Free Security Compliance Manager hardens server systems

Defending the Baseline

Article from ADMIN 11/2012

By Thomas Joos

Microsoft operating systems are not necessarily regarded as the epitome of computer security, but the free Security Compliance Manager helps enforce some basic hardening measures.

When companies deploy multiple Windows servers, they often have a problem defining and distributing security settings uniformly and for best possible effect. The free Microsoft Security Compliance Manager (SCM) contains templates and recommendations for protecting servers via Group Policies and PowerShell scripts. The focus is on protecting the Windows operating system. In the new version, the tool can also protect Exchange Server 2007 SP3/2010 SP2.

Basically, the tool creates templates for Group Policies that integrate Microsoft recommendations. Administrators can customize the policies to meet their enterprise needs and then add new policies via Group Policy for distribution to servers.

The SCM tool supports not only Active Directory servers but standalone servers as well. SCM also offers a command-line tool that administrators can use to harden servers through batch files.

Free Tool

Microsoft provides SCM for free [1]. After you install the tool, import the existing group policies from Active Directory and compare the settings in your policies with the configuration recommendations from SCM. You can then import the custom policies back into Active Directory. If you are not currently using group policies, you can create new policies easily with SCM or secure individual servers with SCM via local security policies.

SCM helps protect Windows Server 2003/2008/2008 R2, as well as the client operating systems Windows XP/Vista and Windows 7, including Service Pack 1. Version 2.5 of SCM still lacks the support for Windows 8 and Windows Server 2012, but by the time these operating systems are released in the last quarter of 2012, Microsoft will probably have an updated version of SCM on offer. Additionally, SCM protects Internet Explorer 8/9, Office 2007/2010, and Exchange Server 2007/2010, including the latest service packs –

...

Use Express-Checkout link below to read the full article (PDF).