04-09-2020 11:55 AM
Good Afternoon,
I am wondering if anyone out there has some guidance on managing multiple baselines. Meaning, I have Windows 10 1803, 1809, 1903 and 1909 versions. What is the best way to manage baselines with multiple version of Windows 10? Same question might apply to Microsoft 365 suite as well as Edge Browser (80, 81).
A. Do I have a baseline for each OS? (WMI filtering?)
B. Do I have a baseline for each with delta changes only?
C. Do I have a single baseline with deltas added for each version of Windows 10
What are enterprises doing to manage this?
Thanks
04-09-2020 07:10 PM
04-13-2020 05:25 AM
Hi @Chad Brower and thanks for the post! @Brian Steingraber is pretty much spot on but please let me expand just a little. If we had the time we would absolutely go back and adjust the previous baselines but we have to continue to move forward and handle other new baselines from Office, Edge and soon some additional products on top of that. With that being said part of the reason we release the blog post on what we are changing is so consumers of the baseline can make informed decisions if they decide to run multiple baselines (per OS version). We of course encourage baseline consumer to always test the latest baseline before applying them to an older OS version but generally speaking the latest is always the greatest. However with that being said we do have a few customers that will WMI filter the baselines to the OS version (lot of work).
04-13-2020 05:26 AM - edited 04-13-2020 05:31 AM
@Brian Steingraber I am trying to remember where I might have read that before? I seem to remember maybe reading that before. Any doco out there for this?
@Rick_Munck Same question then? Or perhaps a future blog post?
Thanks for the reply's guys!
04-13-2020 05:42 AM
@Chad Brower sure we can do a blog post on it. Will add it to the list but it probably wont go out until after the next Windows and Edge releases as we are in the middle of those right now.
04-13-2020 05:53 AM
@Rick_Munck Great! Thanks, we will look out for the blog post.
I am working with my sec team right now about what we want to do about this. We currently maintain 4 versions of Windows 10. A lot less work with maintaining 1 (Current) + 1 (Future) baselines.
We setup WMI filters already and that was easy. What seemly won't be easy is 4-5 baselines being in our environment.
04-13-2020 06:06 AM
It wasn't in the specific posting, rather in the comments as I had ask a followup question in the comments of the original posting.
I think Aaron M w/Microsoft was the one that replied (also the original poster)
05-04-2020 11:38 PM
A design focused on functionality, not so much organization.
Need to decide how many builds / versions to support, but it's managable.
Loopback policy processing replace -- UsersGPO's doesn't matter this way
(Can still be managed with group filtering)
GPO's are merged (user/computer), so one GPO per function.
MSFT - Clean import from MSSec
CustomSecurity - Security related settings for that specific component
CustomSettings - NonSecuritySettings related to that specific component
OU Structure:
Computers\Standard\Portable
Computers\Standard\Stationary
Computers\OtherFunction\Portable
Computers\OtherFunction\Stationary
GPOs
Above the below, comes group filtered GPO's for exceptions etc.
(WMI Appver, Authenticated users)
Client-Edge 80-CustomSettings
Client-Edge 80-CustomSecurity
Client-Edge 80-MSFT
(WMI Appver, Authenticated users)
Client-Office 1908-CustomSettings
Client-Office 1908-CustomSecurity
Client-Office 1908-ExcelDDE-MSFT
Client-Office 1908-LegacyFileBlock-MSFT
Client-Office 1908-RequireMacro
Client-Office 1908-MSFT
(WMIOSVer, Authenticated users)
Client-Windows 10 1909-InternetExplorer11-CustomSettings
Client-Windows 10 1909-InternetExplorer11-CustomSecurity
Client-Windows 10 1909-InternetExplorer11-MSFT
Client-Windows 10 1909-DomainSecurityCustomSettings
Client-Windows 10 1909-DomainSecurityCustomSecurity
Client-Windows 10 1909-DomainSecurity-MSFT
Client-Windows 10 1909-Defender-CustomSettings
Client-Windows 10 1909-Defender-CustomSecurity
Client-Windows 10 1909-Defender-MSFT
Client-Windows 10 1909-CredentialGuard-CustomSettings
Client-Windows 10 1909-CredentialGuard-CustomSecurity
Client-Windows 10 1909-CredentialGuard-MSFT
Client-Windows 10 1909-BitLocker-CustomSettings
Client-Windows 10 1909-BitLocker-CustomSecurity
Client-Windows 10 1909-BitLocker-MSFT
Client-Windows 10 1909-CustomSettings
Client-Windows 10 1909-CustomSecurity
Client-Windows 10 1909-MSFT
08-11-2020 05:42 AM
@Rick_Munck Were you able to do a blog post on this? I am just wondering if I missed it. Thanks
08-11-2020 05:50 AM
@Chad Brower not yet, we actually plan to start writing the blog later this week. Not sure how long it will take us but we are closer than before :)
08-11-2020 08:39 AM
@Rick_Munck Looking forward to it. Our company is writing a standards doco on baselines right now. Plus we are also working on a deployment of these policies in a POC environment. Guidance would be helpful.
09-25-2020 10:58 AM
09-25-2020 11:56 AM
Hi @Chad Brower, we have the draft ready and it's waiting to be reviewed. Don't have an ETA but once the GP teams gives us a thumbs up we will get it published :) In the interim please DM me and let's see what we can do for you!
10-29-2020 06:58 AM
Hello. Please i will like to know what's the update regarding the documentation for managing multiple windows 10 builds. It'll be very helpful to me. Thanks
10-30-2020 10:33 AM
@fresh23434 I sent the draft blog off for review and the suggestion was made to not only discuss WMI filtering for the GPOs but also Security Group filtering. Once we write that section we should be good to go as everything else has already been gone through. The 20H2 release took priority but I imagine we will have it ready before the end of November.
12-09-2020 07:56 AM
@Rick_Munck Good work and interesting topic for sure.
While you're at it, think a bit about edge baselines and how to keep up with versioning.
Cheers / Mikael