As a best practice, we recommend using the Microsoft security baseline and CIS benchmarks for secure configuration of ICM servers. Use the latest Microsoft security baseline and Level 1 CIS benchmark profile to lower the attack surface without impacting the functionality and performance.

Apply the security policy in the form of Group Policy Object (GPO) into a separate Organizational Unit(OU) that contains ICM servers. Name the OU as Cisco_ICM_Servers (or a similar clearly identifiable name) and ensure to name these servers in accordance with your corporate policy.

Create this OU either at the same level as the Computers' container or at the Cisco Unified ICM Root OU. If you are unfamiliar with the Active Directory, engage your Domain Administrator to assist you with Group Policy deployments.

After applying the security policy at the OU level, block any differing policies from being inherited at the Unified Contact Center Enterprise Servers OU. You can override a blocking inheritance, a configuration option at the OU object level, by selecting the Enforced/No Override option at a higher hierarchy level. The application of group policies must follow a thought-out design that starts with the most common denominator. These group policies must be restrictive at the appropriate level in the hierarchy.

This section outlines the security baseline that is needed for hardening Windows Servers running ICM servers. This security baseline is essentially a collection of Microsoft group policy settings based on the Microsoft security baseline and Level 1 CIS benchmark profile.

To apply the security baseline in the domain controller, perform the following steps:

1. Download the security hardening templates applicable for the respective Windows version from the Microsoft and CIS benchmark URL. You can download these security hardening templates from https://www.microsoft.com/en-us/download/details.aspx?id=55319 and https://workbench.cisecurity.org/files?q=&tags=3.

2. Install the latest Administrative Templates (ADMX) for the Windows Server. These templates can be downloaded from the Microsoft website at https://www.microsoft.com/en-us/download/details.aspx?id=103667. You can install the .msi installer on any Windows node as per your IT policy. The windows server can be ICM or non ICM or Domain Controller.

3. Navigate to the installed location of administrative templates. Copy the below-mentioned template files to the domain controller SYSVOL folder.

   • Copy the *.admx files from the PolicyDefinitions folder to \<Domain>\SYSVOL<Domain>\Policies\PolicyDefinitions

   • Copy the *.adml files from the PolicyDefinitions<applicable-language> folder to \<Domain>\SYSVOL<Domain>\Policies\PolicyDefinitions\en-US

     Note	The domain controller automatically copies the admx and adml files to all the domain-joined machines. Select the applicable language code (en-US) based on your deployment setting. Create the PolicyDefinitions folder if it does not exist.

4. Create a Group Policy Object in the domain controller using the Group Policy Management console and import respective policy using the Import Setting Wizard in the console as per below details. This can be done directly on the ICM nodes based on the IT policy.

   • The downloaded Microsoft baseline (see Step-1) has Group Policy Object (GPO) for Windows Client, Windows Server, Common GPO for both Client and Server, Domain Controller, and Internet Explorer. We recommend you to import the GPO specific to Windows Server, Internet Explorer, and Common GPO for both Client and Server.

   • The downloaded CIS baseline (see Step-1) has GPO for Domain Controller, Microsoft, and User. We recommend importing only the MS-L1 and User-L1 GPO.

5. Create the custom GPO in the Domain Controller to override the policies outlined in the Security Baseline Policy Exception for ICM, and import the custom exception GPO using import setting wizard in the console. You can manually override the policies directly on the ICM nodes based on the IT policy.

6. Ensure that the exception policy imported (see Step-5) has higher priority such that the exception policy is applied after the Microsoft and CIS policies are applied.

   Note	Step 6 is applicable only on domain controllers.

7. Create the OU Cisco_ICM_Servers (or a similar identifiable name) under the domain. Map all the ICM machines to this OU. You can perform this step at any point, even before performing Step-1.

8. Link the created GPO (see Step-4 and Step-5) to the OU created (see Step-7).

9. Restart the ICM servers in the organizational unit or run the gpupdate command on the respective target ICM nodes to apply the security baseline.

Note	You can set the Turn on Virtualization Based Security policy to Disabled when Secure Boot is not enabled on Unified ICM machines.

The following CIS baseline policies impact the ICM functionality.

The recommended values (outlined in the table below) are to be used for the exception policies to override the recommended values of CIS.

The following policies are optional. You can enable these policies as per the IT policy after considering the remarks column carefully.

Enable the following policies after you install the ICM server. Refer to the Remarks column for the deviations observed.

Note

The CIS benchmark versions 3.0.0 for Windows Server 2022, version 1.2.1 for Windows Server 2019, Microsoft baseline Windows Server 2019 version 1809, and latest Microsoft baseline Windows Server 2022 are validated. Before applying the higher version of CIS and Microsoft benchmark, analyze the additional policies introduced in the new version for the impact on ICM functionality and performance. We recommend the GPOs must be tailored according to your organization’s need. We recommend rolling out the GPOs to a small group of systems, preferably in a lab environment before rolling out into production. In addition to the GPO settings, disable the following settings in Windows Server: NetBIOS SMBv1