Microsoft Security Compliance Toolkit

The important starting point is that Policy Analyzer compares policy settings; it doesn’t certify a GPO as “Microsoft-approved” or secure. You need to compare your settings with an appropriate Microsoft security baseline, then review and document the differences.

Here’s a practical workflow:

1. Choose the correct baseline. From the Security Compliance Toolkit downloads, select the baseline matching the Windows/Windows Server version or product you’re assessing. Read its documentation and select the relevant role—for example, member server versus domain controller. Don’t combine unrelated baselines into one comparison.
2. Use proper GPO backups. Export your pre-production GPOs through Group Policy Management > Back Up. Policy Analyzer needs the policy data from the backups, not just HTML reports. Keep production backups separate.
3. Create the Microsoft reference set. In Policy Analyzer, click Add to open the Policy File Importer. Use File > Add files from GPO(s) to import the relevant baseline GPO backups, then import/save them as a clearly named .PolicyRules set.
4. Create your environment set. Repeat for the relevant pre-production GPO backups. Group policies that are intended to apply to the same type of system, rather than combining every GPO in the domain. Make a separate set for production.
5. Compare the sets. Select the baseline and pre-production entries, then click View / Compare. Review the setting names, values, differences, and conflicts. Use the viewer’s Excel export option to retain the comparison for your report. Repeat for production.

Interpret the findings carefully:

• Matching value: aligned with that baseline setting.
• Different value: needs review; it may be weaker, stronger, or a justified operational exception.
• Baseline setting absent from your set: not configured by the GPOs you imported. It doesn’t automatically mean the endpoint is unprotected.
• Conflicting values within your set: investigate GPO precedence and targeting. Policy Analyzer doesn’t resolve OU links, link order, security filtering, or WMI filtering into the effective policy for each computer.

For that last point, validate representative machines with Group Policy Results or gpresult /h report.html. The Compare to Effective State option concerns the machine running the tool, not every device governed by the imported GPOs.

Your report should record: setting, Microsoft recommendation, current value, affected systems, risk/impact, proposed action or exception, owner, and approval status. Pilot proposed changes in pre-production before deploying them to production.

Also check the downloaded package for PolicyAnalyzer.pdf. It explains the workflow and comparison displays. Use the results as evidence for a reviewed hardening assessment, not as an automatic pass/fail certificate.