The question went up in the Windows Server Insiders forum on Microsoft Tech Community on October 20, 2026. The poster, Jan, asked three things: whether the tools "play nicely together", whether it is a "use one or the other" decision, and whether OSConfig is still being developed or will be deprecated once MSHardenedPolicyEval reaches general availability. When the thread was captured it had no replies, and Microsoft had not answered.
The short answer is that Microsoft hasn't said. What Microsoft has published still tells admins how these tools differ and where using both could cause trouble.
What MSHardenedPolicyEval actually is
MSHardenedPolicyEval arrived with Windows Server vNext Preview Build 29683, which Microsoft announced on October 12, 2026. The announcement calls it a new built-in tool for evaluating the new default hardened security settings on Windows Server Core. It lives at %SystemRoot%\System32\MSHardenedPolicyEval.exe, needs an elevated administrator prompt, and runs only on Windows Server SKUs.
Microsoft says it checks the machine against a curated catalog of hardening policies covering:
- Registry settings
- Local Security Authority (LSA) rights and SID assignments
- Audit subcategories
- Security Accounts Manager (SAM) settings
The tool then reports a hardening score for each group and an overall score. One design choice stands out. The same policy tables drive evaluation, apply and revert, so Microsoft says there's no gap between what gets measured and what gets enforced. Any setting that counts toward your score is exactly the setting the apply switch will change. Scores and policy bitmasks can go to the Windows event log and, if you want, to TraceLogging, so monitoring pipelines can pick them up.
The documented switches
| Command | What it does |
|---|---|
| (no arguments) | Read-only evaluation |
-v | Verbose scores per group and overall |
-ap [selectors] | Apply hardened values |
-rp [selectors] | Revert to non-hardened values (Windows Server 2025 defaults) |
-l [path] | Write output to a log file (default under %SystemRoot%\System32\LogFiles\MSHardenedPolicyEval\) |
-t | Send scores through TraceLogging |
If you leave out the selectors, the operation covers every supported group. You can also target specific areas. Microsoft's examples are -ap registry, -rp Printing and -ap Audit,LSA. Selectors aren't case-sensitive and can be separated by commas, semicolons or vertical bars. Microsoft also warns that applying or reverting can need a reboot, and that some operations touch security-sensitive settings. Check your selectors before running -ap or -rp broadly on critical systems.
One more detail matters for the coexistence question. Microsoft describes the tool as both a standalone assessment utility and the mechanism behind scheduled hardening tasks on the system. So MSHardenedPolicyEval isn't only something an admin runs by hand. It may also be enforcing settings on a schedule.
Context check: this is pre-release software. Build 29683 covers Standard and Datacenter, in both Desktop Experience and Server Core, plus Azure Edition for VM evaluation only. It still shows Windows Server 2025 branding, and the preview expires October 15, 2027. Microsoft hasn't announced a GA date or final scope for the tool.
Section summary: MSHardenedPolicyEval is a preview-stage evaluator with a direct apply/revert switch. It works from a single built-in catalog aimed at vNext's new hardened defaults.
What OSConfig is, and why it's a different kind of tool
OSConfig is a much broader platform. Microsoft calls it a security configuration and compliance management tool, introduced as a PowerShell module for Windows Server 2025, that enables you to enforce security baselines, automate compliance, and prevent configuration drift on Windows Server 2025 computers.
It's built on scenarios, which are predefined groups of settings. You declare a desired state and OSConfig keeps the machine there. The main feature is drift control. When you turn it on, OSConfig automatically corrects any system changes that deviate from the desired state. It also ties into the wider management stack. Microsoft says it integrates with Azure Policy, Microsoft Defender, Windows Admin Center, and Azure Automanage machine configuration to facilitate monitoring and compliance reporting.
Microsoft's current overview lists these Windows Server 2025 scenarios:
- A role-aware Windows Server security baseline (domain controller, member server, workgroup member)
- Microsoft Defender Antivirus configuration
- Windows LAPS
- Secured-core server configuration
- App Control for Business
OSConfig also has a precedence model for when several management authorities touch the same machine. For cloud or Azure Arc-connected resources, Azure Policy comes first. Local authorities (Windows Admin Center and PowerShell) come second, and other deployment tools come last.
A typical deployment looks like this. Install the module from an elevated prompt with Install-Module -Name Microsoft.OSConfig -Scope AllUsers -Repository PSGallery -Force, then apply the role baseline, for example Set-OSConfigDesiredConfiguration -Scenario SecurityBaseline/WS2025/MemberServer -Default. You can change the drift control schedule using the Set-OSConfigDriftControl cmdlet. One version limit applies: OSConfig doesn't support versions of Windows Server earlier than Windows Server 2025.
Section summary: OSConfig is a scenario-based desired-state system with drift correction, cloud and admin-tool integration, and a precedence model. MSHardenedPolicyEval is a scoring and enforcement utility for one catalog.
Side by side
| MSHardenedPolicyEval | OSConfig | |
|---|---|---|
| Status | Preview (Windows Server vNext Build 29683) | Shipping for Windows Server 2025 |
| Interface | Built-in executable | PowerShell module (also Windows Admin Center, Azure Policy) |
| Model | Evaluate, score, apply or revert one catalog | Declarative scenarios with drift control |
| Scope stated by Microsoft | New hardened defaults on Server Core: registry, LSA, audit, SAM | Role baselines, Defender AV, LAPS, Secured-core, App Control |
| Reporting | Event log, optional TraceLogging, log file | Compliance reporting through integrated tools |
| Undo | -rp back to Windows Server 2025 defaults | Baseline removal, which may not restore earlier values |
Do they play nicely together? What the evidence supports
Here's what Microsoft's published material does and doesn't establish.
- No deprecation notice. Nothing reviewed says OSConfig is being retired, deprecated or replaced by MSHardenedPolicyEval. OSConfig's overview carries a 2026 revision date and still describes it as the platform for Windows Server 2025 security baselines.
- No documented integration. The MSHardenedPolicyEval announcement never mentions OSConfig. It doesn't say the tools coordinate, share a policy source, or have been tested together on the same settings.
- A clear conflict warning on Microsoft's side. OSConfig's baseline guidance is blunt: "If you're currently configuring the same settings with two different methods, one being OSConfig, expect conflicts. With drift control involved, you must remove one of the sources if the parameters differ, to prevent the settings from constantly changing between sources."
That warning is written about any second configuration source, not MSHardenedPolicyEval specifically. It still applies directly here.
The following is analysis, not a Microsoft statement. MSHardenedPolicyEval is described as the engine behind scheduled hardening tasks, and OSConfig runs its own refresh task to fix drift. Put two automated enforcers on the same server with different opinions about the same audit subcategory or LSA right, and they could keep overwriting each other. Each tool would see the other's change as drift and set it back.
The undo behaviour differs as well. MSHardenedPolicyEval's -rp is documented as reverting to Windows Server 2025 defaults. Microsoft says removing an OSConfig baseline needs a restart and can't guarantee settings go back to how they were before OSConfig managed them. The two "undo" operations aren't equivalent, so don't treat them as if they were.
A cautious evaluation plan for Insiders
If you're testing vNext and already rely on OSConfig, this approach follows Microsoft's documented read-only mode, selector controls and conflict warning. It's my own suggested workflow, not a joint procedure Microsoft has published:
- Use test machines only. The build is pre-release and unsupported in production.
- Inventory ownership. Record which tools currently control each security setting: OSConfig scenarios, Group Policy, Azure Policy, scripts.
- Run MSHardenedPolicyEval with no arguments first. That evaluation is read-only. Add
-vfor per-group scores and-lto keep a log you can compare later. - Check the overlap. Compare the groups the tool flags with the settings your OSConfig scenario manages. Microsoft hasn't published the full catalog or scoring formula in the announcement, so you'll have to check this on a real machine.
- Narrow your selectors. If you apply anything, target specific groups rather than running a blanket
-ap, and plan for reboots. - Pick one authority per setting. Where both tools want different values, follow Microsoft's OSConfig guidance and remove one source rather than letting them fight.
- Send feedback. Microsoft asks Insiders to file through Feedback Hub under the Windows Server category and put the build number in the title.
The bottom line
Can you use MSHardenedPolicyEval and OSConfig together? On the published evidence, nobody can confirm it yet, including Microsoft. They do different jobs. One is a preview tool that scores and enforces a built-in hardening catalog. The other is a shipping desired-state platform with drift control and cloud integration. Microsoft has said nothing about retiring OSConfig, and it has also documented no handshake between the two.
Until Microsoft answers the thread or updates its documentation, assume any setting both tools touch could conflict. Use MSHardenedPolicyEval's read-only mode to see where your servers stand, and keep a single tool in charge of each setting.