MS Security Baselines Makes DC Painfully Slow
Posted by IndyPilot80@reddit | sysadmin | View on Reddit | 0 comments
This is a non-production domain, we are just trying out different configurations.
We are experimenting with building out a domain that uses Microsoft's Security Baselines. These are SVR2025 and WIN11 24H2 systems. Now, I know, if this was production, don't just throw in the baselines and expecting everything to go well. But, since this is just a lab, we thought we'd give it a go. Also, I know the baselines only include SVR2022 right now but we thought we'd try it out on SVR2025. All of this to say, this is just experimentation.
When we apply all of the baselines to WIN11 24H2, things run well. The problem is when we add the baselines to a DC running 2025. Once the baseline GPOs are applied, the system comes to a crawl. Bringing up the start menu can take a good 15-30 seconds. Opening task manager can take 30+ seconds. But, task manager isn't showing anything abnormal. Reasonable CPU, memory, and disk usage.
I read that VBS (the credential guard GPO) can cause a massive performance hit, so we remove that GPO. We also removed the Defender GPO to make sure there wasn't any aggressive scanning going on, and no luck. We even tried removing all baseline GPOs and just kept the "Default Domain Controller" GPO and everything was still slow. So, it seems like something that was applied by GPO at one time remains persistent. I tried to load the event manager to see whats going on, but it just errors out and won't fully load.
We decide to wipe the domain and reinstall the DC. Without the baselines, everything runs normally, no slowness. As soon as we add the GPOs, slows to a crawl.
Is there anything I'm missing or something else I should be looking at?
TLDR: DC run normally without the MS baseline GPO. As soon as we apply it, systems come to a crawl.
0 Comments