Hi,

currently, I'm working on security hardening of windows 10 machines, I checked the Windows Security Baseline https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-baselines and come over this repo while reading this article https://www.microsoft.com/security/blog/2019/04/11/introducing-the-security-configuration-framework-a-prioritized-guide-to-hardening-windows-10/

so, My questions :

1. Do implementing the security hardening using the Windows Servutiy Baseline enough without checking the L1 Enterprise Basic Security documented here?

2. What are the main differences in security control implemented by the two approaches, are they the same or different! if different, how can you know the difference in mean of controls between the two approaches?

Thanks

Can you please add some context as to how Modern Standby relates to a secure configuration?

Hello

Is this framework still relevant? if not what have taken its place.
Level 4 and 5 is missing.

There are important files that Microsoft projects should all have that are not present in this repository. A pull request has been opened to add the missing file(s). When the pr is merged this issue will be closed automatically.

Microsoft teams can learn more about this effort and share feedback within the open source guidance available internally.

Merge this pull request

Hello,
My input here would be to state that the deployment should be prepared and started within 4 days, and completed within the shortest possible time frame, however i doubt any 'enterprise' does this within 4 days.
When looking at most mid to large size enterprises they usually follow a process where updates are deployed in stages, such as Test, Pilot and the into production. What i usually recommend and also see happening is

1. Patch/Update is released, start immediate deployment to test ring (2-3 days)
2. Deploy to pilot ring (2-4 days)
3. Deploy into production (3-5 days)

This comes close to patching is completed 2.5 weeks after its release.
Any thoughts?

Hi,

I have around 15 windows 10 machine and they are nondomain joined, they are used for the daily working process and accessing cloud data, mainly the used programs are web browsers and office applications with some default windows applications.

I went over the Level 1 security recommendation pointed here: https://github.com/microsoft/SecCon-Framework/blob/master/level-1-enterprise-basic-security.md and thinking to skip the security recommendations that have the Domain member as my devices are not domain-joined.

is that a correct approach to implement the previously mentioned recommendation ! to skip Domain member controles on the non-domain devices?

Thanks in advance.

is there a simple way to map the requirements of a Level 1 Enterprise Basic Security configuration against an existing domain joined w10-endpoint?

I found the security baselines within the Security Compliance Toolkit but they don't seem to be the same as the Level 1-5 configurations?