Summary
Optionally bake Microsoft Security Baseline policies (from the Security Compliance Toolkit, Windows 11 baseline) into the image via the existing offline-hive registry machinery, exposed as a new opt-in hardened build profile.
Motivation
The tool already writes machine/user policy registry values into the offline SOFTWARE/SYSTEM/DEFAULT hives with evidence grading + BOM provenance. Security-baseline Administrative-Template settings are exactly that kind of policy value, so a curated subset maps 1:1 onto the current catalog + Set-RegistryTweaks path — hardening the image with no new servicing code.
Scope (MVP)
- Registry-only subset, baked fully offline (no first-boot
secedit/auditpol, no bundled LGPO.exe).
- New
config/catalog.baseline.psd1; every entry EvidenceGrade=1, DefaultEnabled=$false, Profiles=@('hardened'), Category='Security'.
- New
hardened profile = default debloat + baseline (mirrors how opinionated layers on aggressive); unions with other profiles; per-setting cherry-pick via EnableCatalogId/DisableCatalogId.
- Curated ~12 settings (autorun off, SmartScreen, UAC consent, insecure-guest off, WDigest/LM-hash, LLMNR off, anonymous restrictions, LSA RunAsPPL, SMB client signing, ...).
Out of scope (possible future increment)
The .inf (password/lockout/user-rights/security-options) and audit.csv parts of the baseline, which need a first-boot secedit/auditpol step.
Design
See docs/security-baseline.md (added in the linked PR) for the full design, file touch-list, provenance/versioning, and safety properties.
Summary
Optionally bake Microsoft Security Baseline policies (from the Security Compliance Toolkit, Windows 11 baseline) into the image via the existing offline-hive registry machinery, exposed as a new opt-in
hardenedbuild profile.Motivation
The tool already writes machine/user policy registry values into the offline
SOFTWARE/SYSTEM/DEFAULThives with evidence grading + BOM provenance. Security-baseline Administrative-Template settings are exactly that kind of policy value, so a curated subset maps 1:1 onto the current catalog +Set-RegistryTweakspath — hardening the image with no new servicing code.Scope (MVP)
secedit/auditpol, no bundledLGPO.exe).config/catalog.baseline.psd1; every entryEvidenceGrade=1,DefaultEnabled=$false,Profiles=@('hardened'),Category='Security'.hardenedprofile = default debloat + baseline (mirrors howopinionatedlayers onaggressive); unions with other profiles; per-setting cherry-pick viaEnableCatalogId/DisableCatalogId.Out of scope (possible future increment)
The
.inf(password/lockout/user-rights/security-options) andaudit.csvparts of the baseline, which need a first-bootsecedit/auditpolstep.Design
See
docs/security-baseline.md(added in the linked PR) for the full design, file touch-list, provenance/versioning, and safety properties.