Azure Policy built-in packages for guest configuration

  • Article

This page is an index of Azure Policy built-in packages for the guest configuration feature.

How to use Guest configuration package details

Each row represents a package used by a built-in policy definition.

  • Definition: Links to the policy definition in the Azure portal.
  • Configuration: Links to the .mof file in the Azure Policy GitHub repo containing the configuration that is used to audit and/or remediate machines.
  • Required modules: Links to the PowerShell Desired State Configuration (DSC) modules used by each configuration. The resource modules contain the script logic used to evaluate each setting in the configuration.

To understand what settings are checked in Windows or Linux, and how, find the name of the policy definition in the left column and navigate to the DSC Resource in the right column to review the PowerShell scripts.

The table doesn't include details of packages used to evaluate baseline configurations. Baselines are written in C++ rather than PowerShell Desired State Configuration.

Policy definition Configuration Required DSC modules
Audit Windows machines that have extra accounts in the Administrators group AdministratorsGroupMembers LocalGroup
Audit Windows machines that have the specified members in the Administrators group AdministratorsGroupMembersToExclude LocalGroup
Audit Windows machines missing any of specified members in the Administrators group AdministratorsGroupMembersToInclude LocalGroup
Windows machines should be configured to use secure communication protocols AuditSecureProtocol SecureProtocolWebServer
[Preview]: Linux machines should meet requirements for the Azure compute security baseline AzureLinuxBaseline
[Preview]: Windows machines should meet requirements of the Azure compute security baseline AzureWindowsBaseline
Audit Windows machines that contain certificates expiring within the specified number of days CertificateExpiration CertificateManagement
Audit Windows machines that allow re-use of the previous 24 passwords EnforcePasswordHistory SecurityPolicyDsc
Linux machines should only have local accounts that are allowed LocalUsers_Linux LocalUser
Windows machines should only have local accounts that are allowed LocalUsers_Windows LocalUser
Audit Windows machines that have not restarted within the specified number of days MachineLastBootUpTime MachineUpTime
Audit Windows machines that do not have a maximum password age of 70 days MaximumPasswordAge SecurityPolicyDsc
Audit Windows machines that do not have a minimum password age of 1 day MinimumPasswordAge SecurityPolicyDsc
Audit Windows machines that do not restrict the minimum password length to 14 characters MinimumPasswordLength SecurityPolicyDsc
Audit Windows machines that do not have the password complexity setting enabled PasswordMustMeetComplexityRequirements SecurityPolicyDsc
Configure time zone on Windows machines. SetWindowsTimeZone WindowsTimeZone
Audit Windows machines that do not store passwords using reversible encryption StorePasswordsUsingReversibleEncryption SecurityPolicyDsc
Audit Windows machines that don't have the specified applications installed WhitelistedApplication UserApplication
Audit Windows machines that do not contain the specified certificates in Trusted Root WindowsCertificateInTrustedRoot CertificateManagement
Windows Defender Exploit Guard should be enabled on your machines WindowsDefenderExploitGuard WindowsDefender
Audit Windows machines that are not joined to the specified domain WindowsDomainMembership DomainMembership
Audit Windows machines on which the DSC configuration is not compliant WindowsDscConfiguration WindowsDscConfiguration
Audit Windows machines on which the Log Analytics agent is not connected as expected WindowsLogAnalyticsAgentConnection LogAnalyticsAgent
Audit Windows VMs with a pending reboot WindowsPendingReboot WindowsPendingReboot
Audit Windows machines that do not have the specified Windows PowerShell execution policy WindowsPowerShellExecutionPolicy PowerShellExecutionPolicy
Audit Windows machines that do not have the specified Windows PowerShell modules installed WindowsPowerShellModules PowerShellModules
Audit Windows machines network connectivity WindowsRemoteConnection WindowsRemoteConnection
Audit Windows machines on which Windows Serial Console is not enabled WindowsSerialConsole WindowsSerialConsole
Audit Windows machines on which the specified services are not installed and 'Running' WindowsServiceStatus WindowsServiceStatus
Audit Windows machines that are not set to the specified time zone WindowsTimeZone WindowsTimeZone

Next steps