Remote Systems Hardening: 7 Critical Gaps Off the LAN
Remote systems hardening is mostly the same work as the office version, right up until the point where it quietly is not. The controls all still exist. What changes is that several of them were built on assumptions — a domain, a maintenance window, a machine you can physically reach — that a distributed fleet does not satisfy, and none of them announce it when they stop holding.
This is not the “you need a VPN” conversation. It is narrower and duller than that: seven specific places where remote systems hardening behaves differently from the on-premises version, each one taken from the vendor’s own documentation rather than from folklore. Most of them fail silently, which is the reason they are worth writing down.
1. The baseline is not applied until somebody applies it
Microsoft publishes security baselines in Intune — preconfigured groups of settings from the same security team that writes the group policy baselines. They are genuinely good, and they are inert until an administrator creates a profile from one and assigns it. Having Intune is not having a baseline.
That sounds obvious written down. It is worth stating because the mental model people carry over from Active Directory is that policy is a property of the domain: join the machine, inherit the policy. In a cloud-managed fleet the enrolment and the configuration are separate acts, and a device can be fully enrolled, fully compliant with an empty policy set, and reported as healthy.
2. Baselines freeze, and the freeze is silent
This is the one that catches careful people. From the same page: “When a new version for a profile becomes available, settings in profiles based on the older versions become read-only.” You can carry on using the old profile. You can still edit its name, its description and its assignments. What you cannot do is change a setting in it, or create new profiles from that version.
So a baseline deployed carefully in 2023 does not degrade in any visible way. It keeps applying. It keeps reporting compliance. It simply stops being the thing Microsoft currently recommends, and the console that would tell you so is the one you stopped opening because everything was green. Hardening is not a project with an end date for exactly this reason — the artefact has a shelf life that is not printed on it.
Checking it is not difficult, which is the frustrating part. Intune lists the available baseline types with the number of profiles using each, the number of versions available, and a Last Published date; selecting a baseline type and opening its Versions view shows which version each of your profiles is actually pinned to. Changing version does not require rebuilding the profile — there is a built-in option to move an existing profile to a newer instance. A standing item in whoever owns remote systems hardening is worth more here than any individual setting, because this is a question with an answer that changes underneath you.
3. Two baselines, one setting, two different defaults
Microsoft is unusually candid about this. Separate baseline types — the Windows MDM baseline and the Defender baseline, say — “might include the same settings and use different default values for those settings”, and “Intune can't determine which configuration is best for you”. The guidance is to review each setting and decide.
The same page adds the sentence that should govern every rollout: “In almost all scenarios, the default settings in the security baselines are the most restrictive. You should confirm that these settings don't conflict with other policy settings or features in your environment.” Restrictive defaults plus a distributed workforce plus no pilot ring is how a hardening exercise becomes an outage, and the outage is what teaches everyone that hardening is disruptive.
4. The baseline is not the standard you told the auditor about
Straight from Microsoft’s own Q&A, in answer to whether the Intune baselines are CIS or NIST compliant: “Strictly speaking, no.” Microsoft consults organisations such as CIS, but there is no one-to-one mapping. The baselines are a well-informed starting point, not a certification.
That distinction matters the moment someone writes “CIS-aligned” on a questionnaire. It also matters for a smaller, more practical reason: the Intune baselines deliberately exclude settings that only apply to an on-premises domain controller, so a control you remember from the group policy baseline may be absent here because it has nowhere to land, not because it was judged unnecessary.
5. Patch rings assume a maintenance window you no longer control
Deployment rings are the right pattern and they work remotely. The Windows Update client policies let you defer feature updates by up to 365 days and pause either kind for up to 35 days — enough to validate on a small group before a broad rollout.
Two details deserve attention in a distributed estate. Pausing expires by itself: “After 35 days have passed, the pause setting will automatically expire and the device will scan Windows Update.” And the console lies about it — the local group policy editor “won't reflect whether the quality update pause period has expired”; the checkbox stays ticked while updates have quietly resumed. In an office you would notice reboots. Across a distributed fleet on domestic connections, you find out from a support ticket.
The related trap is optional updates, which are off by default. That is usually correct, but it means “we are fully patched” and “we have installed everything Windows Update offered” are different statements, and only one of them is true.
6. Local administrator passwords, and the control nobody switches on
The identical local administrator password on every laptop is an old problem, and remote systems hardening makes it worse rather than better, because the machines are dispersed and re-imaging one is a courier job. Windows LAPS solves it: it rotates and backs up the local administrator password automatically, and Microsoft lists protection against “pass-the-hash and lateral-traversal attacks” as the first benefit.
Three facts make its absence hard to justify. It has shipped in Windows itself since the update released on 11 April 2023, with Microsoft Entra ID and Intune support generally available from 23 October 2023. “The Windows LAPS feature itself is available for free in all supported Windows platforms”, and storing passwords in Entra ID needs only Entra ID Free. And it works for Entra-joined devices, not just domain-joined ones — though note that a device joined only to Entra ID can back up only to Entra ID, and no device can back up to both directories.
This one is worth doing before most of the glamorous items. It is free, it is native, and it closes the path that turns one compromised laptop into all of them — the same lateral movement problem we covered from the identity side in the seven gaps MFA does not close.
7. The machines you cannot see are still in the fleet
Windows 10 reached end of support on 14 October 2025. Microsoft’s Intune documentation is precise about what that means operationally: Windows 10 is still an “allowed” version, devices “can still enroll in Intune and use eligible features”, but “functionality won't be guaranteed and can vary”.
In an office, an unsupported machine is a thing somebody eventually walks past. In a distributed business it is a row in a report, and the report says “enrolled”. The hardening question is not whether the policy applies to it — it may well apply — but whether the behaviour it depends on is still guaranteed underneath. An inventory that distinguishes supported from merely enrolled is doing real work here, and most inventories do not.
The same reasoning applies to anything with a lifecycle date attached: a browser baseline pinned to a version from 2023, an Office baseline two releases behind, a device that has not checked in for four months and is therefore neither compliant nor non-compliant but simply stale. Remote systems hardening has to treat “we have not heard from it” as a state that needs a decision, because it is the state in which every other control on this list silently stops applying.
What remote systems hardening should actually start with
In rough order of value per hour, and deliberately unglamorous: turn on Windows LAPS, because it is free and closes a lateral movement path. Check which baseline version your profiles are pinned to, because that answer is often years old. Confirm your update rings are still running rather than paused-and-expired. Then, and only then, argue about individual settings.
The through-line is the same one that runs through the seven architecture decisions made by default: distance does not weaken these controls, it removes the incidental feedback that used to tell you when they stopped working. Nobody walks past a laptop any more. The compensating control is deliberate checking, on a schedule, of a small number of things that fail quietly.
One dependency sits underneath all of it. Remote systems hardening assumes the operating system is still receiving fixes at all, and a fleet left on Windows 10 fails that assumption quietly — baselines still apply, rings still report, and nothing underneath is being patched. Our piece on Windows 10 Extended Security Updates sets out what that costs and the six ways off it.
One adjacent control belongs on the same list, and it now runs to a schedule set outside your organisation. The maximum life of a publicly trusted certificate fell to 200 days in March 2026 and reaches 100 in March 2027; our note on TLS certificate lifetimes works through the inventory that makes it manageable. Remote systems hardening covers the device. The certificate estate is the other half of what a distributed environment presents to the internet, and it fails just as quietly.
If you would rather that were somebody’s job than another item on yours, that is what our systems hardening and automation service is for — baselines that stay current, update rings that are verified rather than assumed, and reporting that runs whether anyone remembers or not.