Forum Discussion

Haruko_N's avatar
Haruko_N
Copper Contributor
Dec 06, 2022

Microsoft Security Compliance Toolkit 1.0 - Script File for 2012 R2

My customer is looking for the local script files for Microsoft Security Compliance Toolkit 1.0,  which are missing. These are available on Windows 2016 up but not on Windows 2012 R2. If you can tell...
Haruko_N's avatar
Haruko_N
Copper Contributor
Dec 06, 2022
CSS team recommended download via GPO but customer replied that GPO is not an option since the installation is for a stand-alone server and not domain-joined server. Please see if there are other means of installing the baseline to Win 2012 R2?
AaronMargosis_Tanium's avatar
AaronMargosis_Tanium
Iron Contributor
Dec 06, 2022
Use the LGPO.exe tool with /g and the root path of the GPO you want to apply. GPOs\{631572F1-2CE9-481D-8FAB-A1553A4DBD56} is the Domain Controller baseline; GPOs\{AB1A03CA-A251-4FDC-9C95-3BFE14EF9A54} is the Member Server baseline. Optionally add /v to the LGPO.exe command line for verbose output.
  • Xuefeng_L's avatar
    Xuefeng_L
    Icon for Microsoft rankMicrosoft
    Dec 07, 2022
    Hi Aaron, the customer said that their target server is a stand-alone server. Not a domain controller nor joined to domain.

    I recognized that the following policy should be applied based on the above assumption, is this correct?
    GPOs\{AB1A03CA-A251-4FDC-9C95-3BFE14EF9A54}

    GPOs\{AB1A03CA-A251-4FDC-9C95-3BFE14EF9A54}
    • Gary_666's avatar
      Gary_666
      Copper Contributor
      Dec 07, 2022

      Xuefeng_L AaronMargosis_Tanium 

      Dear Aaron, hope you doing well!

      CX raised concern that target server is a standalone server, non-domain joined, there is no such baseline for a standalone server neither, the point here is that whether LGPO can functions as a workaround for local script which was missing in the tookit package, and whether baseline listed below can work as a solution? Namely, can baseline for DC or member server functions as a workaround for standalone server? Appreciate your reply. 

       

    • Xuefeng_L's avatar
      Xuefeng_L
      Icon for Microsoft rankMicrosoft
      Dec 09, 2022

      Hi AaronMargosis_Tanium , we would appreciate if you could share your knowledge.

      • AaronMargosis_Tanium's avatar
        AaronMargosis_Tanium
        Iron Contributor
        Dec 14, 2022

        Xuefeng_L 

         

        Good points you raise. The scripts that come with the newer baseline packages include switches for non-domain joined. What they do when you select one of them is to import the domain-member GPO(s) but then apply a couple of modifications in the ConfigFiles\DeltaForNonDomainJoined.* files, reverting the logon rights SeDenyNetworkLogonRight and SeDenyRemoteInteractiveLogonRight, and setting LocalAccountTokenFilterPolicy so that administrative local accounts can be used over the network. It should work if you bring those config files over and use LGPO.exe to apply those deltas:

         

        lgpo.exe /v /s ConfigFiles\DeltaForNonDomainJoined.inf /t ConfigFiles\DeltaForNonDomainJoined.txt

         

Resources