I would like to update existing GPOs from a Windows Build Kit to align with the newest Benchmark release

Problem

Solution

The Window’s GPO updating process can be maintained as there are typically a small number of recommendations to update yearly.

The Server and Workstation Benchmark publications are always 2nd point releases**, and a typical year’s worth of Change Logs is about 15 entries.

Once you have applied a set of CIS Build Kit GPOs, per your Organizational needs, the best method to keep the GPOs up-to-date and in-accordance with new Benchmark publications is going to be to manually update, test, and apply anything from the Change Log into the existing GPOs.

At the end of all Windows Benchmarks PDF Documents there is a Change Log. The Log shows if Recommendations have been removed, added or updated. See this KB for more information on Change Logs: Is there a way to compare changes between Benchmark older and newer versions?

1. You’ll look at the Change Log Appendix

2. Go to that updated/ added/ removed Recommendation and remediate per the updated Recommendations.

3. If the Recommendation is for Level 1 Member Server, adjust that within the L1 Member Server GPO

   1. Or copy the existent GPO, edit it, test it, and then go into production with it. Whichever your SysAdmin prefers.

Keywords; GPO Update Upgrading

Content by Label