Hardened workstation images disable RDP, but weeks later drift re-enables it on several clerk PCs. Which mitigation keeps the secure baseline from eroding?

Configuration enforcement uses ongoing policy, management tooling, and hardened image practices to detect and correct drift such as RDP re-enabled on clerk PCs weeks after a secure image. One-time hardening without continuous enforcement erodes under help-desk exceptions, local admin habits, and software installs. Municipal endpoints need durable baselines because clerk fleets are large and change constantly through seasonal staffing.

Documenting the baseline once and never re-checking endpoints guarantees silent drift. Allowing local admins to change any setting without monitoring maximizes uncontrolled deviation from the hardened state. Relying on users to remember not to turn RDP back on substitutes hope for control and fails under operational pressure.

Exam caveat: secure baselines require enforcement and monitoring, not merely an initial image. When stems describe drift weeks later, the mitigation is continuous configuration control (GPO/MDM/desired-state), not user reminders.

Operational check: redeploy hardened images or configuration profiles that disable RDP, monitor configuration compliance dashboards for drift, alert on local firewall/RDP service changes, limit local admin rights, and schedule periodic compliance scans across clerk VLANs before audits or election events.