R01.08.01.01 · 任务小类

设备策略与配置描述文件

Device policies & configuration profiles

Author MDM policies, Group Policy objects and .mobileconfig/PPPC profiles to meet a requirement.

20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。

典型应用: Intune · Jamf Pro · Group Policy Editor
小类 GUI 需求标签: HY · 混合

任务提案 · 20

展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。

R01.08.01.01-T01 Block Control Panel and Settings with Local Group Policy

原始指令

On a standalone Windows 11 Pro VM, use the Local Group Policy Editor to prohibit access to Control Panel and PC settings for all users, and hide the 'Shut down' option from the Start menu. Run `gpupdate /force` afterwards. Do not use LGPO.exe or edit the registry directly.

平台: win · Windows
应用: Group Policy Editor
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

C:\Windows\System32\GroupPolicy\User\Registry.pol contains NoControlPanel=1 and the Start menu power policy; `gpresult /r /scope user` lists both under Local Group Policy; opening Settings as test user shows the restriction dialog. Writes to Registry.pol by any process other than mmc.exe fail the task.

建议部分得分

50% Control Panel/Settings policy; 30% Start menu policy; 20% applied (gpresult)

R01.08.01.01-T02 Build and link a kiosk lockdown GPO in a test domain

原始指令

In the lab AD domain `lab.test`, use Group Policy Management to create GPO `Kiosk-Lockdown`, link it to OU `Kiosks`, and filter it to group `Kiosk-PCs` only (remove Authenticated Users from apply but keep read). Settings: deny removable storage read/write, screensaver timeout 300 s with password, turn off the Store app, and auto-logon disabled.

平台: win · Windows
应用: Group Policy Management · Group Policy Editor
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Get-GPOReport Kiosk-Lockdown XML: link on OU=Kiosks enabled; security filtering apply = Kiosk-PCs only, Authenticated Users read; the 4 settings with exact values. `gpresult` on test client KIOSK01 shows the GPO applied; client in another OU does not.

建议部分得分

25% GPO created and linked; 25% security filtering; 40% four settings (a quarter each); 10% client result

R01.08.01.01-T03 Create an Intune Windows compliance policy with grace period and notification

原始指令

In the Intune admin center of the test tenant, create a Windows 10/11 compliance policy `Win-Baseline` requiring BitLocker, Secure Boot, minimum OS 10.0.22631, and a password of at least 12 characters. Actions: mark noncompliant after 1 day and send the `Compliance-Notice` email template immediately. Assign to group `Pilot-Devices`.

平台: web · 任意系统（网页）
应用: Intune
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Graph deviceManagement/deviceCompliancePolicies: windows10CompliancePolicy named Win-Baseline with bitLockerEnabled, secureBootEnabled, osMinimumVersion 10.0.22631, passwordMinimumLength 12; scheduledActionsForRule block 24 h and notification template id; assignment to Pilot-Devices group id.

建议部分得分

40% four requirements; 30% actions (grace + email); 30% assignment

R01.08.01.01-T04 Author an Intune Settings Catalog profile for Microsoft Edge

原始指令

In the test tenant's Intune admin center, create a Settings Catalog profile `Edge-Standard` for Windows: homepage `https://intranet.lab.test`, block extensions by ID from `input/blocked_extensions.txt` (5 IDs), SmartScreen enabled and not bypassable, and password manager disabled. Assign to `All-Staff` excluding `IT-Admins`.

平台: web · 任意系统（网页）
应用: Intune
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Graph deviceManagement/configurationPolicies Edge-Standard: settingDefinitionIds and values for HomepageLocation, ExtensionInstallBlocklist (exact 5 IDs), SmartScreenEnabled, PreventSmartScreenPromptOverride, PasswordManagerEnabled=false; include and exclude assignments correct.

建议部分得分

20% homepage; 30% blocklist exact; 30% SmartScreen+password; 20% assignments with exclusion

R01.08.01.01-T05 Enforce FileVault on Macs found by a Jamf Pro smart group

原始指令

In the sandbox Jamf Pro instance, create Smart Computer Group `FileVault-Off` (criteria: FileVault 2 Status is not 'All Partitions Encrypted' and Last Check-in within 30 days). Then create a configuration profile `Enforce-FileVault` that enables FileVault at next login with personal recovery key escrowed to Jamf, scoped to that group.

平台: web · 任意系统（网页）
应用: Jamf Pro
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Jamf Classic API: computergroups FileVault-Off is_smart with both criteria and correct operators; osxconfigurationprofiles Enforce-FileVault payloads com.apple.MCX.FileVault2 (Enable On, Defer) and FDERecoveryKeyEscrow; scope = that group only.

建议部分得分

35% smart group criteria; 45% profile payloads; 20% scope

R01.08.01.01-T06 Author a PPPC profile granting Full Disk Access to a backup agent

原始指令

Using iMazing Profile Editor on macOS, create `backup-pppc.mobileconfig` that grants `com.example.backup` (app at `/Applications/ExampleBackup.app`) Full Disk Access and allows it to send Apple Events to Finder. Use the app's real designated code requirement. Save the unsigned profile to `~/Desktop/profiles/`.

平台: mac · macOS
应用: iMazing Profile Editor
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

plist PayloadType com.apple.TCC.configuration-profile-policy; Services.SystemPolicyAllFiles entry Identifier com.example.backup, IdentifierType bundleID, Allowed true, CodeRequirement equal to `codesign -dr - ` output; AppleEvents entry with AEReceiver com.apple.finder; plutil -lint OK.

建议部分得分

40% FDA entry; 30% code requirement exact; 30% Apple Events entry

R01.08.01.01-T07 Install and approve a Wi-Fi configuration profile on macOS

原始指令

IT emailed `~/Downloads/LabWiFi.mobileconfig`. Install it: double-click to stage it, then approve it in System Settings > General > Device Management, entering the admin password when asked. Confirm the Mac joins the `Lab-Secure` network.

平台: mac · macOS
应用: System Settings
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G3 · 仅 GUI
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

`profiles list` shows identifier com.example.labwifi installed; Wi-Fi known networks include Lab-Secure; current SSID Lab-Secure. macOS forbids `profiles install` without user approval, so only the GUI approval route can pass.

建议部分得分

40% profile staged; 40% approved and installed; 20% joined network

R01.08.01.01-T08 Write and sign a multi-payload security profile for Macs

原始指令

Create `~/Desktop/profiles/security-baseline.mobileconfig` with three payloads: passcode policy (min 12 characters, alphanumeric, max age 90 days), screensaver password required after 5 minutes idle, and restrictions disabling AirDrop. Sign it with the test identity `Lab Profile Signing` in the login keychain. Any editor or tool is fine.

平台: mac · macOS
应用: iMazing Profile Editor · security
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

`security cms -D` decodes the file and signer CN = Lab Profile Signing; payloads com.apple.mobiledevice.passwordpolicy (minLength 12, requireAlphanumeric, maxPINAgeInDays 90), com.apple.screensaver (idleTime 300, askForPassword), com.apple.applicationaccess allowAirDrop false; unique PayloadUUIDs.

建议部分得分

30% passcode payload; 25% screensaver; 20% AirDrop; 25% valid signature

R01.08.01.01-T09 Enforce an AppLocker allow-list with a publisher exception

原始指令

On a Windows Enterprise VM, use Local Security Policy > AppLocker to create default executable rules (Windows and Program Files for Everyone, all for Administrators), add a publisher rule allowing `CN=Lab Tools` signed `LabTool.exe` from the user profile, enable Application Identity, and set executable rules to Enforce. Verify a seeded unsigned exe in Downloads is blocked.

平台: win · Windows
应用: Local Security Policy · Services
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Get-AppLockerPolicy -Effective XML: Exe collection EnforcementMode Enabled; 3 default path rules; FilePublisherRule for CN=Lab Tools with product LabTool; AppIDSvc running; running the unsigned exe as test user logs event 8004, LabTool.exe logs 8002. PowerShell script-block logging detects AppLocker cmdlets (New-/Set-AppLockerPolicy) and Sysmon detects reg.exe writes to the SrpV2 key; either voids the rule milestones.

建议部分得分

30% default rules; 30% publisher rule; 20% enforce + service; 20% block verified

R01.08.01.01-T10 Create Windows Update rings and a feature-update profile in Intune

原始指令

In the test tenant, create update ring `Ring-Broad` (quality deferral 7 days, feature deferral 30 days, deadline 3 days for quality, 7 for feature, grace 2 days, auto-restart outside 08:00-18:00 active hours) and a Feature updates profile pinning Windows 11 24H2. Assign both to `Broad-Devices`.

平台: web · 任意系统（网页）
应用: Intune
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Graph windowsUpdateForBusinessConfiguration Ring-Broad: qualityUpdatesDeferralPeriodInDays 7, featureUpdatesDeferralPeriodInDays 30, deadlineForQualityUpdatesInDays 3, deadlineForFeatureUpdatesInDays 7, deadlineGracePeriodInDays 2, active hours 8-18; windowsFeatureUpdateProfile featureUpdateVersion 24H2; both assigned.

建议部分得分

40% deferrals; 30% deadlines/active hours; 20% feature profile; 10% assignments

R01.08.01.01-T11 Control pair of T03: create the same compliance policy through Microsoft Graph

原始指令

Control pair of T03. Using Microsoft Graph PowerShell with the provided app-only test credentials, create compliance policy `Win-Baseline-API` with the same requirements, actions and assignment as T03. Do not open the admin center.

平台: win · Windows mac · macOS
应用: Microsoft Graph PowerShell
交互表面: api · API / SDK term · 终端
GUI 需求 · 任务设定: AP · API 足够
GUI 需求 · 普通权限: AP · API 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

Same Graph field checks as T03 on Win-Baseline-API; tenant audit log shows creation by the app principal, not by a user session.

建议部分得分

40% requirements; 30% actions; 30% assignment

R01.08.01.01-T12 Deploy a package via a Jamf Pro policy with Self Service

原始指令

In sandbox Jamf Pro, create policy `Install-LabTool` that installs package `LabTool-2.4.pkg` once per computer at recurring check-in, scoped to smart group `Engineering-Macs`, excluding `Loaners`. Also make it available in Self Service under category `Utilities` with description from `input/selfservice.txt` and icon `labtool.png`.

平台: web · 任意系统（网页）
应用: Jamf Pro
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Classic API policies/name/Install-LabTool: trigger_checkin true, frequency Once per computer, package action Install, scope target group and exclusion, self_service enabled with category Utilities, description text exact, icon uploaded.

建议部分得分

30% package+trigger+frequency; 30% scope with exclusion; 40% Self Service config

R01.08.01.01-T13 Map home drives with Group Policy Preferences and item-level targeting

原始指令

In `lab.test` Group Policy Management, add to GPO `Staff-Drives` a Drive Maps preference: map H: to `\\fs01\home\%USERNAME%`, action Update, label 'Home', reconnect, with item-level targeting to security group `Staff-HQ` AND operating system Windows 11. Link the GPO to OU `Staff`.

平台: win · Windows
应用: Group Policy Management
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

SYSVOL ...\User\Preferences\Drives\Drives.xml has Drive letter H, path, action U, label Home, persistent 1, Filters with FilterGroup Staff-HQ and FilterOs Windows 11 combined with AND; GPO linked to OU=Staff; test user in Staff-HQ gets H: on logon. SYSVOL auditing (4663) detects Drives.xml written by a process other than mmc.exe; hand-written XML also lacks the Drive Maps CSE GUID on the GPO, so H: is not mapped.

建议部分得分

40% drive map fields; 40% ILT filters with AND; 20% link and logon check

R01.08.01.01-T14 Build a Windows provisioning package for lab PCs

原始指令

Using Windows Configuration Designer, build `LabPC.ppkg` that renames devices to `LAB-%RAND:4%`, adds Wi-Fi `Lab-Secure` (WPA2-Personal, key in `input/wifi.txt`), installs root certificate `input/LabRoot.cer`, creates local admin `labadmin` with the password in `input/admin.txt`, and removes pre-installed Xbox apps. Save to `C:\Out\`.

平台: win · Windows
应用: Windows Configuration Designer
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Extract ppkg customizations.xml: ComputerName LAB-%RAND:4%, WLAN profile SSID and key, Certificates/RootCertificates with the cer thumbprint, Accounts/Users labadmin in Administrators, removal of the Xbox package family names; applying it to a fresh VM yields matching state.

建议部分得分

40% device name and Wi-Fi; 20% root cert; 20% local admin; 20% Xbox app removal

R01.08.01.01-T15 Lay out an iPad Home Screen profile in Jamf Pro by dragging apps

原始指令

In sandbox Jamf Pro, create mobile device configuration profile `Classroom-iPad` with a Home Screen Layout payload matching `input/homescreen.png` (dock: 3 apps; page 1: 12 apps in a set order; page 2: a folder `Tools` with 4 apps) and a Restrictions payload blocking App Store installs. Scope to group `Classroom-iPads`.

平台: web · 任意系统（网页） ios · iOS/iPadOS
应用: Jamf Pro
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: drag · 拖放 click · 指向与点击 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Mobile device profile XML payload com.apple.homescreenlayout: Dock and Pages arrays equal the reference order (bundle IDs); folder Tools with 4 items; com.apple.applicationaccess allowAppInstallation false; scope correct. Order distance (Kendall tau) used for partial credit. The sandbox Jamf Pro has no API role or bearer token for the agent, so the profile is built in the web UI and logged under its UI session.

建议部分得分

15% dock; 40% page 1 order; 25% folder; 20% restrictions+scope

R01.08.01.01-T16 Resolve setting conflicts between an Intune baseline and a catalog profile

原始指令

Test device `WIN-PILOT-07` reports Conflict for three settings set both by the security baseline `Win-SecBaseline` and the Settings Catalog profile `Desktop-Std`. Following `input/conflict_rule.md` (keep the stricter value, set it in the baseline only), resolve the conflicts so both policies report Succeeded on the device after sync.

平台: web · 任意系统（网页）
应用: Intune
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 nav · 平移 / 缩放 / 滚动 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: hidden · 隐藏 / 过期状态
提案难度: 5 / 5

建议验证方式

Graph per-setting device status for WIN-PILOT-07: no 'conflict' states for the 3 setting definitions; baseline holds the stricter value per rule file; Desktop-Std no longer configures those 3 but keeps its other 11 settings unchanged.

建议部分得分

30% conflicting settings identified; 40% stricter values in baseline; 30% catalog profile pruned without collateral

R01.08.01.01-T17 Import Chrome ADMX templates and set forced extensions via local policy

原始指令

Copy the Chrome ADMX/ADML files from `C:\input\policy_templates\` into the local PolicyDefinitions store, then in the Local Group Policy Editor configure: force-install extension ID in `input/ext.txt` from the Chrome Web Store update URL, disable the built-in password manager, and set `DownloadDirectory` to `D:\Downloads`.

平台: win · Windows
应用: Group Policy Editor · Chrome
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

C:\Windows\PolicyDefinitions contains chrome.admx and en-US\chrome.adml; HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist\1 = '<id>;https://clients2.google.com/service/update2/crx'; PasswordManagerEnabled 0; DownloadDirectory D:\Downloads; chrome://policy export lists them as Platform/Machine.

建议部分得分

20% templates imported; 40% forcelist exact; 20% password manager; 20% download dir

R01.08.01.01-T18 Configure macOS security settings through an Intune Settings Catalog profile

原始指令

In the test tenant, create macOS Settings Catalog profile `Mac-Security`: Gatekeeper allow App Store and identified developers with override disabled, application firewall on with stealth mode and block all incoming off, screen saver ask-for-password delay 0, and login window show full name. Assign to `Mac-Pilot`.

平台: web · 任意系统（网页）
应用: Intune
交互表面: brow · 浏览器
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Graph configurationPolicies Mac-Security platform macOS: settings com.apple.systempolicy.control (EnableAssessment true, AllowIdentifiedDevelopers true), com.apple.security.firewall (EnableFirewall, EnableStealthMode true, BlockAllIncoming false), askForPasswordDelay 0, SHOWFULLNAME true; assignment.

建议部分得分

25% Gatekeeper; 35% firewall; 20% screensaver; 20% login window + assignment

R01.08.01.01-T19 Translate a 25-control hardening checklist into one domain GPO

原始指令

`input/cis_subset.xlsx` lists 25 CIS-style Windows controls with the required values. In `lab.test`, create GPO `CIS-L1-Subset` in Group Policy Management that implements all of them (Account Policies, Audit Policy, Security Options and Administrative Templates), link it to OU `Workstations`, and export a settings report to `C:\Out\cis_report.html`.

平台: win · Windows
应用: Group Policy Management · Group Policy Editor
交互表面: desk · 桌面 GUI
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: click · 指向与点击 type · 文字与表单 nav · 平移 / 缩放 / 滚动
工作产物: WP08 · 应用 / 系统状态
条件: long · 长流程
提案难度: 5 / 5

建议验证方式

Get-GPOReport XML parsed against the 25 expected setting/value pairs (each scored); link on OU=Workstations; report file present. Using a security template import (secedit/LGPO) is allowed but must produce the same GPO content.

建议部分得分

Per-control credit: 80% scaled by fraction of 25 controls exact; 10% linked; 10% report exported

R01.08.01.01-T20 Debug and install a malformed macOS restrictions profile

原始指令

`~/Desktop/profiles/restrictions.mobileconfig` fails to install with 'The profile is invalid'. Fix it in a profile editor or text editor (duplicate PayloadUUIDs, a misspelled PayloadType, a string where a boolean is required), then install and approve it in System Settings and confirm camera access is restricted as intended.

平台: mac · macOS
应用: iMazing Profile Editor · System Settings
交互表面: desk · 桌面 GUI term · 终端
GUI 需求 · 任务设定: HY · 混合
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: type · 文字与表单 click · 指向与点击 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: hidden · 隐藏 / 过期状态
提案难度: 4 / 5

建议验证方式

Fixed file: plutil -lint OK, unique UUIDs, PayloadType com.apple.applicationaccess, allowCamera <false/>; `profiles list` shows it installed; managed preferences (`profiles show -type configuration`) report allowCamera false; other keys unchanged from the original.

建议部分得分

45% three defects fixed (equal thirds); 35% installed and approved; 20% no unintended key changes

已有研究映射

当前映射未给此小类指定基准参考。

同工作流族的小类

R01.08.01.02 目录、身份与远程支持