Allow Only Known Applications

Software allowlisting is an administrative monster waking up from a deep sleep. An allowlist of applications would virtually eliminate the problem of ransomware. Ransomware launches an executable when the attack occurs. The simple logic is that if only known and documented software is allowed in the company, and all other software is forbidden, the ransomware cannot do its job. Although it is a trivial approach, it works worlds better than trying to detect and prevent ransomware from launching with behavior detection.

In my security proposals, AppLocker and Software Restriction Policies are always included as mandatory components. However, this solution increases workload and costs time, and the system needs maintenance once it is set up. As with the firewall, the technology comes from the age of Windows XP SP2.

The latter four security ideas mentioned here can be wonderfully implemented locally with group policies, but they share issues with time, maintenance, and overhead. Microsoft's desired solution is to move to the cloud. In Microsoft 365, you can force the user to use 2FA, with no ancient protocols that an attacker can exploit. From Microsoft's point of view, the system is secure if local resources are no longer important. If the crown jewels of the company are in the cloud, then admins can encrypt all data locally. The response to a security incident would then simply be to reinstall computers and continue working. The time and downtime are still annoying and cost money, but they are inexpensive compared with a genuine data loss by encryption for ransom.

Conclusions

Even if Windows Server 2022 does not deliver that much new functionality in terms of GPO, it is still important to ensure maximum security for clients. Numerous GPO templates help with this job. Server 2022 does not establish any new rules. It's just that the requirements for your own network now need to adapt to the 2022 server version.