I found a few posts which suggest using Microsoft SCM (Security Compliance Manager) to audit the security of Microsoft software solutions:

Here's a sample screenshot of SCM, showing "261 unique settings" for Windows 7 SP1 computer security:

SCM screenshot

What I don't get is how these "unique settings" are audited. I mean, SCM seems to simply report all hardening options, rather than checking (auditing) whether they are applied to Windows.

So far, I found the following way to (automatically) audit the settings:

  1. Export them (using the panel to the right of SCM) as SCAP XML files.
  2. Use a tool such as OVAL or jOVAL to audit the system against the exported XML files.

Along the same lines, I use the following approach to apply a baseline:

  1. Export the baseline (or a customization thereof) as a GPO.
  2. Apply the GPO.

My question is:

Can SCM audit the settings itself, so that I don't have to export XML files and then use 3rd-party tools?

1 Answer 1


SCM itself does not audit or apply settings. Settings are applied by importing a GPO backup in to AD and reported on by importing a DCM in to SCCM (no relation to SCM despite the similar abbreviation).

There is documentation that describes how it all works under "attachments" for each baseline.

  • There's a lot of acronyms here that not everybody may be clear on. Can you expand on it?
    – h4ckNinja
    Nov 9, 2016 at 1:04
  • Here's the non-TLA version: Security Compliance Manager itself does not audit or apply settings. Settings are applied by importing a Group Policy Object backup in to Active Directory and reported on by importing a Desired Configuration Management format, exported from the Security Compliance Manager Console, in to SCCM. Nov 25, 2016 at 5:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .