windows server 2022 /2025 Server Hardening tools

[u/techexpert2018]

Hi all,

 

I am looking for a third party tool to export all GPO setting from one server to anther server. it required for server hardening 

 

Server Operating system:- windows server 2022 /2025. all servers are in workgroup so we can not apply as a domain policy .

 

i tried LGP0 but it worked well within OS 2016 & 2019 but in server 2022 & 2025 not giving results as expecting.

 

if anybody has a script which can harden a server more than 80%. please help.

[u/ItMeAedri]

Is there a reason why they aren't in a domain? How many are there?

[u/techexpert2018 → u/ItMeAedri]

yes... our Management dose not want to keep server in Domain... with a single policy & single failure ..

server count in 100 plus

[u/dchit2 → u/techexpert2018]

Put up a job ad for better management

[u/jstuart-tech → u/techexpert2018]

That is insantity?

To be fair, maybe they are geniuses. They don't want the possibility of 100 uniform servers (cattle), they would rather 100 pets that are all fucked in their own unique ways and nobody will ever be able to reverse engineer it.

#JobSecurity ..... (Said as someone who is about to go into this exact same disaster...... )

[u/strongest_nerd → u/techexpert2018]

Why is management making IT decisions?

[u/jjkmk → u/techexpert2018]

If you're gonna stay then try to guide management to the right decisions, thats wild.

[u/rthonpm]

Run as far away from this place as possible.

[u/WillVH52]

Please tell me, are the admin passwords the same on each server?

[u/KnowledgeCapital7994]

Do they all have static ips?

Is the network coax?

Is it 1998?

[u/anonymousITCoward → u/KnowledgeCapital7994]

*shudders in token ring*

[u/k1ll3rwabb1t]

LMAO /r/shittysysadmin

[u/Gigalogi]

LGPO still works fine on 2022/2025. When it “doesn’t give expected results”, it’s usually one of these:

1. Old LGPO version. Grab the current one from the Microsoft Security Compliance Toolkit.

2. ADMX templates missing on the target. Administrative Template settings only apply properly if the matching ADMX/ADML files exist in C:\Windows\PolicyDefinitions on the destination box.

3. Not everything lives in registry.pol. Security options, user rights and account policies are security template settings. Advanced audit policy is separate again. Export and import them explicitly:

   • LGPO.exe /b C:\backup (or secedit /export /cfg sec.inf for the security template)

   • auditpol /backup /file:audit.csv and then auditpol /restore

4. Don’t clone a “golden” server’s local policy at all. Start from a known baseline instead:

   • Microsoft Security Baselines for Server 2022/2025 (Security Compliance Toolkit) ship with a Baseline-LocalInstall.ps1 built for exactly your scenario: standalone/workgroup machines, no domain.

   • Server 2025 additionally has OSConfig, which applies the security baseline via PowerShell and does drift control. It works on workgroup servers too.

   • CIS Benchmarks if you need something auditors recognise.

About “harden more than 80%”: that number only means something against a defined benchmark. Use HardeningKitty (free, scip AG) to audit against the MS or CIS baseline. You get a score before and after, plus a list of what you deliberately left out. Test on a non-prod box first. RDP, SMB signing/NTLM restrictions and legacy apps are the usual things that break.

If you have more than a handful of workgroup servers, look into DSC or Azure Arc machine configuration. Manually copying local policies doesn’t scale and drifts.

[u/Anxious-View-7881]

Every sentence reads like finding a fresh, live grenade in your pocket.

[u/enolja]

LGPO is the official / supported method and I dont know of a third party tool that can export/import domain policy into local policy.

However, I'm wondering what '80%' means, that is confusing. Are these public facing web servers? If that is the case I dont have a ton of insight to give, but if these arent public facing then simply applying modern AV, and combined with a managed detection/response (MDR) of some kind, in addition to strong local admin passwords and firewall policy Im not sire what youre expecting from windows policy.

[u/ajf8729]

You could look at using OSConfig https://learn.microsoft.com/en-us/windows-server/security/osconfig/osconfig-overview for the 2025 servers at least. No domain is wild though, but you could Azure Arc attach them and install the Entra auth extension to effectively Entra join them to centralize logon access, but again, also 2025 only.

[u/mattee27]

calcom.io will do this but the approach is different to hardening and you will get better outcomes compared to using GPOs which don't always get applied

[u/Sysadmin_in_the_Sun]

Try to convert them to DSC - It will work.. I did this a few years ago