EPM uses a ConfigMgr Configuration Baseline (CB) and operating system-specific Configuration Items (CIs) to assess managed Windows devices against the applicable CIS Level 1 benchmark.

The assessment is lightweight and informational. It runs through the existing ConfigMgr client, writes a detailed report locally, stores summary results in the registry, and uses Hardware Inventory to make those results available in ConfigMgr reports. The full CIS-CAT application does not need to be installed on each endpoint.

The CIS score indicates benchmark alignment, not an institutional compliance determination. Use it to identify trends and devices requiring further review, not as a standalone pass/fail result.

Open

The CB contains multiple CIs for supported Windows versions. Each CI uses detection logic to determine whether its benchmark applies to the device, allowing one CB deployment to support multiple operating systems while running only the appropriate assessment.

The applicable CI runs a PowerShell assessment using embedded CIS benchmark content. The CI is informational and does not include remediation logic or automatically change device settings.

The assessment creates:

• A detailed local report containing the evaluated controls, actual values, and available evidence

• Reports are stored in “C:\ProgramData\CISCompliance\Reports”

• Registry values containing the benchmark, scores, and last assessment time

• Four reports are generated as:

  • HTML for easy consumption

  • JSON for scripting purposes

  • CSV for CIS benchmark results

  • CSV for device only benchmark results

The local report supports device-level investigation, while the registry summary provides a consistent source for centralized collection.

ConfigMgr Hardware Inventory collects the registry values and sends them to the site database. Because baseline evaluation and Hardware Inventory are separate client operations, completed assessments may not appear in centralized reporting immediately.

Custom reports provide:

• Fleet and collection-level views

• Scores by device and benchmark

• Assessment timestamps

• Detailed control results

• Actual values and available evidence

This allows ITSOs to review their managed fleet or investigate an individual device without retrieving each endpoint’s local report. The SSRS report can be run here: EPM - CIS Assessment by Collection

The CB compliance state primarily indicates whether the applicable assessment ran and returned a result. It does not mean that the device achieved a particular CIS score. The CIs are optional so that benchmarks that do not apply to the device do not cause the entire baseline to fail.

The score provides a high-level measure of how closely the device aligns with the selected benchmark. It is useful for:

• Establishing a starting point

• Comparing similar device populations

• Measuring change over time

• Identifying outliers for further review

Two devices can have the same score while failing different controls. Review the detailed findings before making remediation or exception decisions.

Open

• No CIS-CAT installation is required on managed endpoints.

• The assessment uses the existing ConfigMgr CI/CB and Hardware Inventory infrastructure.

• The solution does not automatically remediate CIS findings.

• A compliant CB result means the applicable assessment completed, not that the device met a specific score.

• Hardware Inventory timing affects when results appear in reports.

• Scores are useful for triage and trend analysis, but detailed control results should guide remediation decisions.

For definitions of Configuration Items, Configuration Baselines, and Hardware Inventory, see ConfigMgr - Glossary of Terms.