Question Regarding Server 2022 Domain & Controller MSCT baselines

[wbaumgardt]

I have a basic 'Newbie' question regarding the MSCT baselines.   I see the GPO for 'MSFT Windows Server 2022 - Domain Controller' and also 'MSFT Windows Server 2022 - Member Server'.  I just want to confirm that we should only apply the 'MSFT Windows Server 2022 - Domain Controller' policies to our DC's, and not the Member Server policies as well.  While this seems obvious, I just want to make sure.

[#2]

That is correct.

[#3]

@AaronMargosis_Tanium 

Many thanks!

[#4]

@AaronMargosis_Tanium - Does the MSFT replace "Default Domain Controller Policy" aswell? If not, Should MSFT be higher linked than Default Domain Controller Policy?

[#5]

@criiser - the recommended policies in the Security Compliance Toolkit baselines should take precedence over the built-in default GPOs.