215 settings currently Unconfirmed. These candidates are not counted as verified.
JNL TOOLS v1.0.0
Intune Baseline
Comparison
See the coverage first. Inspect the evidence when needed.
ComparingOIB v3.8 ↔ Microsoft 25H2
Last successful fetch15 Sept 2026, 05:48
Comparison generated17 Sept 2026, 16:12
COVERAGE OVERVIEW
How much of Microsoft’s baseline does OIB cover?
The verified figure requires both a reliable setting identity and comparable value semantics. Unconfirmed candidates are shown separately instead of inflating coverage.
24.9%
Verified coverage120 of 482 Microsoft settings335 of 482 if all current Unconfirmed candidates are verified.
147 Microsoft settings have no current OIB candidate.
Microsoft baseline composition
482 settings- 115 Same
- 5 Different
- 215 Unconfirmed
- 147 No established OIB match
Among the 120 verified comparisons, 115 use equivalent values and 5 differ.
VERIFIED DIFFERENCES
Where do OIB and Microsoft differ?
5 verified configuration differences found.
- Submit Samples Consent
- Privilege Use Audit Sensitive Privilege Use
- User Account Control Behavior Of The Elevation Prompt For Standard Users
- PK Init Hash Algorithm SHA256
- Require Platform Security Features
IDENTITY NOT ESTABLISHED
No established Microsoft baseline match
1015OIB settings for which the current matcher has not established a Microsoft counterpart. This group may include genuine OIB additions and false negatives caused by differing source representations or incomplete metadata.
Explore these OIB settings →OPENINTUNEBASELINE FULL PROFILE SET
v3.8
1350 normalized settings · 1445 occurrences
View pinned OIB source ↗MICROSOFT WINDOWS BASELINE
25H2
482 reference entries · Intune
View pinned Microsoft source ↗LAST SUCCESSFUL FETCH
15 Sept 2026, 05:48
Europe/Stockholm
Comparison generated 17 Sept 2026, 16:12
SECURITY AREAS
Coverage by area
Start with the part of the baseline you care about, then inspect individual settings if needed.
Defender & attack surface
30.4%verified
17 of 56 Microsoft settings
+46.4% unconfirmed26 settings · potential 76.8%
13 No established OIB match
Explore area →BitLocker & data protection
36.4%verified
4 of 11 Microsoft settings
+36.4% unconfirmed4 settings · potential 72.7%
3 No established OIB match
Explore area →Identity & authentication
49.2%verified
31 of 63 Microsoft settings
+28.6% unconfirmed18 settings · potential 77.8%
14 No established OIB match
Explore area →Device & platform security
83.3%verified
10 of 12 Microsoft settings
+8.3% unconfirmed1 setting · potential 91.7%
1 No established OIB match
Explore area →Firewall & networking
38.6%verified
17 of 44 Microsoft settings
+52.3% unconfirmed23 settings · potential 90.9%
4 No established OIB match
Explore area →Audit & privileges
44.4%verified
16 of 36 Microsoft settings
+50% unconfirmed18 settings · potential 94.4%
2 No established OIB match
Explore area →Applications & browser
2.6%verified
5 of 189 Microsoft settings
+51.9% unconfirmed98 settings · potential 54.5%
86 No established OIB match
Explore area →Windows system & experience
31%verified
18 of 58 Microsoft settings
+31% unconfirmed18 settings · potential 62.1%
22 No established OIB match
Explore area →Other
15.4%verified
2 of 13 Microsoft settings
+69.2% unconfirmed9 settings · potential 84.6%
2 No established OIB match
Explore area →DETAILED VIEWExplore individual settings
Search, filter and inspect source evidence when you need the granular view.
Open explorer ↓
DETAILED VIEW
Explore individual settings
Search, filter and inspect source evidence when you need the granular view.
The default view contains the 482 Microsoft baseline settings. OIB settings without an established Microsoft baseline match are available as a separate dataset.
Open the explorer to load settings.
Loading comparison data…
No settings match these filters. Try another search or reset the filters.
METHODOLOGY
Evidence before coverage.
Produced by JNL Group AB. This is an independent tool, not an official Microsoft or OpenIntuneBaseline product. Verify results before making security decisions.
- Deterministic setting IDs and documented CSP paths establish identity first.
- Uncertain mappings remain Unconfirmed and do not increase verified coverage.
- No established Microsoft baseline match means that the matcher found no counterpart; it does not prove that the setting is absent from Microsoft’s baseline.
- “Not Configured” is not automatically assigned an effective Windows value.
- Different describes a configuration difference, not a security ranking.
How this comparison works
The comparison uses saved public configuration data. Stable setting IDs and documented CSP paths establish identity. Unconfirmed means that the available source evidence is insufficient for the tool to classify a comparison as Same or Different. Verified OIB coverage is 24.9% of the Microsoft baseline.
OIB settings without an established Microsoft baseline match are reported separately and never enter the Microsoft coverage denominator. This group may contain both genuine OIB additions and false negatives caused by source representation differences or incomplete metadata.
Configured values are separate from effective Windows defaults. “Not Configured” is never assumed to mean Disabled. v1 does not use effective-default mappings.
Downloads include the entire current dataset, regardless of filters. No tenant access is required. Source snapshots are versioned, and upstream changes require validation and review before promotion.