Depending on products yea, but if they are using windows it’s windows enterprise. I agree saying just gpo is an understatement, you can get the automated stigs from the public disa site for all the things they harden. https://public.cyber.mil/stigs/supplemental-automation-content/