CHAPTER 3
WINDOWS UPDATES AND BASELINES
Windows Updates and Baselines in
Windows Server 2022
1. Update management ranges from automatic updates to complex systems
like Windows Server Updated Services with group policies.
2. Each approach has its pros and cons for update control.
3. Baselines help monitor resource changes, like hard drive space, memory, and
processor speed.
4. Baselines are essential for ensuring server health and performance in
Windows Server 2022.
Importance of Windows Updates
1. Windows updates serve various critical purposes:
Security patches protect against malware attacks.
Bug fixes enhance stability and performance.
New features improve functionality.
2. Keeping software up to date is crucial, including browsers, email clients, and antivirus
software.
3. Installing security updates promptly is essential for malware protection.
4. Automatic installation of security updates can be configured for convenience.
Types of Windows Updates
1. Four main types of Windows updates:
Security updates: Address vulnerabilities to prevent malware exploits.
Quality updates: Include bug fixes and performance improvements.
Feature updates: Major releases adding new features.
Driver updates: Ensure proper hardware device functionality.
2. Additional, less common update types:
Servicing stack updates: Enhance update handling in Windows.
Preview updates: Pre-release versions for testing.
Cumulative updates: Combine multiple security and quality updates into one.
Security Updates: Priority and Protection
1. Security updates are the highest priority.
2. They fix Windows vulnerabilities to prevent malware attacks.
3. Prompt installation of security updates is critical for computer security.
4. Configuring automatic installation of security updates is recommended for
timely protection.
Windows Updates Enhance Performance
and Functionality
◦Windows updates not only enhance security but also improve performance
and functionality.
◦Bug fixes in quality updates stabilize Windows.
◦Feature updates introduce new features and capabilities.
◦Driver updates ensure proper communication with hardware devices.
◦Regular updates contribute to a smoother and more secure computing
experience
Here are the steps for deploying a WSUS
server
1. Install the WSUS role on a server. You can do this by going to Server
Manager > Manage > Add Roles and Features.
2. Configure the WSUS server. This includes configuring the synchronization
schedule, the update classifications, and the update groups.
3. Approve updates for deployment. This includes approving security updates,
critical updates, and other updates.
4. Deploy updates to client computers. This can be done manually or
automatically.
To configure the WSUS server, you can follow these steps
1. Open the WSUS Administration console.
2. In the left pane, expand Servers and select the server that you want to
configure.
3. In the right pane, click Options.
4. On the Synchronization tab, configure the synchronization schedule.
5. On the Update classifications tab, configure the update classifications.
6. On the Update groups tab, configure the update groups.
Approve updates for deployment
1. Open the WSUS Administration console.
2. In the left pane, expand Computers.
3. In the right pane, select the computers that you want to deploy the updates
to.
4. Click Deploy.
Integrating Windows Defender with WSUS
and Windows Update
1. Windows Defender updates can be managed through Windows Update.
2. WSUS (Windows Server Update Services) can also be used to deploy Defender updates.
3. Steps for automatic deployment:
Open WSUS Administration console.
Select the server to configure.
Verify Windows Defender is selected under Products.
Configure automatic approvals for Defender updates.
Save changes.
Tips for Effective Windows Defender
Integration with WSUS
1. Configure synchronization schedule:
Set a regular schedule for synchronizing Windows Defender updates.
2. Configure automatic approvals:
Automatically approve Defender updates for deployment.
3. Monitor synchronization:
Ensure correct synchronization of Defender updates.
4. Effective integration with WSUS enhances Windows Defender management
and security.
Windows Security Baselines
1. Windows is designed with a balance between security and user-friendliness.
2. Organizations may require a higher level of security than the default
configuration.
3. Security Baselines offer a way to apply industry-standard security measures
efficiently.
4. Baselines evolve with input from security experts, industry data, metrics, and
AI.
5. Creating effective security baselines involves adhering to specific rules.
Rules for Creating Security Baselines
1. Baselines are intended for organizations with active security teams and
restricted user privileges.
2. Baselines must secure against current threats while maintaining system
stability and usability.
3. Changes to baseline settings should have a minimal impact on system
performance.
4. Baselines enforce default secure values and mitigate administrator errors.
5. Striking the right balance between security and usability is a key goal of
security baselines.
The Role of Security Baselines
1. Security Baselines enhance Windows security without manual configuration.
2. They adapt to evolving threats and industry standards.
3. Designed to meet organizational security needs while maintaining system
functionality.
4. Collaborative efforts of security experts, industry data, and AI drive baseline
development.
5. Baselines provide a valuable tool for organizations to strengthen their
security posture.
Managing Security Baselines with Group
Policy
1. Security baselines are managed using the Group Policy Management
interface.
2. The Security Compliance Toolkit aids in implementation by comparing GPO
values.
3. The Toolkit includes an Analyzer for GPO import.
4. The Analyzer doesn't support editing or creating new baselines.
5. Managing baselines through Group Policy is a crucial step in enhancing
security.
Security Compliance Toolkit Download and
Usage
1. When downloading the Security Compliance Toolkit, users can select desired
baselines.
2. Baselines and tools are provided as compressed files.
3. These files contain backup images of policy objects.
4. Treating them like regular backup images ensures proper usage and
management.
5. The Toolkit streamlines the process of implementing and managing security
baselines in Windows.
Creating the Baseline Backup
1. Open the Group Policy Management
Console.
2. Navigate to the Group Policy Objects
container.
3. Right-click on the container and select
Back Up All…
Creating the Baseline Backup,
continued
4. Or, Select a single Object and Right-click, then select Backup.
5. Choose a folder into which you want the backup files to be stored.
6. Click Backup.
7. Click OK to close the confirmation window.
Importing Security Baselines
◦Importing security baselines can be done through the Policy Analyzer or GPO
Editor.
◦The Policy Analyzer offers a quicker and automated import process.
◦GPO Editor requires manual placement of imported policies.
◦PowerShell can also be used for importing, but it involves complex scripting
techniques.
Importing the Baselines
1. Open the Group Policy Management Console.
2. Navigate to the intended group policy container.
3. Right-click on the container and select Manage Backups.
4. Select the folder in which your baselines are kept.
5. Select the baselines that you wish to apply.
6. Click Restore.
7. Click OK to confirm that you want to restore the settings.
8. When the restore is complete, you’ll see a confirmation screen.
Applying Security Baselines to Servers
1. Applying baselines to servers, whether domain-joined or non-domain,
follows standard Group Policy procedures.
2. The primary difference lies in the application location.
3. Non-domain servers require direct application of changes.
4. Domain-joined servers can have baselines applied to the primary AD DS
controller under the desired OU.
Domain Joined Server Baselines
1. Open the Security Compliance Manager.
2. Open the baseline and export it to a GPO.
3. Open Group Policy Management.
4. Navigate to the desired OU and container.
5. Create a new policy and give it a name that you’ll recognize later.
6. Right-click the new policy and select Import Settings.
7. Click Next until you reach the last page of the import wizard, then click
Finish.
What We Have Learned
◦The importance of Windows updates pertaining to security
◦Deploying a WSUS server
◦Integrate Windows Defender with WSUS and Windows Update.
◦Create, view, and import security baselines
◦Deploy configurations to domain and non-domain joined servers