Going down the IT rabbit hole

With Windows Server 2025 getting closer and closer to GA, Microsoft recently announced Windows Server 2025 Security Baseline Preview (beginning with build 26296 -> register as insider -> download).

With new security baseline for Windows Servers we got some major changes in security management:

• apply baselines for individual machines:
  • PowerShell cmdlets (available in Microsoft.OSConfig)
  • Windows Admin Center (WAC)
• apply and monitor baselines at-scale:
  • Azure Policy and Azure Automanage Machine Configuration

The WAC, Azure Policy and Azure Automanage Machine Configuration experiences will be released soon to the Windows Insider Program and will only work with Windows Server 2025.

At the core of new security baseline is Microsoft.OSConfig PowerShell Desired State Configuration (DSC) module. (There is also Linux version with similar name and capabilities: Azure OSConfig.) Because we are going to be using DSC to apply security defaults, those settings that we want to enforce will be automatically protected from any drift (DSC also enables us to use declarative model for system configuration management – we define the end state and the DSC module knows how to get there.)

Current version (0.1.201) of Microsoft.OSConfig DSC module has four functions that we can use:

• Get-OSConfigMetadata
• Get-OSConfigDesiredConfiguration
• Remove-OSConfigDesiredConfiguration
• Set-OSConfigDesiredConfiguration

and three aliases (that we probably shouldn’t be using):

• osc-get
• osc-remove
• osc-set

To apply security defaults we get to choose from four baseline scenarios:

• AppControl
• Defender\Antivirus (48 settings)
• SecuredCore (3 settings -> UEFI MAT, Secure Boot, Signed Boot Chain​)
• SecurityBaseline (329 settings -> Account and password policies​, Credentials Protections, Protocol defaults, Security Policies and Security Options,…)

CSV files (report) with details for above scenarios are available on GitHub.

Peeking into SD subfolder of the current version of Microsoft.OSConfig DSC module reveals few more details about the supported scenarios:

• AppControl
• AppControl_AzureStackHCI_DefaultPolicy_Audit
• AppControl_AzureStackHCI_DefaultPolicy_Enforce
• AppControl_WS2025_AppBlockList_Audit
• AppControl_WS2025_AppBlockList_Enforce
• AppControl_WS2025_DefaultPolicy_Audit
• AppControl_WS2025_DefaultPolicy_Enforce
• Defender_Antivirus
• SecuredCore
• SecuredCoreState
• SecurityBaseline_AzureStackHCI
• SecurityBaseline_AzureWindowsBaseline
• SecurityBaseline_WS2025_DomainController
• SecurityBaseline_WS2025_MemberServer
• SecurityBaseline_WS2025_WorkgroupMember

After we install the prerequisites:
Install-PackageProvider NuGet, PowerShellGet -Force
we can install OSConfig module:
Install-Module -Name Microsoft.OSConfig -AllowPrerelease -Scope AllUsers -Repository PSGallery -Force
Get-Module -ListAvailable -Name Microsoft.OSConfig

To apply the Security Baseline via PowerShell cmdlets we have to run Set-OSConfigDesiredConfiguration (to apply new configuration, we have to restart the device):

• On domain-joined device:
  Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Default
• On workgroup device:
  Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\WorkgroupMember -Default
• On domain controller device:
  Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WS2025/DomainController -Default
• For Secured-core configuration:
  Set-OSConfigDesiredConfiguration -Scenario SecuredCore -Default
• For Defender Antivirus configuration:
  Set-OSConfigDesiredConfiguration -Scenario Defender\Antivirus -Default

Set-OSConfigDesiredConfiguration cmdlet includes few additional nice-to-have parameters that we can use when we apply security baseline:

• Setting & Value -> custom value for specific setting
• Setting & Default -> use the default value of the setting
• Version -> apply specific version (current module has one version per scenario)

If we want to customize specific setting in the basline, we can run:
Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Name AuditDetailedFileShare -Value 3
or
Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Name RemoteDesktopServicesDoNotAllowDriveRedirection -Value 0

Verify custom setting:
Get-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Name AuditDetailedFileShare
or
Get-OSConfigDesiredConfiguration -Scenario SecurityBaseline\WS2025\MemberServer -Name RemoteDesktopServicesDoNotAllowDriveRedirection

To view the compliance of the applied Security Baseline we can use:
Get-OSConfigDesiredConfiguration -Scenario SecuredCoreState

More info including impact and some known issues are available in the official anouncement.