Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration)

What does the recommendation "Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration)" check?

Compares the in-guest operating system settings of each Windows VM against the Azure compute security baseline in the Microsoft Cloud Security Benchmark, using data gathered by the Azure machine configuration extension (formerly Guest Configuration). It flags individual hardening rules that fail, such as password policy, audit logging and legacy protocol settings. It does not scan for missing software patches or CVEs in installed packages, and it does not assess Linux machines or anything outside the OS configuration baseline. It only produces findings on subscriptions where Defender for Servers Plan 2 is enabled and the extension is reporting, so a machine that is simply not yet onboarded shows as not assessed rather than compliant.

Why does "Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration)" matter?

An unhardened Windows host gives an attacker who lands a foothold an easy path to escalate: weak audit settings hide their tracks, permissive account policies let them brute-force or reuse credentials, and enabled legacy protocols open lateral-movement routes. Configuration drift accumulates silently as machines age, so a fleet that passed at build time slowly rots into a soft target. Each unremediated finding is a concrete control an auditor and an intruder can both see, and the business consequence is a breach that began not with a novel exploit but with a default setting nobody changed. A low individual severity masks the aggregate exposure, because dozens of small misconfigurations across a fleet add up to a materially weaker estate that incident responders and regulators will both hold you to.

How do I fix "Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration)"?

1. Confirm the assessment can run: enable Defender for Servers Plan 2 on the subscription, then remediate 'Guest Configuration extension should be installed on machines' and, for Azure VMs only, 'Virtual machines Guest Configuration extension should be deployed with system-assigned managed identity' so the extension has an identity to report under.
2. Verify the baseline policy is assigned at your scope (Plan 2 assigns it automatically; do not delete it). Look it up by display name rather than pasting a GUID: pid=$(az policy definition list --query "[?displayName=='Windows machines should meet requirements of the Azure compute security baseline'].name" -o tsv); az policy assignment create --name win-compute-baseline --policy "$pid" --scope <scope>
3. Open the recommendation in Defender for Cloud, expand the failing rules, and apply the matching settings on the host (via Group Policy, a configuration baseline or your image build), then let the extension re-evaluate so the findings clear.

# Step 1: give a machine the system-assigned identity the agent needs to authenticate.
az vm identity assign --resource-group prod-apps --name legacy-app-01

# Install the machine configuration agent (instance name MUST be AzurePolicyforWindows / AzurePolicyforLinux).
az vm extension set \
  --resource-group prod-apps --vm-name legacy-app-01 \
  --publisher Microsoft.GuestConfiguration \
  --name ConfigurationforLinux \
  --extension-instance-name AzurePolicyforLinux \
  --enable-auto-upgrade true

# Step 2: assign the deploy-prerequisites initiative so identity + agent self-heal across the scope.
# Look the initiative up by its EXACT display name rather than pasting a GUID.
scope="/subscriptions/00000000-0000-0000-0000-000000000000"
setid=$(az policy set-definition list \
  --query "[?displayName=='Deploy prerequisites to enable Guest Configuration policies on virtual machines'].name" -o tsv)
az policy assignment create \
  --name deploy-gc-prereqs \
  --policy-set-definition "$setid" \
  --scope "$scope" \
  --location uksouth \
  --mi-system-assigned

# Assign the Windows compute security baseline initiative (look it up by display name too).
baseid=$(az policy set-definition list \
  --query "[?displayName=='Windows machines should meet requirements for the Azure compute security baseline'].name" -o tsv)
az policy assignment create \
  --name assign-win-baseline \
  --policy-set-definition "$baseid" \
  --scope "$scope"