secpol.msc baseline

secpol.msc # → import baseline

Open Local Security Policy (secpol.msc) and import the configuration baseline, applying the reference password and privilege policy.

Use it when you want to apply or verify a machine's local security policy: secpol.msc manages account policies (passwords, lockout), user rights assignments (privileges like SeDebugPrivilege), security options, and audit policies. Importing the baseline (the .inf file exported from a reference host or from the CIS Benchmark) applies the homogeneous configuration to the machine. In hardening, secpol is the local piece of the baseline: passwords with the requirements, account lockout, and restricted user rights.

Don't use it for scale deployment: local policy applies machine by machine — in a domain, Group Policy (GPO) is the correct mechanism (137). Importing the baseline without review overwrites existing configurations that may be necessary (legacy apps, local requirements): review the baseline before applying. And note: secpol.msc doesn't cover all hardening (registry, application policies, Windows Defender are configured separately) — it's one piece of the puzzle. Applying the password policy affects local accounts: new requirements force a change at next logon.