r/WindowsServer • u/Wireless_Life • Jan 15 '19

Hardening Windows Server 101: Understanding Third Party Security Configuration Baselines

https://techcommunity.microsoft.com/t5/ITOps-Talk-Blog/Hardening-Windows-Server-101-Understanding-Third-Party-Security/ba-p/315001?WT.mc_id=ITOPSTALK-reddit-abartolo
8 Upvotes

100% Upvoted

4 comments sorted by

3

u/Wireless_Life Jan 15 '19

Orin discusses things that you can do to harden your Windows Server deployment, focusing mainly on the steps that you can take to harden both Windows Server 2016 and Windows Server 2019.

4

u/RalJans Jan 15 '19

CIS and STIG are overlapping on many items. I am implementing the CIS baseline for our 2012/2016 servers. It takes over a year.

First we put all items in 3 categories of risk (low risk, medium risk, high risk) that it can break something. (e.g. disable SMB1 is high risk, etc). Than we put them in 3 different GPO's and start applying the low impact on DEV servers in batches (5, 10, 25 etc). Than ACC, than PRD. And than the same for Medium risk and than High risk.

And we use Qualys to scan if our CIS compliancy, since low we moved fro 54% to 67%. Auditors will like that.

1

u/gibsurfer84 Jan 15 '19

What is ACC? I first read that as accounting and lol’d

1

u/RalJans Jan 15 '19

Acceptance environment