ASD - Australian Signals Directorate

ASD's Blueprint for Secure Cloud

Operational Support

This section describes the design decisions associated with operational support for Windows 10 and 11 endpoints configured according to guidance in ASD's Blueprint for Secure Cloud.

Estimated reading time: 2 minutes

Windows 10 and 11, and supporting management tools, offer various Standard Operating Environment (SOE) support features to enable support staff to access a machine remotely or provide users with the option to perform automated repairs. The following support components are available to support Windows 10 and 11:

  • Intune – Intune can remotely wipe, reset and remove a device from Microsoft Entra ID. These functions are controlled by role-based administration, permitting only certain administrators to control these settings.
  • Windows Remote Management (WinRM) – WinRM is the Microsoft implementation of the WS-Management Protocol, a standard Simple Object Access Protocol (SOAP) based, firewall-friendly protocol that enables hardware and Operating Systems from different vendors to interoperate.
  • WS-Management protocol - The WS-Management protocol specification provides a common way for systems to access and exchange management information across an IT infrastructure. WinRM and Intelligent Platform Management Interface (IPMI), along with the Event Collector are components of the Windows Hardware Management features.
  • Windows Remote Assistance – Windows Remote Assistance in Windows uses the Remote Desktop Protocol (RDP) protocol to provide a Remote Desktop connection that is interactive between the locally logged on user and a remote user.
  • Remote Desktop – Remote Desktop enables a user to remotely logon interactively to a workstation from another computer with a supported Remote Desktop client.
  • Remote Control – Remote control options are limited to the following:
    • TeamViewer which is a paid service that fully integrates in Intune.
    • Remote Control within Microsoft Endpoint Configuration Manager (MECM) is configured in hybrid deployments.
    • Microsoft Teams assuming the user can share the desktop.

Security & Governance

Design

  • None identified

Configuration

  • None identified

References

  • None identified

Do you have a suggestion on how the above page could be improved? Get in touch! ASD's Blueprint for Secure Cloud is an open source project, and we would love to get your input. Submit an issue on our GitHub, or send us an email at blueprint@asd.gov.au

Acknowledgement of Country icon

Acknowledgement of Country
We acknowledge the Traditional Owners and Custodians of Country throughout Australia and their continuing connections to land, sea and communities. We pay our respects to them, their cultures and their Elders; past, present and emerging. We also recognise Australia's First Peoples' enduring contribution to Australia's national security.

Authorised by the Australian Government, Canberra