We help IT Professionals succeed at work.

Best way to check for GPO compliance? Having trouble with SCCM.

2,460 Views
Last Modified: 2014-12-10
What is the best way to check computers on the network for compliance against Group Policies?

I have tried exporting Backups of our GPOs and converting them to .cab in Microsoft Security Compliance Manager, but that only converts to 2007 and I'm on SCCM 2012, so I'm not sure if it's 100% accurate there. Secondly, there's always some kind of issue, like it not knowing how to translate some configuration items' queries and determine if systems are compliant.

Is there a better way? I'm new to this area. Is it all commercial software solutions to "get things done" in this area? Or is there a simple free approach I'm overlooking?

There is interest in comparing USGCB baselines as well, and I can only work with their GPO backups and convert with Microsoft Security Compliance Manager, which like my own GPO backups, leads to strange issues.
I'm assuming the USGCB SCAP is a better file to use for baseline scanning?
Comment
Watch Question

Exec Consultant
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
Well fascinating stuff, a lot to go through. I do appreciate it and will check it out.

I ran into one issue today, where Compliance Manager, appended the word "Equals" to the beginning of the Interactive Logon message for security group policy, and it also omitted a comma from one of the sentences in the paragraph of text.
This kind of stuff is very strange to me and I find myself having to in every single "export" and "import" to clean up the programs' mess. If not it comes back as compliant. Which leads me to believe, how do I know what's "compliant" is indeed compliant?
The criteria/expressions/values get whacky sometimes and I find that troubling.
btanExec Consultant
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.