Device Compliance - Windows

In order to to protect data integrity and safeguard security when accessing university IT infrastructure, it is very important to ensure that the device you are using is not infected with malware (malicious software) or compromised in any other way. Malware can infect your device without your knowledge: it might install itself from an e-mail message, when you connect to the Internet, or when you install certain apps using a USB flash drive, CD, DVD, or other removable media. Some malware can also be programmed to run at unexpected times, not only when it's installed.

Compliance and Conditional Access Policy

To protect university IT infrastructure from cybersecuriy threats, any device running Windows OS that is used to access university systems, apps and data is subject to a set of minimum requirements and must be administered by Intune so that its compliance with these minimum requirements can be continuously evaluated. Devices deemed as noncompliant (i.e. not meeting these requirements, hence not fully protected and free from malware), will not be allowed access to university systems that store sensitive data once conditional access policy goes in effect in Q4 of 2023.

The same set of minimum requirements is applied to both "corporate" or university-owned devices (i.e. devices purchased with university funds or grants) and personal devices (i.e. devices purchased with personal funds used to access university systems, apps and data), referred to as as BYOD devices (Bring Your Device). However, Intune administers personal devices differently that corporate devices. To protect your privacy, Intune manages only university apps and data on registered personal devices. It has no visibility into your personal apps and data on that device.

In order for your computer running Windows OS to be deemed as compliant, it must meet all of these requirements:

  • Must be enrolled in Intune Mobile Device Management (MDM) (more details)
  • Windows 10 version must be 21H2 or 22H2 with latest security patches installed (more details).
  • Windows 11 version must be 22H2 with latest security patches installed (more details).
  • Windows Security real-time protection must be enabled (more details).
  • Microsoft Defender anti-malware must be enabled and up-to-date (more details).
  • Microsoft Defender anti-spyware must be enabled (more details).
  • Windows Firewall must be enabled (more details).

To check if your device is compliant or update its compliance status, launch the Company Portal app installed on your university device or go to https://portal.manage.microsoft.com on any device and:

  • Click on the three lines icon next to "University of Windsor" to open the navigation bar (web version of Company Portal only)


     
  • Click on Devices icon on the navigation bar on the left
  • Click on the device of interest
  • Click on Check Access button

This will force a check-in with the Intune service, and refresh its device compliance policies and status.

Device Enrollment

While both corporate and personal BYOD devices must be managed by Intune, the enrollment process is different for them.

Corporate Devices

In order to get unrestricted access to University of Windsor software, systems and data, your work device has to be joined to Azure Active Directory (AAD) and enrolled in Intune Mobile Device Management (MDM) platform. To enroll you device, follow these instructions:

Personal Devices

In order to get unrestricted access to University of Windsor software, systems and data, your BYOD device has to be registered in Azure Active Directory (AAD) and enrolled in Intune Mobile Device Management (MDM) platform. To register/enroll you device, follow these instructions:

Windows Version and Updates

For the device to be deemed as compliant:

  • Monthly Windows quality updates (security patches) generally have to be installed within four weeks from the day they were released by Microsoft.
  • Semi-annual feature updates have to be installed within two months from the day they were released by Microsoft.

To check version/build of Windows 10/11 on your computer:

  1. Click the Start menu button and type winver then press Enter
  2. Make a note of the second line that should look like this:
    • On Windows 10: Version 21H2 (OS Build 19044.3324) or Version 21H2 (OS Build 19045.3324​​​​​​​) - these includes Aug 8 security update
      NOTE: It's OK if your last number is higher than 3324
    • On Windows 11: Version 22H2 (OS Build 22621.2134​​​​) - this includes Aug 8 security update
      NOTE: It's OK if your last number is higher than 2134

To update your Windows to the latest supported version, go to Windows settings:

  1. Click on Start menu (Windows logo)
  2. Click on the gear icon (Windows Settings)
  3. Click Update & Security
  4. Click Check for Updates
  5. Install missing updates
  6. Reboot your computer

If Windows Update feature tells you that there are no updates available for your computer even though your version/build is not at the level listed above, you can to update to the latest version/build of Windows 10/11 following these steps:

  1. Launch a web browser and navigate to this site:
  2. Click on Update Now
  3. Your browser will attempt to download Windows Update Assistant app. Open/run this file, or save it in your Downloads folder and then open it once it is downloaded.
  4. When asked Do you want to allow this app to make changes to your device? click on Yes.
  5. Follow instructions on the screen.

Virus and Threat Protection

Windows 10 includes Windows Security module, which provides settings for the virus, malware and spyware protection.

Corporate Devices

Cortex XDR must be installed on every university device. When installed, it takes over the real-time protection function form Microsoft Defender Antivirus.

Uploaded Image (Thumbnail)

Personal Devices

On personal devices, the adequate threat protection is provided by Microsoft Defender Antivirus on you personal computer and Cortex on your work computers running Windows 10. Your device will be actively protected from the moment you start Windows 10/11, as long as Windows Security features listed below are enabled and functioning properly. Windows Security continually scans for malware (malicious software), viruses, and security threats. In addition to this real-time protection, updates are downloaded automatically to help keep your device safe and protect it from threats.

Starting with Windows 10 version 2004, Windows Defender Antivirus (which is one of the components of Windows Security) as been renamed to Microsoft Defender Antivirus.

When you install some 3rd party antivirus (AV) programs, they may automatically turn off Microsoft Defender Antivirus. In this case you may not be able to turn on Microsoft Defender Antivirus again until the 3rd party AV program has been disabled (turned off) or completely uninstalled. If you have a 3rd party AV program installed and disable Microsoft Defender Antivirus, this will also disable periodic scanning. 

NOTE: As of March 31, 2021, faculty and staff are no longer licensed to use Sophos Endpoint Security & Control suite of apps. If you still have Sophos software installed on your work computer, you should un-install it as soon as possible.

Real-Time Protection

In Windows 10/11, you can turn off Microsoft Defender Antivirus real-time protection, but it will only be temporary unless disabled. Windows will automatically turn real-time protection back on if it's off for a while. Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities. These activities include events, such as processes making unusual changes to existing files, modifying or creating automatic startup registry keys and startup locations (also known as auto-start extensibility points, or ASEPs), and other changes to the file system or file structure. To check your real-time protection settings:

  1. Click on the Start menu button then Settings (gear icon)
  2. Click on Update & Security
  3. Click on Windows Security
  4. Click on Virus and threat protection


     

Microsoft Defender Anti-malware and Anti-spyware

The Antimalware Service Executable process is Microsoft Defender’s background service, and it always remains running in the background. It’s responsible for checking files for malware when you access them, performing background system scans to check for dangerous software, installing antivirus definition updates, and anything else a security application like Microsoft Defender needs to do.

Windows Firewall

On your work computer, Microsoft Defender Firewall must be on to protect your computer from unauthorized access. To check if your computer's Microsoft Defender Firewall is on or off:

  1. Click on the Start menu button then Settings (gear icon)
  2. Click on Update & Security
  3. Click on Windows Security
  4. Click on Firewall and network protection. You should see Firewall is on message next to Domain network, Private Network, and Public network.


     
  5. If any of the three networks display a message Firewall is off, click on Turn on button to turn it back on or click on Restore settings button to restore firewall settings back to the recommended values.

For more information, please see Turn Microsoft Defender Firewall on or off

 

100% helpful - 1 review

Details

Article ID: 118303
Created
Wed 10/14/20 11:02 AM
Modified
Mon 8/28/23 1:59 PM

Related Articles (9)

IT Services is currently running a pilot implementation of conditional access involving a limited number of users. Full implementation will take in Q4 of 2023.
At the University of Windsor, Intune combined with Azure AD provides device and application administration, corporate data protection, identity management and directory services.
In order for your macOS computer to be deemed as compliant, it must meet a number of requirements. Non-compliant devices will not be able to access some of the resources and systems.
Every Windows computer has a name to help identify it on a network. Here are several methods for finding it out.
Instructions for extracting model and serial number on a Windows computer using command prompt.
When accessing OneDrive or other Microsoft 365 Apps in a browser you may see a message displayed on the top of the browser window that says "Your organization doesn't allow you to download, print, or sync using this device (...) This can happen for three different reasons
If you see a message "Your company hasn't made any apps available to you on this device" or "You don't have any apps yet" it means that your computer does not meet minimum requirements as defined in the device compliance policy (i.e. your device is not compliant).
Microsoft Windows Update is a Microsoft service for the Windows operating system, which automates downloading and installing Microsoft Windows software updates over the Internet. This article discusses two different types of Windows updates and provides a listing of the most recent updates required for device compliance.
Microsoft Company Portal is an app that faculty and staff at the University of Windsor use to manage their workstations.