Add option to Compliance Baselines to decide what happens when a device falls out of scope of the Baseline
With the idea of using Baselines to replace Group Policy when possible, Baselines/CIs should have an option of what step(s) to perform when a device/user is no longer in scope of the settings.
When a Group Policy is applied, most will remove their settings (usually a "Policies" reg key), that will restore the unmodified settings to what they were previously.
With Baselines/CIs, it is possible to modify the "Policies" key/value, but when an object falls out of scope of the Baseline, it is not possible to remove that change to restore the original setting.
Baselines/CIs should have an option to determine what happens when an object is no longer in scope, such as "Do Nothing (Leave in place)", "Remove Setting" (helpful for reg settings), "Run script" (to allow additional changes that may be necessary to remove the setting than removing a simple file/reg).