๐ย Secure Bits ๐ก
๐๐ผ๐ ๐๐ผ ๐ฝ๐ฟ๐ฒ๐ฝ๐ฎ๐ฟ๐ฒ ๐ณ๐ผ๐ฟ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐๐ฎ๐๐ฒ๐น๐ถ๐ป๐ฒ๐ & ๐ง๐ถ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ ๐ผ๐ฑ๐ฒ๐น โ ๐๐ถ๐๐ต๐ผ๐๐ ๐ฏ๐ฟ๐ฒ๐ฎ๐ธ๐ถ๐ป๐ด ๐ฒ๐๐ฒ๐ฟ๐๐๐ต๐ถ๐ป๐ด?
Implementing Security Baselines and the Tiering Model can significantly improve your Windows Infrastructure security.
But letโs be honest โ if youโre working with anย ๐ผ๐น๐ฑ๐ฒ๐ฟ ๐ผ๐ฟ ๐บ๐ฒ๐๐๐ ๐ฒ๐ป๐๐ถ๐ฟ๐ผ๐ป๐บ๐ฒ๐ป๐, this change can turn into chaos quickly.
๐๐ป ๐ฎ ๐ป๐ฒ๐, ๐ฐ๐น๐ฒ๐ฎ๐ป ๐ฒ๐ป๐๐ถ๐ฟ๐ผ๐ป๐บ๐ฒ๐ป๐? No problem.
๐๐ป ๐ฎ ๐ฝ๐ฟ๐ผ๐ฑ๐๐ฐ๐๐ถ๐ผ๐ป ๐ฒ๐ป๐๐ถ๐ฟ๐ผ๐ป๐บ๐ฒ๐ป๐ ๐ณ๐ฟ๐ผ๐บ ๐ฎ๐ฌ๐ญ๐ญย with undocumented GPOs and legacy services? Now thatโs where things get tricky.
Hereโs the approach I useย ๐ฏ๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐ ๐ฎ๐ฝ๐ฝ๐น๐ ๐ฏ๐ฎ๐๐ฒ๐น๐ถ๐ป๐ฒ๐ ๐ฎ๐ป๐ฑ ๐๐ถ๐ฒ๐ฟ๐ถ๐ป๐ดย to any device:
๐ย ๐ญ. ๐๐ต๐ฒ๐ฐ๐ธ ๐๐ผ๐ฐ๐ฎ๐น ๐จ๐๐ฒ๐ฟ๐ & ๐๐ฟ๐ผ๐๐ฝ๐
Look for leftover accounts and custom group memberships. Sometimes theyโre obsolete โ sometimes theyโre tied to production services. Know before you break something.
๐งฐย ๐ฎ. ๐ฅ๐ฒ๐๐ถ๐ฒ๐ ๐ฆ๐ฒ๐ฟ๐๐ถ๐ฐ๐ฒ๐ & ๐ฆ๐ฒ๐ฟ๐๐ถ๐ฐ๐ฒ ๐๐ฐ๐ฐ๐ผ๐๐ป๐๐
I check whatโs running, what accounts are used, and whether I canย upgrade to MSA/GMSA/VSA. If the tiering model restricts access โ service accounts must follow suit.
๐ก๏ธย ๐ฏ. ๐๐ป๐ฎ๐น๐๐๐ฒ ๐จ๐๐ฒ๐ฟ ๐ฅ๐ถ๐ด๐ต๐๐ ๐๐๐๐ถ๐ด๐ป๐บ๐ฒ๐ป๐๐ (๐จ๐ฅ๐)
Security baselines and tiering willย overwrite many of these settings. This is where legacy config hides โ and itโs often essential for apps to function. Export and document them early.
๐งชย ๐ฐ. ๐ฅ๐๐ป ๐ฃ๐ผ๐น๐ถ๐ฐ๐ ๐๐ป๐ฎ๐น๐๐๐ฒ๐ฟ
This is my favorite tool for baseline comparison. It showsย GPO differences, conflicts, and potential impactsย โ perfect for validating changes before rollout. Exporting this gives you a good rollback reference too.
๐ก ๐๐
๐๐ฟ๐ฎ ๐๐ถ๐ฝ๐:
โข If a 3rd-party app is installed, I try to get theย application owner involvedย (they rarely know the technical details, but itโs worth a shot).
โข Youโll never catch 100% of the issues beforehand โ but this prepย avoids 90% of post-implementation surprises.
โข For high-value systems, I spendย more time on analysis and documentationย before rollout.
๐ย ๐ง๐ต๐ถ๐ ๐ถ๐ ๐ฒ๐
๐ฎ๐ฐ๐๐น๐ ๐๐ต๐ฒ ๐ธ๐ถ๐ป๐ฑ ๐ผ๐ณ ๐ฝ๐ฟ๐ฎ๐ฐ๐๐ถ๐ฐ๐ฎ๐น ๐๐ผ๐ฟ๐ธ ๐๐ฒ ๐ฑ๐ผ in my course Building a Secure Active Directory:
https://horizon-secured.com/courses/building-a-secure-active-directory/
In the next Secure Bits post, Iโll show you what theย actual migration looks likeย after preparation is done.
Whatโs been your experience rolling outย ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐๐ฎ๐๐ฒ๐น๐ถ๐ป๐ฒ๐ ๐ผ๐ฟ ๐ง๐ถ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ ๐ผ๐ฑ๐ฒ๐น? Any horror stories or success tips?
