Currently the GPOs provided by MS SCT (https://docs.microsoft.com/en-us/windows/security/threat-protection/security-compliance-toolkit-10) have differents approaches how to install them.
e.g.
Windows 10 Version 1507 Security Baseline\LocalScript\10ClientInstall.cmd
Windows 10 Version 1809 and Windows Server 2019 Security Baseline\LocalScript\BaselineLocalInstall.ps1
Windows 10 Version 1909 and Windows Server Version 1909 Security Baseline\Scripts{Baseline-LocalInstall.ps1, Baseline-ADImport.ps1, Remove-EPBaselineSettings.ps1}

It would be nice to have common/generic approach how those GPOs can be applied. For example one powershell script that can be used to install any GPO regardless of the Windows patch level or AD status (joind to AD or standalone/local GPO) and specify the details with parameters. Otherwise it every time such GPOs are rolled out it is necessary to follow a different approach on how to install them.
My wish would be to have a generic "entrypoint" that can be used for all GPOs (also GPOs which will be released in the future).

Cheers

Currently volume licensing and most other MS portals don't provide (SHA, MD5 or any) filehashes.
I learned that later this year MS is planning to update the VLSC portal to support this. That's good news.

It would be a bonus to see the hashes on a true public part of the portals or otherwise on www.microsoft.com without any form of subscription.
Reason is that only a limited number of persons have an account that can actually download ISO’s from VLSC. On the other hand, a lot of IT admins cannot download themselves but use these ISO’s and have to rely on the hashes provided by the first group.

Could be done for all types of downloads (.ISO, setup.exe, msi etc).

Hash access without an account would enable everyone to directly verify with the source at MS which enhances integrity and security !

Microsoft lawyers claim that Microsoft comes with "help" also known as "documentation." When one examines the claimed documentation one finds the usual finely crafted, artistic web pages that contain minimal information for the technical, non-employees who want a deep dive into how to operate Windows (various attempted releases). It is clear why Microsoft keeps this sort of thing close to the vest. Were it to become clear that there really isn't any documentation and no operating instructions then sales would stay exactly where they are. Nobody cares. Especially among the don't care group are top executives at Microsoft. And the receptionist users of WaaS learn as little as possible and still get some work done. This is outrageous and unacceptable. But legal in USA. ... Want Microsoft to provide documentation for their products and services?
The lawyers ordered the engineers to put this into Hyper-V Manager so their company
has something to point at should somebody complain, accurately, there is no documentation.

Just calling words on websites documentation does not make it documentation.

Launch the Hyper-V Manager in Windows Server 2019, locate the Help link, and launch.
The Microsoft Management Console, another "masterpiece" of the Component Object Model,
displays the following:

Access help for Microsoft operating systems
Need help? All help for Windows 10 and Windows Server products is available online.

If you're looking for general help with Windows, the main Windows site is the best resource.

Are you an administrator for Windows 10 devices? Find content especially for IT Pros, developers, and more at the Windows 10 site.

Do you manage servers? All of the Windows Server products are documented at Windows Server.

https://go.microsoft.com/fwlink/?linkid=861993
This is called "the main Windows site."

https://go.microsoft.com/fwlink/?linkid=861991
This is "for administrators who administrate Windows 10 devices."

https://go.microsoft.com/fwlink/?linkid=861992
This is "for those who manage Windows Server products."

Help indeed.

If you have several types of clients updated by a wsus server, the software vendor for some of the clints might have found some updates to cause problems for their software so that the specific updates should be possible to decline for specific computer groups while still being available for other groups. I really do not understand why there is no such possibility in wsus.. As it is now, "not approved updates" could mean two things. Either you specifically do not want to install the update or you have just not decided over the update yet, it really should be an easy way to distinguish the two..

When accessing resources the user Token is presented and granted or denied access based on SIDs presented (Not taking DACL in to account). Tracking stale groups and ACLs is difficult in an environment, especially if there are multiple granting ACLs to a resource.

It would be good if there could be an event or log that would show an audit of not just a principal getting access, but how they got access. E.g. SID of the user is present on the Resource and gained access by proxy of direct permissions... or by proxy of a SID of a group in their tokens that gave them access. It would also be good to seperate out SID History as this could act as a validation of SID history use declining or being used heavily.

This would allow for stale principals to be cleaned up and for a better audit of how access was granted to a resource in a retrospective audit.