Recommended Security GPOs for Active Directory –

Harden Active Directory by importing the Microsoft Security Baseline GPOs from the Security Compliance Toolkit (SCT), linking each to the correct domain or OU, and adding a few custom GPOs the baseline does not cover (LAPS, admin tiering, NTLM/SMB/LDAP hardening).

Applies to: Windows Server 2016, 2019, 2022 and 2025 domain controllers and member servers; Windows 10 and 11 domain-joined clients.

Audience: AD and Group Policy administrators with Domain Admin (or delegated GPO create/link) rights.

Out of scope: Entra ID / Intune baselines, Defender for Identity deployment, and forest recovery.

Prerequisites

• Group Policy Management Console (GPMC) and the GroupPolicy PowerShell module (RSAT) on an admin workstation or DC.
• Domain Admin rights, or delegated rights to create GPOs and link them to the target OUs.
• A full GPO backup taken before changes: Backup-GPO -All -Path C:\GPOBackup\Pre-Baseline.
• An OU structure that separates Domain Controllers, member servers and workstations (baselines are linked by role).
• A test OU for each role with a few representative machines.
• A change window and a rollback plan (unlink the GPO, then gpupdate /force).

Recommended GPOs and where to link them

Create one GPO per baseline file and link it by role. Keep the Microsoft GPOs unedited and put your exceptions in a separate override GPO with higher precedence. Version numbers in the names (for example v2602, 25H2) change with each release.

If you have one OU for all servers and clients, filter the role GPOs with WMI filters on ProductType (1 = client, 2 = DC, 3 = member server).

Step 1: Download the baseline and update the Central Store

1. Go to the Microsoft Security Compliance Toolkit download page (aka.ms/SCT).
2. Download the baseline zip for each OS you run (for example Windows Server 2025 Security Baseline and Windows 11 version 25H2 Security Baseline), plus PolicyAnalyzer.zip and LGPO.zip.
3. Unblock and extract each zip to a working folder, for example C:\SecurityBaselines\WS2025.
4. Review the folder contents:
   • GPOs – GPO backups you will import.
   • GP Reports – HTML report of every GPO’s settings.
   • Documentation – Excel spreadsheet of all settings and the release announcement.
   • Templates – ADMX/ADML files the baseline needs (for example SecGuide.admx and MSS-legacy.admx).
   • Scripts – local-install scripts for testing on standalone machines.
5. Copy the files from Templates to the Central Store so GPMC can display the custom settings:

$store = "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies\PolicyDefinitions"
Copy-Item C:\SecurityBaselines\WS2025\Templates\*.admx $store
Copy-Item C:\SecurityBaselines\WS2025\Templates\en-US\*.adml "$store\en-US"

If the PolicyDefinitions folder does not exist yet, create it first by copying C:\Windows\PolicyDefinitions from an up-to-date machine.

Step 2: Create the GPOs and import the baseline settings

Import creates the GPOs unlinked, so nothing changes on any machine until Step 5.

Option A: GPMC (one GPO at a time)

1. Open Group Policy Management (gpmc.msc).
2. Expand Forest > Domains > yourdomain > Group Policy Objects.
3. Right-click Group Policy Objects > New. Name it exactly as the baseline GPO (for example MSFT Windows Server 2025 v2602 - Domain Controller).
4. Right-click the new GPO > Import Settings > Next.
5. Skip the backup of the empty GPO, then Browse to the baseline’s GPOs folder.
6. Select the matching backup from the list (tick Show only the latest version) > Next.
7. On Migrating References, choose Copying them identically from the source > Next > Finish.
8. Repeat for each GPO in the table above.

Option B: PowerShell (all GPOs at once)

The baseline’s Scripts folder includes Baseline-ADImport.ps1, which creates and imports every GPO in the zip. Run it from an elevated PowerShell on a machine with GPMC:

cd C:\SecurityBaselines\WS2025\Scripts
.\Baseline-ADImport.ps1

To import a single GPO yourself:

Import-Module GroupPolicy
$path = 'C:\SecurityBaselines\WS2025\GPOs'
$name = 'MSFT Windows Server 2025 v2602 - Domain Controller'
Import-GPO -Path $path -BackupGpoName $name -TargetName $name -CreateIfNeeded

Create the custom GPOs

Create the custom GPOs empty now; Step 4 lists what goes in them.

'SEC - LAPS','SEC - Tier 0 Logon Restrictions','SEC - Baseline Overrides' |
    ForEach-Object { New-GPO -Name $_ -Comment 'Security hardening - see KB' }

Step 3: Review the key settings before linking

The settings below are the ones most likely to affect applications or users. Confirm exact values in the Documentation spreadsheet of your release, since they change between versions.

Tip: before linking, compare the baseline with your current GPOs in Policy Analyzer. Add your existing GPO backups and the baseline’s .PolicyRules file, then click View / Compare to see every conflict.

Step 4: Configure the custom GPOs

The Microsoft baseline does not manage local admin passwords or admin logon boundaries, so add these two GPOs.

SEC – LAPS (Windows LAPS)

1. Extend the schema and grant computers permission to write their own password (once per forest/OU):

Update-LapsADSchema
Set-LapsADComputerSelfPermission -Identity 'OU=Servers,DC=contoso,DC=com'
Set-LapsADComputerSelfPermission -Identity 'OU=Workstations,DC=contoso,DC=com'

2. Edit the GPO: Computer Configuration > Policies > Administrative Templates > System > LAPS.
   • Configure password backup directory: Enabled, Active Directory.
   • Password Settings: Enabled, large letters + small letters + numbers + specials, length 15 or more, age 30 days.
   • Enable password encryption: Enabled (requires Windows Server 2016 domain functional level).
   • Post-authentication actions: Reset the password and log off the managed account.
3. Read a password to confirm it works: Get-LapsADPassword -Identity PC01 -AsPlainText.

SEC – Tier 0 Logon Restrictions

Stops domain admin credentials from being exposed on servers and workstations. Link it to server and workstation OUs only, never to the Domain Controllers OU.

Edit Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment and add Domain Admins, Enterprise Admins and Schema Admins to:

• Deny access to this computer from the network
• Deny log on as a batch job
• Deny log on as a service
• Deny log on locally
• Deny log on through Remote Desktop Services

Before linking, move any service or scheduled task that runs as a Domain Admin to a dedicated, least-privilege account. Also add admin accounts to the Protected Users group (a group, not a GPO setting).

SEC – Baseline Overrides

Put every exception to the baseline here, with a comment explaining why. Link it to each OU above the baseline GPOs (link order 1) so it wins. This keeps the MSFT GPOs untouched and makes the next baseline upgrade a simple swap.

Step 5: Test, then link in production

1. Audit first (DCs). Before enforcing LDAP signing and NTLM restrictions, turn on auditing and watch for 1–2 weeks:
   • LDAP: Directory Service log events 2887/2889 list clients doing unsigned or simple binds.
   • NTLM: set Network security: Restrict NTLM: Audit NTLM authentication in this domain to Enable all and review the NTLM Operational log (event 8004).
2. Link to test OUs. Link each baseline GPO to its test OU, then run gpupdate /force on the test machines and reboot (VBS and Credential Guard need a restart).

New-GPLink -Name 'MSFT Windows Server 2025 v2602 - Member Server' -Target 'OU=Test-Servers,DC=contoso,DC=com' -LinkEnabled Yes

3. Test the business apps on each role: logons, file shares, printing, backups, monitoring agents, LOB apps. Put any required exception in SEC – Baseline Overrides.
4. Roll out in waves: workstations pilot group, then all workstations, then member servers, then the Domain Controllers OU, then Domain Security at the domain root last.
5. Set link order so SEC – Baseline Overrides is 1 on each OU:

Set-GPLink -Name 'SEC - Baseline Overrides' -Target 'OU=Servers,DC=contoso,DC=com' -Order 1

Rollback: disable the link (Set-GPLink -LinkEnabled No) and run gpupdate /force. Note that some security settings remain on the machine after the GPO is removed (“tattooing”) and must be reset by an opposite setting in a GPO.

Verification and troubleshooting

Repeat this procedure for each new baseline release: import the new GPOs next to the old ones (names include the version), test, then swap the links.