Ref Windows Mdm Settings
Doc updateThe documentation now includes the Windows 11 version 26H2 security baseline and its default settings across areas including SMB, network security, DNS, and Windows Connection Manager.
Day in brief
Intune's Windows 11 26H2 baseline reference adds new settings and updated defaults
The period's strongest Intune change is expanded Windows 11 26H2 security-baseline and Settings Catalog guidance, including new settings, updated defaults, and revised instructions. Existing baseline profiles do not update automatically. Remote Help is now documented as available for Android and Windows devices in GCCH environments. Configuration Manager 2609 guidance adds upgrade prerequisites, records several security and operational behavior changes, and drops support for older Windows Server client operating systems.
- Windows 11 26H2 baseline and Settings Catalog coverage
Intune · GeneralIntune guidance now covers the Windows 11 version 26H2 security baseline and Settings Catalog support, including new settings, updated defaults, and revised guidance. Existing security baseline profiles do not update automatically; administrators wanting the 26H2 baseline must create a new profile or update an existing one.
The documentation now states that Remote Help is available in US Government Community Cloud High environments for Android and Windows devices. GCCH support staff can provide real-time troubleshooting for enrolled devices using role-based access controls and Microsoft Entra ID sign-in.
- Configuration Manager 2609 checklist sets hierarchy prerequisites
Configuration Manager · GeneralThe 2609 update checklist requires a top-level service connection point. After the parent site is updated, secondary sites require manual updating.
- Configuration Manager 2609 changes security and approval behaviorConfiguration Manager · General
The 2609 change summary records CMPivot clients trusting its signing certificate, removal of the SQLCLR TRUSTWORTHY requirement, automatic disabling of CMG storage shared-key access, and upgrade checks that warn about automatic computer approval. The related guidance also calls out planned removal of automatic approval for all computers.
- Configuration Manager 2609 drops older Windows Server client supportConfiguration Manager · General
Version 2609 no longer supports Windows Server 2012, Windows Server 2012 R2, or their Windows Storage Server editions as client operating systems. Administrators should identify affected devices and move them to a supported Windows Server version.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
7 updates
Microsoft Intune
4 updatesOverview
Doc updateThe overview now links to Version 26H2 Windows MDM settings and updates its documentation metadata.
Index
Feature updateThe documentation now states that Remote Help is available in US Government Community Cloud High (GCCH) environments for Android and Windows devices.
Index
Feature updateIntune now documents the Windows 11 version 26H2 security baseline and Settings Catalog support, including new settings, updated defaults, and revised guidance.
Microsoft Configuration Manager
3 updatesChecklist for 2609 - Configuration Manager | Microsoft Learn
Doc updateAction requiredA checklist now documents prerequisites and installation behavior for updating a Configuration Manager hierarchy to version 2609, including service connection point and site update requirements.
Summary of changes in Configuration Manager current branch, version 2609 - Configuration Manager | Microsoft Learn
Feature updateVersion 2609 includes fixes and improvements: CMPivot clients trust its signing certificate, SQLCLR no longer requires TRUSTWORTHY, CMG storage shared-key access is automatically disabled, and upgrade checks warn about automatic computer approval.
What's new in version 2609 - Configuration Manager | Microsoft Learn
Feature updateAction requiredConfiguration Manager 2609 no longer supports Windows Server 2012, Windows Server 2012 R2, or their Windows Storage Server editions as client operating systems.