MSHardenedPolicyEval and/or OSConfig

Hello, JanMischo​ the tool we shared in the preview post is part of the new Windows Server vNext capabilities, which will be announced at Ignite with more details and an updated post that will better answer your questions.

Do they both play nicely together? Yes.

MSHardenedPolicyEval or OSConfig? MSHardenedPolicyEval is in-box tooling for the hardened security defaults. OSConfig manages a broader set of security settings. Once an OSConfig baseline is in place, it supersedes the initial settings.

Think of the two like this:

• Day 0: initial security, built into the image and assessed in-box with MSHardenedPolicyEval (the name is subject to change).

• Day 2: ongoing security management with OSConfig, aligned with the Windows Admin Center and Azure Policy experiences.

These tools overlap in security configuration, but Microsoft has not described MSHardenedPolicyEval as an OSConfig replacement in the announcement. OSConfig’s Windows Server 2025 baselines apply desired configuration and protect it against drift. MSHardenedPolicyEval was introduced in a Server vNext preview to assess a curated hardening catalogue and optionally apply or revert settings. For an initial comparison, use its documented no-argument evaluation from an elevated administrator prompt; that mode is read-only. Do not assume that applying both tools’ policies will be conflict-free: overlapping settings with different target values could compete, particularly where drift enforcement is active. Compare the actual settings on a disposable test VM before choosing which mechanism owns enforcement. The preview announcement does not establish a retirement date for OSConfig or certify combined enforcement. Continue following OSConfig’s supported baseline guidance and request an explicit compatibility statement from the Server team.