security baseline
90 TopicsAnnouncing Windows Server 2025 Security Baseline Preview
Announcing Windows Server 2025 Security Baseline Preview Hello Windows Server Insiders! Today we are pleased to announce the Windows Server 2025 Security Baseline Preview. You can enable security right from the start by applying the recommended security posture for your device or VM role through application of a tailored security baseline, with over 350 preconfigured Windows security settings that help you apply and enforce granular security settings that support best practices recommended by Microsoft and Industry standards. We have organized the Windows Server 2025 Security Baseline content into three categories based on your server role: Domain Controller (DC) Member Server Workgroup Member In addition, you can apply baselines with dedicated security settings specific to: Windows Defender Antivirus (48) Secured-Core (6) Main Highlights of the security baseline are the following enforcements: Secured-Core – UEFI MAT, Secure Boot, Signed Boot Chain Account and password policies Security Policies and Security Options Protocols: TLS Enforced >1.2+, SMB 3.0+, Kerberos AES, etc. Credentials Protections (LSASS/PPL) And many more. Please review the GitHub repository for what settings comprise of each definition: https://github.com/microsoft/osconfig/blob/main/security/SecurityBaseline_WindowsServer_2025-2409.csv Customer Experience: The customer experience to apply baselines for individual machines, including image customizations are: PowerShell cmdlets Windows Admin Center (WAC) For at-scale operations, you can apply baseline and monitor using Azure Policy and Azure Automanage Machine Configuration and see your compliance score. The baseline experience is powered by ‘OSConfig - our newly introduced security configuration platform’. Once applied, your baseline settings are protected from any drift automatically, which is one of the key features of the security platform. The WAC, Azure Policy and Azure Automanage Machine Configuration experiences will be released soon to the Windows Insider Program. This mechanism will not work for any earlier version of Windows Server. 1. Download prerelease modules from the PowerShell Gallery If you have not previously configured your system to pull modules from the PowerShell Gallery, please do so using the following steps: a. Open an elevated PowerShell window (not the x86 version) b. Run Install-PackageProvider NuGet, PowerShellGet -Force c. Open a new elevated PowerShell window d. Run Set-PSRepository -Name PSGallery -InstallationPolicy Trusted 2. Install the OSConfig PowerShell module Run Install-Module -Name Microsoft.OSConfig -AllowPrerelease -Scope AllUsers -Repository PSGallery -Force To verify if the OSConfig module is installed, run Get-Module -ListAvailable -Name Microsoft.OSConfig 3. Apply the Security Baseline via PowerShell cmdlets For domain-joined device, run Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Default For workgroup device, run Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\WorkgroupMember -Default For domain controller device, run Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WS2025/DomainController -Default For Secured-core, Run Set-OSConfigDesiredConfiguration -Scenario SecuredCore -Default For Defender Antivirus, Run Set-OSConfigDesiredConfiguration -Scenario Defender\Antivirus -Default Restart machine 4. Customize the Security Baseline via PowerShell cmdlets Example using AuditDetailedFileShare for Member Server device (where the default value is 2) Run Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Name AuditDetailedFileShare -Value 3 Run Get-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Name AuditDetailedFileShare Check that the value is now 3. 5. View compliance of the Security Baseline via PowerShell cmdlets Run Get-OSConfigDesiredConfiguration -Scenario SecuredCoreState Run Get-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer | ft Name, @{ Name = "Status"; Expression={$_.Compliance.Status} }, @{ Name = "Reason"; Expression={$_.Compliance.Reason} } -AutoSize -Wrap 6. Most Common tasks impacted/Known Issues after applying baseline Note: (Please read before exercising the scenario! Also, these scripts are for preview only and should not be used in production.) Password requirements are Complexity and Minimum of 14-character length. This only applies to local user accounts; when signing in with a domain account, domain requirements prevail for domain accounts. TLS connections are subject to a minimum of TLS/DTLS 1.2 or higher. May prevent connections to older systems. Copy/Paste of files from RDP sessions is disabled. If you need to use this function, run: Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\[role being applied] -Name RemoteDesktopServicesDoNotAllowDriveRedirection -Value 0 and then reboot. SMB connections are subject to a minimum of 3.0 or higher (available as of WS2012). Connecting to non-windows systems (like Linux SAMBA) must support SMB 3.0, or adjustments to the baseline are needed. You may run into a few user rights errors depending on your domain configuration. It does not impact the rest of the security baseline and can be ignored. We are working on fixing it. See MSLearn doc for details. If you are configuring the same settings with two different tools (one being OSConfig in this case), there will be conflicts, especially with drift control involved. See MSLearn doc for details. In case you are blocked or experiencing a work disruption after applying the security baseline: File a bug in feedback hub under Category Windows Server-> Security Configuration Management You should preview the security baseline only on test systems. While there is a ‘Remove’ command, not all configurations can be reversed. Open an elevated PowerShell window, run Remove-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer and then reboot. We value your feedback! Please provide feedback as to what is working and what needs to be improved as your feedback is extremely valued to make the product experience better. Please use Feedback Hub app for Windows Server 2025. Category: Windows Server->Security Configuration Management You can also reach us via email at heseccon@microsoft.com Edge Security Connect. What’s coming? We will also share a Windows Admin Center, Azure Policy and Azure Automanage Machine Configuration experience, to try out for getting full E2E experience & Application control for Windows Insider Program!!16KViews8likes0CommentsAnnouncing Microsoft Defender Vulnerability Management in public preview
Today, we are thrilled to announce the public preview of Microsoft Defender Vulnerability Management, a single solution offering the full set of Microsoft’s vulnerability management capabilities to help take your threat protection to the next level.Security baseline (DRAFT) for Chromium-based Microsoft Edge, version 79
The draft release of the recommended security configuration baseline settings for the next version of Microsoft Edge based on Chromium, version 79. The downloadable draft baseline package includes importable GPOs, a script to apply the GPOs to local policy, a script to import the GPOs into Active Directory Group Policy, and all the recommended settings in spreadsheet form, as Policy Analyzer rules, and as GP Reports.Security baseline for Office 365 ProPlus (v1907, July 2019) - DRAFT
The draft release of the recommended security configuration baseline settings for Microsoft Office 365 ProPlus, version 1907. Highlights include componentization of GPOs so that "challenging" settings are grouped and treated as cohesive units; comprehensive blocking of legacy file formats; and blocking Excel from using DDE. The downloadable attachment includes GPOs that can be imported into AD, a script to apply the GPOs to local policy, documentation, and more.Security baseline (FINAL) for Chromium-based Microsoft Edge, version 79
The final release of the recommended security configuration baseline settings for the next version of Microsoft Edge based on Chromium, version 79. The baseline package - in the Security Compliance Toolkit - includes importable GPOs, a script to apply the GPOs to local policy, a script to import the GPOs into Active Directory Group Policy, and all the recommended settings in spreadsheet form, as Policy Analyzer rules, and as GP Reports.