Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Aaron Margosis
Clarifying CVE-2020-1472 (“Zerologon”)
There’s been confusion regarding Microsoft’s patch for CVE-2020–1472 (mitigating the so-called “Zerologon” attack), what you need to do, and when. That’s not entirely surprising: this vulnerability and phased patch response is very different from anything I can recall, and Microsoft’s documentation about it is complex. I’m going to try to clear up the major issues as concisely as I can. First: if you haven’t yet, you must apply this patch to your domain controllers (DCs) as soon as possible.
Security baseline (FINAL) for Chromium-based Microsoft Edge, version 79
Microsoft is pleased to announce the enterprise-ready release of the recommended security configuration baseline settings for the next version of Microsoft Edge based on Chromium, version 79. The settings recommended in this baseline are identical to the ones we recommended in the version 79 draft, minus one setting that we have removed and that we discuss below. We continue to welcome feedback through the Baselines Discussion site.
It rather involved being on the other side of this airtight hatchway: Unquoted service paths
Or, Why most "Unquoted Service Paths" findings are unnecessarily alarmist In late 2012, the issue of improper quoting in the configuration of paths to service executables seemed to begin getting attention again, possibly due to this article. Or perhaps this one. Or maybe this one, which links to articles describing similar issues going back to 2000.
Security baseline (FINAL) for Windows 10 v1909 and Windows Server v1909
11-20-2019 03:24 PM Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 version 1909 (a.k.a., “19H2”), and for Windows Server version 1909. Note that Windows Server version 1909 is Server Core only and does not offer a Desktop Experience (a.k.a., “full”) server installation option.
Security baseline (DRAFT) for Chromium-based Microsoft Edge, version 78
Microsoft is pleased to announce the draft release of the recommended security configuration baseline settings for the next version of Microsoft Edge based on Chromium, version 78. Please evaluate this proposed baseline and send us your feedback through the Baselines Discussion site.
Security baseline (Sept2019Update) for Windows 10 v1903 and Windows Server v1903
We have updated our Windows 10 v1903 and Windows Server v1903 security configuration baseline recommendations to address some issues: The first and most important change is that we are removing the Computer Configuration setting, “Enable svchost.exe mitigation options” (in System\Service Control Manager Settings\Security Settings) from the Windows 10 and Windows Server baselines at this time because of reports that in its current implementation it causes more compatibility issues than we had...
Security baseline for Office 365 ProPlus (v1908, Sept 2019) - FINAL
Microsoft is pleased to announce the final release of the recommended security configuration baseline settings for Microsoft Office 365 ProPlus, version 1908. Please evaluate this proposed baseline and send us your feedback through the Baselines Discussion site. This baseline builds on the overhauled Office baseline we released in early 2018. The highlights of this baseline include: Componentization of GPOs so that “challenging” settings can be added or removed as a unit.
My last blog post on this platform
Microsoft's MSDN and TechNet blog platform is being retired, and as I understand it, what's left on these sites will soon become read-only.
Microsoft Security Baselines Blog
First published on TechNet on Apr 07, 2014 [Note added 3 Oct 2017 to clarify an occasional misinterpretation: at no poin...
“AaronLocker” big perf and feature updates (17 June 2019)
Performance improvements in the scripts, especially in Get-AppLockerEvents.ps1. And: Get-AppLockerEvents.ps1 ... Now retrieves Packaged App events; -EventLogNames parameter supports retrieving from named event logs, to support the use case when forwarded events are saved in event logs other than "ForwardedEvents"; Removed all the field-omission switches (as part of the perf upgrade) Generate-EventWorkbook.ps1 ...
Security baseline (FINAL) for Windows 10 v1903 and Windows Server v1903
Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 version 1903 (a.k.a., “19H1”), and for Windows Server version 1903. Download the content from the Microsoft Security Compliance Toolkit (click Download and select Windows 10 Version 1903 and Windows Server Version 1903 Security Baseline.zip). Note that Windows Server version 1903 is Server Core only and does not offer a Desktop Experience (a.k.a., “full”) server installation option.
“AaronLocker” updates (22 May 2019)
Always handles Portable Executable files even with non-standard extensions such as .tmp and determines whether it's an EXE or DLL. (Ignores files with extensions that should never be PE files such as .txt). Ignores .js files by default; switches on scripts enable overriding to build rules for .js. (AppLocker enforced on .js files only through Windows Script Host; most .js files are processed by other tools that do not enforce AppLocker rules).
“AaronLocker” updates (13 May 2019)
Hot on the heels of yesterday's changes, "AaronLocker" now handles EXE and DLL files with non-standard extensions. Scan a directory with, say, "*.pyd" files or "*.api" files or any other non-standard extension, the "AaronLocker" scripts now identify them, distinguish whether they are Win32 EXE or DLL rules, and builds rules to cover them.
“AaronLocker” updates (12 May 2019)
Just committed some changes to the "AaronLocker" repo on GitHub and its documentation. Changes include: Rule-generation for files in unsafe paths: always used to create one publisher or hash rule for each file in the directory hierarchy. New granularity options enable rules tied only to publisher name or publisher+product name instead of one-rule-per-file.
Security baseline (DRAFT) for Windows 10 v1903 and Windows Server v1903
Microsoft is pleased to announce the draft release of the security configuration baseline settings for Windows 10 version 1903 (a.k.a., “19H1”), and for Windows Server version 1903. Please evaluate these proposed baselines and send us your feedback via blog comments below. Download the content here: Windows-10-1903-Security-Baseline-DRAFT.
“AaronLocker” videos on YouTube
7 minute "Intro to 'AaronLocker'," a set of PowerShell scripts that automate AppLocker-related tasks to achieve robust, practical, customizable, and maintainable application whitelisting for Windows. https://youtu.be/nQyODwPR5qo 13 minute "AaronLocker Quick Start:" how to build, customize, and deploy robust and practical AppLocker rules quickly using AaronLocker. https://youtu.be/E-IrqFtJOKU
“AaronLocker” moved to GitHub
"AaronLocker" is a robust, practical, and free PowerShell-based application whitelisting solution for Windows, built on Windows AppLocker. Earlier posts with description here and here. Rather than continuing to attach zip files to blog posts, I have moved the "AaronLocker" materials, including scripts and documentation, to GitHub: https://github.com/Microsoft/AaronLocker. Among other things, this will make it easier to upload changes as I make them rather than building up a whole package first.
Read “Remote Use of Local Accounts: LAPS Changes Everything”
Read “Remote Use of Local Accounts: LAPS Changes Everything” Over on the Microsoft Security Guidance blog, we've posted a long overdue article about LAPS enabling us to revisit the question about whether and when to block the use of local accounts, particularly for remote administration: https://blogs.technet.microsoft.com/secguide/2018/12/10/remote-use-of-local-accounts-laps-changes-everything/ Remote Use of Local Accounts: LAPS Changes Everything
Remote Use of Local Accounts: LAPS Changes Everything
Beginning in 2014 with our baselines for Windows 8.1 and Windows Server 2012R2, our security baselines have been blocking remote use of local accounts. Back then, Windows had yet to offer anything resembling secure management of administrative local account credentials. It was typical for an entire organization to have an administrative local user account with the same username and password on every Windows computer.
Security baseline (FINAL) for Windows 10 v1809 and Windows Server 2019
Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 October 2018 Update (a.k.a., version 1809, “Redstone 5” or “RS5”), and for Windows Server 2019. For now, download the content here: Windows-10-1809-Security-Baseline-FINAL. It will be posted to the Security Compliance Toolkit download site very soon.
New tool: Policy Analyzer
Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). It can highlight when a set of Group Policies has redundant settings or internal inconsistencies, and can highlight the differences between versions or sets of Group Policies. It can also compare GPOs against current local policy settings and against local registry settings. And you can export its findings to a Microsoft Excel spreadsheet. Policy Analyzer lets you treat a set of GPOs as a single unit.
“AaronLocker” update (v0.91) - and see “AaronLocker” in action on Channel 9!
"AaronLocker" is a robust, practical, PowerShell-based application whitelisting solution for Windows. See it in action in this new Defrag Tools episode on Channel 9! This update (AaronLocker-v0.91) to the original 0.9 release includes these improvements: I still intend to put it on GitHub but haven't gotten to it yet. In the meantime, I want to get the update out, so you can download the updated AaronLocker here.
Security baseline (DRAFT) for Windows 10 v1809 and Windows Server 2019
Microsoft is pleased to announce the draft release of the security configuration baseline settings for Windows 10 version 1809 (a.k.a., “Redstone 5” or “RS5”), and for Windows Server 2019. Please evaluate these proposed baselines and send us your feedback via blog comments below.
ANNOUNCING: Application whitelisting with “AaronLocker”
Announcing the pre-release (v0.9) of "AaronLocker:" robust and practical application whitelisting for Windows. AaronLocker is designed to make the creation and maintenance of robust, strict, AppLocker-based whitelisting rules as easy and practical as possible. The entire solution involves a small number of PowerShell scripts. You can easily customize rules for your specific requirements with simple text-file edits.
Security baseline for Windows 10 “April 2018 Update” (v1803) - FINAL
Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 “April 2018 Update,” also known as version 1803, “Redstone 4,” or RS4.
Security baseline for Windows 10 "April 2018 Update" (v1803) - FINAL
Read in English Read in English Twitter LinkedIn Facebook Email Article 04/30/2018 2 minutes to read In this article Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 “April 2018 Update,” also known as version 1803, “Redstone 4,” or RS4. Download the content from the Microsoft Security Compliance Toolkit (click Download and select Windows 10 Version 1803 Security Baseline.zip).
Issue with BitLocker/DMA setting in Windows 10 “Fall Creators Update” (v1709)
Customers that deployed Microsoft’s security baseline for Windows 10 v1709 might have experienced device and component failures. The BitLocker GPO settings recommended in the Windows security configuration baselines for Windows 10 include enabling “Disable new DMA devices when this computer is locked” to defend against Direct Memory Access (DMA) attacks.
Security baseline for Windows 10 “Fall Creators Update” (v1709) - FINAL
Microsoft is pleased to announce the final release of the recommended security configuration baseline settings for Windows 10 “Fall Creators Update,” also known as version 1709, “Redstone 3,” or RS3. There are no changes from the draft release we published a few weeks ago. The 1709 baseline package has been added to the Microsoft Security Compliance Toolkit.
Why We’re Not Recommending “FIPS Mode” Anymore
Jun 18 2019 01:14 PM First published on TechNet on Apr 07, 2014 [Note added 3 Oct 2017 to clarify an occasional misinterpretation: at no point does this blog post recommend against using FIPS mode. As stated near the end of the post, " we’re not telling customers to turn it off – our recommendation is that it’s each customer’s decision to make.
Security baseline for Windows 10 "Fall Creators Update" (v1709) - DRAFT
Read in English Read in English Twitter LinkedIn Facebook Email Article 09/27/2017 2 minutes to read In this article Microsoft is pleased to announce the draft release of the recommended security configuration baseline settings for Windows 10 “Fall Creators Update,” also known as version 1709, “Redstone 3,” or RS3. Please evaluate this proposed baseline and send us your feedback via blog comments below.
Security baseline for Windows 10 “Creators Update” (v1703) - FINAL
Microsoft is pleased to announce the final release of the recommended security configuration baseline settings for Windows 10 “Creators Update,” also known as version 1703, “Redstone 2,” or RS2. The downloadable attachment to this blog post includes importable GPOs, tools for applying the GPOs, custom ADMX files for Group Policy settings, and all the settings in spreadsheet form. This updated content will be incorporated into the Security Compliance Toolkit shortly.
The Case of the Reverting Office Theme (resolved with a long-running Procmon trace)
Several times a day, all my Office apps kept reverting to the default “Colorful” theme, even though I had set it to the “White” theme. I prefer the “White” theme because I customize the Quick Access Toolbar in my Office apps with extra icons. Those icons have colors, and the oddly-misnamed “Colorful” theme renders them in monochrome, making it harder to tell what they are. I repeatedly set the theme back to “White,” but several hours later when I’d start an Office app I’d find that it had reverted.
Disabling SMBv1 through Group Policy
Version 1 of the Server Message Block (SMB) protocol was developed in the early days of personal computer networking, and as Ned Pyle describes in his blog post, Stop using SMB1 there are many reasons to cease using it on your networks. We have added that recommendation to our baseline, and have exposed a way to do so through Group Policy editors for local or domain GPOs by adding to the custom “MS Security Guide” ADMX.
Guidance on Disabling System Services on Windows Server 2016 with Desktop Experience
The Windows operating system includes many system services that provide important functionality. Different services have different default startup policies: some are started by default (automatic), some when needed (manual) and some are disabled by default and must be explicitly enabled before they can run. These defaults were chosen carefully for each service to balance performance, functionality and security for typical customers.
LAPS Implementation Hints and Security Nerd Commentary (including mini threat model)
Security supergurustar Jessica Payne (@jepayneMSFT) wrote a fantastic blog post about LAPS a while back. We should have linked to it from here a long time ago; we are correcting that oversight now. It authoritatively answers many frequently-asked-questions about LAPS. Check it out:
Troubleshooting with the Windows Sysinternals Tools - now available!
Troubleshooting with the Windows Sysinternals Tools – now available! Over three years ago, I announced that Mark Russinovich and I had signed a contract with Microsoft Press to write the Second Edition of the Windows Sysinternals Administrator’s Reference. I figured it would take a year to finish it. I underestimated. ?™‚ But Mark and I are happy that we can finally tell you that Troubleshooting with the Windows Sysinternals Tools, Second Edition, is now available.
Blocking Remote Use of Local Accounts
The use of local accounts for remote access in Active Directory environments is problematic for a number of reasons.
Microsoft Security Guidance
Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). It can highlight when a set of Group Policies has redundant settings or internal inconsistencies, and can highlight the differences between versions or sets of Group Policies. It can also compare GPOs against current local policy settings and against local registry settings. And you can export its findings to a Microsoft Excel spreadsheet. Policy Analyzer lets you treat a set of GPOs as a single unit.
Security baseline for Windows 10 (build 10240) - FINAL
Microsoft is pleased to announce the final release of the security baseline settings for Windows 10 (Build 10240, a.k.a., “Threshold 1” or “TH1”) along with updated baseline settings for Internet Explorer 11. Note that we are also separately releasing draft guidance for the November Update, a.k.a., “Threshold 2” or “TH2.” The only differences between the TH1 final and the TH2 draft are the new settings that apply only to TH2.
Security baseline for Windows 10 (“Threshold 2”) - DRAFT
Microsoft is pleased to announce the beta release of the security baseline settings for Windows 10 version 1511 (Build 10586, a.k.a., “Version 1511,” “Threshold 2,” “TH2,” “November Update”) along with updated baseline settings for Internet Explorer 11.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Aaron
Contact Aaron, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack