Microsoft Security Compliance Toolkit

Hi Laura,

Thanks for the reply its appreciated

I have executed the Policy Viewer and imported one Backup GPO from pre-prod using the Add button and Add Files from GPO. . .  option.

The object that is in the container that the Backup GPO processes against is a W2012R2 server. In my policy Analyzer tool I have selected MSFT-WS2012RS-FINAL and the Backup GPO called Windows update Policy. 

I have run the View / Compare option and am presented with quite a bit of information I assume relate to MSFT-WS2012R2-FINAL and the Backup GPO. See below.

However, I have a few questions about the output and what it means. I see a yellow CONFLICT  on the report and the Policy Type is Audit Policy. I am not sure what this is and what it means to the Backup GPO. See Below. 

I see information on the Backup GPO but not on the MSFT-WS2012R2-FINAL side of the output, could you explain what this means, I assume its settings on the Backup GPO that MSFT-WS2012R2-FINAL doesn't apply against the security Hardening for itself, I also see quite a bit of information on the MSFT-WS2012R2-FINAL side that and is grey Blank on the Backup GPO side. See Below.

One final question relates to the Policy Type again, and specifically the Security Template. I see quite a lot of information on the MSFT-WS2012R2-FINAL i see quite a lot of information regarding Security Templates and nothing on the Backup GPO side also there appears to be quite a few Yellow Conflicts. Please could you let me know what this all means. See Below.

Your help in this matter is greatly appreciated.

Regards.

The important starting point is that Policy Analyzer compares policy settings; it doesn’t certify a GPO as “Microsoft-approved” or secure. You need to compare your settings with an appropriate Microsoft security baseline, then review and document the differences.

Here’s a practical workflow:

1. Choose the correct baseline. From the Security Compliance Toolkit downloads, select the baseline matching the Windows/Windows Server version or product you’re assessing. Read its documentation and select the relevant role—for example, member server versus domain controller. Don’t combine unrelated baselines into one comparison.
2. Use proper GPO backups. Export your pre-production GPOs through Group Policy Management > Back Up. Policy Analyzer needs the policy data from the backups, not just HTML reports. Keep production backups separate.
3. Create the Microsoft reference set. In Policy Analyzer, click Add to open the Policy File Importer. Use File > Add files from GPO(s) to import the relevant baseline GPO backups, then import/save them as a clearly named .PolicyRules set.
4. Create your environment set. Repeat for the relevant pre-production GPO backups. Group policies that are intended to apply to the same type of system, rather than combining every GPO in the domain. Make a separate set for production.
5. Compare the sets. Select the baseline and pre-production entries, then click View / Compare. Review the setting names, values, differences, and conflicts. Use the viewer’s Excel export option to retain the comparison for your report. Repeat for production.

Interpret the findings carefully:

• Matching value: aligned with that baseline setting.
• Different value: needs review; it may be weaker, stronger, or a justified operational exception.
• Baseline setting absent from your set: not configured by the GPOs you imported. It doesn’t automatically mean the endpoint is unprotected.
• Conflicting values within your set: investigate GPO precedence and targeting. Policy Analyzer doesn’t resolve OU links, link order, security filtering, or WMI filtering into the effective policy for each computer.

For that last point, validate representative machines with Group Policy Results or gpresult /h report.html. The Compare to Effective State option concerns the machine running the tool, not every device governed by the imported GPOs.

Your report should record: setting, Microsoft recommendation, current value, affected systems, risk/impact, proposed action or exception, owner, and approval status. Pilot proposed changes in pre-production before deploying them to production.

Also check the downloaded package for PolicyAnalyzer.pdf. It explains the workflow and comparison displays. Use the results as evidence for a reviewed hardening assessment, not as an automatic pass/fail certificate.