Going down the IT rabbit hole

On the 28th of July 2016 Microsoft released new version of Security Compliance Manager. You can find some basic info about new version here: Security Compliance Manager 4.0 now available for download!

For those of you who haven’t heard about this solution before, it’s a free tool that enables you to quickly configure computers in your environment using Group Policy and/or Microsoft System Center Configuration Manager. New installer currently includes the same set of baselines as its previous version (3.0.60 released on 22nd of January 2013). All baselines include supporting documentation and referenced set of best-practice GPO settings for:
– Exchange 2007 SP3 & Exchange 2010 SP2
– Internet Explorer 8, 9 & 10
– Office 2007 SP2 & Office 2010 SP1
– Windows XP SP3, Windows Vista SP2, Windows 7 SP1, Windows 8
– Windows Server 2003 SP2, Windows Server 2008 SP2, Windows Server 2008 R2 SP1, Windows Server 2012

Main improvements are:
– Windows 10 and Windows Server 2016 support
–  Support for existing Windows 10 version 1507, and Windows 10 version 1511 security baselines
– Support for upcoming Windows 10 version 1607, and Windows Server 2016
– Bug fixes for ‘Compare’ and ‘Simple View’ features in SCM

I guess they were a bit in a hurry since they missed few things in SCM version 4.0.00.1:
– File version of the new installer file is the same as it is on the previous version
– LocalGPO.wsf is gone
– no new baselines included

If you liked and used now deprecated LocalGPO.wsf, you can find new version of LocalGPO here: LGPO.exe – Local Group Policy Object Utility, v1.0.

If you have internet access on the computer where you installed SCM, SCM can and does automatically download new versions of baselines for:
– Internet Explorer 11 (Attachments)
– Windows 8.1 (Attachments)
– Windows 10 version 1511 (Attachments)
– Windows Server 2012 R2 (Attachments)
– Office 2013 (Attachments)
– SQL 2012 (Attachments)

If you wander where do all the links come from, you can check this link (SCM does this when checking for updates). It points to the latest version of RssFeed_BaselineUpdateV4dot0.xml. With some imagination and few lines of PowerShell syntax you can automate this process and auto-download new baselines without SCM or for offline use.

SCM on Download Center:
– Microsoft Security Compliance Manager 3.0.60
– Microsoft Security Compliance Manager 4.0.00.1