Skip to content
WindowsHardening

Area 12 / 12

Security Baselines

Nobody should hand-pick hundreds of Group Policy settings from scratch. This area explains the Microsoft Security Compliance Toolkit, CIS Benchmarks and DISA STIGs, how they differ, how to compare them against what you already deploy with Policy Analyzer, and how to layer your own hardening on top without losing track of why each deviation exists.

Start the path

Learning path

0/4 done
  1. 01Windows security baselines: Microsoft SCT, CIS and STIGCompare the Microsoft Security Compliance Toolkit, CIS Benchmarks and DISA STIGs, then apply one with Policy Analyzer and LGPO, layer your own settings and track every deviation.
  2. 02Policy Analyzer and LGPO: compare, test, apply baselinesUse Policy Analyzer to diff GPOs, baselines and effective policy, and LGPO.exe to test, apply and export local policy on standalone machines and lab builds.
  3. 03Intune security baselines, settings catalog, GPO conflictsDeploy Intune security baselines without conflicts: baseline versions, settings catalog layering, endpoint security overlap, MDMWinsOverGP and on-device checks.
  4. 04Configuration drift: OSConfig, DSC and compliance reportsDetect and correct Windows configuration drift: OSConfig on Server 2025, PowerShell DSC auto-correct, Group Policy reprocessing, change events and reports.