Security baseline script not working

Question

&nbsp; Recently I tried to run the security baseline script on the Win 2019 (Version 1809, OS Build 17763.4252) . But always failed ( can't see any change&nbsp; on the password length for example). Here below is the log files. Not sure if there are any experts can instruct me how to solve this? Many thanks in advance.&nbsp;&nbsp;------------------here below is the log-----------------------------&nbsp;Baseline-LocalInstall.ps1, 4/14/2023 9:30:28 AM--------------------------------------------------------------------------------------------------Windows Server - non-domain-joinedGPOs to be installed:MSFT Internet Explorer 11 - ComputerMSFT Internet Explorer 11 - UserMSFT Windows 10 1909 and Server 1909 - Defender AntivirusMSFT Windows 10 1909 and Server 1909 - Domain SecurityMSFT Windows 10 1909 and Server 1909 Member Server - Credential GuardMSFT Windows Server 1909 - Member Server==================================================================================================Copy custom administrative templates...==================================================================================================Configuring Client Side Extensions...LGPO.exe v2.2 - Local Group Policy Object utilityEnabling Group Policy client side extension for local policy: Mitigation OptionsEnabling Group Policy client side extension for local policy: Advanced Audit Policy ConfigurationEnabling Group Policy client side extension for local policy: Internet Explorer Zone MappingEnabling Group Policy client side extension for local policy: Device Guard, Virtualization Based Security==================================================================================================--------------------------------------------------------------------------------------------------Applying GPO "MSFT Internet Explorer 11 - Computer"...--------------------------------------------------------------------------------------------------LGPO.exe v2.2 - Local Group Policy Object utilityImport Machine settings from registry.pol: ..\GPOs\{6E2073CE-B1B5-4A0F-B1E4-C007BD052B18}\DomainSysvol\GPO\Machineegistry.pol; ----------------------------------------------------------------------; PROCESSING Computer POLICY; Source file: ..\GPOs\{6E2073CE-B1B5-4A0F-B1E4-C007BD052B18}\DomainSysvol\GPO\Machineegistry.polComputerSoftware\Microsoft\Windows\CurrentVersion\Policies\ExtRunThisTimeEnabledDWORD:0ComputerSoftware\Microsoft\Windows\CurrentVersion\Policies\ExtVersionCheckEnabledDWORD:1ComputerSoftware\Policies\Microsoft\Internet Explorer\DownloadRunInvalidSignaturesDWORD:0ComputerSoftware\Policies\Microsoft\Internet Explorer\DownloadCheckExeSignaturesSZ:yesComputerSoftware\Policies\Microsoft\Internet Explorer\MainIsolation64BitDWORD:1ComputerSoftware\Policies\Microsoft\Internet Explorer\MainDisableEPMCompatDWORD:1ComputerSoftware\Policies\Microsoft\Internet Explorer\MainIsolationSZ:PMEMComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL(Reserved)SZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOLiexplore.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOLexplorer.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLINGexplorer.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLINGiexplore.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING(Reserved)SZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFINGexplorer.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFINGiexplore.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING(Reserved)SZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL(Reserved)SZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALLexplorer.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALLiexplore.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD(Reserved)SZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOADiexplore.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOADexplorer.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND(Reserved)SZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBANDiexplore.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBANDexplorer.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONSiexplore.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS(Reserved)SZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONSexplorer.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION(Reserved)SZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATIONexplorer.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATIONiexplore.exeSZ:1ComputerSoftware\Policies\Microsoft\Internet Explorer\PhishingFilterPreventOverrideAppRepUnknownDWORD:1ComputerSoftware\Policies\Microsoft\Internet Explorer\PhishingFilterPreventOverrideDWORD:1ComputerSoftware\Policies\Microsoft\Internet Explorer\PhishingFilterEnabledV9DWORD:1ComputerSoftware\Policies\Microsoft\Internet Explorer\RestrictionsNoCrashDetectionDWORD:1ComputerSoftware\Policies\Microsoft\Internet Explorer\SecurityDisableSecuritySettingsCheckDWORD:0ComputerSoftware\Policies\Microsoft\Internet Explorer\Security\ActiveXBlockNonAdminActiveXInstallDWORD:1ComputerSoftware\Policies\Microsoft\Windows\AxInstallerOnlyUseAXISForActiveXInstallDWORD:1ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet SettingsSecurity_zones_map_editDWORD:1ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet SettingsSecurity_options_editDWORD:1ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet SettingsSecurity_HKLM_onlyDWORD:1ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet SettingsCertificateRevocationDWORD:1ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet SettingsPreventIgnoreCertErrorsDWORD:1ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet SettingsWarnOnBadCertRecvingDWORD:1ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet SettingsEnableSSL3FallbackDWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet SettingsSecureProtocolsDWORD:2560ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\01C00DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\11C00DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\21C00DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\32301DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\42301DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\41C00DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapUNCAsIntranetDWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\01C00DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0270CDWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1270CDWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\11201DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\11C00DWORD:65536ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\21C00DWORD:65536ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2270CDWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\21201DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32001DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32102DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31802DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3160ADWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31201DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31406DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31804DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32200DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31209DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31206DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31809DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32500DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32103DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31606DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32402DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32004DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31C00DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31001DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31A00DWORD:65536ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32708DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31004DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3120bDWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31407DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31409DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3270CDWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31607DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32709DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32101DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\32301DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\31806DWORD:1ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3120cDWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3140CDWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41608DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41201DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41001DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41607DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4120bDWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41809DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41004DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41606DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41407DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4160ADWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41406DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42102DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42004DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42200DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42000DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41402DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41803DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42402DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41400DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41A00DWORD:196608ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42001DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42500DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41409DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41C00DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41209DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4270CDWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41206DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42708DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41802DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42103DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42709DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41405DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42101DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\42301DWORD:0ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41200DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41804DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\41806DWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4120cDWORD:3ComputerSoftware\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4140CDWORD:3; Computer POLICY SAVED.; ----------------------------------------------------------------------==================================================================================================--------------------------------------------------------------------------------------------------Applying GPO "MSFT Internet Explorer 11 - User"...--------------------------------------------------------------------------------------------------LGPO.exe v2.2 - Local Group Policy Object utilityImport User settings from registry.pol: ..\GPOs\{4E60D2FB-5E65-4AAB-843E-836833DEFA15}\DomainSysvol\GPO\Useregistry.pol; ----------------------------------------------------------------------; PROCESSING User POLICY; Source file: ..\GPOs\{4E60D2FB-5E65-4AAB-843E-836833DEFA15}\DomainSysvol\GPO\Useregistry.polUserSoftware\Policies\Microsoft\Internet Explorer\Control PanelFormSuggest PasswordsDWORD:1UserSoftware\Policies\Microsoft\Internet Explorer\MainFormSuggest PW AskSZ:noUserSoftware\Policies\Microsoft\Internet Explorer\MainFormSuggest PasswordsSZ:no; User POLICY SAVED.; ----------------------------------------------------------------------==================================================================================================--------------------------------------------------------------------------------------------------Applying GPO "MSFT Windows 10 1909 and Server 1909 - Defender Antivirus"...--------------------------------------------------------------------------------------------------LGPO.exe v2.2 - Local Group Policy Object utilityImport Machine settings from registry.pol: ..\GPOs\{6359FA45-B4E8-4B56-864A-591B4DD8642C}\DomainSysvol\GPO\Machineegistry.pol; ----------------------------------------------------------------------; PROCESSING Computer POLICY; Source file: ..\GPOs\{6359FA45-B4E8-4B56-864A-591B4DD8642C}\DomainSysvol\GPO\Machineegistry.polComputerSoftware\Policies\Microsoft\Windows DefenderPUAProtectionDWORD:1ComputerSoftware\Policies\Microsoft\Windows Defender\Real-Time ProtectionDisableBehaviorMonitoringDWORD:0ComputerSoftware\Policies\Microsoft\Windows Defender\ScanDisableRemovableDriveScanningDWORD:0ComputerSoftware\Policies\Microsoft\Windows Defender\SpynetSubmitSamplesConsentDWORD:1ComputerSoftware\Policies\Microsoft\Windows Defender\SpynetSpynetReportingDWORD:2ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASRExploitGuard_ASR_RulesDWORD:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84SZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules3b576869-a4ec-4529-8536-b80a7769e899SZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rulesd4f940ab-401b-4efc-aadc-ad5f3c50688aSZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7BSZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules5beb7efe-fd9a-4556-801d-275e5ffc04ccSZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rulesd3e037e1-3eb8-44c8-a917-57927947596dSZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rulesbe9ba2d9-53ea-4cdc-84e5-9b1eeee46550SZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2SZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rulesb2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4SZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules26190899-1602-49e8-8b27-eb1d0a1ce869SZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules7674ba52-37eb-4a4f-a9a1-f0f9a1619a2cSZ:1ComputerSoftware\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network ProtectionEnableNetworkProtectionDWORD:1; Computer POLICY SAVED.; ----------------------------------------------------------------------==================================================================================================--------------------------------------------------------------------------------------------------Applying GPO "MSFT Windows 10 1909 and Server 1909 - Domain Security"...--------------------------------------------------------------------------------------------------LGPO.exe v2.2 - Local Group Policy Object utilityNothing to do.LGPO.exe has four modes:* Import and apply policy settings;* Export local policy to a GPO backup;* Parse a registry.pol file to "LGPO text" format;* Build a registry.pol file from "LGPO text".&nbsp;To apply policy settings:&nbsp;LGPO.exe command [...]&nbsp;where "command" is one or more of the following (each of which can be repeated):&nbsp;/g path import settings from one or more GPO backups under "path"/m pathegistry.pol import settings from registry.pol into machine config/u pathegistry.pol import settings from registry.pol into user config/ua pathegistry.pol import settings from registry.pol into user config for Administrators/un pathegistry.pol import settings from registry.pol into user config for Non-Administrators/u:username pathegistry.polimport settings from registry.pol into user config for local userspecified by "username"/s path\GptTmpl.inf apply security template/a[c] path\Audit.csv apply advanced auditing settings; /ac to clear policy first/t path\lgpo.txt apply registry commands from LGPO text/e &lt;name&gt;|&lt;guid&gt; enable GP extension for local policy processing; specify aGUID, or one of these names:* "zone" for IE zone mapping extension* "mitigation" for mitigation options, including font blocking* "audit" for advanced audit policy configuration* "LAPS" for Local Administrator Password Solution* "DGVBS" for Device Guard virtualization-based security* "DGCI" for Device Guard code integrity policy/boot reboot after applying policies/v verbose output/q quiet output (no headers)&nbsp;To create a GPO backup from local policy:&nbsp;LGPO.exe /b path [/n GPO-name]&nbsp;/b path Create GPO backup in "path"/n GPO-name Optional GPO display name (use quotes if it contains spaces)&nbsp;To parse a Registry.pol file to LGPO text (stdout):&nbsp;LGPO.exe /parse [/q] {/m|/u|/ua|/un|/u:username} pathegistry.pol&nbsp;/m pathegistry.pol parse registry.pol as machine config commands/u pathegistry.pol parse registry.pol as user config commands/ua pathegistry.pol parse registry.pol as user config for Administrators/un pathegistry.pol parse registry.pol as user config for Non-Administrators/u:username pathegistry.polparse registry.pol as user config for local userspecified by "username"/q quiet output (no headers)&nbsp;To build a Registry.pol file from LGPO text:&nbsp;LGPO.exe /r path\lgpo.txt /w pathegistry.pol [/v]&nbsp;/r path\lgpo.txt Read input from LGPO text file/w pathegistry.pol Write new registry.pol file&nbsp;(See the documentation for more information and examples.)==================================================================================================--------------------------------------------------------------------------------------------------Applying GPO "MSFT Windows 10 1909 and Server 1909 Member Server - Credential Guard"...--------------------------------------------------------------------------------------------------LGPO.exe v2.2 - Local Group Policy Object utilityImport Machine settings from registry.pol: ..\GPOs\{BA64EEBE-B4EC-47F2-BED8-C53274D6CDF2}\DomainSysvol\GPO\Machineegistry.pol; ----------------------------------------------------------------------; PROCESSING Computer POLICY; Source file: ..\GPOs\{BA64EEBE-B4EC-47F2-BED8-C53274D6CDF2}\DomainSysvol\GPO\Machineegistry.polComputerSOFTWARE\Policies\Microsoft\Windows\DeviceGuardEnableVirtualizationBasedSecurityDWORD:1ComputerSOFTWARE\Policies\Microsoft\Windows\DeviceGuardRequirePlatformSecurityFeaturesDWORD:1ComputerSOFTWARE\Policies\Microsoft\Windows\DeviceGuardHypervisorEnforcedCodeIntegrityDWORD:1ComputerSOFTWARE\Policies\Microsoft\Windows\DeviceGuardHVCIMATRequiredDWORD:0ComputerSOFTWARE\Policies\Microsoft\Windows\DeviceGuardLsaCfgFlagsDWORD:1ComputerSOFTWARE\Policies\Microsoft\Windows\DeviceGuardConfigureSystemGuardLaunchDWORD:1; Computer POLICY SAVED.; ----------------------------------------------------------------------==================================================================================================--------------------------------------------------------------------------------------------------Applying GPO "MSFT Windows Server 1909 - Member Server"...--------------------------------------------------------------------------------------------------LGPO.exe v2.2 - Local Group Policy Object utilityImport Machine settings from registry.pol: ..\GPOs\{3657C7A2-3FF3-4C21-9439-8FDF549F1D68}\DomainSysvol\GPO\Machineegistry.pol; ----------------------------------------------------------------------; PROCESSING Computer POLICY; Source file: ..\GPOs\{3657C7A2-3FF3-4C21-9439-8FDF549F1D68}\DomainSysvol\GPO\Machineegistry.polComputerSoftware\Microsoft\Windows\CurrentVersion\Policies\ExplorerNoDriveTypeAutoRunDWORD:255ComputerSoftware\Microsoft\Windows\CurrentVersion\Policies\ExplorerNoAutorunDWORD:1ComputerSoftware\Microsoft\Windows\CurrentVersion\Policies\SystemDisableAutomaticRestartSignOnDWORD:1ComputerSoftware\Microsoft\Windows\CurrentVersion\Policies\SystemLocalAccountTokenFilterPolicyDWORD:0ComputerSoftware\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\ParametersAllowEncryptionOracleDWORD:0ComputerSoftware\Policies\Microsoft\Biometrics\FacialFeaturesEnhancedAntiSpoofingDWORD:1ComputerSoftware\Policies\Microsoft\Internet Explorer\FeedsDisableEnclosureDownloadDWORD:1ComputerSoftware\Policies\Microsoft\Windows\CredentialsDelegationAllowProtectedCredsDWORD:1ComputerSoftware\Policies\Microsoft\Windows\EventLog\ApplicationMaxSizeDWORD:32768ComputerSoftware\Policies\Microsoft\Windows\EventLog\SecurityMaxSizeDWORD:196608ComputerSoftware\Policies\Microsoft\Windows\EventLog\SystemMaxSizeDWORD:32768ComputerSoftware\Policies\Microsoft\Windows\ExplorerNoAutoplayfornonVolumeDWORD:1ComputerSoftware\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}NoBackgroundPolicyDWORD:0ComputerSoftware\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}NoGPOListChangesDWORD:0ComputerSoftware\Policies\Microsoft\Windows\InstallerAlwaysInstallElevatedDWORD:0ComputerSoftware\Policies\Microsoft\Windows\InstallerEnableUserControlDWORD:0ComputerSoftware\Policies\Microsoft\Windows\Kernel DMA ProtectionDeviceEnumerationPolicyDWORD:0ComputerSoftware\Policies\Microsoft\Windows\LanmanWorkstationAllowInsecureGuestAuthDWORD:0ComputerSoftware\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\*\SYSVOLSZ:RequireMutualAuthentication=1,RequireIntegrity=1ComputerSoftware\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\*\NETLOGONSZ:RequireMutualAuthentication=1,RequireIntegrity=1ComputerSoftware\Policies\Microsoft\Windows\PersonalizationNoLockScreenCameraDWORD:1ComputerSoftware\Policies\Microsoft\Windows\PersonalizationNoLockScreenSlideshowDWORD:1ComputerSoftware\Policies\Microsoft\Windows\PowerShell\ScriptBlockLoggingEnableScriptBlockLoggingDWORD:1ComputerSoftware\Policies\Microsoft\Windows\PowerShell\ScriptBlockLoggingEnableScriptBlockInvocationLoggingDELETEComputerSoftware\Policies\Microsoft\Windows\SystemEnumerateLocalUsersDWORD:0ComputerSoftware\Policies\Microsoft\Windows\SystemEnableSmartScreenDWORD:1ComputerSoftware\Policies\Microsoft\Windows\SystemShellSmartScreenLevelSZ:BlockComputerSoftware\Policies\Microsoft\Windows\Windows SearchAllowIndexingEncryptedStoresOrItemsDWORD:0ComputerSoftware\Policies\Microsoft\Windows\WinRM\ClientAllowBasicDWORD:0ComputerSoftware\Policies\Microsoft\Windows\WinRM\ClientAllowUnencryptedTrafficDWORD:0ComputerSoftware\Policies\Microsoft\Windows\WinRM\ClientAllowDigestDWORD:0ComputerSoftware\Policies\Microsoft\Windows\WinRM\ServiceAllowBasicDWORD:0ComputerSoftware\Policies\Microsoft\Windows\WinRM\ServiceAllowUnencryptedTrafficDWORD:0ComputerSoftware\Policies\Microsoft\Windows\WinRM\ServiceDisableRunAsDWORD:1ComputerSoftware\Policies\Microsoft\Windows NT\DNSClientEnableMulticastDWORD:0ComputerSoftware\Policies\Microsoft\Windows NT\RpcRestrictRemoteClientsDWORD:1ComputerSoftware\Policies\Microsoft\Windows NT\Terminal ServicesDisablePasswordSavingDWORD:1ComputerSoftware\Policies\Microsoft\Windows NT\Terminal ServicesfDisableCdmDWORD:1ComputerSoftware\Policies\Microsoft\Windows NT\Terminal ServicesfPromptForPasswordDWORD:1ComputerSoftware\Policies\Microsoft\Windows NT\Terminal ServicesfEncryptRPCTrafficDWORD:1ComputerSoftware\Policies\Microsoft\Windows NT\Terminal ServicesMinEncryptionLevelDWORD:3ComputerSoftware\Policies\Microsoft\WindowsFirewallPolicyVersionDWORD:538ComputerSoftware\Policies\Microsoft\WindowsFirewall\DomainProfileDefaultOutboundActionDWORD:0ComputerSoftware\Policies\Microsoft\WindowsFirewall\DomainProfileDefaultInboundActionDWORD:1ComputerSoftware\Policies\Microsoft\WindowsFirewall\DomainProfileEnableFirewallDWORD:1ComputerSoftware\Policies\Microsoft\WindowsFirewall\PrivateProfileEnableFirewallDWORD:1ComputerSoftware\Policies\Microsoft\WindowsFirewall\PrivateProfileDefaultInboundActionDWORD:1ComputerSoftware\Policies\Microsoft\WindowsFirewall\PrivateProfileDefaultOutboundActionDWORD:0ComputerSoftware\Policies\Microsoft\WindowsFirewall\PublicProfileEnableFirewallDWORD:1ComputerSoftware\Policies\Microsoft\WindowsFirewall\PublicProfileDefaultOutboundActionDWORD:0ComputerSoftware\Policies\Microsoft\WindowsFirewall\PublicProfileDefaultInboundActionDWORD:1ComputerSoftware\Policies\Microsoft\WindowsInkWorkspaceAllowWindowsInkWorkspaceDWORD:1ComputerSoftware\Policies\Microsoft Services\AdmPwdAdmPwdEnabledDWORD:1ComputerSYSTEM\CurrentControlSet\Control\SecurityProviders\WDigestUseLogonCredentialDWORD:0ComputerSYSTEM\CurrentControlSet\Control\Session Manager\kernelDisableExceptionChainValidationDWORD:0ComputerSYSTEM\CurrentControlSet\Policies\EarlyLaunchDriverLoadPolicyDWORD:3ComputerSYSTEM\CurrentControlSet\Services\LanmanServer\ParametersSMB1DWORD:0ComputerSYSTEM\CurrentControlSet\Services\MrxSmb10StartDWORD:4ComputerSYSTEM\CurrentControlSet\Services\Netbt\ParametersNoNameReleaseOnDemandDWORD:1ComputerSYSTEM\CurrentControlSet\Services\Netbt\ParametersNodeTypeDWORD:2ComputerSYSTEM\CurrentControlSet\Services\Tcpip\ParametersEnableICMPRedirectDWORD:0ComputerSYSTEM\CurrentControlSet\Services\Tcpip\ParametersDisableIPSourceRoutingDWORD:2ComputerSYSTEM\CurrentControlSet\Services\Tcpip6\ParametersDisableIPSourceRoutingDWORD:2; Computer POLICY SAVED.; ----------------------------------------------------------------------Import User settings from registry.pol: ..\GPOs\{3657C7A2-3FF3-4C21-9439-8FDF549F1D68}\DomainSysvol\GPO\Useregistry.pol; ----------------------------------------------------------------------; PROCESSING User POLICY; Source file: ..\GPOs\{3657C7A2-3FF3-4C21-9439-8FDF549F1D68}\DomainSysvol\GPO\Useregistry.pol; User POLICY SAVED.; ----------------------------------------------------------------------==================================================================================================Non-domain-joined: back out the local-account restrictions...LGPO.exe v2.2 - Local Group Policy Object utilityApply security template: ConfigFiles\DeltaForNonDomainJoined.inf----------------------------------------------------------------------PROCESSING SECURITY TEMPLATE: ConfigFiles\DeltaForNonDomainJoined.infC:\Windows\system32\secedit.exe /configure /db "C:\Users\Operator\AppData\Local\Temp\1\GPT8E4C.tmp" /cfg "ConfigFiles\DeltaForNonDomainJoined.inf" /log "C:\Users\Operator\AppData\Local\Temp\1\GPT8E4D.tmp" /overwrite /quiet[[[ Security template log file output follows: C:\Users\Operator\AppData\Local\Temp\1\GPT8E4D.tmp ]]]Completed 1 percent (0/63) Process Privilege Rights areaCompleted 25 percent (15/63) Process Privilege Rights areaCompleted 25 percent (15/63) Process Group Membership areaCompleted 49 percent (30/63) Process Group Membership areaCompleted 49 percent (30/63) Process Registry Keys areaCompleted 49 percent (30/63) Process File Security areaCompleted 49 percent (30/63) Process Services areaCompleted 65 percent (40/63) Process Services areaCompleted 73 percent (45/63) Process Services areaCompleted 73 percent (45/63) Process Security Policy areaCompleted 77 percent (48/63) Process Security Policy areaCompleted 84 percent (52/63) Process Security Policy areaCompleted 88 percent (55/63) Process Security Policy areaCompleted 93 percent (58/63) Process Security Policy areaCompleted 100 percent (63/63) Process Security Policy areaThe task has completed successfully.SECEDIT.EXE exited with exit code 0----------------------------------------------------------------------Apply registry-based settings from LGPO text file: ConfigFiles\DeltaForNonDomainJoined.txtPROCESSING INPUT FILE FOR REGISTRY-BASED POLICY: ConfigFiles\DeltaForNonDomainJoined.txtComputer Configuration Software\Microsoft\Windows\CurrentVersion\Policies\System LocalAccountTokenFilterPolicy REG_DWORD 1Computer Configuration Software\Policies\Microsoft\Windows NT\Rpc RestrictRemoteClients REG_DWORD 0POLICY SAVED.----------------------------------------------------------------------&nbsp;

aaronmargosis_tanium · Answer

I just downloaded the Server 2019 baseline and ran the script for non-domain-joined, and what I've got looks different from yours. For one thing, your logs reference "Server 1909" but the one I've got referenced "Server 2019." And something went wrong with yours: At Applying GPO "MSFT Windows 10 1909 and Server 1909 - Domain Security" it says "Nothing to do." Mine worked without errors or warnings, and the password length is set to 14.
Did you modify the content of the baseline or the script before you ran it? Did you get it from the Microsoft SCT or from another source?

jiecui · Answer

AaronMargosis_Tanium&nbsp;Thanks so much for your reminder. I re downloaded the security baseline from Microsoft website and now ok. Possibly the problem one was changed somewhere.&nbsp;

Forum Discussion

Security baseline script not working

2 Replies

Resources