Settings

Active Directory is not necessary for securing Windows Server with SCM; the settings also can be programmed in local policies. SCM provides the LocalGPO command-line tool for this purpose. The tool from the Microsoft Security Compliance Manager program group lets you import settings locally from SCM into a policy on the server. The tool provides various options for the import process. LocalGPO is especially intended for servers that do not have a domain assignment. The first step is to install the tool on the server; you then import the settings at the command line.

After installation, launch LocalGPO Command-line in the LocalGPO program group. To import the settings from a SCM baseline onto the local server, you must first create the baseline, as previously described. Next, export this as a GPO backup to a directory. Copy the directory to the server on which you want to implement the policies. Then, type the command

cscript LocalGPO.wsf /path:<path to GPO backup>

(Figure 3). When transferring the new settings, LocalGPO saves the settings in the local policy. You can restore the policy at any time. To restore the original settings on the server, use the command:

cscript LocalGPO.wsf /Restore

Figure 3: Importing settings as a script with LocalGPO.

LocalGPO also lets you back up local security policy settings in a GPO backup, and you can use this for a restore by reimporting it to the server. Additionally, you can import the backup on other local servers, and it is possible to create a new Active Directory Group Policy on the basis of a backup and to import the policy. To do this, use the command:

cscript LocalGPO.wsf /path: <path> /Export

You can import this backup with LocalGPO, or you can use the Group Policy Management Console. Moreover, you can export the local security policy on a server to a GPOPack , which lets you import the security settings on another server without having to install LocalGPO on the target system. To do this, use the command:

cscript LocalGPO.wsf /path: "<path>" /Export /GPOPack

For more details on this subject, visit the website [5].