ADCycleGroups – Multi-Level GPO Phase-In Tool
Introduction
My clients usually adopt a security framework such as Center for Internet Security (CIS).
Part of the paid subscription to CIS is what they call "CIS Remediation Kits" which are ultimately Active Directory security hardening policies. These policies are regularly updated to include new and updated hardening policies or to address identified issues.
I never apply any policy to all devices at once, in fact I find this a very bad practice. Instead, I automatically phase a policy out to computers and users by utilizing my ADRandomAddToGroup tool (See Phasing in a Group Policy)
The reason I apply a policy as a phased in approach is that, no matter how many device you include in your testing environment, it is unrealistic to think that a such a sample group would be a proper representation of all production systems, especially in a larger environment.
I have, on more than one occasion, found mission critical, legacy systems that no-one supports or knows about, that do not support a particular security setting. You might even be surprised how some security suites are not capable of running on a security-hardened computer.
Using this process, you will identify issues not identified via testing earlier, without impacting the larger user community.
Essentially, out-of-the-box, you can limit a GPO to a specific group by altering the security of the GPO.
My ADRandomAddToGroup tool leverages this capability and allows me to randomly add computers or users to a group, whilst giving me the options to control how many objects are added to a group at a time, as well as setting an included/excluded Distinguished Names value.
This has worked well for me over the years for phasing in a single version GPO, but have found it challenging to maintain more than two versions of a policy. The issue is that, before I manage to get all computers/users onto a newer version of the remediation kit, a new one is released.
In large environments, it becomes a real pain to test and roll these policies out.
ADCycleGroups
I decided to develop a new tool to automate the moving of computers from one version to the next, until it finally gets to the latest GPO policy. If, at any point, a new hardening policy is released, it can simply be added to the phased group list and member will move to the new group as soon as its minimum group member time is reached.
For example: The following config will move groups members, maximum of 4 per execution after they have been a member for at least 1 days, from RG-CIS_COMP_L1_v1.4.0 to CN=RG-CIS_COMP_L1_v1.4.2 and will move groups members, maximum of 2 per execution after they been a member for at least 10 days, from RG-CIS_COMP_L1_v1.4.2 to CN=RG-CIS_COMP_L1_v1.5.0
CIS COMP L1|1|CN=RG-CIS_COMP_L1_v1.4.0,OU=CIS,OU=Role Groups,OU=Groups,OU=HQ,DC=ITtelligence,DC=com|01:00:00:00|4
CIS COMP L1|2|CN=RG-CIS_COMP_L1_v1.4.2,OU=CIS,OU=Role Groups,OU=Groups,OU=HQ,DC=ITtelligence,DC=com|10:00:00:00|2
CIS COMP L1|3|CN=RG-CIS_COMP_L1_v1.5.0,OU=CIS,OU=Role Groups,OU=Groups,OU=HQ,DC=ITtelligence,DC=com|10:00:00:00|5Implementation
1) Download and extract ADCycleGroups.zip (here is VirusTotal scan) to a folder of your choice.
2) Run Configurator.exe (Configurator Editor).
a) On the Encrypt tab, enter the password for the account that will be performing the cleanup task. Encrypt it with key AAuPAoB1ektD4EkKBVXtdajuxsTIo9Xj and record encrypted password
b) On the Settings tab, enter the domain information, the service account user name and the encrypted password
c) Set History File to a writable location.
d) On the PhaseInSets tab, add the various PhaseInSets
3) After that, you can schedule or manually run ADCycleGroups.exe
Conclusion
I hope you found this tutorial useful. You are encouraged to ask questions, report any bugs or make any other comments about it below.