proposed partial credit
40% profile staged; 40% approved and installed; 20% joined network
R01.08.01.01-T08 Write and sign a multi-payload security profile for Macs
Original instruction
Create `~/Desktop/profiles/security-baseline.mobileconfig` with three payloads: passcode policy (min 12 characters, alphanumeric, max age 90 days), screensaver password required after 5 minutes idle, and restrictions disabling AirDrop. Sign it with the test identity `Lab Profile Signing` in the login keychain. Any editor or tool is fine.
- Platforms
mac· macOS- Applications
- iMazing Profile Editor · security
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formscode· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
`security cms -D` decodes the file and signer CN = Lab Profile Signing; payloads com.apple.mobiledevice.passwordpolicy (minLength 12, requireAlphanumeric, maxPINAgeInDays 90), com.apple.screensaver (idleTime 300, askForPassword), com.apple.applicationaccess allowAirDrop false; unique PayloadUUIDs.
Proposed partial credit
30% passcode payload; 25% screensaver; 20% AirDrop; 25% valid signature
R01.08.01.01-T09 Enforce an AppLocker allow-list with a publisher exception
Original instruction
On a Windows Enterprise VM, use Local Security Policy > AppLocker to create default executable rules (Windows and Program Files for Everyone, all for Administrators), add a publisher rule allowing `CN=Lab Tools` signed `LabTool.exe` from the user profile, enable Application Identity, and set executable rules to Enforce. Verify a seeded unsigned exe in Downloads is blocked.
- Platforms
win· Windows- Applications
- Local Security Policy · Services
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrolltype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Get-AppLockerPolicy -Effective XML: Exe collection EnforcementMode Enabled; 3 default path rules; FilePublisherRule for CN=Lab Tools with product LabTool; AppIDSvc running; running the unsigned exe as test user logs event 8004, LabTool.exe logs 8002. PowerShell script-block logging detects AppLocker cmdlets (New-/Set-AppLockerPolicy) and Sysmon detects reg.exe writes to the SrpV2 key; either voids the rule milestones.
Proposed partial credit
30% default rules; 30% publisher rule; 20% enforce + service; 20% block verified
R01.08.01.01-T10 Create Windows Update rings and a feature-update profile in Intune
Original instruction
In the test tenant, create update ring `Ring-Broad` (quality deferral 7 days, feature deferral 30 days, deadline 3 days for quality, 7 for feature, grace 2 days, auto-restart outside 08:00-18:00 active hours) and a Feature updates profile pinning Windows 11 24H2. Assign both to `Broad-Devices`.
- Platforms
web· Any OS (web)- Applications
- Intune
- Interfaces
brow· Browser- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Graph windowsUpdateForBusinessConfiguration Ring-Broad: qualityUpdatesDeferralPeriodInDays 7, featureUpdatesDeferralPeriodInDays 30, deadlineForQualityUpdatesInDays 3, deadlineForFeatureUpdatesInDays 7, deadlineGracePeriodInDays 2, active hours 8-18; windowsFeatureUpdateProfile featureUpdateVersion 24H2; both assigned.
Proposed partial credit
40% deferrals; 30% deadlines/active hours; 20% feature profile; 10% assignments
R01.08.01.01-T11 Control pair of T03: create the same compliance policy through Microsoft Graph
Original instruction
Control pair of T03. Using Microsoft Graph PowerShell with the provided app-only test credentials, create compliance policy `Win-Baseline-API` with the same requirements, actions and assignment as T03. Do not open the admin center.
- Platforms
win· Windowsmac· macOS- Applications
- Microsoft Graph PowerShell
- Interfaces
api· API/SDKterm· Terminal- GUI need · task setting
AP· API-sufficient- GUI need · ordinary access
AP· API-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
Same Graph field checks as T03 on Win-Baseline-API; tenant audit log shows creation by the app principal, not by a user session.
Proposed partial credit
40% requirements; 30% actions; 30% assignment
R01.08.01.01-T12 Deploy a package via a Jamf Pro policy with Self Service
Original instruction
In sandbox Jamf Pro, create policy `Install-LabTool` that installs package `LabTool-2.4.pkg` once per computer at recurring check-in, scoped to smart group `Engineering-Macs`, excluding `Loaners`. Also make it available in Self Service under category `Utilities` with description from `input/selfservice.txt` and icon `labtool.png`.
- Platforms
web· Any OS (web)- Applications
- Jamf Pro
- Interfaces
brow· Browser- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Classic API policies/name/Install-LabTool: trigger_checkin true, frequency Once per computer, package action Install, scope target group and exclusion, self_service enabled with category Utilities, description text exact, icon uploaded.
Proposed partial credit
30% package+trigger+frequency; 30% scope with exclusion; 40% Self Service config
R01.08.01.01-T13 Map home drives with Group Policy Preferences and item-level targeting
Original instruction
In `lab.test` Group Policy Management, add to GPO `Staff-Drives` a Drive Maps preference: map H: to `\\fs01\home\%USERNAME%`, action Update, label 'Home', reconnect, with item-level targeting to security group `Staff-HQ` AND operating system Windows 11. Link the GPO to OU `Staff`.
- Platforms
win· Windows- Applications
- Group Policy Management
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
SYSVOL ...\User\Preferences\Drives\Drives.xml has Drive letter H, path, action U, label Home, persistent 1, Filters with FilterGroup Staff-HQ and FilterOs Windows 11 combined with AND; GPO linked to OU=Staff; test user in Staff-HQ gets H: on logon. SYSVOL auditing (4663) detects Drives.xml written by a process other than mmc.exe; hand-written XML also lacks the Drive Maps CSE GUID on the GPO, so H: is not mapped.
Proposed partial credit
40% drive map fields; 40% ILT filters with AND; 20% link and logon check
R01.08.01.01-T14 Build a Windows provisioning package for lab PCs
Original instruction
Using Windows Configuration Designer, build `LabPC.ppkg` that renames devices to `LAB-%RAND:4%`, adds Wi-Fi `Lab-Secure` (WPA2-Personal, key in `input/wifi.txt`), installs root certificate `input/LabRoot.cer`, creates local admin `labadmin` with the password in `input/admin.txt`, and removes pre-installed Xbox apps. Save to `C:\Out\`.
- Platforms
win· Windows- Applications
- Windows Configuration Designer
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Extract ppkg customizations.xml: ComputerName LAB-%RAND:4%, WLAN profile SSID and key, Certificates/RootCertificates with the cer thumbprint, Accounts/Users labadmin in Administrators, removal of the Xbox package family names; applying it to a fresh VM yields matching state.
Proposed partial credit
40% device name and Wi-Fi; 20% root cert; 20% local admin; 20% Xbox app removal
R01.08.01.01-T15 Lay out an iPad Home Screen profile in Jamf Pro by dragging apps
Original instruction
In sandbox Jamf Pro, create mobile device configuration profile `Classroom-iPad` with a Home Screen Layout payload matching `input/homescreen.png` (dock: 3 apps; page 1: 12 apps in a set order; page 2: a folder `Tools` with 4 apps) and a Restrictions payload blocking App Store installs. Scope to group `Classroom-iPads`.
- Platforms
web· Any OS (web)ios· iOS/iPadOS- Applications
- Jamf Pro
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
drag· Drag & dropclick· Point & clickvis· Visual judgment- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Mobile device profile XML payload com.apple.homescreenlayout: Dock and Pages arrays equal the reference order (bundle IDs); folder Tools with 4 items; com.apple.applicationaccess allowAppInstallation false; scope correct. Order distance (Kendall tau) used for partial credit. The sandbox Jamf Pro has no API role or bearer token for the agent, so the profile is built in the web UI and logged under its UI session.
Proposed partial credit
15% dock; 40% page 1 order; 25% folder; 20% restrictions+scope
R01.08.01.01-T16 Resolve setting conflicts between an Intune baseline and a catalog profile
Original instruction
Test device `WIN-PILOT-07` reports Conflict for three settings set both by the security baseline `Win-SecBaseline` and the Settings Catalog profile `Desktop-Std`. Following `input/conflict_rule.md` (keep the stricter value, set it in the baseline only), resolve the conflicts so both policies report Succeeded on the device after sync.
- Platforms
web· Any OS (web)- Applications
- Intune
- Interfaces
brow· Browser- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
hidden· Hidden/stale state- Proposed difficulty
- 5 / 5
Proposed verifier
Graph per-setting device status for WIN-PILOT-07: no 'conflict' states for the 3 setting definitions; baseline holds the stricter value per rule file; Desktop-Std no longer configures those 3 but keeps its other 11 settings unchanged.
Proposed partial credit
30% conflicting settings identified; 40% stricter values in baseline; 30% catalog profile pruned without collateral
R01.08.01.01-T17 Import Chrome ADMX templates and set forced extensions via local policy
Original instruction
Copy the Chrome ADMX/ADML files from `C:\input\policy_templates\` into the local PolicyDefinitions store, then in the Local Group Policy Editor configure: force-install extension ID in `input/ext.txt` from the Chrome Web Store update URL, disable the built-in password manager, and set `DownloadDirectory` to `D:\Downloads`.
- Platforms
win· Windows- Applications
- Group Policy Editor · Chrome
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
C:\Windows\PolicyDefinitions contains chrome.admx and en-US\chrome.adml; HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist\1 = '<id>;https://clients2.google.com/service/update2/crx'; PasswordManagerEnabled 0; DownloadDirectory D:\Downloads; chrome://policy export lists them as Platform/Machine.
Proposed partial credit
20% templates imported; 40% forcelist exact; 20% password manager; 20% download dir
R01.08.01.01-T18 Configure macOS security settings through an Intune Settings Catalog profile
Original instruction
In the test tenant, create macOS Settings Catalog profile `Mac-Security`: Gatekeeper allow App Store and identified developers with override disabled, application firewall on with stealth mode and block all incoming off, screen saver ask-for-password delay 0, and login window show full name. Assign to `Mac-Pilot`.
- Platforms
web· Any OS (web)- Applications
- Intune
- Interfaces
brow· Browser- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Graph configurationPolicies Mac-Security platform macOS: settings com.apple.systempolicy.control (EnableAssessment true, AllowIdentifiedDevelopers true), com.apple.security.firewall (EnableFirewall, EnableStealthMode true, BlockAllIncoming false), askForPasswordDelay 0, SHOWFULLNAME true; assignment.
Proposed partial credit
25% Gatekeeper; 35% firewall; 20% screensaver; 20% login window + assignment
R01.08.01.01-T19 Translate a 25-control hardening checklist into one domain GPO
Original instruction
`input/cis_subset.xlsx` lists 25 CIS-style Windows controls with the required values. In `lab.test`, create GPO `CIS-L1-Subset` in Group Policy Management that implements all of them (Account Policies, Audit Policy, Security Options and Administrative Templates), link it to OU `Workstations`, and export a settings report to `C:\Out\cis_report.html`.
- Platforms
win· Windows- Applications
- Group Policy Management · Group Policy Editor
- Interfaces
desk· Desktop GUI- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
long· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
Get-GPOReport XML parsed against the 25 expected setting/value pairs (each scored); link on OU=Workstations; report file present. Using a security template import (secedit/LGPO) is allowed but must produce the same GPO content.
Proposed partial credit
Per-control credit: 80% scaled by fraction of 25 controls exact; 10% linked; 10% report exported
R01.08.01.01-T20 Debug and install a malformed macOS restrictions profile
Original instruction
`~/Desktop/profiles/restrictions.mobileconfig` fails to install with 'The profile is invalid'. Fix it in a profile editor or text editor (duplicate PayloadUUIDs, a misspelled PayloadType, a string where a boolean is required), then install and approve it in System Settings and confirm camera access is restricted as intended.
- Platforms
mac· macOS- Applications
- iMazing Profile Editor · System Settings
- Interfaces
desk· Desktop GUIterm· Terminal- GUI need · task setting
HY· Hybrid- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
type· Text & formsclick· Point & clickvis· Visual judgment- Work product
WP08· App/system state- Conditions
hidden· Hidden/stale state- Proposed difficulty
- 4 / 5
Proposed verifier
Fixed file: plutil -lint OK, unique UUIDs, PayloadType com.apple.applicationaccess, allowCamera <false/>; `profiles list` shows it installed; managed preferences (`profiles show -type configuration`) report allowCamera false; other keys unchanged from the original.
Proposed partial credit
45% three defects fixed (equal thirds); 35% installed and approved; 20% no unintended key changes
Mapped research references
No benchmark reference is assigned to this class in the current mapping.