Workshop Agenda
Windows Security Baseline Assessment Workshop Agenda
Five days of structured collaborative sessions covering Windows 11 25H2 and Windows Server 2025 baselines from assessment to sign-off.
Monday
Day 1
Windows 11 25H2: Orientation + High-Risk Controls
| Session | Lead | Scope / Reference | Expected Output | Rapporteur | |
|---|---|---|---|---|---|
| 01 | Welcome Note | Sergej / Diego | - | - | - |
| 02 | Workshop objectives and agenda walk through | Polly / Diego | Workshop purpose, expected outputs, 5-day structure | Shared understanding of goals, outputs, and workshop flow | - |
| 03 | Baseline lifecycle: L1, L2, L3 and source of truth | Polly / Damien | Microsoft baseline (L1), UNICEF Core (L2), UNICEF SOC/InfoSec (L3) | Agreed understanding of layering and baseline ownership | - |
| 04 | Review of issue register structure and priorities | Polly / Konstantin | Issue Register structure, priority model, decision categories | Confirmed review structure and decision model for the week | - |
| 05 | Windows 11 25H2 delta overview | Polly / Neima | 25H2 delta areas including NetBIOS, NTLM auditing, ASR additions, command-line logging, printing alignment, IE11 COM automation, obsolete settings | Shared understanding of what is new/changed in 25H2 and why it matters | Day 1 - Daniel |
| Coffee break · pause | |||||
| 07 | Block 1 tester findings - Defender / ASR / Security Core | Konstantin Mateev | CL-01, CL-02, CL-03, CL-04, CL-16, CL-24 | Condensed tester findings for security core controls and likely treatment areas | - |
| 08 | Discussion - Block 1 | Polly / Group | ASR rules, exclusions, Defender visibility/control, CFA, SmartScreen, PowerShell/monitoring | Initial direction on what is enforceable globally vs exception / monitoring candidate | - |
| Lunch · pause | |||||
| 10 | Block 3 tester findings - Network / Connectivity / Field Reality | Dieudonne Matamba / Konstantin / Neima | CL-11, CL-12, CL-13, CL-14, CL-27 | Condensed tester findings for firewall, Miracast, Features on Demand, location, network endpoints | - |
| 11 | Discussion - Block 3 | Polly / Group | Connectivity, field practicality, offline implications | Initial direction on what needs flexibility, exceptions, or operational guidance | - |
| Coffee break · pause | |||||
| 13 | Block 2 tester findings - BitLocker / Identity / Access | Neima Khairy | CL-05, CL-06, CL-07, CL-08, CL-09, CL-31 | Condensed tester findings for TPM, Secure Boot, recovery keys, LAPS, BitLocker, FIDO2 | TBD |
| 14 | Discussion - Block 2 | Polly / Group | TPM/Secure Boot, recovery model, BitLocker disablement, LAPS, FIDO2 | Initial decision direction and identified gaps / fallback needs | TBD |
| 15 | Consolidation of Blocks 1-3 | Polly / Rapporteur | Block 1-3 summary | Top risks, open issues, and decision candidates captured for Day 2 | TBD |
| 16 | Day 1 wrap-up | Polly | Recap and carry-over items | Agreed carry-over list for Tuesday | TBD |
Tuesday
Day 2
Windows 11 25H2: Field Reality + Applications
| Session | Lead | Scope / Reference | Expected Output | Rapporteur | |
|---|---|---|---|---|---|
| 01 | Recap from Day 1 | Polly | Day 1 outcomes | Shared starting point for Day 2 | David |
| 02 | Block 5 tester findings - Intune / Platform / Lifecycle | Yusuf Oloyede | CL-10, CL-25, CL-26, CL-28 | Condensed tester findings for deprovisioning, Intune conflicts, RBAC, CloudNative | - |
| 03 | Discussion - Block 5 | Polly / Group | Platform blockers, rollout impact, ownership, supportability | Initial direction on lifecycle and platform decisions | - |
| 04 | Block 4 tester findings - Productivity / Applications | Joseph | CL-15, CL-17, CL-18, CL-20, CL-21, CL-22, CL-30 | Condensed tester findings for Outlook preview, SAP GUI, Defender scans, browser dependency, passwords, USB, scripts | - |
| 05 | Discussion - Block 4 | Polly / Group | Productivity impact, business-critical apps, user workflows | Initial direction on app exceptions, communications, or policy tuning | - |
| Coffee break · pause | |||||
| 07 | Cross-check of Blocks 1-5 against security decisions | Aggrey / Suhail | Compare field/app impacts with security decisions/policies | Dependencies, conflicts, and priority issues identified | Aggrey |
| 08 | Windows 11 decision shaping session | Polly / Group | Blocks 1-5 combined | Draft decisions into adopt / adjust / audit-first / conditional / defer-reject | Neima |
| Lunch · pause | |||||
| 10 | Working session - Windows 11 draft policies | Damien / Core Team | Consolidated Win11 Policies | Draft Windows 11 25H2 policies L1, L2, L3 | - |
| Coffee break · pause | |||||
| 12 | Windows 11 open issues review | Polly / Group | Unresolved Win11 issues | Shortlist of known issues | Yusuf |
Wednesday
Day 3
Windows 11 25H2: Platform / Lifecycle + Finalization
| Session | Lead | Scope / Reference | Expected Output | Rapporteur | |
|---|---|---|---|---|---|
| 01 | Recap from Day 2 | Polly | Day 2 outcomes | Shared starting point for Day 3 | - |
| 02 | Working session - Testing with new L2, L3 | Group | - | - | Sergio |
| Coffee break · pause | |||||
| 04 | Working session - Testing with new L2, L3 | Group | - | - | - |
| 05 | Open sharing of feedback on testing of new baseline | Group | - | - | - |
| Lunch · pause | |||||
| 07 | Windows 11 baseline close-out | Polly | Final Win11 outputs | Windows 11 25H2 UNICEF baseline ready for publishing | - |
| Coffee break · pause | |||||
| 09 | Transition to Windows Server 2025 | Polly / Drini / Vicente | Server scope, roles, testing focus | Clear transition into server workstream for Thu-Fri | - |
Thursday
Day 4
Windows Server 2025: Tester Presentations + Role-Based Assessment
| Session | Lead | Scope / Reference | Expected Output | Rapporteur | |
|---|---|---|---|---|---|
| 01 | Windows Server 2025 baseline context | Polly / Drini / Vicente | 2025 deltas | Shared understanding of what is new/changed in 2025 and why it matters | - |
| 02 | Server Block A - Remote Access & Admin Operations | Vicente | SRV-01, SRV-02, SRV-03, SRV-04 | Condensed tester findings for RDP clipboard/drive, SSL override, admin browsing | - |
| 03 | Discussion - Server Block A | Polly / Group | Admin workflows vs server hardening | Direction on blocked vs role-based admin operations | - |
| 04 | Server Block B - Protocol & Network Hardening | Vicente / Infra SMEs | SRV-05, SRV-06, SRV-08, SRV-09, SRV-10 | Condensed tester findings for TLS, legacy SSL/TLS, SMB, NTLM, NetBIOS | - |
| 05 | Discussion - Server Block B | Polly / Group | Legacy dependencies, audit-first vs enforce | Initial protocol hardening direction and exception needs | - |
| Coffee break · pause | |||||
| 07 | Server Block C - Identity, Cloud & Role-Based Controls | Vicente / Infra SMEs | SRV-07, SRV-11, SRV-18, SRV-28 | Condensed tester findings for role-based deviations, Arc/SSH, identity baseline, RDP restrictions | - |
| 08 | Discussion - Server Block C | Polly / Group | Identity model, role-based baseline, cloud/hybrid impact | Initial direction on identity and role-based controls | - |
| 09 | Server Block D - Infrastructure & Monitoring Controls | Vicente / SOC / Infra SMEs | SRV-12, SRV-13, SRV-14, SRV-15 | Condensed tester findings for firewall, log sizing, command-line logging, Defender for Server | - |
| 10 | Discussion - Server Block D | Polly / Group | Visibility, SOC value, performance, role-based firewalling | Initial direction on infrastructure visibility and monitoring controls | - |
| Lunch · pause | |||||
| 12 | Server Block E - Operations & Lifecycle | Vicente / Ops SMEs | SRV-16, SRV-17, SRV-19, SRV-20 | Condensed tester findings for patching, backup/restore, printers/shares, admin workarounds | - |
| 13 | Discussion - Server Block E | Polly / Group | Operational sustainability and governance | Direction on operational baseline and workaround control | - |
| 14 | Server Block F - New / Changed 2025 Behaviors | Vicente / SMEs | SRV-22, SRV-23, SRV-24, SRV-25, SRV-26, SRV-27, SRV-29 | Condensed tester findings for WHfB ROCA, IE11 COM, NTLM, printer RPC, spooler impersonation, command-line logging | - |
| 15 | Discussion - Server Block F | Polly / Group | Rollout risks and compatibility impact | Initial direction on new server-specific settings | - |
| Coffee break · pause | |||||
| 17 | Server consolidation session | Polly / Core team | Server Blocks A-F | Server blockers, decision candidates, and validation gaps captured | - |
| 18 | Day 4 wrap-up | Polly | Recap and carry-over items | Agreed focus for Friday finalization | - |
Friday
Day 5
Windows Server 2025: Finalization + Closure
| Session | Lead | Scope / Reference | Expected Output | Rapporteur | |
|---|---|---|---|---|---|
| 01 | Recap of Day 4 | Polly | Day 4 outcomes | Shared starting point for finalization | TBD |
| 02 | Review of unresolved server items | Polly / Group | Open SRV items and decision conflicts | Final server issues resolved or clearly parked | - |
| 03 | Final consolidation of Windows Server 2025 baseline | Polly / Core team | Server baseline package | Consolidated Windows Server 2025 baseline view | - |
| Coffee break · pause | |||||
| 05 | Agreement on next steps | Polly / Damien / Drini / Core team | Image integration, deployment approach, maintenance, ownership | Agreed next-step roadmap for implementation | - |
| 06 | Final outputs review | Polly | Win11 + Server package outputs | Confirmation of workshop deliverables and decision records | - |
| Lunch · pause | |||||
| 08 | Deployment roadmap and closure planning | Polly / Core team | How outputs feed image / GPO / server implementation | Deployment path and ownership clarified | - |
| 09 | Final housekeeping | Polly | Any remaining admin items | Ready for closure | TBD |
| Coffee break · pause | |||||
| 11 | Formal closure and sign-off path | Polly / Diego / Sergej | Closure, final owner confirmation | Workshop formally closed with sign-off path confirmed | - |