Deploying a Windows compliance policy
There are two ways to configure compliance policies for Windows devices. Both will be covered in this chapter, but we will start with the easier of the two, which is GUI-driven.
Getting started
As mentioned earlier, before we start creating our policy, we should look at the available settings and what they do.
Compliance settings
We will start with the available compliance settings.
Custom compliance
We will cover this in a later recipe (Configuring and deploying a Windows custom compliance policy), but to summarize, you can deploy a custom PowerShell script to monitor anything on the device and feed it into a compliance policy.
Device Health
Device health rules use the Device Health Attestation service. One important thing to note is that they require a reboot to report back as they are querying the BIOS, among other things. Therefore, if you set these settings, make sure you do not set devices as non-compliant immediately...
