{"id":8788,"date":"2024-05-08T09:24:59","date_gmt":"2024-05-08T07:24:59","guid":{"rendered":"https:\/\/www.teal-consulting.de\/2024\/05\/08\/gpos-und-systemhaertung\/"},"modified":"2024-06-17T10:13:22","modified_gmt":"2024-06-17T08:13:22","slug":"gpos-and-system-hardening","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2024\/05\/08\/gpos-and-system-hardening\/","title":{"rendered":"GPOs put to the test: Why group policies are not enough for professional system hardening"},"content":{"rendered":"
[vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”30″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text][\/vc_column_text][vc_empty_space height=”20″][vc_column_text]We are often asked why we do not carry out system hardening using Group Policies or Group Policy Objects. The simple answer is that it is extremely inefficient and leads to unsatisfactory results. In this article, we explain why this is the case.<\/p>\n

 <\/p>\n

A guest article from our partner: FB Pro GmbH<\/a><\/strong>[\/vc_column_text][vc_empty_space height=”20″][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n

Group policies: Effective and essential<\/h2>\n[\/vc_column_text][vc_empty_space height=”20″][vc_column_text]Group Policy Objects (GPO), known as group policies in German, marked a significant advance when they were introduced around 25 years ago. They enable administrators to implement a consistent configuration on remote or distributed systems in a minimum of time.<\/p>\n

Creating effective group policies was relatively straightforward when they were first introduced. To this day, GPOs remain a common and widely used tool for distributing and maintaining configurations. Nevertheless, it is becoming increasingly clear that Group Policy Objects lack important functions or do not focus on them.<\/p>\n

Microsoft itself, for example, emphasizes in an article<\/a> the advantages that newer technologies such as PowerShell DSC offer over GPOs.[\/vc_column_text][vc_empty_space height=”20″][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n

Can system hardening be carried out using GPOs?<\/h2>\n[\/vc_column_text][vc_empty_space height=”20″][vc_column_text]Yes, in principle, GPOs can technically be used to distribute system configurations and corresponding hardening settings.<\/p>\n

For example, you can follow the BSI’s SiSyPHuS guidelines<\/a> by downloading the recommended group policy objects for hardening Windows 10<\/a>. Hardening configurations can then be transferred to the target systems on the basis of GPOs. The Center for Internet Security (CIS) also offers group policy-based configuration sets.<\/p>\n

However, there are weighty arguments against implementation via GPO:<\/p>\n