Chapter 13 — Configuration baselines on Windows
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Choosing settings"]
N2["13.2 Measuring"]
N3["13.3 Piloting"]
N4["13.4 Rolling out"]
N5["Explaining changes and reaching every laptop"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Choosing settings"]
N2["13.2 Measuring"]
N3["13.3 Piloting"]
N4["13.4 Rolling out"]
N5["Explaining changes and reaching every laptop"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Choosing settings]
|
v
[13.2 Measuring]
|
v
[13.3 Piloting]
|
v
[13.4 Rolling out]
|
v
[Explaining changes and reaching every laptop]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) compare laptops with a baseline; (2) pilot changes; (3) measure compliance.
13.1 Choosing settings
For laptops, Tomás and Dev pick fifteen settings from the CIS Benchmark and Microsoft security baseline that matter most for the trust: screen lock, firewall on, guest disabled, SMBv1 off, PowerShell logging, removable media scanning, LAPS, and others.
Each setting was chosen because it addresses something already seen at the trust, such as the thirty-minute screen lock, the public firewall profile switched off on two laptops and the shared local administrator password. Tomás records the source and value of each setting so the next technician knows why it is there.
13.2 Measuring
The management service reports each setting's state per device. Tomás exports this and computes how many laptops meet all fifteen. At the start, 31 of 94 do.
A laptop counts as compliant only if all fifteen settings match, so one missing setting is enough to fail it. Tomás chose this strict measure because a laptop with fourteen good settings and the firewall off is still exposed. The export also lists which setting failed on each laptop, so the 63 non-compliant laptops can be grouped by the setting they miss.
13.3 Piloting
Changes go to ten laptops in one school for two weeks. One problem appears: an old interactive whiteboard app needs SMBv1 to reach a shared folder. The app vendor's newer version works without it, so the app is updated rather than the setting relaxed.
The pilot laptops belong to staff who volunteered and who agreed to report anything that stopped working. Dev keeps the old settings documented so he can revert the pilot group within minutes if a classroom problem appears. The whiteboard app problem is exactly the kind of conflict the pilot exists to find before ninety-four laptops are affected rather than ten.
13.4 Rolling out
The baseline then goes to all laptops in two groups a week apart. Compliance rises to 86 of 94, with the rest offline over a holiday.
Rolling out in two groups a week apart means that a problem missed in the pilot affects only half the laptops before it is noticed. Dev watches the support requests during the first week and only releases the second group once there are no new complaints linked to the baseline. The eight laptops not yet compliant are listed by name for checking after the holiday.
Explaining changes and reaching every laptop
Before rollout, Dev sends staff a short note listing what will change, such as the screen lock and blocked USB autorun, and why; questions drop when people know what to expect. Tomás also writes a one-page record of the fifteen settings with each value and source, so the next technician understands the baseline. One practical gap remains: laptops that stay at home over holidays never touch the school network. Because settings are delivered by the cloud management service, these laptops receive the baseline whenever they are online anywhere. Tomás confirms this by checking the policy timestamp on a laptop that was away for two weeks.
Worked example
The final eight are checked when they reconnect after the holiday, bringing compliance to 93 of 94; the last laptop has a failed management agent and is reinstalled.
Synthetic case. Figures are synthetic.
Errors and limits
Relaxing a setting to suit old software is sometimes needed, but updating the software is usually better.
Exercises
- EX037 — Picking settings. Why choose fifteen settings rather than the whole benchmark at first? Rubric: 3 = manageable, focus on impact, measurable;; 2 = easier;; 1 = vague;; 0 = none.
- EX038 — Old software conflict. How was the SMBv1 conflict resolved and why? Rubric: 3 = app updated rather than setting relaxed;; 2 = app updated;; 1 = vague;; 0 = none.
- EX039 — Compliance measure. Write the compliance result before and after as a fraction. Rubric: 3 = 31/94 to 93/94;; 2 = one;; 1 = vague;; 0 = none.
Synthesis
A focused Windows baseline, piloted and measured, moves compliance from a third to nearly all laptops.
Continue studying — chapter 13 of 30
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →