Guidance on multiple window 10 builds and baselines

[Chad Brower]

Good Afternoon,

I am wondering if anyone out there has some guidance on managing multiple baselines.  Meaning, I have Windows 10 1803, 1809, 1903 and 1909 versions.  What is the best way to manage baselines with multiple version of Windows 10? Same question might apply to Microsoft 365 suite as well as Edge Browser (80, 81).

A. Do I have a baseline for each OS? (WMI filtering?)

B. Do I have a baseline for each with delta changes only?

C. Do I have a single baseline with deltas added for each version of Windows 10

What are enterprises doing to manage this?

Thanks

[#2]

Great question! I asked a similiar question quite a while ago and if memory serves, the newest/most recent baseline superseeds all previous baseline versions.

[#3]

Hi @Chad Brower and thanks for the post!  @Brian Steingraber is pretty much spot on but please let me expand just a little.  If we had the time we would absolutely go back and adjust the previous baselines but we have to continue to move forward and handle other new baselines from Office, Edge and soon some additional products on top of that.  With that being said part of the reason we release the blog post on what we are changing is so consumers of the baseline can make informed decisions if they decide to run multiple baselines (per OS version).  We of course encourage baseline consumer to always test the latest baseline before applying them to an older OS version but generally speaking the latest is always the greatest.  However with that being said we do have a few customers that will WMI filter the baselines to the OS version (lot of work).

[#4]

@Brian Steingraber I am trying to remember where I might have read that before?  I seem to remember maybe reading that before. Any doco out there for this?  

@Rick_Munck Same question then?  Or perhaps a future blog post?  

Thanks for the reply's guys!

[#5]

@Chad Brower sure we can do a blog post on it.  Will add it to the list but it probably wont go out until after the next Windows and Edge releases as we are in the middle of those right now.

[#6]

@Rick_Munck Great!  Thanks, we will look out for the blog post.

I am working with my sec team right now about what we want to do about this.  We currently maintain 4 versions of Windows 10.  A lot less work with maintaining 1 (Current) + 1 (Future) baselines.  

We setup WMI filters already and that was easy.  What seemly won't be easy is 4-5 baselines being in our environment.  

[#7]

@Chad Brower 

It wasn't in the specific posting, rather in the comments as I had ask a followup question in the comments of the original posting.

I think Aaron M w/Microsoft was the one that replied (also the original poster)

[#8]

A design focused on functionality, not so much organization.

Need to decide how many builds / versions to support, but it's managable.

Loopback policy processing replace -- UsersGPO's doesn't matter this way

(Can still be managed with group filtering)

GPO's are merged (user/computer), so one GPO per function.

MSFT - Clean import from MSSec

CustomSecurity - Security related settings for that specific component

CustomSettings - NonSecuritySettings related to that specific component

OU Structure:

Computers\Standard\Portable

Computers\Standard\Stationary

Computers\OtherFunction\Portable

Computers\OtherFunction\Stationary

GPOs

Above the below, comes group filtered GPO's for exceptions etc.

(WMI Appver, Authenticated users)

Client-Edge 80-CustomSettings

Client-Edge 80-CustomSecurity

Client-Edge 80-MSFT

(WMI Appver, Authenticated users)

Client-Office 1908-CustomSettings

Client-Office 1908-CustomSecurity

Client-Office 1908-ExcelDDE-MSFT

Client-Office 1908-LegacyFileBlock-MSFT

Client-Office 1908-RequireMacro

Client-Office 1908-MSFT

(WMIOSVer, Authenticated users)

Client-Windows 10 1909-InternetExplorer11-CustomSettings

Client-Windows 10 1909-InternetExplorer11-CustomSecurity

Client-Windows 10 1909-InternetExplorer11-MSFT

Client-Windows 10 1909-DomainSecurityCustomSettings

Client-Windows 10 1909-DomainSecurityCustomSecurity

Client-Windows 10 1909-DomainSecurity-MSFT

Client-Windows 10 1909-Defender-CustomSettings

Client-Windows 10 1909-Defender-CustomSecurity

Client-Windows 10 1909-Defender-MSFT

Client-Windows 10 1909-CredentialGuard-CustomSettings

Client-Windows 10 1909-CredentialGuard-CustomSecurity

Client-Windows 10 1909-CredentialGuard-MSFT

Client-Windows 10 1909-BitLocker-CustomSettings

Client-Windows 10 1909-BitLocker-CustomSecurity

Client-Windows 10 1909-BitLocker-MSFT

Client-Windows 10 1909-CustomSettings

Client-Windows 10 1909-CustomSecurity

Client-Windows 10 1909-MSFT

[#9]

@Rick_Munck Were you able to do a blog post on this?  I am just wondering if I missed it.  Thanks

[#10]

@Chad Brower not yet, we actually plan to start writing the blog later this week. Not sure how long it will take us but we are closer than before :)

[#11]

@Rick_Munck Looking forward to it.  Our company is writing a standards doco on baselines right now.  Plus we are also working on a deployment of these policies in a POC environment.  Guidance would be helpful. 

[#12]

@Rick_Munck 

Any Update to this?

[#13]

Hi @Chad Brower, we have the draft ready and it's waiting to be reviewed.  Don't have an ETA but once the GP teams gives us a thumbs up we will get it published :)  In the interim please DM me and let's see what we can do for you! 

[#14]

@Rick_Munck 

Hello. Please i will like to know what's the update regarding the documentation for managing multiple windows 10 builds. It'll be very helpful to me. Thanks

[#15]

@fresh23434 I sent the draft blog off for review and the suggestion was made to not only discuss WMI filtering for the GPOs but also Security Group filtering.  Once we write that section we should be good to go as everything else has already been gone through.  The 20H2 release took priority but I imagine we will have it ready before the end of November.  

[#16]

@Rick_Munck Good work and interesting topic for sure.

While you're at it, think a bit about edge baselines and how to keep up with versioning.

Cheers / Mikael

[#17]

Hey @Rick_Munck 

I've been looking for the blog post talking about which version of the baseline to apply, but I can't seem to find it. Would you have a direct link to it? I've seen the comments saying to always apply the latest (and greatest!), but it would be great to be able to reference an actual post instead of comments, when asked about it :) 

[#18]

@ixniz the comments in this thread are accurate about testing and using the latest but there isn't a dedicated blog on that topic yet.  We do plan to release a blog just not sure when we will be able to get it completed. 

[#19]

I plan to add 21h2 baselines to our env.   It is actually very simple, because there are very little amount of changes from 21h1 to 21h2.  

Basically my plan was to create a new policy for the new settings > Test > merge into production policy.  

[#20]

Any news on the blog post? We're waiting since 2020 ;)