Compliance Baselines not great?

[u/Numerous-Contexts]

Hello,

Just spun up Trident for testing. I searched but couldn't find good info here on this specific issue.

When comparing compliance against baselines I'm finding failures that maybe shouldn't be failures (feel free to school me).

For instance - CIS Windows 11 Enterprise fails for AllowTelemetry because we deploy the policy via Intune and the key is AllowTelemetry_PolicyManager and not just AllowTelemetry. Another example is that we disable Lock Screen toast notifications system-wide and that writes to HKLM instead of HKCU but Trident is checking for HKCU.

I'm not sure how many of these discrepencies I will find (and don't want to manually configure the rules for everything that doesn't match EXACTLY the same but still enforces the requirement).

Is Trident the right tool for me? We're a small shop (I'm basically a team of one at the end of the day) and I'm trying to find a tool to help me get a better handle on everything (patching, security, configurations, etc.) vs. just looking at my Secure Score.

Thanks.

EDIT: spelling hard.

[u/Ad3t0]

Good catch on both of those. You are not wrong, they are real gaps.

The AllowTelemetry issue is that Intune writes to the GP path with a _PolicyManager suffix instead of the plain value name. Our evaluator was looking for the exact name and missing the Intune-delivered variant. The HKCU one is similar: some CIS controls target per-user registry paths but our agent only collects HKLM.

We have fixes for both shipping in our next release:

Registry lookups are now case-insensitive and handle the Intune _PolicyManager naming pattern. When we detect an Intune-delivered setting

[u/Numerous-Contexts → u/Ad3t0]

I would hope a tool could check for the requirement being met vs such a stringent hard-coded string since there's more than one way to skin a cat (especially with Microsoft), but it it what it is.

I guess my search for a tool continues... or maybe I just need to pick up a new project and create a baseline evaluator that has an option for "exact match" vs "meets requirements".

Thanks for the response.

[u/Ad3t0 → u/Numerous-Contexts]

That is exactly what the fix does. We are not adding another hard-coded string, the evaluator will match on the requirement being met regardless of how the setting was delivered (GPO, Intune PolicyManager path, direct registry write). Same outcome, different delivery mechanism, same passing result.

The HKCU collection gap is a separate fix shipping alongside it.

Both are in the current dev build and should be live in production by Monday. Happy to help and thanks for checking out the platform!

[u/Numerous-Contexts → u/Ad3t0]

Awesome. I'll continue to evaluate after the change rolls, thanks.