I am currently working on hardening our Windows OS systems. I'm reviewing guidance from CIS and Microsoft Security Compliance Manager. What I have found is that many of the security settings are already set to the recommended setting by default.
This means that if I do nothing and leave the policy set to "Not Configured", the system will be in the ideal security state.

**Here is my question:**
Is it prudent to go ahead and use group policy to enforce ALL security settings to the desired state?

Advantages I see\*: Local administrators cannot change the policy. Malicious changes will revert during next group policy refresh.

*Disadvantages I see*: OS updates that change the default configuration will not be applied because the GPO will enforce a different setting. Lower group policy load times.

Is there any standard or guidance from Microsoft or another security authority (SANS, etc...) that addresses this issue?

Thanks in advance!