Windows security baselines: CIS and Microsoft benchmarks
You compare published Windows security baselines, measure current settings, close the gaps with GPOs and check for drift regularly.
Level 301 · 15 lessons · 15 practice labs
Lessons
Baselines
- Windows baselines: CIS, the Microsoft security baseline, STIG
- Importing a baseline as a GPO
- Seeing the gap with current settings using a policy analyser
- Conflicting settings and precedence
- Short task: list the ten most important gaps between the server and the baseline
Measuring
- Writing a settings audit script in PowerShell
- Querying security settings in the registry
- Seeing the policy actually applied with gpresult and RSoP
- Checking configuration drift with PowerShell DSC
- Short task: script a twenty-item compliance check
Rollout
- Pilot group and staged rollout
- Diagnosing applications broken by the baseline
- Exceptions and documentation
- Short task: fix the service that broke on the pilot server without an exception
Capstone
- Capstone: move a server group to the baseline and prepare a compliance report
Practice labs
- Compare the server with the baseline and list the top five gaps: Compare with Policy Analyzer and write down the five most critical gaps with setting and expected value.
- Work out which of two conflicting GPOs wins: Find two GPOs setting the same option differently, explain the precedence and show the effective value with gpresult.
- Keep a local setting that is stricter than the baseline: Notice that importing the baseline would loosen a stricter password setting and prepare a merged policy.
- Catch an item that looks compliant but is overridden locally: Compare the effective policy from RSoP with the registry and find the setting a local script overrides.
- Write a script that checks three security settings in the registry: Read three registry values with PowerShell and print PASS or FAIL for each.
- Extend the compliance script to ten items with CSV output: Add account and audit policy items to the script and write the results to CSV with the server name.
- Detect drift with DSC and report it: Write a simple DSC configuration, find the drifted setting with Test-DscConfiguration and report it before fixing.
- Find the GPO that did not apply in gpresult output: Find the denied GPO and its reason in the report, remove the cause and show it now applies.
- Link the baseline GPO to the pilot group: Link the GPO to the pilot OU only, set security filtering and show it does not reach a non-pilot server.
- Find why an application broke after the baseline: Find the setting the application trips over in the event logs and propose a fix without an exception.
- Write a narrow exception for an app tied to an old protocol: Define a narrow, time-limited, owned exception for the single server needing NTLMv1 and keep the rest protected.
- Decide to halt or continue the rollout from pilot results: Assess event and error records from the pilot servers and justify the decision to move to the next ring with evidence.
- Import a baseline GPO and review its settings: Import a ready baseline backup into a new GPO and list the settings in its password and audit sections.
- Open an exception record for a setting that deviates from the baseline: Fill in an exception record with owner, justification, compensating control and expiry date for a setting an old application prevents you applying.
- Find why the baseline GPO skips one server: Examine security filtering, the WMI filter and blocked inheritance, find why the policy is skipped on that server, fix it and prove it with gpresult.
About this course
You compare published Windows security baselines, measure current settings, close the gaps with GPOs and check for drift regularly.
What you will learn
- Baselines
- Measuring
- Rollout
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.