Edit

Surface Hub 3 security best practices

  • Article
  • Applies to:
    Surface Hub 3, Surface Hub 3 Pack

Surface Hub 31 runs the Microsoft Teams Rooms experience on Windows. Depending on your organization's security posture, you might wish to take other security measures, as described in this article. At a minimum, we recommended the following measures:

Tip

Before you begin, review the guidance for Microsoft Teams Rooms security, which primarily focuses on security for tabletop conference devices: Teams Rooms certified systems. The Windows 11 IoT Enterprise operating system provides IT admins with a range of centralized configuration and management options.

Change default local admin password

The default local admin account is a well-known entry point for malicious actors. If the default admin password remains unchanged after first-time setup, the device might be vulnerable to data breaches, system manipulation, or other unauthorized access.

To change the local admin password on Surface Hub 3

  1. Sign in with admin credentials and go to Settings > Accounts > Sign-in options > Password > Change.

  2. Enter the current default password:sfb.

  3. Create a new password, confirm the password, and add a hint. To learn more, see Change or reset your Windows password.

    Screenshot showing Change your password.

Tip

When joined to Microsoft Entra ID (Azure AD), you can utilize Windows LAPS (Local Administrator Password Solution). Although LAPS doesn't remove local admin accounts, it automatically manages local admin passwords, ensuring they're randomized and securely stored in AD. This reduces the risk associated with stale or widely known admin passwords. To learn more, see Microsoft Intune support for Windows LAPS.

Set a UEFI password

The Unified Extensible Firmware Interface (UEFI) is an advanced firmware interface designed to replace the traditional BIOS (Basic Input/Output System), providing enhanced features like improved security, faster boot times, and support for larger hard drives in modern Windows operating systems. By setting a UEFI password, you add an extra layer of security, preventing unauthorized users from changing the device's firmware settings. Set a strong UEFI password and store it in a secure location.

Set a UEFI password via the downloadable Surface UEFI Configurator and Surface Enterprise Management Mode (SEMM).

Enroll Surface Hub 3 in SEMM

You need a dedicated USB drive with at least 50 MB of storage space.

  1. Download Surface UEFI Configurator from Surface Tools for IT.

  2. Install UEFI Configurator and select Start.

    Screenshot showing UEFI Configurator Start

  3. Select Configuration Package > DFI.

    Screenshot showing screen to select DFI File

  4. Add your organizational Personal Information Exchange (PFE) certificate.

Note

This article assumes that you either obtain certificates from a third-party provider or already have expertise in PKI certificate services and know how to create your own. See Certificate Services Architecture documentation to learn more.

  1. Now you're ready to set a UEFI password. Select Password Protection. Enter and confirm your password. Select Next.

    Screenshot showing screen to set UEFI password

  2. Select Surface Hub 3 as the Surface type you want to target.

    Screenshot showing screen to select Surface Hub 3

  3. Optionally, you can configure components and advanced settings. Otherwise, continue to select Next.

  4. Select your USB drive and choose Build.

    Screenshot showing screen to build UEFI DFI Package

  5. Upon successful creation of the package, the Configurator displays the last two characters of your certificate's thumbprint. You need these characters when you import the configuration to Surface Hub 3.

    Screenshot showing UEFI Configurator completion

SEMM also includes various UEFI settings that you can configure, as described in the section Manage UEFI settings with SEMM, on this page.

Physically secure Surface Hub 3

Physical security is as crucial a tool as digital security. Devices like the Surface Hub in public conference rooms can be susceptible to physical damage or tampering. To protect Surface Hub, consider the following steps:

  • Tamper-evident seals: Use tamper-evident seals on the device. If someone attempts to open the device, the seal shows signs of tampering.
  • Security cables and locks: Use security cables and locks to secure the device to a heavy or immovable object, making it difficult for someone to walk away with it.
  • Surveillance: Depending on the workplace environment, you might opt to install surveillance cameras in the conference room. The mere presence of cameras can deter potential wrongdoers.

Differences with Windows 10 Team on Surface Hub & Surface Hub 2S

The following security features are no longer enabled by default on Surface Hub 3:

BitLocker

You can enable BitLocker via Intune when joined to Microsoft Entra ID (Azure AD). See Encrypt Windows devices with BitLocker in Intune to learn more.

To enable BitLocker on a stand-alone Surface Hub 3

  1. Sign in to Surface Hub 3 with admin credentials.
  2. Select Start, enter **Control, and open Control Panel.
  3. Select System & Security > BitLocker Drive Encryption > Turn on BitLocker.

Screenshot showing how to turn on BitLocker via Control Panel..

User Mode Code Integrity (UMCI)

UMCI enforces code integrity policies and ensures that only trusted code runs in user mode, helping to prevent the execution of malicious or untrusted code. You can configure UMCI via Group Policy when Hub 3 is joined to a Microsoft Entra domain or by using PowerShell cmdlets. UMCI is part of a set of features that you can manage with the Windows Defender Application Control (WDAC), which also includes configurable code integrity policies. To learn more, see Understand Windows Defender Application Control (WDAC) policy rules and file rules.

Microsoft Teams Rooms Pro Management

We highly recommend utilizing the Microsoft Teams Rooms Pro Management portal license. This cloud-based management platform is designed to elevate the meeting room experience by offering proactive monitoring and updates for Microsoft Teams Rooms devices and their peripherals. Intended for organizations looking to optimize their meeting environments, this service ensures real-time oversight and management of Microsoft Teams Rooms devices, including Surface Hub 3. By adopting this solution, organizations can significantly enhance usability and reliability for end users, ensuring seamless meeting experiences.

  • Intelligent operations: Utilizes software and machine learning to automate updates, detect problems, and resolve issues for Microsoft Teams Rooms.
  • Timely security updates: Automated update management ensures that security patches are applied promptly as they become available, minimizing the window of vulnerability and protecting devices from known security threats.
  • Update management: Automates the orchestration of meeting application and Windows updates based on customer-configurable deployment rings.

To learn more, see Microsoft Teams Rooms Pro Management.

Enterprise Management of Surface Hub 3

We recommend you join Surface Hub 3 to Microsoft Entra ID (Azure AD) and manage the device using Microsoft Intune or equivalent mobile device management (MDM) solution. The following table describes configuration management options for Intune.

Feature Description Learn More
Device configuration profiles Use Intune's endpoint protection settings to configure Windows Defender, firewall settings, and other security features to protect the device from potential threats. Create device profiles in Microsoft Intune
Device compliance policies Ensure the device complies with your organization's security standards. If a device falls out of compliance (e.g., if a required update isn't installed), you can configure automated remediation actions or notifications. Create device compliance policies in Microsoft Intune
Update management Use default update management settings to automatically install updates during a nightly maintenance window. Intune provides more options to customize if needed. Windows Update settings you can manage with Intune Update Ring policies for Windows 10/11 devices.
App management Use Intune to manage the apps installed on Surface Hub 3. Ensure only necessary apps related to Teams Rooms functionality are installed and regularly updated. Manage and secure apps in Intune
BitLocker encryption Ensure that the device's storage is encrypted using BitLocker. This protects data in case of unauthorized access or device theft. Note that, unlike Surface Hub 2S, Bitlocker is not installed by default. Encrypt Windows devices with BitLocker in Intune
WindowsLocal Administrator Password Solution Windows LAPS automatically manages local admin passwords, ensuring they're randomized and securely stored in Microsoft Entra ID (Azure AD). This reduces the risk associated with stale or widely-known admin passwords. Microsoft Intune support for Windows LAPS
Conditional access Set up conditional access policies to ensure the device can access corporate resources only when it meets specific conditions, such as compliance with security policies. Use Conditional Access with Microsoft Intune compliance policies
Network security Ensure the device is connected to a secure network segment. Use Intune to configure Wi-Fi settings, VPNs, or other network configurations to protect data in transit. Create a Wi-Fi profile for devices in Microsoft Intune

Network endpoints for Microsoft Intune
Remote Wipe and Lock In case of any security incidents, ensure you can remotely lock or wipe the device using Intune. Retire or wipe devices using Microsoft Intune
Audit and monitoring Regularly review audit logs and set up alerts for suspicious activities. Intune integrates with Microsoft Endpoint Manager and other Microsoft security solutions, providing a holistic view of device security. Audit changes and events in Microsoft Intune
User training Educate users about not leaving sensitive information visible on the screen.

If your organization has Microsoft Purview Data Loss Prevention (DLP), you can define policies that prevent people from sharing sensitive information in a Microsoft Teams channel or chat session.		 Data loss prevention and Microsoft Teams

Manage Group Policy settings in domain-joined scenarios

When integrating Teams Rooms with a domain, it's imperative to establish a separate, dedicated Organizational Unit (OU) specifically for Teams Rooms. This approach enables the application of Group Policy Object (GPO) exclusions directly to this OU, ensuring that only relevant policies affect Teams Rooms objects.

  • Disable GPO inheritance. It's crucial to disable all GPO inheritance within this OU to prevent the application of unsupported or irrelevant Group Policy settings to Teams Rooms.

  • Apply GPOs to OU before joining domain. Ensure that machine objects for Teams Rooms are created within this specific OU prior to domain joining. This step is essential to avoid the inadvertent application of default computer OU policies to Teams Rooms, thereby maintaining the intended configuration and security posture.

To learn more about configuring Group Policy in domain-joined scenarios, see the following resources:

Manage UEFI settings with SEMM

SEMM enables IT admins to lock down features at the firmware level that you might wish to implement depending on the security posture of your environment. Open Surface UEFI Configurator, as explained earlier, and go to the following screens:

Screenshot showing components to activate or deactivate.

Screenshot showing advanced settings to turn on or off.

Simultaneous Multi-Threading (SMT)

Commonly known as hyperthreading in Intel processors, SMT allows a single physical CPU core to execute multiple threads concurrently. This can improve performance in multi-threaded applications. However, there are specific scenarios where you might want to control the SMT setting. Some vulnerabilities, like speculative execution side-channel attacks (for example, L1 Terminal Fault, MDS vulnerabilities), can potentially exploit SMT to access sensitive data. Disabling SMT can mitigate the risk associated with these vulnerabilities, although at the cost of some performance. SMT is enabled by default.

IPv6 for PXE Boot

If your network infrastructure and security controls are primarily designed around IPv4 and still need to be fully equipped to handle IPv6 traffic securely, enabling IPv6 for PXE boot could introduce vulnerabilities. This is because IPv6 might bypass some of the existing security controls for IPv4.

While enabling IPv6 for PXE boot aligns with the broader industry move towards IPv6 adoption, it's essential to ensure that the network infrastructure, security controls, and operational practices are all equipped to handle IPv6 securely. If not, it might be safer to keep IPv6 for PXE boot disabled until those measures are in place.

Alternate Boot & USB Boot

The ability to boot from another source, such as a USB or Ethernet device, provides flexibility for system recovery but can also introduce vulnerabilities:

  • Unauthorized Operating Systems: If Alternate boot is enabled, an attacker with physical access to the device could boot the system using an unauthorized operating system from a USB drive. This could bypass the security controls of the primary OS.
  • Data Extraction: An attacker could boot from an external device to a system that allows direct access to the internal storage, potentially extracting sensitive data.
  • Malware Installation: Booting from an untrusted source could introduce malware, rootkits, or other malicious software at the system level.

Given these implications, organizations in highly secure workplace environments might choose to disable Alternate Boot and USB Boot to reduce the risk of unauthorized access or tampering.

Boot Order Lock

Enabling the "Boot Order Lock" enhances the security posture by ensuring it only boots from authorized sources. Boot Order Lock is turned off by default.

References

  1. Applies to Surface Hub 3 and Surface Hub 2S upgraded with Surface Hub 3 Pack.

Learn more