Take a deep breath, and let’s dive in…
Patrick Burwell, Burwell.tech
This set of tools allows enterprise security administrators to download, analyze, test, edit and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products, while comparing them against other security configurations.
Security Compliance Toolkit (SCT) — Updated for Windows Server 2025
Download the latest SCT package here: https://aka.ms/SCT and review baseline documentation at aka.ms/baselines.
High-Level Policy Analyzer Overview
+-------------------+ +-------------------+ +-------------------+
| GPO Backups | | MS Baselines | | Local Policies |
| (D:\GPOBackups) | | (.INF files) | | (secpol.msc) |
+---------+---------+ +---------+---------+ +---------+---------+
\ | /
\ | /
\ | /
\ | /
v v v
+--------------------------------+
| Policy Analyzer |
| Offline Comparison Engine |
+--------------------------------+
|
v
+-------------------------------+
| Comparison Report (CSV/HTML) |
+-------------------------------+
Prerequisites
- Administrative privileges
- RSAT installed (Windows 10/11 or Server)
- Domain access to at least one domain controller
- Supported OS: Windows Server 2016 → 2025
Step-by-Step Procedure to Use Policy Analyzer
1. Download and Extract SCT
- Download from aka.ms/SCT.
- Copy the ZIP before extracting.
- Extract to
D:\utils\SCT.
+------------------+ copy +------------------+ extract +----------------------+ | SCT.zip (source) | -------------> | SCT-copy.zip | ---------------> | D:\utils\SCT\... | +------------------+ +------------------+ +----------------------+ Rule: Never extract directly from the original download; always work from a copy. Avoid installing non-native tools on the OS (C:) volume.
2. Locate Policy Analyzer
- Navigate to
D:\utils\SCT\PolicyAnalyzer. - Run
PolicyAnalyzer.exeas Administrator.
D:\utils\SCT\
├─ PolicyAnalyzer\
│ ├─ PolicyAnalyzer.exe
│ └─ ...
└─ Baselines\
└─ WindowsServer2025\...
Run: Right-click PolicyAnalyzer.exe → "Run as administrator"
3. Prepare GPO Backups
- Open GPMC (
gpmc.msc). - Right-click each GPO → Back Up.
- Store backups in
D:\GPOBackups. - Include MS baselines (
.inf) from SCT.
+-------------------+ backup +---------------------------+
| GPMC (Domain GPO) | ---------------> | D:\GPOBackups\{GPO GUID} |
+-------------------+ +---------------------------+
Tip: Back up all GPOs, then run a filtered backup for "linked + enabled" GPOs.
4. Add Policies to Compare
- Open Policy Analyzer.
- Click Add.
- Use Add files from GPO or Add files from folder.
- Assign friendly names.
Policy Analyzer "Add" Workflow +---------------------------+ | Add | +---------------------------+ | [x] Add files from GPO | | [ ] Add files from folder| +---------------------------+ Friendly names: - "Prod Default Domain Policy" - "MS Windows Server 2025 Baseline" - "Legacy Hardening GPO"
5. Compare Policies
- Select at least two policies.
- Click Compare.
- Review identical, differing, and unique settings.
Comparison Table (Conceptual) +-----------------------------+---------------------------+---------------------------+ | Setting | Policy A (GPO Backup) | Policy B (MS Baseline) | +-----------------------------+---------------------------+---------------------------+ | PasswordLength | 8 | 14 | | AccountLockoutThreshold | 5 | 10 | | AuditLogonEvents | Success | Success, Failure | | ... | ... | ... | +-----------------------------+---------------------------+---------------------------+
Note: Policy Analyzer runs offline and does not modify GPOs directly.
6. Export Results
- Export to CSV, HTML, or Excel.
- Store with GPO change documentation.
+---------------------------+ | Export Comparison Results | +---------------------------+ | [x] CSV | | [ ] HTML | | [ ] Excel | +---------------------------+ Output: D:\Reports\PolicyAnalyzer_Compare_2025-05-19.csv
Local Policy & gpresult
gpresult /r
gpresult /h %TEMP%\gpo_report.html
gpresult /r (summary)
Computer Settings:
Applied Group Policy Objects:
- Default Domain Policy
- Workstation Hardening GPO
User Settings:
Applied Group Policy Objects:
- Default Domain Policy
- User Restrictions GGO
ConcurrentCallLimit and Throttling
Import-Module GroupPolicy
Get-GPRegistryValue -Name "Default Domain Policy" `
-Key "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" `
-Value "ConcurrentCallLimit"
Group Policy Request Flow
Clients ----> DC (Non-GC Infrastructure Master)
| |
| many requests |
v v
+-------------------------------+
| ConcurrentCallLimit threshold |
+-------------------------------+
|
v
+-------------------------------+
| Throttling / Event ID 1129 |
+-------------------------------+
Infrastructure Master vs Global Catalog
Multi-Domain Concept
+-------------------+ +-------------------+
| Domain A DC (IM) | | Domain B DC (GC) |
+-------------------+ +-------------------+
| |
| cross-domain references |
v v
IM:
- Tracks references to objects in other domains.
- Should NOT be a GC unless all DCs are GCs.
GC:
- Holds partial replica of all objects in forest.
- Handles forest-wide queries.
Group Policy Replication Flow
Replication (Conceptual) +-----------+ +-----------+ +-----------+ | DC1 | ---> | DC2 | ---> | DC3 | +-----------+ +-----------+ +-----------+ Advice: - Do NOT enforce new GPOs immediately. - Let replication converge naturally.
Final Notes for Rookies
GPO Naming Pattern Original: "Default Domain Controllers Policy" Updated: "20250519 Default Domain Controllers Policy" Practice: - Always keep a disabled original. - Enable the updated copy. - Document who changed what, when, and why.
Authored with assistance from Microsoft Copilot.
Most of all, take a deep breath. Stay calm. This isn’t complicated — it’s just structured.
You’re in control. The tools won’t bite. One step at a time and everything makes sense.
Patrick Burwell, Burwell.tech