Baseline recommendation for Server 2019 1809

[F1rstLevel]

Hi

I'm doing my first steps into device hardening.
HardeningKitty seems to be a very promising solution for this task.

I'm unsure which Microsoft security baseline would be the correct starting point for Windows 2019 1809 member servers.

My first guess would be
Microsoft Security baseline for Windows Server (Member) 2004
using the file
finding_list_msft_security_baseline_windows_server_2004_member_machine.csv
as it is the closest one to the build my servers have.

Also I would like to know if other users prefer CIS or MS security baselines or even a combination of them.

Many thanks for your answers
Mike

[0x6d69636b]

Hi Mike

You're right, I also think that 2004 is the closest to Windows Server 2019 (1809).

Here is a thread on Twitter on the subject MSFT/CIS: https://twitter.com/rucam365/status/1683117215791431680. IMO both CIS and MSFT cover the important hardening settings. One advantage of the Microsoft Baseline is that you can download the ADMX templates directly from Microsoft. Of course you can also use HailMary ;-) Especially if you want to manage multiple servers, I recommend using GPOs.

[F1rstLevel]

Hi Michael

Thanks for the feedback!

In this special situation the customer wants the servers to be hardened as early as possible, even before joining the domain, therefore GPO's are not yet available at that point.
So I'm thinking of a two-phased hardening approach:

• setup Windows 2019
• hardening step 1 using HailMary
• various tasks: drivers, domain-join, virus-scanner, MS updates, apps, agents, config...
• hardening step 2 via GPO's using MS Baseline ADMX template