Configuration Drift Package

The 15 Settings That Actually Get You Breached

P0 — Critical (found in majority of breaches)

P1 — High (common attack enabler)

P2 — Medium (amplifies blast radius)

Entry Point: Forensic Configuration Assessment

Assessment Script (P0 checks)

# P0-1: Legacy auth — any CA policy still allowing it?
Get-MgIdentityConditionalAccessPolicy | Select DisplayName, State,
  @{N='ClientApps';E={$_.Conditions.ClientAppTypes -join ','}}

# P0-2: MFA gaps — users without any strong auth method
Get-MgUser -All -Property StrongAuthenticationMethods |
  Where-Object { $_.StrongAuthenticationMethods.Count -eq 0 } |
  Select DisplayName, UserPrincipalName

# P0-3: AD CS — find vulnerable templates (ESC1)
# Run from domain-joined machine:
certutil -v -dstemplate | findstr /i "ENROLLEE_SUPPLIES_SUBJECT"

# P0-4: Backup server domain membership
Get-ADComputer -Filter {Name -like "*backup*" -or Name -like "*veeam*"} |
  Select Name, DistinguishedName

# P1-5: RDP listeners
Get-NetTCPConnection -LocalPort 3389 -State Listen

# P1-7: SMB signing
Get-SmbServerConfiguration | Select RequireSecuritySignature

# P1-9: Conditional Access exclusions
Get-MgIdentityConditionalAccessPolicy | ForEach-Object {
  [PSCustomObject]@{
    Policy = $_.DisplayName
    State = $_.State
    ExcludedUsers = ($_.Conditions.Users.ExcludeUsers -join ',')
    ExcludedGroups = ($_.Conditions.Users.ExcludeGroups -join ',')
  }
} | Where { $_.ExcludedUsers -or $_.ExcludedGroups }

Output

• Block legacy auth protocols — create a CA policy that blocks Exchange ActiveSync, POP3, IMAP4, SMTP AUTH. This single change eliminates 99% of password spray.
  30 minFreeFixes P0-1
• Revoke all MFA exceptions older than 30 days — if the user hasn't re-requested, they don't need it
  1 hourFreeFixes P0-2
• Enforce CA policies stuck in "report-only" — report-only = not protecting anything
  30 minFreeFixes P1-9
• Close RDP to internet — disable on all machines where not needed, require VPN+MFA where needed
  1 hourFreeFixes P1-5
• Enable SMB signing via GPO: Microsoft network server: Digitally sign communications (always) = Enabled
  30 minFreeFixes P1-7
• Disable LLMNR via GPO: Turn off multicast name resolution = Enabled. Disable NBT-NS via DHCP or registry.
  30 minFreeFixes P1-8
• Disable stale admin accounts (90+ days inactive)
  30 minFree
• Check HIBP for your domain — any exposed corporate credentials still active?
  15 minFreeFixes P2-15

• AD CS template audit: Identify and remediate ESC1-ESC8 misconfigurations. Remove ENROLLEE_SUPPLIES_SUBJECT where not required. Restrict enrollment rights.
• Backup infrastructure separation: Remove backup server from AD domain. Create separate backup admin credentials. Verify immutability.
• Full exception inventory: Every CA exclusion, MFA exception, firewall rule exception gets: owner, justification, expiry date.
• Emergency baseline lock: Export current (corrected) config as the known-good state for drift monitoring.

• Enable Entra audit log alerts for: CA policy changes, MFA method changes, role assignments, app consent grants
  30 minFree
• Schedule weekly PingCastle scan: PingCastle.exe --healthcheck — tracks AD health score trend
  30 min setupFree
• Schedule monthly ScubaGear scan — M365 config vs CISA baselines
  1 hour setupFree
• Alert on new firewall rules that allow inbound from Any/0.0.0.0/0
  30 minFree
• Track Secure Score weekly — score should never decrease without documented exception
  10 min/weekFree

• Deploy Maester — 360+ Pester-based M365 security tests in GitHub Actions. Weekly automated runs. Alerts on failure.
• Deploy Microsoft365DSC — export desired M365 config as code. LCM monitors continuously. Three modes: detect, alert, or auto-revert drift.
• Build drift dashboard: M365 Secure Score trend, PingCastle AD score trend, exception count trend, P0 setting status.
• Increase log retention to 365 days — don't rely on defaults (Windows Event Log defaults = 20MB, overwrites in hours). 1TB disk costs less than a coffee per day. Store logs on-host AND forward to central logging. On-host logs are your forensic backup if central is compromised.

• Enable Standard Preset Security Policy in M365 Defender — one toggle, 15 minutes, activates dozens of settings
  15 minFree
• Enable Microsoft-managed CA policies — auto-created in report-only, switch to enforcing
  30 minFree
• Set MFA exception expiry policy: max 30 days, requires owner + justification. No permanent exceptions.
  Policy decisionFree
• Deploy Microsoft LAPS — unique local admin password per machine, eliminates shared local admin
  4–8 hoursFree
• Run Lynis on Linux servers: lynis audit system --cronjob
  1 hourFree

• M365 config-as-code: Export desired state via Microsoft365DSC, commit to Git. Any drift = alert or auto-revert. PR-based change process for intentional modifications.
• AD hardening baseline: Tiered admin model, GPO security settings, LLMNR/NBT-NS disabled org-wide, SMB signing enforced, AD CS templates remediated, Kerberos delegation restrictions.
• Firewall rule cleanup: Remove rules older than 12 months with no traffic. Document remaining rules. Block new allow-rules without change ticket.
• FIDO2/passkeys for admins: Upgrade from push/OTP to phishing-resistant MFA for all privileged accounts. This fixes P1-10 (79% of BEC victims had MFA but wrong kind).
• CIS Benchmark alignment: Run OpenSCAP or CIS-CAT against servers. Remediate to Level 1 minimum.

• Config-as-code pipeline: M365 desired state in Git (Microsoft365DSC). PR-based changes. Auto-revert unauthorized modifications. Full audit trail. Graduate each setting detect → alert → auto-revert only after it has run clean in alert mode; a setting that keeps flipping back and forth means another tool or admin process is fighting the pipeline — find it before auto-revert turns the fight into an outage.
• Exception workflow automation: Exceptions submitted via form/ticket → auto-approved max 30 days → auto-expired → auto-reported to management. No permanent exceptions possible.
• Separate management AD: All privileged accounts (backup admin, hypervisor admin, network admin) in a separate AD forest. Production trusts management (one-way). Attackers who compromise production AD cannot see or target the real admins — they don't exist in that directory.
• Log retention architecture: 365 days on every server (increase Windows Event Log to 1GB+ per channel). Forward to central logging on isolated infrastructure. On-host logs survive central compromise. Disks are cheap; missing forensic evidence is not.
• Board reporting: Quarterly posture report showing the 15 settings status, drift incidents, exception trends, Secure Score trajectory. One page.
• NIS2 mapping: Continuous posture monitoring satisfies "appropriate and proportionate measures." Drift monitoring IS the compliance evidence. The cadence table above maps directly to Article 21 requirements.
• Insurance evidence: Insurers want proof controls are "implemented AND enforced" — not just configured. MFA exception logs, CA enforcement evidence, automated drift reports with timestamps. This is what gets claims approved.

Program Economics (200-seat reference)