Windows security baselines: Microsoft SCT, CIS and STIG

A Windows Group Policy inventory contains thousands of settings. Choosing each one yourself is slow, error-prone and hard to defend in an audit. Security baselines solve this: curated, versioned sets of settings produced by people who have tested them against thousands of environments. The work for you is choosing one, applying it without breaking things, and managing the exceptions.

The three main baselines

Microsoft baselines are deliberately lean. CIS configures more settings explicitly, which helps auditors but produces more GPO noise. STIGs are the strictest and assume a government context.

You can also look at national guidance such as the French ANSSI recommendations for Active Directory and Windows, or the Australian Essential Eight maturity model, which map to many of the same settings.

Step 1: get the Microsoft Security Compliance Toolkit

The Security Compliance Toolkit (SCT) from the Microsoft Download Center contains, per product version:

• Baseline packages: GPO backups (for example MSFT Windows 11 24H2 - Computer, MSFT Windows Server 2025 - Member Server, - Domain Controller), documentation spreadsheets listing every setting and why, and local-install scripts.
• Policy Analyzer: compares sets of GPOs and local policy, highlights conflicts and differences.
• LGPO.exe: imports, exports and applies local Group Policy, for non-domain systems and testing.

There are separate baselines for Microsoft 365 Apps and Microsoft Edge, which matter just as much as the OS baseline: Office macro and add-in settings are among the most effective controls you can apply.

Step 2: compare against what you already have

Before importing anything, see how far your current GPOs are from the baseline. Back up your existing GPOs (Backup-GPO -All -Path C:\GPOBackup), then in Policy Analyzer:

1. Add your GPO backups as one policy rule set.
2. Add the baseline GPOs as another.
3. View / Compare: the grid shows every setting, its value in each set, and highlights conflicts (same setting, different values).

Export the comparison to Excel. This is your gap list, and it usually contains some surprises: old GPOs that weaken the default (for example re-enabling LM hashes or SMBv1), conflicting settings from different teams, and settings nobody can explain.

You can also compare the effective local policy of a running machine against the baseline, which catches drift from scripts, local changes or software installers.

Step 3: import and link in rings

Create new GPOs from the baseline backups rather than merging into existing ones, so the baseline stays identifiable and upgradable:

Import-GPO -BackupGpoName "MSFT Windows 11 24H2 - Computer" `
  -Path "C:\SCT\Windows 11 24H2 Security Baseline\GPOs" `
  -TargetName "BL - Win11 24H2 - Computer" -CreateIfNeeded

Then:

• Link to a pilot OU first, with representative hardware and users.
• Keep baseline GPOs unmodified. Put your deviations in a separate, higher-precedence GPO named for what it does, for example BL-Exceptions - Win11 - Legacy scanner SMB.
• Link to production OUs ring by ring, as with update rings.

For Intune-managed devices, use Endpoint security > Security baselines (Windows, Defender for Endpoint, Edge, Microsoft 365 Apps). The same principle applies: keep the baseline profile close to default and put exceptions in separate profiles.

Step 4: test the settings that commonly break things

Most baseline settings are uneventful. The ones that most often generate tickets:

The detailed guides on this site cover the measurement step for each: legacy protocols, Credential Guard, ASR rules.

Step 5: add what baselines leave to you

Baselines are a floor, not the whole building. Controls you usually need to add on top:

• Windows LAPS and admin tiering logon restrictions (specific to your OU and group design).
• ASR rules beyond the few included, and App Control policies.
• Firewall rules scoped to your management networks.
• Audit and Sysmon settings and log forwarding tuned to your SIEM.
• LLMNR / NetBIOS / WPAD settings, depending on the baseline version.

Step 6: document deviations and measure drift

For every setting you don't apply, or apply differently, record: setting, baseline value, your value, reason, risk, compensating control, owner and review date. Auditors ask for this, and it forces the question "do we still need this exception?" every year.

To measure compliance on endpoints:

• Policy Analyzer against local policy on sampled machines.
• CIS-CAT (Lite free, Pro for members) for CIS benchmark scoring.
• Open-source tools such as HardeningKitty, which audits a machine against CIS, Microsoft and other finding lists and reports each deviation.
• OSConfig on Windows Server 2025: apply and keep a baseline in place, with drift correction, from PowerShell:

Install-Module -Name Microsoft.OSConfig -Scope AllUsers -Repository PSGallery -Force
Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WindowsServer/2025/MemberServer -Default
Get-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WindowsServer/2025/MemberServer |
  Format-Table Name, @{n='Status';e={$_.Compliance.Status}}, @{n='Reason';e={$_.Compliance.Reason}}

Step 7: keep up with new versions

Microsoft publishes a new baseline with each Windows feature release (and for Office and Edge more frequently), usually announced on the Microsoft Security Baselines blog with a list of changes. CIS publishes new benchmark versions on its own cadence. Treat each release as a small project: diff it with Policy Analyzer against the previous version, read what changed and why, pilot, then roll out.

Checklist

• Baseline chosen (Microsoft, CIS Level 1, or STIG) per OS, Office and Edge
• Current GPOs compared with Policy Analyzer; weakening settings removed
• Baseline GPOs imported unmodified, exceptions in separate GPOs
• Rolled out ring by ring, known-breaking settings measured first
• Controls beyond the baseline (LAPS, tiering, ASR, App Control, firewall, logging) layered on top
• Deviation register with owners and review dates
• Compliance measured (Policy Analyzer, CIS-CAT, HardeningKitty, OSConfig)
• New baseline versions reviewed when released

A baseline turns hardening from a collection of opinions into a versioned, reviewable configuration. The rest of this site explains the individual controls that matter most, and why they are worth the exceptions work.