Windows 10: Microsoft Security Baseline policies conflict

MGhabboun_440 · Feb 28, 2023

Hello There,I am planning to configure the Microsoft Security Compliance Toolkit for my domain controller, and after linking the domain controller policy and check the resultant group policy I found that some settings are not changed by the new policy but instead taking the default domain controllers policy which results in conflict.The question would be, when I want to use the domain controller security baseline policy, Is it required to disable the default domain controller policy for it to work? and if not, is it okay for this conflict to occur and to keep both policies linked to the domain

:)

Brink · Feb 28, 2023

Security baseline news for Microsoft Edge version 81

We have reviewed the new settings in version 81 of Microsoft Edge and determined that no new security settings are required. The settings recommended in the version 80 baseline will continue to be the security baseline for version 81! This means we will not be releasing our typical package.

Version 81 of Microsoft Edge adds 15 new computer- and user-based settings. There are now 285 enforceable Computer Configuration policy settings and 269 User Configuration policy settings. Using our streamlined approach, our baseline remains at 12 Group Policy settings. We have attached a spreadsheet with the new settings to make it easier for you to find them.

The version 80 package continues to be available as part of the Security Compliance Toolkit. Like all our baseline packages, this package includes:

Importable GPOs

A script to apply the GPOs to local policy

A script to import the GPOs into Active Directory Group Policy

A spreadsheet documenting all recommended settings in spreadsheet form (minus the version 81 setting that are attached to this blog)

Policy Analyzer rules

GP Reports

We always welcome feedback through the Baselines Discussion site.
Click to expand...

Source: https://techcommunity.microsoft.com/...1/ba-p/1303621

Latest Microsoft Edge released for Windows

Brink · Feb 28, 2023

Security baseline for Microsoft Edge version 102 now available

We are pleased to announce the enterprise-ready release of the security baseline for Microsoft Edge, version 102!

We have reviewed the new settings in Microsoft Edge version 102 and determined that there are no additional security settings that require enforcement. The Microsoft Edge version 98 package continues to be our recommended baseline. That baseline package can be downloaded from the Microsoft Security Compliance Toolkit.

There are 2 settings we would like to call out, Enable the network service sandbox and List of origins that allow all HTTP authentication

Enable the network service sandbox (Consider Testing)

This policy controls whether the network service process runs sandboxed. Sandboxing of the network service will reduce security risks, however we are not ready to enforce this setting yet. In the future, sandboxing of the network service will be enabled by default and required by the security baseline, but for now please test turning the policy on and see if anything breaks in your environment, specifically in the application compatibility arena. If you experience any issues, please talk to your Antivirus/security-software vendor and mention this policy setting.

List of origins that allow all HTTP authentication (Worth Mentioning)

The last time we discussed HTTP authentication was with version 88. Since then, admins have asked for more granularity. With version 102, this policy provides a way for Enterprises to safely deploy an existing lockdown policy (AuthSchemes) to turn off legacy schemes (e.g. Basic and Digest) while still allowing the use of those legacy schemes on individually-listed websites. That means, for instance, and admin can now set a configuration of “My users cannot use ‘Basic’ auth except on https://crustyoldservicegettingreplacedsoon.contoso.intranet”. This wasn’t possible before—if you needed to allow a legacy auth scheme for any site, you had to allow it for every site.

Microsoft Edge version 102 introduced 7 new computer settings and 7 new user settings. We have included a spreadsheet listing the new settings in the release to make it easier for you to find them.

As a friendly reminder, all available settings for Microsoft Edge are documented here, and all available settings for Microsoft Edge Update are documented here.

Please continue to give us feedback through the Security Baselines Discussion site or this post.
MSFT Edge v101 to v102 New Settings.xlsx
Click to expand...

Source: https://techcommunity.microsoft.com/...2/ba-p/3465195

Brink · Feb 28, 2023

Security baseline (DRAFT) release for Chromium-based Microsoft Edge 79

We are pleased to announce the draft security baseline for the initial stable release of the new Microsoft Edge! Please review the security baseline (DRAFT) for Microsoft Edge version 79, and send us your feedback through the Baselines Discussion site.

What are security baselines?

Every organization faces security threats. However, the types of security threats that are of most concern to one organization can be completely different from another organization. For example, an e-commerce company may focus on protecting its Internet-facing web apps, while a hospital may focus on protecting confidential patient information. The one thing that all organizations have in common is a need to keep their apps and devices secure.

A security baseline is a group of Microsoft-recommended configuration settings that explains their security impact. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers.

Why are security baselines needed?

Security baselines are an essential benefit to your organization because they bring together expert knowledge from Microsoft, partners, and customers.

For example, there are 200+ Microsoft Edge Group Policy settings for Windows. Of these settings, only some are security-related. Although Microsoft provides extensive guidance on these policies, exploring each one can take a long time. You would have to determine the security impact of each setting on your own. Then, you would still need to determine the appropriate value for each setting.

In modern organizations, the security threat landscape is constantly evolving, and IT administrators and policy-makers must keep up with security threats and make required changes to Microsoft Edge security settings to help mitigate these threats. To enable faster deployments and make managing Microsoft Edge easier, Microsoft provides customers with security baselines that are available in consumable formats, such as Group Policy Objects backups.

Security baseline principles

As with our current Windows and Office security baselines, our recommendations for Microsoft Edge configuration follow a streamlined and efficient approach to baseline definition when compared with the baselines we published before Windows 10. The foundation of that approach is essentially this:

The baselines are designed for well-managed, security-conscious organizations in which standard end users do not have administrative rights.

A baseline enforces a setting only if it mitigates a contemporary security threat and does not cause operational issues that are worse than the risks they mitigate.

A baseline enforces a default only if it is otherwise likely to be set to an insecure state by an authorized user:

If a non-administrator can set an insecure state, enforce the default.

If setting an insecure state requires administrative rights, enforce the default only if it is likely that a misinformed administrator will otherwise choose poorly.

(For further explanation, see the “Why aren’t we enforcing more defaults?” section in this blog post.)

How can you use security baselines?

You can use security baselines to:

Ensure that user and device configuration settings are compliant with the baseline.

Set configuration settings. For example, you can use Group Policy, System Center Configuration Manager, or Microsoft Intune to configure a device with the setting values specified in the baseline.

Download the security baselines

For version 78, see Security baseline (DRAFT) for Chromium-based Microsoft Edge, version 78.

For version 79, see Security baseline (DRAFT) for Chromium-based Microsoft Edge, version 79.

Future draft security baselines versions will be posted to the Microsoft Security Baselines Blog, and final security baselines will be available in the Security Compliance Toolkit (SCT).

Learn about Microsoft Edge in the enterprise

Check out our Microsoft Edge enterprise documentation to learn more about deploying and managing the next version of Microsoft Edge.

– Forbes Higman, Program Manager, Microsoft Edge enterprise security
– Brian Altman, Program Manager, Microsoft Edge manageability
Click to expand...

Source: https://blogs.windows.com/msedgedev/...draft-edge-79/

Tweet

— Twitter API (@User) View on Twitter

Windows 10: Microsoft Security Baseline policies conflict

Microsoft Security Baseline policies conflict

Microsoft Security Baseline policies conflict

Microsoft Security Baseline policies conflict

Microsoft Security Baseline policies conflict - Similar Threads - Microsoft Security Baseline

Microsoft Baseline Security Analyzer

Microsoft Baseline Security Analyzer

23h2 security baseline. Whats new from 2021 baseline?

Revert Security Baselines

Revert Security Baselines

Microsoft Security Baseline policies conflict

Windows 11 Security Baselines - will the two new policies be included in the next Windows...

Microsoft Security Compliance Toolkit Security Baseline Challenge Question

Microsoft Security Compliance Toolkit Security Baseline Challenge Question