Active Directory domain security hardening with Microsoft Security Compliance Manager (SCM). Twelve easy steps.

A step-by-step guide how to create, export and import Group Policy Objects with recommended security baselines for your domain.

The article provides a complete guide how to deploy the required GPO. The guide assumes that you deploy security baselines for Windows Server 2008 R2 SP1. You can easily adapt the guide for other versions of Windows.

Step 1. Prerequisites
Step 2. Domain Security Hardening GPO – Baseline design
Step 3. Domain Security Hardening GPO – Baseline export
Step 4. Domain Controllers Security Hardening GPO – Baseline customization
Step 5. Domain Controllers Security Hardening GPO – Baselines merge
Step 6. Domain Controllers Security Hardening GPO – Baselines export
Step 7. Member Servers Security Hardening GPO – Baseline design
Step 8. Member Servers Security Hardening GPO – Baseline export
Step 9. Target domain – GPO folders copying
Step 10. Target domain – The first GPO creation and settings import
Step 11. Target domain – Creation and import of two more GPO
Step 12. Target domain – GPO assignments

Step 1. Prerequisites

Download the latest version of the SCM tool from the Microsoft web site: http://technet.microsoft.com/en-us/library/cc677002.aspx.
Install SCM to your client computer.

Step 2. Domain Security Hardening GPO – Baseline design

Start Security Compliance Manager from the All Programs menu.

The main SCM window opens.

 

Expand Microsoft Baselines -> Windows Server 2008 R2 SP1 in the navigation pane. Select WS2008R2SP1 Domain Security Compliance 1.0.



Review the highlighted values suggested by SCM. Change if needed.
 

Step 3. Domain Security Hardening GPO – Baseline export

Select GPO backup (folder) task at the right pane.

 

Select a path to export the GPO and create a new folder named SCM Domain Security Hardening GPO.
 


GPO is exported to a folder.
Windows Explore opens automatically to display the folder.
The exported GPO will be later imported to a target domain.

Important note!
The highlighted values can be applied to a target domain only through a GPO that is linked to the root of the domain. The settings are NOT applied, if the GPO is linked to Domain Controllers OU.

 

Step 4. Domain Controllers Security Hardening GPO – Baseline customization

Domain controllers typically run Active Directory Domain Services and DNS services at the same time. Therefore we need a combined security baseline for these two services.
SCM includes two separate baselines that must be merged into a single one:

• WS2008R2SP1 DNS Server Security Compliance 1.0
• WS2008R2SP1 Domain Controller Security Compliance 1.1

Review both baselines first and adjust if needed.

Select the WS2008R2SP1 DNS Server Security Compliance 1.0 baseline.
The baseline for DNS servers contains only settings within the System Services section.
No customization is needed for this baseline.
 


Select the WS2008R2SP1 Domain Controller Security Compliance 1.1 baseline.
The baseline for domain controllers is complicated and contains hundreds of settings.
 

Step 5. Domain Controllers Security Hardening GPO – Baselines merge

To merge the baselines follow the steps below.

1. Select the WS2008R2SP1 Domain Controller Security Compliance 1.1 baseline.
2. Click the Compare/Merge link at the right pane.

 

3. Select the WS2008R2SP1 DNS Server Security Compliance 1.0 and click OK.

 

The window compares two baseline settings. No changes here.
4. Click Merge Baselines.

 

5. Resolve conflicts between the baselines by selecting the highlighted options. Click OK.
 


6. Name the new custom baseline Security Hardening - Domain Controllers and DNS Servers. Click OK.

 

7. The new custom baseline appears under the Custom Baselines node in the main window of SCM.
 

Step 6. Domain Controllers Security Hardening GPO – Baselines export

You must export the custom baseline in order to use it later in an Active Directory domain.


1. Select the Security Hardening - Domain Controllers and DNS Servers GPO.
2. Select the GPO Backup (folder) link in the right pane.

 

Select Computer > C: and then click the Make New Folder button.
Name the new folder Security Hardening - Domain Controllers and DNS Servers baseline.
Click OK.

 

Windows Explorer opens and displays the newly created folder. 

Step 7. Member Servers Security Hardening GPO – Baseline design

Review the WS2008R2SP1 Member Server Security Compliance 1.1 baseline. It doesn’t require any customization or merging with another baseline.

Important note!
This security hardening  baseline contains couple of settings that may break your web applications, including SharePoint and MS SQL Server Reporting Services. Please test this baseline carefully within non-prod environment first.  

 

Step 8. Member Servers Security Hardening GPO – Baseline export

You must export the WS2008R2SP1 Member Server Security Compliance 1.1 baseline in order to use it later in an Active Directory domain.


1. Select the WS2008R2SP1 Member Server Security Compliance 1.1.
2. Select the GPO Backup (folder) link in the right pane.

 

Select Computer > C: and then click the Make New Folder button.
Name the new folder Security Hardening – Member Servers GPO.
Click OK.

 

Windows Explorer opens and displays the newly created folder.

 

Step 9. Target domain – GPO folders copying

Logon to a domain controller of the target domain.
Copy exported GPO folders from remote computer to the drive C: of the domain controller.

 

Step 10. Target domain – The first GPO creation and settings import

Open the Group Policy Management console.


1. Select the Group Policy Objects node.
2. From the Action menu select New.

 

Type Security Hardening: Domain Security Compliance in the Name field.
Click OK.

 

Select the newly created GPO.
Select Action > Import Settings… .

 
Import Settings Wizard window opens.


Click Next.

 

Click Next.

 

Browse to the folder that contains exported GPO.
Click Next.
 


Click Next.

 

Click Next.

 

Click Next.

 

Click Finish.

 

Click OK.
 

Step 11. Target domain – Creation and import of two more GPO

Repeat the Import Settings Wizard steps (see Step 10) for the other previously exported GPO:

• Security Hardening – Domain Controllers and DNS Servers GPO;
• Security Hardening – Member Servers GPO.

Step 12. Target domain – GPO assignments

Assign the newly created GPO according the table

GPO name	Target
Security Hardening - Domain Security Compliance	The domain root
Security Hardening - Domain Controllers and DNS Servers	Domain Controllers OU
Security Hardening - Member Servers	Servers OU

Unlink all other default GPO from the containers.
The domain Group Policy Objects assignments should look like this:

 

Conclusion

Domain security hardening process is not a complicated process when you use the right tools. Tricky thing, however, that every security hardening policy requires thorough testing in a non-prod environment. Especially if you deploy it in a domain where applications have already been installed and configured.