Windows Group Policy Hardening

Windows Group Policy Hardening: Core Concepts

In a Windows domain, configuring security settings on each machine individually is impossible at scale. Group Policy Objects (GPOs) solve this by providing a centralized mechanism to enforce security configurations across thousands of computers and users from a single management point.

The GPO Architecture

A GPO is a collection of settings that define how a computer or user should be configured. GPOs are stored in two locations:

• Group Policy Container (GPC) — Stored in Active Directory, contains the GPO's attributes and version information.
• Group Policy Template (GPT) — Stored in the SYSVOL share on domain controllers, contains the actual settings, scripts, and administrative templates.

When a GPO is linked to an Organizational Unit (OU), site, or domain, the settings apply to all users and computers within that scope. Group Policy replicates across all domain controllers via the File Replication Service (FRS) or Distributed File System Replication (DFSR).

Processing Order: LSDOU

When multiple GPOs apply to a computer or user, they are processed in a specific order:

1. Local — The local GPO on the machine itself
2. Site — GPOs linked to the site
3. Domain — GPOs linked to the domain
4. OU — GPOs linked to the Organizational Unit (processed parent to child)

Later GPOs override earlier ones when there is a conflict. This means an OU-level GPO can override a domain-level GPO, which can override the local GPO. The gpresult /r command shows which GPOs applied and which won.

Key Security Settings

Password Policy (found in Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Password Policy):

• Enforce password history — Prevents reuse of recent passwords (recommend 24)
• Maximum password age — Forces periodic password changes (recommend 60-90 days)
• Minimum password age — Prevents immediate password changes to bypass history (recommend 1 day)
• Minimum password length — Enforces complexity (recommend 14+ characters)
• Password must meet complexity requirements — Requires uppercase, lowercase, digit, and special character

Account Lockout Policy:

• Account lockout threshold — Number of failed attempts before lockout (recommend 5)
• Account lockout duration — How long the account stays locked (recommend 30 minutes)
• Reset account lockout counter after — Time window for counting failures (recommend 30 minutes)

Audit Policy (Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration):

• Audit account logon events
• Audit account management
• Audit logon events
• Audit object access
• Audit policy change
• Audit privilege use
• Audit process tracking
• Audit system events

Software Restriction Policies / AppLocker:

Control which applications can run on a system:

• Allow only approved software (whitelisting)
• Block known malicious executables
• Restrict software by path, hash, or publisher certificate

Where It Fits

Group Policy is the enforcement mechanism for Windows security baselines. It works alongside Active Directory (which provides the identity and organizational structure) and complements host-level controls like Windows Defender and BitLocker. Study Active Directory Fundamentals first to understand the domain structure that GPOs depend on.

Windows Group Policy Hardening: Practice

Group Policy changes affect every computer and user in the linked scope. A mistake can lock out administrators or disable critical services. The exercises below follow a methodical approach to implementing and verifying GPO changes.

Exercise 1: Configure Password and Lockout Policies

Open the Group Policy Management Console (gpmc.msc) and create a new GPO:

1. Right-click the target OU → "Create a GPO in this domain, and Link it here..."
2. Name: "Security Baseline - Password Policy"
3. Edit the GPO:
   Navigate to: Computer Configuration → Policies → Windows Settings →
                Security Settings → Account Policies → Password Policy

4. Configure:
   - Enforce password history: 24 passwords remembered
   - Maximum password age: 60 days
   - Minimum password age: 1 day
   - Minimum password length: 14 characters
   - Password must meet complexity requirements: Enabled
   - Store passwords using reversible encryption: Disabled

5. Navigate to: Account Policies → Account Lockout Policy
   - Account lockout threshold: 5 invalid logon attempts
   - Account lockout duration: 30 minutes
   - Reset account lockout counter after: 30 minutes

Force a Group Policy update and verify:

# On a target computer, force GP update
gpupdate /force

# Verify the applied policy
gpresult /r

# Check specific password policy settings
net accounts

Exercise 2: Enable Advanced Auditing

1. Edit the GPO: "Security Baseline - Audit Policy"
   Navigate to: Computer Configuration → Policies → Windows Settings →
                Security Settings → Advanced Audit Policy Configuration →
                Audit Policies

2. Configure:
   - Audit Account Logon Events: Success and Failure
   - Audit Account Management: Success and Failure
   - Audit Logon Events: Success and Failure
   - Audit Object Access: Success and Failure
   - Audit Policy Change: Success and Failure
   - Audit Privilege Use: Failure
   - Audit Process Tracking: Success and Failure
   - Audit System Events: Success and Failure

Verify auditing is working:

# Check audit policy
auditpol /get /category:*

# Generate a test event and check the Security log
wevtutil qe Security /c:5 /rd:true /f:text

Exercise 3: Deploy Software Restriction via AppLocker

1. Edit the GPO: "Security Baseline - AppLocker"
   Navigate to: Computer Configuration → Policies → Windows Settings →
                Security Settings → Application Control Policies → AppLocker

2. Create Executable Rules:
   - Default rule: Allow everyone to run files in Program Files
   - Default rule: Allow everyone to run files in Windows
   - Custom rule: Deny everyone from running executables in %TEMP%

3. Set AppLocker to Enforce rules (not just Audit)

Test by attempting to run an executable from a blocked location.

Check Your Understanding

• Why does the LSDOU processing order matter when multiple GPOs conflict?
• What happens if you set "Minimum password age" to 0 days?
• How do you verify which GPOs actually applied to a computer?

Windows Group Policy Hardening: Trade-offs and Interviews

Group Policy is powerful but introduces complexity that can create operational problems. Understanding the trade-offs is essential for designing maintainable security policies.

The Complexity Problem

In large environments, hundreds of GPOs may apply to a single computer. Troubleshooting why a particular setting is applied (or not applied) becomes difficult. The gpresult /h report.html command generates a comprehensive HTML report showing all applied GPOs, but interpreting it requires experience.

Best practices to manage complexity:

• Use a naming convention that includes the purpose, target, and version (e.g., SEC-PasswordPolicy-v2.0)
• Document every GPO with a description of its purpose and the settings it contains
• Minimize the number of GPOs — consolidate related settings into fewer GPOs
• Use WMI filtering and security filtering to target GPOs precisely rather than linking broadly and blocking

When Group Policy Is the Wrong Tool

• Standalone (non-domain) computers: Group Policy requires Active Directory. For standalone machines, use Local Group Policy (gpedit.msc) or PowerShell Desired State Configuration (DSC).
• Cloud-managed environments: In Azure AD / Intune environments, many traditional GPO settings are replaced by Intune configuration profiles. While Group Policy still works for hybrid-joined machines, cloud-native management is the direction Microsoft is moving.
• Application-specific configuration: GPO is designed for OS and security settings. Application-specific configuration (e.g., database connection strings) should be managed through application deployment tools or configuration management systems.

Security Risks of Group Policy

• GPO delegation: If an attacker gains permission to edit GPOs, they can push malicious settings to every computer in the domain. Protect GPO editing permissions carefully.
• SYSVOL exposure: GPO settings are stored in SYSVOL, which is readable by all domain users. Never store sensitive data (passwords, keys) in GPOs.
• Stale GPOs: Old GPOs that are no longer needed but still linked can contain outdated or insecure settings. Regularly audit and clean up GPOs.

How This Comes Up in Interviews

• "How do you enforce a password policy across 10,000 computers?" Create a GPO with the password policy settings, link it to the appropriate OU, and use gpupdate /force to apply immediately. Verify with gpresult /r.
• "A user says they cannot run a legitimate application after a GPO change. How do you troubleshoot?" Run gpresult /h report.html to see which GPOs applied, check if AppLocker or Software Restriction Policies are blocking the application, and verify the user's OU membership.
• "How do you secure Group Policy itself?" Delegate GPO editing permissions to a small group of trusted administrators, audit GPO changes with Advanced Audit Policy, and regularly review GPO settings against a security baseline.