45 lines
5.6 KiB
Markdown
45 lines
5.6 KiB
Markdown
# GPO comparison contract
|
|
|
|
## Microsoft evidence reviewed on 2026-09-06
|
|
|
|
- [Microsoft Security Compliance Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=55319): official PolicyAnalyzer.zip, bundled **Policy Analyzer.pdf**, version 4.0, pages 1 and 6. Read directly from the official ZIP in memory; no executables run.
|
|
- [Policy Analyzer introduction](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/new-tool-policy-analyzer/701049).
|
|
- [ControlPolicyConflict / MDMWinsOverGP](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict).
|
|
- [Windows Hello for Business policy conflicts](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/configure#policy-conflicts-from-multiple-policy-sources).
|
|
|
|
Policy Analyzer distinguishes differing configured values from absent settings. Repeated definitions of the same setting are indicated separately. The comparison retains registry data types: a numeric 5 and a text "5" differ. It can compare policy sets and local effective state; the latter is a separate operation.
|
|
|
|
## User-facing outcomes
|
|
|
|
| Outcome | Evidence required |
|
|
| --- | --- |
|
|
| Fail / Misconfigured | Explicit Microsoft recommendation and a persisted deterministic mismatch. A missing required key or typed empty value is a mismatch; ordinary missing value recommendations remain Not configured. |
|
|
| Not configured | Explicit nonempty Microsoft recommendation and a missing customer setting; informational, excluded from Fail and Deviation. |
|
|
| Pass | Explicit Microsoft recommendation and a persisted deterministic match. For Registry.pol deletion requirements, target absence in the analyzed backup set is an explicit matching state. |
|
|
| Conflicts | Multiple distinct typed customer values for the same setting, or explicitly recorded contradictory recommendations within one baseline set. |
|
|
| Duplicates | Multiple source entries configuring the same setting to the same typed value. |
|
|
|
|
Registry addresses include computer/user scope (implicit HKLM/HKCU in Registry.pol), key and value name. Address matching ignores case; value data retains case and type. Different value names under the same key are distinct settings. Native security-template and advanced-audit settings use their resolved identities. Assessments and projects are never merged for collision detection.
|
|
|
|
Registry.pol `delete-value`, `delete-all-values` and `create-key` are compared as typed target states rather than discarded as missing values. A typed empty string remains a present value. These rules describe only the imported backup configuration; local effective state remains a separate Policy Analyzer operation and requires separate evidence.
|
|
|
|
Microsoft also calls configured differences *between* policy sets conflicts. ASSESSOR labels configured customer-versus-benchmark mismatches Fail. The user's 2026-09-06 correction replaces the earlier four-outcome contract: missing settings remain a separate informational outcome. GPO Deviation includes only Misconfigured, not Conflicts, Duplicates, missing values or review-only records. Other scanner deviation semantics remain unchanged. A conflict in the imported set is not a claim that both settings apply to the same endpoint: GPO backup analysis does not establish resultant policy.
|
|
|
|
One baseline comparison creates one Work row with all source references. One customer collision group creates one Conflicts/Duplicates row. A duplicate group may also have a separate Pass/Fail benchmark result; these are different questions. Multiple benchmarks do not themselves create duplicate customer settings.
|
|
|
|
Unsupported, unbound, not-evaluated, and ordinary review-only observations do not create Work rows. Diagnostics and original evidence remain available separately. Existing persisted data is not deleted or reclassified by this presentation change.
|
|
|
|
## Hybrid AD / Intune
|
|
|
|
A GPO and an Intune policy can prescribe conflicting values for an equivalent setting. This requires both policy sources, device/user assignments, an explicit CSP-to-GPO mapping, and applicable precedence rules. Matching raw registry strings is insufficient because equivalent GPO and CSP settings may use different locations.
|
|
|
|
MDMWinsOverGP is device-scoped, defaults to 0, and governs Policy CSP equivalents only. It is not a universal MDM priority rule. Microsoft documents separate behavior for PassportForWork/Windows Hello for Business, where mixed GPO/CSP configuration can prevent CSP settings from applying. MDM diagnostics can report GP settings blocked by an MDM equivalent.
|
|
|
|
The current importer does not provide Intune policy settings and assignment evidence. Hybrid status from another report alone cannot establish such a conflict. Hybrid conflict evaluation therefore remains an explicit future input/mapping task; no synthetic Intune conflict is inferred from GPO backups.
|
|
|
|
## Verification and remaining parity work
|
|
|
|
Synthetic regression coverage includes absent/empty baselines, missing customer values, typed collisions, address case, different value names, scope and timeslot isolation, baseline separation, duplicate read rows, source preservation, and a 2300-GPO group. Work and the analysis summary use the same builder.
|
|
|
|
This is not a claim of complete executable parity with Policy Analyzer. A differential run of the same synthetic packages through Policy Analyzer and ASSESSOR remains required, including cross-format Registry.pol/security-template equivalence, ordered delete instructions, supported type families and translated identifiers. Conditional Group Policy Preferences and resultant endpoint policy require additional semantics/evidence and stay excluded from automatic claims.
|