Apr 09 2020 11:55 AM
Good Afternoon,
I am wondering if anyone out there has some guidance on managing multiple baselines. Meaning, I have Windows 10 1803, 1809, 1903 and 1909 versions. What is the best way to manage baselines with multiple version of Windows 10? Same question might apply to Microsoft 365 suite as well as Edge Browser (80, 81).
A. Do I have a baseline for each OS? (WMI filtering?)
B. Do I have a baseline for each with delta changes only?
C. Do I have a single baseline with deltas added for each version of Windows 10
What are enterprises doing to manage this?
Thanks
Apr 09 2020 07:10 PM
Apr 13 2020 05:25 AM
Hi @Chad Brower and thanks for the post! @Brian Steingraber is pretty much spot on but please let me expand just a little. If we had the time we would absolutely go back and adjust the previous baselines but we have to continue to move forward and handle other new baselines from Office, Edge and soon some additional products on top of that. With that being said part of the reason we release the blog post on what we are changing is so consumers of the baseline can make informed decisions if they decide to run multiple baselines (per OS version). We of course encourage baseline consumer to always test the latest baseline before applying them to an older OS version but generally speaking the latest is always the greatest. However with that being said we do have a few customers that will WMI filter the baselines to the OS version (lot of work).
Apr 13 2020 05:26 AM - edited Apr 13 2020 05:31 AM
@Brian Steingraber I am trying to remember where I might have read that before? I seem to remember maybe reading that before. Any doco out there for this?
@Rick_Munck Same question then? Or perhaps a future blog post?
Thanks for the reply's guys!
Apr 13 2020 05:42 AM
@Chad Brower sure we can do a blog post on it. Will add it to the list but it probably wont go out until after the next Windows and Edge releases as we are in the middle of those right now.
Apr 13 2020 05:53 AM
@Rick_Munck Great! Thanks, we will look out for the blog post.
I am working with my sec team right now about what we want to do about this. We currently maintain 4 versions of Windows 10. A lot less work with maintaining 1 (Current) + 1 (Future) baselines.
We setup WMI filters already and that was easy. What seemly won't be easy is 4-5 baselines being in our environment.
Apr 13 2020 06:06 AM
It wasn't in the specific posting, rather in the comments as I had ask a followup question in the comments of the original posting.
I think Aaron M w/Microsoft was the one that replied (also the original poster)
May 04 2020 11:38 PM
A design focused on functionality, not so much organization.
Need to decide how many builds / versions to support, but it's managable.
Loopback policy processing replace -- UsersGPO's doesn't matter this way
(Can still be managed with group filtering)
GPO's are merged (user/computer), so one GPO per function.
MSFT - Clean import from MSSec
CustomSecurity - Security related settings for that specific component
CustomSettings - NonSecuritySettings related to that specific component
OU Structure:
Computers\Standard\Portable
Computers\Standard\Stationary
Computers\OtherFunction\Portable
Computers\OtherFunction\Stationary
GPOs
Above the below, comes group filtered GPO's for exceptions etc.
(WMI Appver, Authenticated users)
Client-Edge 80-CustomSettings
Client-Edge 80-CustomSecurity
Client-Edge 80-MSFT
(WMI Appver, Authenticated users)
Client-Office 1908-CustomSettings
Client-Office 1908-CustomSecurity
Client-Office 1908-ExcelDDE-MSFT
Client-Office 1908-LegacyFileBlock-MSFT
Client-Office 1908-RequireMacro
Client-Office 1908-MSFT
(WMIOSVer, Authenticated users)
Client-Windows 10 1909-InternetExplorer11-CustomSettings
Client-Windows 10 1909-InternetExplorer11-CustomSecurity
Client-Windows 10 1909-InternetExplorer11-MSFT
Client-Windows 10 1909-DomainSecurityCustomSettings
Client-Windows 10 1909-DomainSecurityCustomSecurity
Client-Windows 10 1909-DomainSecurity-MSFT
Client-Windows 10 1909-Defender-CustomSettings
Client-Windows 10 1909-Defender-CustomSecurity
Client-Windows 10 1909-Defender-MSFT
Client-Windows 10 1909-CredentialGuard-CustomSettings
Client-Windows 10 1909-CredentialGuard-CustomSecurity
Client-Windows 10 1909-CredentialGuard-MSFT
Client-Windows 10 1909-BitLocker-CustomSettings
Client-Windows 10 1909-BitLocker-CustomSecurity
Client-Windows 10 1909-BitLocker-MSFT
Client-Windows 10 1909-CustomSettings
Client-Windows 10 1909-CustomSecurity
Client-Windows 10 1909-MSFT
Aug 11 2020 05:42 AM
@Rick_Munck Were you able to do a blog post on this? I am just wondering if I missed it. Thanks
Aug 11 2020 05:50 AM
@Chad Brower not yet, we actually plan to start writing the blog later this week. Not sure how long it will take us but we are closer than before :)
Aug 11 2020 08:39 AM
@Rick_Munck Looking forward to it. Our company is writing a standards doco on baselines right now. Plus we are also working on a deployment of these policies in a POC environment. Guidance would be helpful.
Sep 25 2020 10:58 AM
Sep 25 2020 11:56 AM
Hi @Chad Brower, we have the draft ready and it's waiting to be reviewed. Don't have an ETA but once the GP teams gives us a thumbs up we will get it published :) In the interim please DM me and let's see what we can do for you!
Oct 29 2020 06:58 AM
Hello. Please i will like to know what's the update regarding the documentation for managing multiple windows 10 builds. It'll be very helpful to me. Thanks
Oct 30 2020 10:33 AM
@fresh23434 I sent the draft blog off for review and the suggestion was made to not only discuss WMI filtering for the GPOs but also Security Group filtering. Once we write that section we should be good to go as everything else has already been gone through. The 20H2 release took priority but I imagine we will have it ready before the end of November.
Dec 09 2020 07:56 AM
@Rick_Munck Good work and interesting topic for sure.
While you're at it, think a bit about edge baselines and how to keep up with versioning.
Cheers / Mikael
Jun 08 2022 01:19 AM
Hey @Rick_Munck
I've been looking for the blog post talking about which version of the baseline to apply, but I can't seem to find it. Would you have a direct link to it? I've seen the comments saying to always apply the latest (and greatest!), but it would be great to be able to reference an actual post instead of comments, when asked about it :)
Jun 10 2022 07:03 AM
@ixniz the comments in this thread are accurate about testing and using the latest but there isn't a dedicated blog on that topic yet. We do plan to release a blog just not sure when we will be able to get it completed.
Jul 06 2022 07:53 AM
I plan to add 21h2 baselines to our env. It is actually very simple, because there are very little amount of changes from 21h1 to 21h2.
Basically my plan was to create a new policy for the new settings > Test > merge into production policy.
Sep 29 2022 02:00 AM