New & Updated Security Tools

by Scott Muniz | Sep 3, 2020 | Uncategorized

This article is contributed. See the original author and article here.

It took us a little longer than we wanted but we are finally ready to announce new versions of LGPO and Policy Analyzer as well as two new tools, GPO2PolicyRules and SetObjectSecurity.

The goal is to keep this post as short as possible so let’s just jump into the details.

LGPO v3.0

Two new options were added in LGPO.exe.  The first, /ef which enables Group Policy extensions referenced in the backup.xml. The second, /p which allows for importing settings directly from a .PolicyRules file which negates the need to have the actual GPOs on hand. Additionally, LGPO.exe /b and /g now capture locally-configured client-side extensions (CSEs) (which we had an issue with previously).   Lastly, /b also correctly captures all user rights assignments, overcoming a bug in the underlying “secedit.exe /export” that fails to capture user rights assignments that are granted to no one.

Policy Analyzer v4.0

The “Compare to Effective State” button has replaced the “Compare local registry” and “Local Policy” checkboxes that used to be in the Policy Analyzer main window.  Press it to compare the selected baseline(s) to the current system state. If the selected baseline(s) contain any user configuration settings, they are compared against the current user’s settings. “Compare to Effective State” requires administrative rights if the selected baseline(s) include any security template settings or Advanced Auditing settings. The effective state corresponding to the selected baseline(s) settings are saved to a new policy rule set.

Policy Analyzer now captures information about Group Policy Client-Side Extensions (CSEs) when you import GPO backups. From a Policy Viewer window, choose View Client Side Extensions (CSEs) to view the Machine and User CSEs for each baseline in the Viewer. (Note that LGPO.exe’s improved support for CSEs includes the ability to apply CSE configurations from Policy Analyzer’s .PolicyRules files.)

Policy Analyzer now maps settings and sub-settings to display names more completely and more accurately, including mapping the GUIDs for Attack Surface Reduction (ASR) rules to their display names, and improved localization.

GPO2PolicyRules

You can now automate the conversion of GPO backups to Policy Analyzer .PolicyRules files and skip the GUI. GPO2PolicyRules is a new command-line tool that is included with the Policy Analyzer download. It takes two command-line parameters: the root directory of the GPO backup that you want to create a .PolicyRules file from, and the path to the new .PolicyRules file that you want to create. For example:

GPO2PolicyRules.exe C:BaselinePkgGPOs C:UsersAnalystDocumentsPolicyAnalyzerbaseline.PolicyRules

SetObjectSecurity v3.0

SetObjectSecurity.exe enables you to set the security descriptor for just about any type of Windows securable object (files, directories, registry keys, event logs, services, SMB shares, etc). For file system and registry objects, you can choose whether to apply inheritance rules. You can also choose to output the security descriptor in a .reg-file-compatible representation of the security descriptor for a REG_BINARY registry value.

Use cases include:

•              Restoring default security descriptor on the file system root directory (which sometimes gets misconfigured by some system setup tools)
•              Restricting access to sensitive event logs that grant access too broadly (examples include AppLocker and PowerShell script block logs that grant read or read-write to NT AUTHORITYINTERACTIVE)
•              Locking down (or opening access to) file shares, directories, registry keys

SetObjectSecurity.exe is a 32-bit standalone executable that needs no installer, has no dependencies on redistributable DLLs, and works on all supported x86 and x64 versions of Windows. (x64 systems must support WOW64)

Terms of Use

We have now included standard use terms for the tooling that is delivered as part of the Security Compliance Toolkit.

We continually try to process all your feedback and make improvements along the way so please give the new and updated tooling a try and as always let us know any feedback in the comments below.

The Patch and Switch “unofficial” End User Guide to Microsoft Ignite

by Scott Muniz | Sep 3, 2020 | Uncategorized

This article is contributed. See the original author and article here.

We sit in a lot of meetings and collaborate with a lot of people who are organizing and planning the Digital Experience of Microsoft Ignite – taking place ONLINE at https://myignite.microsoft.com on September 22nd through to the morning of the 24th (Pacific Time). It’s a free event open to all folks who are interested in what Microsoft is up to, targeting technical professionals, decision makers, students and startups. 

We thought we’d pull together all the useful information we can dig up from the 187 slide PowerPoint presentation and share the interesting nuggets with YOU. (we’re not kidding, it grows at least a half dozen slides or more twice a week). Welcome to the first edition of the Unofficial End User Guide to Microsoft Ignite. 

Keep on checking back periodically as we add more information and more videos as soon as we can share the information. 

Got a question about Microsoft Ignite? Feel free to comment below the posts and we’ll be happy to answer them or heck – we might even create a video answer for ya! 

Episode #1 – Go Register… why register?

In this entry of the Unofficial End User Guide of Microsoft Ignite, Patch and Switch talk about all things Registration.

Why should you register?

1. It’s Free
2. It’s Free
3. Did we mention it’s free?

You need to register at https://myignite.microsoft.com in order to gain full access to all the content, all the digital breakouts and all the additional programming available during Microsoft Ignite.