The solution I use is based on DCM (Desired Configuration Management). The beauty about DCM is you don’t need to look after it, just check the compliancy once and a while.