We have released DSC resources building upon the previously released security and registry cmdlets for applying security settings. You can now implement Microsoft-defined security baselines using DSC.<\/p>\n
AuditPolicyDsc<\/a> A sample configuration, below, takes the Security Baselines for Windows Server 2016<\/a> and extracts the .inf, .csv and .pol containing the desired security settings from the exported Group Policy Objects. (You can find information on extracting the necessary files in the Registry cmdlets blogpost<\/a>.) Simply pass the files into the new DSC resources, and you have successfully implemented security baselines using DSC! WARNING<\/strong>: As with all security settings, you can easily lock yourself out of remote access to your machine if you are not careful. Be sure to carefully review security settings before applying them to Nano Server, and stage test deployments before using security baselines in production!<\/p>\n We have released DSC resources building upon the previously released security and registry cmdlets for applying security settings. You can now implement Microsoft-defined security baselines using DSC. AuditPolicyDsc SecurityPolicyDsc GPRegistryPolicy Install all 3 from the Gallery with the command: install-module SecurityPolicyDsc, AuditPolicyDsc, GpRegistryPolicy A sample configuration, below, takes the Security Baselines for Windows Server 2016 […]<\/p>\n","protected":false},"author":617,"featured_media":13641,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-12945","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-powershell"],"acf":[],"blog_post_summary":" We have released DSC resources building upon the previously released security and registry cmdlets for applying security settings. You can now implement Microsoft-defined security baselines using DSC. AuditPolicyDsc SecurityPolicyDsc GPRegistryPolicy Install all 3 from the Gallery with the command: install-module SecurityPolicyDsc, AuditPolicyDsc, GpRegistryPolicy A sample configuration, below, takes the Security Baselines for Windows Server 2016 […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/12945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/users\/617"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/comments?post=12945"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/12945\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media\/13641"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media?parent=12945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/categories?post=12945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/tags?post=12945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nSecurityPolicyDsc<\/a>
\nGPRegistryPolicy<\/a>
\nInstall all 3 from the Gallery with the command:<\/p>\ninstall-module<\/span> SecurityPolicyDsc,<\/span> AuditPolicyDsc,<\/span> GpRegistryPolicy <\/pre>\n<\/div>\n
\nThis is most useful for Nano Server, since Nano Server doesn\u2019t support Group Policy<\/a>. However, this approach will work for all installation options. It\u2019s not a good idea to manage the same server using both Group Policy and DSC since the two engines will constantly attempt to overwrite each other if they are both managing the same setting.<\/p>\nConfiguration<\/span> SecurityBaseline<\/span>\n{\n Import-DscResource<\/span> -<\/span>ModuleName AuditPolicyDsc,<\/span> SecurityPolicyDSC,<\/span> GpRegistryPolicy\n node localhost\n {\n SecurityTemplate baselineInf\n {\n Path =<\/span> \"C:\\Users\\Administrator\\Documents\\GptTmpl.inf\"<\/span>\n # https:\/\/msdn.microsoft.com\/powershell\/dsc\/singleinstance<\/span>\n IsSingleInstance =<\/span> \"Yes\"<\/span>\n }\n AuditPolicyCsv baselineCsv\n {\n IsSingleInstance =<\/span> \"Yes\"<\/span>\n CsvPath =<\/span> \"C:\\Users\\Administrator\\Documents\\audit.csv\"<\/span>\n }\n RegistryPolicy baselineGpo\n {\n Path =<\/span> \"C:\\Users\\Administrator\\Documents\\registry.pol\"<\/span>\n }\n }\n}\n#Compile the MOF file<\/span>\nSecurityBaseline \nStart-DscConfiguration<\/span> -<\/span>Path .\/<\/span>SecurityBaseline <\/pre>\n<\/div>\n","protected":false},"excerpt":{"rendered":"