User Profile
AaronMargosis_Tanium
Iron Contributor
Joined 6 years ago
User Widgets
Recent Discussions
Re: How to Use Baselines Correctly as a Beginner
The SCT baselines don't provide a means to undo the application of a baseline. Some of the settings are "tattooed" so it's not entirely possible to revert completely to the original state. The purpose of the "Remove-EPBaselineSettings.ps1" script was to TRY to restore default settings for Exploit Protection settings that had been included in a baseline from several years ago. If experimenting, consider using virtual machines with snapshots that can be reverted. For the Policy Analyzer questions, see the documentation ("Policy Analyzer.pdf") that's included with the tool. Note that it does not ingest Excel files.Re: Question Regarding Server 2022 Domain & Controller MSCT baselines
katPedraza-- I think you're mistaken about that. The SCT's baselines for DCs have many settings that intentionally override the "Default Domain Controllers Policy" that ships in Windows and that is created automatically on DCs. Just as a couple of examples, the baselines' SeBackupPrivilege and SeRestorePrivilege user rights assignments intentionally override the default and grant the privilege only to Administrators. (Also, you accidentally marked criiser's question as the "Microsoft Verified Best Answer."))
