Hi, I have a customer who would like to apply Center internet Security (CIS) hardening benchmarks to his Domain Controllers and member servers. My understanding is that the best way to apply these rules is by applying GPOs in Active directory (on Domain controllers OU for DCs and on Domain or OU level for member servers) and not by applying them on Win 2016 local GPOs. I am going into the right direction here ?