Microsoft Baseline Configuration Analyser on Production I came across an useful tool that Microsoft has released for configuration analysis. It's called Microsoft Baseline Configuration Analyser 2.0. 

I downloaded and ran it on my local instance and got a number of errors and warnings. In installation process, it warns you that you should accept some changes happen on you power shell to install the tool. 

Considering that, do you think it is safe to be installed on Production server for regular checkings?

Have anyone used this tool before and recommend it?

Thanks.
We had the same debate at our office before installing them as we also use the Best Practice Analyzer and the Baseline Security Analyzer as well. We use them once a year to baseline our systems and to check for problems/changes compared to previous baselines that we have taken.

I have never had a problem with them personally, but we never run it on an active Production machine - we normally run it against the servers once we have performed our annual DR test so they are technically not in use at the time.

They are useful tools, and can give you a good hint into what you should be looking for. However, they should not be taken as gospel and anything it comes up with really shouldn't be much of a surprise to you.

Sometimes you will get systems that require a precise configuration to get an application to work, sometimes this requires to not follow a best practice - but you should have documented this anyway so that when the analyzer raises it you already know why it is like that.

Even if you do decide to run the tools - don't go changing things before you fully understand the impact that it will have - sometimes something that seems so small can have a very large impact. Remember, anything that is comes up with is really just a recommendation and even though in the main they are good practices to follow ultimately it is you who decides whether it is feasible to do so or not.

Also you mention running these on a regular basis - these tools are just a guideline and should not be used as your sole way of checking - on-going monitoring of your systems, permissions and access in conjunction with a well implemented change management process will give you a better indication of problems before they arise.