CIS benchmarks for Domain Controller.

Question

CIS benchmarks for Domain Controller.

brichardi 361

Hello,

I am task with implement CIS benchmarks to enhance security for our AD environment. I breaks down the CIS benchmarks to 4 phases to ensure if there an issue, it will be quickly remediated.

My questions is will the CIS benchmark policies given the highest priority when link to DCs OU so it won't get override by the Default Domain Controllers policy?

Many of my co-worker think the CIS benchmark GPO should be below the Default Domain so that CIS policy won't override the default GPO settings. But doing that will undo many of the critical security baselines I am trying to implement.

Your help is greatly appreciated.

0 comments

1 answer

Your answer

Answer 1

CIS benchmark GPOs linked directly to the Domain Controllers OU can take precedence over the Default Domain Controllers Policy, but the fact that they are linked to the OU does not by itself give them the highest priority. The Domain Controllers OU is processed after the domain level, so an OU-linked GPO generally has precedence over a domain-linked GPO. However, because both the CIS GPO and the Default Domain Controllers Policy are linked directly to the Domain Controllers OU, their relative precedence is determined by the link order.

If the CIS GPO has Link Order 1 on the Domain Controllers OU, it has the highest precedence among the GPOs linked to that OU. When the CIS GPO and Default Domain Controllers Policy configure the same setting, the CIS GPO's value will be the effective value. Settings configured only in the Default Domain Controllers Policy will continue to apply. In other words, the CIS GPO does not "override" the entire Default Domain Controllers Policy; it takes precedence only where there is a conflict.

Placing the CIS GPO below the Default Domain Controllers Policy would give the Default Domain Controllers Policy higher precedence for overlapping settings. That could prevent the CIS baseline from enforcing some of the security settings you are deliberately implementing. So if the objective is for the CIS configuration to take precedence over conflicting settings in the Default Domain Controllers Policy, the CIS GPO should have the higher link-order precedence on the Domain Controllers OU.

I would not use Enforced simply to make the CIS GPO take precedence over the Default Domain Controllers Policy on the same OU. Correct link ordering is sufficient for that situation. Enforced is more relevant when you need a GPO to prevent lower-level GPOs from overriding its settings through normal inheritance. Using Enforced unnecessarily can make the resulting Group Policy configuration harder to troubleshoot and manage.

For the four-phase rollout, keeping each CIS phase in a separate GPO is a good approach. For example, you could use CIS-Phase-1, CIS-Phase-2, CIS-Phase-3, and CIS-Phase-4. This allows you to deploy and validate each group of controls independently and disable or roll back a particular phase without having to remove the entire CIS configuration.

Do not assume that every CIS setting conflicts with the Default Domain Controllers Policy. Many CIS settings will be additional settings that are not configured elsewhere. The precedence issue matters when two applicable GPOs configure the same setting. The goal should be to leave the default policies intact where possible and use the dedicated CIS GPOs to establish the security baseline, with deliberate link ordering for settings where the CIS baseline must take precedence.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin