Skip to main content

Enterprise Hardening Baselines: Microsoft Security Compliance Toolkit & Policy Analyzer

The "Why" Before the "How": Moving Beyond Random Checklists​

Out-of-the-box Windows Server and Windows 11 configurations are optimized for backwards compatibility with legacy software, not maximum security. Legacy protocols like LLMNR, NetBIOS Name Service (NBT-NS), SMBv1, and unauthenticated RPC endpoints remain enabled by default, presenting low-hanging fruit for network adversaries.

However, randomly modifying Group Policy settings without a disciplined framework frequently breaks business-critical line-of-business applications and domain authentication.

Enterprise systems engineering utilizes the Microsoft Security Compliance Toolkit (SCT):

  • Importing peer-reviewed, Microsoft-curated security baselines designed specifically for Windows Server 2022 and Windows 11 Enterprise.
  • Running Policy Analyzer to calculate exact deltas, identify conflicting settings across inherited GPOs, and verify baseline compliance before linking policies to production OUs.

1. Core Hardening Targets: Eliminating Legacy Attack Vectors​

Our baseline explicitly targets four notorious legacy attack vectors:

Hardening TargetVulnerability / Threat VectorEnforced GPO SettingProduction Impact & Verification
LSASS RunAsPPLAttackers dump LSASS process memory to steal plaintext passwords and Kerberos tickets.Computer Configuration > Administrative Templates > System > Local Security Authority > Configures LSASS to run as a protected process = Enabled with UEFI lockPrevents non-protected processes from injecting DLLs or opening PROCESS_VM_READ handles into LSASS.
LLMNR & NBT-NSAttackers run Responder to poison multicast name resolution broadcasts and capture NTLMv2 challenge-response hashes.Network > DNS Client > Turn off multicast name resolution = EnabledForces all internal name resolution through authoritative DNS servers (10.1.1.10), eliminating broadcast spoofing.
SMBv1 DeprecationRemote Code Execution via legacy SMB vulnerabilities (EternalBlue / WannaCry).System > LanmanServer > Parameters > SMB1 = DisabledEnsures only encrypted, modern SMBv2/SMBv3 dialects negotiate across the network.
NTLMv1 DisablementWeak cryptographic DES-based NTLM responses easily cracked offline via Rainbow Tables.Security Settings > Local Policies > Security Options > Network security: LAN Manager authentication level = Send NTLMv2 response only. Refuse LM & NTLMEnforces strong HMAC-MD5 NTLMv2 authentication across all domain members.

2. Using Policy Analyzer to Audit GPO Deltas​

Before applying newly imported baselines to Active Directory, we run Policy Analyzer to compare existing production Group Policy Objects against the Microsoft baseline:

flowchart LR
    DefaultGPO["Existing Default Domain Policy"] --> PolicyAnalyzer["Policy Analyzer Tool"]
    MSBaseline["Microsoft Windows 11 Security Baseline"] --> PolicyAnalyzer
    PolicyAnalyzer --> DeltaReport["Conflict & Delta Matrix<br>• Identifies conflicting registry keys<br>• Highlights redundant policies<br>• Audits compliance gaps"]

Steps to Run Policy Analyzer:​

  1. Open PolicyAnalyzer.exe from the Microsoft Security Compliance Toolkit.
  2. Click Add and import the backup XML/INF files of the existing domain policies.
  3. Import the official Microsoft Security Baseline GPO files.
  4. Click View / Compare to generate the comparison matrix:
    • Yellow highlights: Settings where policies conflict.
    • White cells: Settings where policies match.
    • Grey cells: Settings defined in the baseline but missing from production.

3. Verification: Trust, but Verify​

1. Verify LSASS Protected Process Light (PPL) Status​

Run PowerShell on a hardened endpoint to verify that LSASS is running with protected process status:

Get-Process lsass | Select-Object Name, Id
(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa").RunAsPPL

Expected Healthy Value:

1

(A value of 1 or 2 confirms LSASS is running as a Protected Process Light, blocking unprivileged memory dumping tools).

2. Verify LLMNR Is Disabled via Registry​

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast"

Expected Healthy Value:

0

(Value 0 confirms that LLMNR broadcast traffic is completely suppressed).