?
Solved

Best way to check for GPO compliance? Having trouble with SCCM.

Posted on 2014-12-03
3
Medium Priority
?
1,578 Views
Last Modified: 2014-12-10
What is the best way to check computers on the network for compliance against Group Policies?

I have tried exporting Backups of our GPOs and converting them to .cab in Microsoft Security Compliance Manager, but that only converts to 2007 and I'm on SCCM 2012, so I'm not sure if it's 100% accurate there. Secondly, there's always some kind of issue, like it not knowing how to translate some configuration items' queries and determine if systems are compliant.

Is there a better way? I'm new to this area. Is it all commercial software solutions to "get things done" in this area? Or is there a simple free approach I'm overlooking?

There is interest in comparing USGCB baselines as well, and I can only work with their GPO backups and convert with Microsoft Security Compliance Manager, which like my own GPO backups, leads to strange issues.
I'm assuming the USGCB SCAP is a better file to use for baseline scanning?
0
Comment
Question by:garryshape
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 64

Accepted Solution

by:
btan earned 2000 total points
ID: 40482103
The typical means is for SCM export the DCM and import into the SCCM for the checks. You can also export settings to Excel (.xlsm), create a GPO backup folder, or export to a SCAP (Security Content Automation Protocol) or a SCM file (both .cab files). http://www.windowsecurity.com/articles-tutorials/misc_network_security/Security-Compliance-Microsoft-SCM.html

the cab should be compatible, and you can check these steps for the checks
http://sccmfaq.wordpress.com/2013/10/07/sccm-2012-compliance-settings-really/

As for the SCCM compliance check use case, you can catch below. You likely need to drill into the compliance rules specific, or run script in specific and have its corresponding remediation task to resolve non compliance...
e.g. s/w  version check - http://blogs.msdn.com/b/scom_2012_upgrade_process__lessons_learned_during_my_upgrade_process/archive/2012/09/21/compliance-settings-sccm-2012.aspx
e.g. port open check -
http://prajwaldesai.com/sccm-2012-compliance-settings/
e.g. disable s/w auto update
http://sccmguru.wordpress.com/2014/08/06/configuration-manager-2012-compliance-baseline-to-disable-adobe-air-automatic-updates/

Useful materials:
Video: Importing GPOs into Security Compliance Manager (SCM)
http://www.windowsecurity.com/articles-tutorials/windows_os_security/Video-Importing-GPOs-Security-Compliance-Manager-SCM.html
Video: SCM 2.5 Creating GPOs from Baselines
http://www.windowsecurity.com/articles-tutorials/windows_os_security/Video-SCM-25-Creating-GPOs-from-Baselines.html
Video: Importing Custom Settings Into Group Policy Production using Security Compliance Manager (SCM)
http://www.windowsecurity.com/articles-tutorials/windows_os_security/Video-Importing-Custom-Settings-Group-Policy-Production-using-SCM.html

Other means are also stated in NIST http://www.nist.org/news.php?extend.204 (most of it is on SCAP tool), but I suggest checking out the below which commonly used besides the SCCM/SCM
CIS benchmark tookit - http://benchmarks.cisecurity.org/downloads/audit-tools/
CIS and Nexpose - https://community.rapid7.com/docs/DOC-2061
Nessus Tenable - https://discussions.nessus.org/thread/3931, http://www.tenable.com/solutions/configuration-auditing
0
 

Author Comment

by:garryshape
ID: 40482109
Well fascinating stuff, a lot to go through. I do appreciate it and will check it out.

I ran into one issue today, where Compliance Manager, appended the word "Equals" to the beginning of the Interactive Logon message for security group policy, and it also omitted a comma from one of the sentences in the paragraph of text.
This kind of stuff is very strange to me and I find myself having to in every single "export" and "import" to clean up the programs' mess. If not it comes back as compliant. Which leads me to believe, how do I know what's "compliant" is indeed compliant?
The criteria/expressions/values get whacky sometimes and I find that troubling.
0
 
LVL 64

Assisted Solution

by:btan
btan earned 2000 total points
ID: 40482122
compliant to SCCM (or any tool) is just the equating of value setting based on registry setting etc or simply want to report based on severity level (http://technet.microsoft.com/en-us/library/bb632716.aspx) - The compliance state is wrt evaluated configuration baseline. It is as it is at that point of check. Trust but verify hence not rely just on tool or one tool, there must be SOP to ensure it stands as claimed. Sometimes, other also do script query to have another check e.g. http://t3chn1ck.wordpress.com/2010/01/11/fix-sccm-client-scan-state/

Pls do not treat it as vulnerability scanning or penetration testing as they drill further to check for verifying and validation of other more (non Windows) services required and needed in business context, and evaluate unnecessary configuration that exposed the Enterprise.
0

Featured Post

Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
Article by: btan
The intent is not to repeat what many has know about Ransomware but more to join its dots of what is it, who are the victims, why it exists, when and how we respond on infection. Lastly, sum up in a glance to share such information with more to help…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…
Suggested Courses
Course of the Month11 days, 16 hours left to enroll

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question