Blog post

Modernising Windows 10 Management

Created:  21 Sep 2017
Updated:  21 Sep 2017
Author:  Stuart G
EUD: Windows 10 MDM

Deploying an array of devices has many benefits for end users - choice of device and platform are obvious wins. But, having to manage multiple infrastructures can seriously add to the workload of IT Admins. It may not be a panacea, but Windows 10 Mobile Device Management (MDM) can take some of the pain away.

Windows Desktop devices have had the ability to be managed via MDM since Windows 8.1, and the experience has been improving since then. It's now at the point where we believe a variety of organisations might benefit from using this new enterprise management model.

With this in mind we have produced some ALPHA guidance. By ALPHA we mean that the settings within this guidance have been tested within our lab on a range of test devices, but haven't yet been tested on large-scale deployments. However, we have no reason to suspect they won't work in such scenarios.

So, with all that out the way, let me introduce... drum roll... the Windows 10 - MDM ALPHA Guidance

And before you go, a few things to note about the guidance:

  • MDM capabilities are maturing all the time, this guidance document will be updated to reflect significant changes in the platform and MDM providers. 

  • We have pointed out some key differences between MDM-managed Windows devices and traditionally managed Windows devices which effect residual risk. Whether MDM management in its current form is right for your organisation will depend on your risk appetite. 
  • We have used Microsoft Intune as the MDM for testing but the guidance should apply to any MDM that implements the Configuration Service Providers (CSP) interface.
  • The guidance implements full cloud management and therefore requires identities to be stored in the cloud. For testing within this guidance we have used Azure Active Directory.
  • A lot of the settings described within the guidance utilise ADMX backed CSP polices. We strongly recommend reading and understanding this format before implementing these settings.  

If you have any further thoughts or ideas on how we could improve this guidance reach out to us below.

Stuart G

EUD Security Research

3 comments

Xperteks - 10 Oct 2017
Windows 10 Mobile Device Management (MDM) is a great way to save time with comprehensive solutions. This new enterprise management model as stated in the article can change the way we perceive data management. With different interfaces and guidelines, IT functioning will get smoother and hassle-free.
Paul Corner - 17 Mar 2018
Recognising the first M in the acronym doesn't limit you to that particular type of asset to manage. Let's hope more organisations of varying sizes start to embrace this sort if capability and take device management seriously.
NCSC Communications Team - 11 Sep 2018
This blog has now closed to comments.

Was this blog post helpful?

We need your feedback to improve this content.

Yes No