ok so i was thinking of a scenario like, if i make some changes in the group policy management console and for some reason or issue, do not sync locally. The content that I create for DC is ultimately checking the registry entries which wont find my changes.
So my question was more about, whether i can query the global policies directly.
If not, makes me question the existence of separate compliance content for Domain controllers which PCI-DSS and CIS provides.