[Deprecated]: Deploy prerequisites to audit Windows VMs configurations in 'Administrative Templates - MSS (Legacy)' - f1f4825d-58fb-4257-8016-8c00e3c9ed9d Azure Policy

[Deprecated]: Deploy prerequisites to audit Windows VMs configurations in 'Administrative Templates - MSS (Legacy)'

Azure BuiltIn Policy definition

Alias

Namespace

ResourceType

Path

PathIsDefault

DefaultPath

Modifiable

Microsoft.Compute/imageOffer

Microsoft.Compute
Microsoft.Compute
Microsoft.Compute

virtualMachines
virtualMachineScaleSets
disks

properties.storageProfile.imageReference.offer
properties.virtualMachineProfile.storageProfile.imageReference.offer
properties.creationData.imageReference.id

True
True
True

False
False
False

Microsoft.Compute/imagePublisher

Microsoft.Compute
Microsoft.Compute
Microsoft.Compute

virtualMachines
virtualMachineScaleSets
disks

properties.storageProfile.imageReference.publisher
properties.virtualMachineProfile.storageProfile.imageReference.publisher
properties.creationData.imageReference.id

True
True
True

False
False
False

Microsoft.Compute/imageSKU

Microsoft.Compute
Microsoft.Compute
Microsoft.Compute

virtualMachines
virtualMachineScaleSets
disks

properties.storageProfile.imageReference.sku
properties.virtualMachineProfile.storageProfile.imageReference.sku
properties.creationData.imageReference.id

True
True
True

False
False
False

Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration

Microsoft.Compute

virtualMachines

properties.osProfile.windowsConfiguration

True

Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType

Microsoft.Compute

virtualMachines

properties.storageProfile.osDisk.osType

True

Microsoft.HybridCompute/imageOffer

Microsoft.HybridCompute

machines

properties.osName

True

False

Rows: 1-1 / 1

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 1

Initiative DisplayName

Initiative Id

Initiative Category

State

Type

polSet in AzUSGov

[Deprecated]: Audit Windows VMs that do not match Azure compute security baseline settings

d618d658-b2d0-410e-9e2e-bfbfd04d09fa

Guest Configuration

Deprecated

BuiltIn

true

Date/Time (UTC ymd) (i)

Change type

Change detail

2020-08-20 14:05:01

change

Previous DisplayName: Deploy prerequisites to audit Windows VMs configurations in 'Administrative Templates - MSS (Legacy)'

2020-06-09 16:25:53

change

Previous DisplayName: [Preview]: Deploy prerequisites to audit Windows VMs configurations in 'Administrative Templates - MSS (Legacy)'

2020-02-08 03:50:24

change

Previous DisplayName: [Preview]: Deploy prerequisites to audit Windows VMs configurations in 'Adminstrative Templates - MSS (Legacy)'

2019-12-17 15:43:46

change

Previous DisplayName: [Preview]: Deploy requirements to audit Windows VMs configurations in 'Adminstrative Templates - MSS (Legacy)'

{

displayName: "[Deprecated]: Deploy prerequisites to audit Windows VMs configurations in 'Administrative Templates - MSS (Legacy)'",
policyType: "BuiltIn",
mode: "Indexed",
description: "This policy creates a Guest Configuration assignment to audit Windows virtual machines with non-compliant settings in Group Policy category: 'Administrative Templates - MSS (Legacy)'. It also creates a system-assigned managed identity and deploys the VM extension for Guest Configuration. This policy should only be used along with its corresponding audit policy in an initiative. For more information on Guest Configuration policies, please visit https://aka.ms/gcpol",
metadata: {4 items
- version: "1.2.0-deprecated",
- category: "Guest Configuration",
- requiredProviders: [1 item
  - "Microsoft.GuestConfiguration"
  ],
- deprecated: true
},
policyRule: {2 items
- if: {1 item
  - anyOf: [2 items
    - {1 item
      - allOf: [2 items
        {2 items
        field: "type",
        equals: "Microsoft.Compute/virtualMachines"
        },
        {1 item
        anyOf: [10 items
        {2 items
        field: "Microsoft.Compute/imagePublisher",
        in: [7 items
        "esri",
        "incredibuild",
        "MicrosoftDynamicsAX",
        "MicrosoftSharepoint",
        "MicrosoftVisualStudio",
        "MicrosoftWindowsDesktop",
        "MicrosoftWindowsServerHPCPack"
        ]
        },
        {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Compute/imagePublisher",
        equals: "MicrosoftWindowsServer"
        },
        {2 items
        field: "Microsoft.Compute/imageSKU",
        notLike: "2008*"
        }
        ]
        },
        {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Compute/imagePublisher",
        equals: "MicrosoftSQLServer"
        },
        {2 items
        field: "Microsoft.Compute/imageOffer",
        notLike: "SQL2008*"
        }
        ]
        },
        {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Compute/imagePublisher",
        equals: "microsoft-dsvm"
        },
        {2 items
        field: "Microsoft.Compute/imageOffer",
        equals: "dsvm-windows"
        }
        ]
        },
        {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Compute/imagePublisher",
        equals: "microsoft-ads"
        },
        {2 items
        field: "Microsoft.Compute/imageOffer",
        in: [2 items
        "standard-data-science-vm",
        "windows-data-science-vm"
        ]
        }
        ]
        },
        {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Compute/imagePublisher",
        equals: "batch"
        },
        {2 items
        field: "Microsoft.Compute/imageOffer",
        equals: "rendering-windows2016"
        }
        ]
        },
        {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Compute/imagePublisher",
        equals: "center-for-internet-security-inc"
        },
        {2 items
        field: "Microsoft.Compute/imageOffer",
        like: "cis-windows-server-201*"
        }
        ]
        },
        {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Compute/imagePublisher",
        equals: "pivotal"
        },
        {2 items
        field: "Microsoft.Compute/imageOffer",
        like: "bosh-windows-server*"
        }
        ]
        },
        {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Compute/imagePublisher",
        equals: "cloud-infrastructure-services"
        },
        {2 items
        field: "Microsoft.Compute/imageOffer",
        like: "ad*"
        }
        ]
        },
        {1 item
        allOf: [2 items
        {1 item
        anyOf: [2 items
        {2 items
        field: "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
        exists: "true"
        },
        {2 items
        field: "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
        like: "Windows*"
        }
        ]
        },
        {1 item
        anyOf: [2 items
        {2 items
        field: "Microsoft.Compute/imageSKU",
        exists: "false"
        },
        {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Compute/imageSKU",
        notLike: "2008*"
        },
        {2 items
        field: "Microsoft.Compute/imageOffer",
        notLike: "SQL2008*"
        }
        ]
        }
        ]
        }
        ]
        }
        ]
        }
        ]
      },
    - {1 item
      - allOf: [2 items
        {2 items
        field: "type",
        equals: "Microsoft.HybridCompute/machines"
        },
        {2 items
        field: "Microsoft.HybridCompute/imageOffer",
        like: "windows*"
        }
        ]
      }
    ]
  },
- then: {2 items
  - effect: "deployIfNotExists",
  - details: {4 items
    - roleDefinitionIds: [1 item
      - "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" Contributor
      ],
    - type: "Microsoft.GuestConfiguration/guestConfigurationAssignments",
    - name: "AzureBaseline_AdminstrativeTemplatesMSSLegacy",
    - deployment: {1 item
      - properties: {3 items
        mode: "incremental",
        parameters: {4 items
        vmName: {1 item
        value: "[field('name')]"
        },
        location: {1 item
        value: "[field('location')]"
        },
        type: {1 item
        value: "[field('type')]"
        },
        configurationName: {1 item
        value: "AzureBaseline_AdminstrativeTemplatesMSSLegacy"
        }
        },
        template: {4 items
        $schema: "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
        contentVersion: "1.0.0.0",
        parameters: {4 items
        vmName: {1 item
        type: "string"
        },
        location: {1 item
        type: "string"
        },
        type: {1 item
        type: "string"
        },
        configurationName: {1 item
        type: "string"
        }
        },
        resources: [4 items
        {6 items
        condition: 🔍"[ equals( toLower( parameters('type') ), toLower( 'microsoft.hybridcompute/machines' ) ) ]",
        apiVersion: "2018-11-20",
        type: "Microsoft.HybridCompute/machines/providers/guestConfigurationAssignments",
        name: 🔍"[ concat( parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('configurationName') ) ]",
        location: "[parameters('location')]",
        properties: {1 item
        guestConfiguration: {2 items
        name: "[parameters('configurationName')]",
        version: "1.*"
        }
        }
        },
        {6 items
        condition: 🔍"[ equals( toLower( parameters('type') ), toLower( 'Microsoft.Compute/virtualMachines' ) ) ]",
        apiVersion: "2018-11-20",
        type: "Microsoft.Compute/virtualMachines/providers/guestConfigurationAssignments",
        name: 🔍"[ concat( parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('configurationName') ) ]",
        location: "[parameters('location')]",
        properties: {1 item
        guestConfiguration: {2 items
        name: "[parameters('configurationName')]",
        version: "1.*"
        }
        }
        },
        {6 items
        condition: 🔍"[ equals( toLower( parameters('type') ), toLower( 'Microsoft.Compute/virtualMachines' ) ) ]",
        apiVersion: "2019-07-01",
        type: "Microsoft.Compute/virtualMachines",
        identity: {1 item
        type: "SystemAssigned"
        },
        name: "[parameters('vmName')]",
        location: "[parameters('location')]"
        },
        {7 items
        condition: 🔍"[ equals( toLower( parameters('type') ), toLower( 'Microsoft.Compute/virtualMachines' ) ) ]",
        apiVersion: "2019-07-01",
        name: 🔍"[ concat( parameters('vmName'), '/AzurePolicyforWindows' ) ]",
        type: "Microsoft.Compute/virtualMachines/extensions",
        location: "[parameters('location')]",
        properties: {6 items
        publisher: "Microsoft.GuestConfiguration",
        type: "ConfigurationforWindows",
        typeHandlerVersion: "1.1",
        autoUpgradeMinorVersion: true,
        settings: {},
        protectedSettings: {}
        },
        dependsOn: [1 item
        🔍"[ concat( 'Microsoft.Compute/virtualMachines/', parameters('vmName'), '/providers/Microsoft.GuestConfiguration/guestConfigurationAssignments/', parameters('configurationName') ) ]"
        ]
        }
        ]
        }
        }
      }
    }
  }
}

}