I am currently working on hardening our Windows OS systems. I'm reviewing guidance from CIS and Microsoft Security Compliance Manager. What I have found is that many of the security settings are already set to the recommended setting by default. This means that if I do nothing and leave the policy set to "Not Configured", the system will be in the ideal security state.
Here is my question: Is it prudent to go ahead and use group policy to enforce ALL security settings to the desired state?
Advantages I see*: Local administrators cannot change the policy. Malicious changes will revert during next group policy refresh.
Disadvantages I see: OS updates that change the default configuration will not be applied because the GPO will enforce a different setting. Lower group policy load times.
Is there any standard or guidance from Microsoft or another security authority (SANS, etc...) that addresses this issue?
Thanks in advance!