Before we start working with Policy Analyzer,
let's go ahead and back up our Group Policies.
The Group Policies that we are going to back up are those
that we are going to use within Policy Analyzer to compare
against the secure baseline.
The two that I am specifically interested in are the Member
Server GPO and the Domain Controllers Policy.
I'm going to go ahead and back these up,
and I will store these on the desktop and give them a descriptive name.
Once the backup is completed,
I will go ahead and repeat the same process for my
Domain Controllers Group Policy.
Right, now that I've got the backups done,
I'm going to go ahead and copy these to my client machine
where I have Policy Analyzer installed.
I've now switched to my client machine,
and I have copied across the two Group Policies that I have just backed up.
Before we work with Policy Analyzer, I would like to highlight one aspect,
which relates to the Policy Rules set.
Now these Policy Rules sets are essentially an XML file,
which contain all of the settings in relation to the
Group Policies that make up the baseline.
So to illustrate, if we take a look at the Policy Rules set for Windows 10,
and I open this within Notepad,
you will see that it follows an XML structure and contains a
multitude of settings that span across different
configuration items within a Group Policy.
Now these policy rules sets have a type extension of .POLICYRULES.
Within your security baseline, you would have one of these files.
To illustrate where that file is, I'll navigate back to the security baseline.
Within the Documentation folder, you will find a POLICYRULES File.
This file contains all of the Group Policy settings that exist within the
Group Policies that are defined in the GPO's folder.
So essentially,
what you can do is you can actually copy this file to your
Policy Rules folder within Policy Analyzer,
and now, when you open up Policy Analyzer,
you will have the policy rule set defined.
Now, if you open our Policy Analyzer and your list of policy rules is blank,
make sure that your Policy Rule set folder is set to the correct folder.
In this case, it needs to be the Policy Rules directory within Policy Analyzer.
Now you may, of course, have this in a different location,
and that's completely fine.
You just need to make sure that you select the right location so that
you can actually see all of these policy rule sets.
Now, once the policy rule set has been loaded,
you can actually view this by selecting the specific
baseline and clicking on View,
and this will bring up a view of all of the settings.
So now let's work with the Group Policies that we have just exported.
In order to import a Group Policy, I can do that by clicking on Add,
and this will bring up the Policy File Importer.
I will click on File, and I can select to either add files from GPOs,
or I can add specific files related to different settings of a Group Policy.
For example, if I only wanted to compare the Audit Policy,
I could add the Audit Policy file and compare that to a baseline.
The same applies for the Security Template registry
configurations for both the user and computer,
and so forth.
Since I would like to add all the files,
I'm going to click on Add files from GPO,
and I'm going to select the Group Policies that I've just backed up.
I'll start with the first one,
and this shows me that this is my Member Server GPO.
Now by default,
Policy Analyzer will actually import all of these configuration settings.
If I wanted to exclude a specific setting,
I would need to select it and press the Delete button on
my keyboard to remove it from the list, so keep that in mind.
So I'll go ahead and import this.
And now, Policy Analyzer is asking me to create a policy rule file.
Essentially, what I've just done is I have built my own policy rule set,
which I can use across any Policy Analyzer because now I have all
of the policy configurations in an XML format.
So I'll go ahead and give this a name and save.
Now that it's saved,
I have a list of my Group Policies and my existing Group
Policy that I can now view and compare.
Let's repeat the process, and this time,
I'm going to add my second Group Policy,
which should be my Domain Controllers policy,
and I will go ahead and give it a descriptive name and save.
Now, I can view the configuration of my MemberServer,
and the same applies for my domain controllers.
Now remember,
the Windows Server 2022 baseline consists of multiple Group Policies.
To illustrate,
I'm going to go ahead and follow the same process of adding a Group Policy.
I'll select the GPO location within the Server Baseline.
Remember, this has multiple Group Policies,
and as I click on OK,
you'll notice that I've got a list of different Group Policies.
These relate to Member Servers, Domain Controllers,
and various configurations such as Defender,
Credential Guard, and so forth.
Since I'm comparing my Group Policies,
and I've split my Group Policies up into two categories,
Member Servers and Domain Controllers,
I can actually go ahead and import these various Group
Policies in relation to what I have.
So I'll start with Member Server, and remember,
I need to remove the ones that I do not want to include.
So I'm going to go ahead and remove all of the ones that say Domain Controller.
Once I've selected them, I will click on Delete, and now I will import.
I will give this a descriptive name and click on Save.
Now,
I can go ahead and compare my Member Server baseline with my current
Member Server Group Policy by clicking on both of them,
selecting the tick box, and then clicking on View/Compare.
Now, I can see the results between the two Group Policies.
And you'll notice that there are a couple of discrepancies where I do not
have settings configured in my MemberServer GPO; however,
in the baseline, these are configured.
So now I can go ahead and make a note of these and
actually configure them in a Group Policy,
or as you will see later, I can import the baseline into Active Directory.
Let's take a look at what the Domain Controllers Group Policy looks like.
So following the same process as before,
I will go ahead and import the domain controller
variants of our secure baseline.
This time, I will remove all of the MemberServer Group Policies.
Once they have been removed, I will click on Import,
provide it with a descriptive name, and then click on Save.
From here, I'm going to go ahead and select my current Domain Controller GPO,
and I will go ahead and select the one that we have just imported.
Clicking on View/Compare,
I can now see the results related to the secure baseline in comparison
with my current Domain Controllers Group Policy.
Remember in the beginning,
we copied the policy rule file that existed within the baseline Group Policy,
so let's go ahead and actually compare our current Group Policies
to that complete list of Group Policy settings.
So I'll go ahead and select both my Domain Controllers,
my Member Server, and the MSFT Windows Server 2022 Final Group Policy,
which is the policy rule set, which contains all of the settings combined.
I will then click on View/Compare,
and now I can see the settings as it spans across the Domain Controllers,
Member Servers, and the baseline.
Now you could work with your Group Policies this way,
but I prefer to actually split them up,
because it makes it easier for me to actually work through the
relevant Group Policies in respect to working with either a
member server or a domain controller.
Another great feature of Policy Analyzer is the
ability to compare the effective state.
Now I am running Policy Analyzer on a Windows 10 client.
If I click on Compare to Effective State,
I can actually compare one of my Group Policies to the
current configuration state of my machine.
So I'm going to go ahead and select Windows 10,
and I'll use version 1909, and I will go ahead and compare it to my active state.
This does require administrative privileges,
and once it runs, it essentially creates a policy rule set,
taking a snapshot of your local Group Policy,
and providing you with a comparison of that to the
baseline that you have just selected.
Now you could do this on a server endpoint on your domain controller,
and it gives you a good way to actually see what
settings you currently have applied, and then compare that to a secure baseline.
So here you've seen that you can leverage Policy Analyzer to
actually work through different Group Policies,
comparing what you currently have configured to either another Group Policy or to a security baseline.