accepted Automated compliance checklist profiles and rules parsed directly from the Active Directory Hardening Guidebook. 1.0 Antigravity Hardening Project Antigravity 2026-09-09 Applies all Tier 0 infrastructure and Domain Controller security checks. Applies security restrictions specifically targeting PAWs. Applies security baselines for general client workstations and endpoints. Target Scope: Applicable Systems: Tier 1 member servers and Tier 2 client workstations. Operating Systems: Windows Server 2016 (and above), Windows 10 (and above) Enterprise/Professional. File Path: 01-architecture/implement-administrative-tiering-model.md To successfully enforce the administrative tiering model, the boundaries must be programmatically restricted. Active Directory administrative groups (such as Domain Admins, Enterprise Admins, and Schema Admins) must be explicitly blocked from authenticating to lower-tier systems. If these permissions are not restricted, a Tier 0 administrator might use their account to troubleshoot a Tier 1 server or Tier 2 workstation. This action caches their administrative password hash or Kerberos Ticket Granting Ticket (TGT) in the local memory of the target machine. If that machine has been compromised, an attacker can extract those credentials and compromise the entire Active Directory domain. By configuring Group Policy objects to explicitly deny logon rights (interactive, network, and Remote Desktop) for high-tier administrative accounts on lower-tier systems, you prevent accidental or unauthorized exposure of high-privilege credentials. Option A: Group Policy Object (GPO) Configuration (Preferred) To prevent Tier 0 credentials from being exposed on Tier 1 and Tier 2 systems, configure the logon restrictions using GPOs linked to the Tier 1 (Member Servers) and Tier 2 (Workstations) OUs. 1. Configure Tier 1 Logon Restrictions GPO Open the Group Policy Management Console (gpmc.msc). Create a GPO linked to the Tier 1 Member Servers OU (e.g., GPO_Restrictions_Tier1). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Define and configure the following policies: Deny access to this computer from the network*: Add Domain Admins, Enterprise Admins, Schema Admins. Deny log on as a batch job*: Add Domain Admins, Enterprise Admins, Schema Admins. Deny log on as a service*: Add Domain Admins, Enterprise Admins, Schema Admins. Deny log on locally*: Add Domain Admins, Enterprise Admins, Schema Admins. Deny log on through Remote Desktop Services*: Add Domain Admins, Enterprise Admins, Schema Admins. 2. Configure Tier 2 Logon Restrictions GPO Create a GPO linked to the Tier 2 Workstations OU (e.g., GPO_Restrictions_Tier2). Navigate to the same path: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Configure the policies to deny access for both Tier 0 and Tier 1 administrative groups: Deny access to this computer from the network*: Add Tier 0 groups (Domain Admins, Enterprise Admins, Schema Admins) and Tier 1 administrative groups. Deny log on as a batch job*: Add Tier 0 and Tier 1 administrative groups. Deny log on as a service*: Add Tier 0 and Tier 1 administrative groups. Deny log on locally*: Add Tier 0 and Tier 1 administrative groups. Deny log on through Remote Desktop Services*: Add Tier 0 and Tier 1 administrative groups. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this script to configure local security database files via secedit to deny specified administrative groups from logging on locally, over the network, or via Remote Desktop. Download Script: Set-LocalLogonRestrictions.ps1 # Set-LocalLogonRestrictions.ps1 # Configures secedit User Rights Assignment to block domain administrative groups. # 1. Define groups to block (Tier 0 admin groups) $DenyGroups = @("Domain Admins", "Enterprise Admins", "Schema Admins") # 2. Translate group names to SID strings $SIDs = foreach ($group in $DenyGroups) { try { $sid = (New-Object System.Security.Principal.NTAccount($group)).Translate([System.Security.Principal.SecurityIdentifier]).Value "*$sid" } catch { Write-Warning "Could not resolve SID for group: $group. Skipping." } } if ($SIDs.Count -eq 0) { Write-Error "No valid group SIDs resolved. Exiting." exit 1 } # 3. Define the temporary paths for secedit config $tempDir = [System.IO.Path]::GetTempPath() $secConfigPath = Join-Path $tempDir "sec_config.inf" $secDbPath = Join-Path $tempDir "sec_db.sdb" # 4. Export current local security policy secedit /export /cfg $secConfigPath /areas USER_RIGHTS /quiet # 5. Modify exported config to inject our deny rules $configContent = Get-Content -Path $secConfigPath $NewContent = [System.Collections.Generic.List[string]]::new() $InUserRights = $false $PolicyEntries = @( "SeDenyInteractiveLogonRight", "SeDenyNetworkLogonRight", "SeDenyRemoteInteractiveLogonRight" ) foreach ($line in $configContent) { if ($line -match '^\[Privilege Rights\]') { $InUserRights = $true $NewContent.Add($line) continue } if ($InUserRights -and $line -match '^\[') { $InUserRights = $false } # Filter out existing lines for the policies we configure $matched = $false foreach ($entry in $PolicyEntries) { if ($line -match "^$entry\s*=") { $matched = $true break } } if (-not $matched) { $NewContent.Add($line) } } # Insert new rules into [Privilege Rights] section $InsertIndex = $NewContent.FindIndex({ $args[0] -match '^\[Privilege Rights\]' }) if ($InsertIndex -ge 0) { $Offset = 1 $FormattedSIDs = $SIDs -join "," foreach ($policy in $PolicyEntries) { $NewContent.Insert($InsertIndex + $Offset, "$policy = $FormattedSIDs") $Offset++ } } # Save new configuration $NewContent | Out-File -FilePath $secConfigPath -Encoding utf16 # 6. Apply configuration using secedit Write-Host "Applying User Rights Assignment restrictions via secedit..." -ForegroundColor Cyan $process = Start-Process secedit -ArgumentList "/configure /db $secDbPath /cfg $secConfigPath /areas USER_RIGHTS /quiet" -Wait -NoNewWindow -PassThru # Cleanup temporary database files if (Test-Path $secConfigPath) { Remove-Item $secConfigPath -Force } if (Test-Path $secDbPath) { Remove-Item $secDbPath -Force } if ($process.ExitCode -eq 0) { Write-Host "Logon restrictions applied successfully." -ForegroundColor Green } else { Write-Error "Failed to apply logon restrictions. Exit code: $($process.ExitCode)" } To audit active logon restriction settings locally: Download Script: Test-LocalLogonRestrictions.ps1 # Test-LocalLogonRestrictions.ps1 # Audits local security policies to check if SeDeny rights are populated. Write-Host "--- Auditing Local User Rights Assignments ---" -ForegroundColor Cyan $tempDir = [System.IO.Path]::GetTempPath() $secConfigPath = Join-Path $tempDir "sec_audit.inf" # Export current configuration secedit /export /cfg $secConfigPath /areas USER_RIGHTS /quiet $configContent = Get-Content -Path $secConfigPath $PoliciesToTest = @( "SeDenyInteractiveLogonRight", "SeDenyNetworkLogonRight", "SeDenyRemoteInteractiveLogonRight" ) foreach ($policy in $PoliciesToTest) { $match = $configContent | Where-Object { $_ -match "^$policy\s*=" } if ($match) { # Check if it contains domain admin or other groups Write-Host " - Policy '$policy' is configured: $match" -ForegroundColor Green } else { Write-Host " - VULNERABLE: Policy '$policy' is not defined (No accounts denied)." -ForegroundColor Red } } if (Test-Path $secConfigPath) { Remove-Item $secConfigPath -Force } # Set-LocalLogonRestrictions.ps1 # Configures secedit User Rights Assignment to block domain administrative groups. # 1. Define groups to block (Tier 0 admin groups) $DenyGroups = @("Domain Admins", "Enterprise Admins", "Schema Admins") # 2. Translate group names to SID strings $SIDs = foreach ($group in $DenyGroups) { try { $sid = (New-Object System.Security.Principal.NTAccount($group)).Translate([System.Security.Principal.SecurityIdentifier]).Value "*$sid" } catch { Write-Warning "Could not resolve SID for group: $group. Skipping." } } if ($SIDs.Count -eq 0) { Write-Error "No valid group SIDs resolved. Exiting." exit 1 } # 3. Define the temporary paths for secedit config $tempDir = [System.IO.Path]::GetTempPath() $secConfigPath = Join-Path $tempDir "sec_config.inf" $secDbPath = Join-Path $tempDir "sec_db.sdb" # 4. Export current local security policy secedit /export /cfg $secConfigPath /areas USER_RIGHTS /quiet # 5. Modify exported config to inject our deny rules $configContent = Get-Content -Path $secConfigPath $NewContent = [System.Collections.Generic.List[string]]::new() $InUserRights = $false $PolicyEntries = @( "SeDenyInteractiveLogonRight", "SeDenyNetworkLogonRight", "SeDenyRemoteInteractiveLogonRight" ) foreach ($line in $configContent) { if ($line -match '^\[Privilege Rights\]') { $InUserRights = $true $NewContent.Add($line) continue } if ($InUserRights -and $line -match '^\[') { $InUserRights = $false } # Filter out existing lines for the policies we configure $matched = $false foreach ($entry in $PolicyEntries) { if ($line -match "^$entry\s*=") { $matched = $true break } } if (-not $matched) { $NewContent.Add($line) } } # Insert new rules into [Privilege Rights] section $InsertIndex = $NewContent.FindIndex({ $args[0] -match '^\[Privilege Rights\]' }) if ($InsertIndex -ge 0) { $Offset = 1 $FormattedSIDs = $SIDs -join "," foreach ($policy in $PolicyEntries) { $NewContent.Insert($InsertIndex + $Offset, "$policy = $FormattedSIDs") $Offset++ } } # Save new configuration $NewContent | Out-File -FilePath $secConfigPath -Encoding utf16 # 6. Apply configuration using secedit Write-Host "Applying User Rights Assignment restrictions via secedit..." -ForegroundColor Cyan $process = Start-Process secedit -ArgumentList "/configure /db $secDbPath /cfg $secConfigPath /areas USER_RIGHTS /quiet" -Wait -NoNewWindow -PassThru # Cleanup temporary database files if (Test-Path $secConfigPath) { Remove-Item $secConfigPath -Force } if (Test-Path $secDbPath) { Remove-Item $secDbPath -Force } if ($process.ExitCode -eq 0) { Write-Host "Logon restrictions applied successfully." -ForegroundColor Green } else { Write-Error "Failed to apply logon restrictions. Exit code: $($process.ExitCode)" } Target Scope: Applicable Systems: Tier 0 assets (Domain Controllers, Jump Hosts) and Tier 1 member servers. Operating Systems: Windows Server 2016 (and above), Windows 10 (and above) Enterprise/Professional. File Path: 01-architecture/restrict-mgmt-protocols.md Remote management protocols like Remote Desktop Protocol (RDP) and Windows Remote Management (WinRM) are critical interfaces for directory administration. However, if these protocols are accessible from any host in the network, they become high-value targets for attackers. If an attacker compromises a standard user workstation (Tier 2), they can run network scanners to identify all machines listening on port 3389 (RDP) or 5985/5986 (WinRM). They can then attempt password spraying or locate open administrative sessions. Restricting administrative protocols at the network and local firewall levels to allow inbound connections only from designated administrative jump hosts or PAW IP ranges stops lateral movement and brute-force attempts from standard user networks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Create or edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security Expand Inbound Rules. Locate the rule Remote Desktop - User Mode (TCP-In) (or create a custom inbound port rule for TCP port 3389). Double-click the rule, navigate to the Scope tab, and configure: Remote IP address : Click These IP addresses* and enter the specific IP range of the Tier 0 Jump Hosts and PAWs (e.g., 10.10.0.0/24). Do not allow "Any IP address". Locate the rule Windows Remote Management (HTTP-In) (TCP port 5985/5986). Double-click the rule, navigate to the Scope tab, and enter the same administrative IP range under Remote IP address. Enforce blocking of any other inbound connections by ensuring the default firewall action for the profile is set to block inbound connections that do not match an allow rule. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally on a Domain Controller or member server to create Windows Defender Firewall rules restricting WinRM and RDP to authorized subnets. Download Script: Set-AdminProtocolRestrictions.ps1 # Set-AdminProtocolRestrictions.ps1 # Creates inbound firewall rules to restrict RDP and WinRM to designated management subnets. Write-Host "--- Restricting Administrative Protocols Inbound ---" -ForegroundColor Cyan # Define the authorized administrative network subnet $AdminSubnet = "10.10.0.0/24" # Replace with your PAW / Jump Host subnet # 1. Restrict RDP (TCP port 3389) Inbound $RdpRule = Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" -ErrorAction SilentlyContinue if ($RdpRule) { Write-Host "[+] Restricting existing RDP firewall rule to admin subnet..." -ForegroundColor Gray Set-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" -RemoteAddress $AdminSubnet Write-Host " RDP rule restricted." -ForegroundColor Green } else { Write-Host "[+] Creating new restricted RDP inbound rule..." -ForegroundColor Gray New-NetFirewallRule -DisplayName "Hardening: Restricted RDP Inbound" ` -Direction Inbound ` -Action Allow ` -Protocol TCP ` -LocalPort 3389 ` -RemoteAddress $AdminSubnet ` -Enabled True | Out-Null Write-Host " Restricted RDP rule created." -ForegroundColor Green } # 2. Restrict WinRM HTTPS (TCP port 5986) Inbound $WinRMRule = Get-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -ErrorAction SilentlyContinue if ($WinRMRule) { Write-Host "[+] Restricting existing WinRM HTTPS rule to admin subnet..." -ForegroundColor Gray Set-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -RemoteAddress $AdminSubnet Write-Host " WinRM rule restricted." -ForegroundColor Green } else { Write-Host "[+] Creating new restricted WinRM HTTPS inbound rule..." -ForegroundColor Gray New-NetFirewallRule -DisplayName "Hardening: Restricted WinRM HTTPS Inbound" ` -Direction Inbound ` -Action Allow ` -Protocol TCP ` -LocalPort 5986 ` -RemoteAddress $AdminSubnet ` -Enabled True | Out-Null Write-Host " Restricted WinRM rule created." -ForegroundColor Green } To audit the firewall restrictions: Download Script: Test-AdminProtocolRestrictions.ps1 # Test-AdminProtocolRestrictions.ps1 # Audits local firewall rules for RDP and WinRM to check remote address restrictions. Write-Host "--- Auditing Administrative Port Firewall Rules ---" -ForegroundColor Cyan $Rules = @( "Remote Desktop - User Mode (TCP-In)", "Windows Remote Management (HTTPS-In)", "Hardening: Restricted RDP Inbound", "Hardening: Restricted WinRM HTTPS Inbound" ) foreach ($RuleName in $Rules) { $Rule = Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue if ($Rule) { $Address = Get-NetFirewallAddressFilter -AssociatedNetFirewallRule $Rule $color = if ($Address.RemoteAddress -ne "Any" -and $Address.RemoteAddress -ne "") { "Green" } else { "Red" } Write-Host " - Firewall Rule: $($Rule.DisplayName) | Enabled: $($Rule.Enabled) | RemoteAddress Restriction: $($Address.RemoteAddress)" -ForegroundColor $color } } # Set-AdminProtocolRestrictions.ps1 # Creates inbound firewall rules to restrict RDP and WinRM to designated management subnets. Write-Host "--- Restricting Administrative Protocols Inbound ---" -ForegroundColor Cyan # Define the authorized administrative network subnet $AdminSubnet = "10.10.0.0/24" # Replace with your PAW / Jump Host subnet # 1. Restrict RDP (TCP port 3389) Inbound $RdpRule = Get-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" -ErrorAction SilentlyContinue if ($RdpRule) { Write-Host "[+] Restricting existing RDP firewall rule to admin subnet..." -ForegroundColor Gray Set-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" -RemoteAddress $AdminSubnet Write-Host " RDP rule restricted." -ForegroundColor Green } else { Write-Host "[+] Creating new restricted RDP inbound rule..." -ForegroundColor Gray New-NetFirewallRule -DisplayName "Hardening: Restricted RDP Inbound" ` -Direction Inbound ` -Action Allow ` -Protocol TCP ` -LocalPort 3389 ` -RemoteAddress $AdminSubnet ` -Enabled True | Out-Null Write-Host " Restricted RDP rule created." -ForegroundColor Green } # 2. Restrict WinRM HTTPS (TCP port 5986) Inbound $WinRMRule = Get-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -ErrorAction SilentlyContinue if ($WinRMRule) { Write-Host "[+] Restricting existing WinRM HTTPS rule to admin subnet..." -ForegroundColor Gray Set-NetFirewallRule -DisplayName "Windows Remote Management (HTTPS-In)" -RemoteAddress $AdminSubnet Write-Host " WinRM rule restricted." -ForegroundColor Green } else { Write-Host "[+] Creating new restricted WinRM HTTPS inbound rule..." -ForegroundColor Gray New-NetFirewallRule -DisplayName "Hardening: Restricted WinRM HTTPS Inbound" ` -Direction Inbound ` -Action Allow ` -Protocol TCP ` -LocalPort 5986 ` -RemoteAddress $AdminSubnet ` -Enabled True | Out-Null Write-Host " Restricted WinRM rule created." -ForegroundColor Green } Target Scope: Applicable Systems: Active Directory Domain. Operating Systems: Windows Server 2016 (and above) Domain Controllers. File Path: 01-architecture/audit-privileged-groups.md Attackers who gain initial access to an Active Directory domain attempt to elevate their privileges to Tier 0. A primary method for establishing domain persistence is adding compromised domain accounts to highly privileged administrative groups, such as Domain Admins, Enterprise Admins, Schema Admins, or Builtin\Administrators. If these groups are not audited continuously: 1. Backdoor Persistence: Attackers can add temporary users to administrative groups and remove them later, leaving backdoor accounts with administrative authority that go unnoticed. 2. Privilege Creep: Unmanaged administrative accounts accumulate over time, violating the principle of least privilege. 3. Delegation Risks: Administrative accounts can inherit unintended administrative rights if nested within other groups. Enforcing advanced auditing on directory object changes, combined with a daily script to monitor privileged group members, ensures immediate visibility into unauthorized modifications. Option A: Group Policy Object (GPO) Configuration (Preferred) To generate events when administrative group membership is altered: 1. Open the Group Policy Management Console (gpmc.msc). 2. Create or edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). 3. Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access 4. Configure the setting: Policy : `Audit Directory Service Changes` Setting: Enabled (Select Success and Failure) This ensures that Event ID 5136 is logged in the Security log of the Domain Controller whenever an Active Directory object attribute (such as a group's member attribute) is changed. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run this script from a secure administrative workstation to audit nested and direct memberships in critical Tier 0 groups, highlighting any unexpected accounts. Download Script: Audit-ADAdminGroups.ps1 # Audit-ADAdminGroups.ps1 # Queries memberships of privileged Tier 0 AD groups recursively. Import-Module ActiveDirectory $Tier0Groups = @( "Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators", "Account Operators", "Server Operators", "Backup Operators" ) Write-Host "--- Auditing Privileged AD Groups ---" -ForegroundColor Cyan # Define the list of explicitly authorized accounts (e.g. emergency break-glass account) $AuthorizedUsers = @("Administrator", "a0-breakglass") foreach ($GroupName in $Tier0Groups) { try { $Group = Get-ADGroup -Identity $GroupName -ErrorAction Stop $Members = Get-ADGroupMember -Identity $GroupName -Recursive Write-Host "`n[+] Group: $($Group.Name)" -ForegroundColor Yellow if ($Members.Count -eq 0) { Write-Host " No members found." -ForegroundColor Gray } else { foreach ($Member in $Members) { # Highlight unauthorized accounts in red if ($AuthorizedUsers -notcontains $Member.SamAccountName -and $Member.SamAccountName -notlike "a0-*") { Write-Host " - VULNERABLE: Unauthorized user '$($Member.SamAccountName)' in admin group!" -ForegroundColor Red } else { Write-Host " - Member: $($Member.SamAccountName) | Class: $($Member.objectClass)" -ForegroundColor Green } } } } catch { Write-Warning "Could not query group '$GroupName'. Ensure appropriate permissions." } } To verify that directory auditing is active on the local DC: Download Script: Test-ADChangesAuditing.ps1 # Test-ADChangesAuditing.ps1 # Audits local DC auditpol settings to verify Directory Service auditing is enabled. Write-Host "--- Auditing Directory Service Audit Policy ---" -ForegroundColor Cyan $rawOutput = auditpol.exe /get /subcategory:"Directory Service Changes" /r # Parse CSV output: Machine,Subcategory,GUID,PolicyVal if ($rawOutput -match "^.+,Directory Service Changes,.+,(.+)$") { $policyVal = $Matches[1] $color = if ($policyVal -match "Success") { "Green" } else { "Red" } Write-Host " - Directory Service Changes Audit: $policyVal (Required = Success and Failure)" -ForegroundColor $color } else { Write-Warning " - Status: Could not parse DS auditpol status." } Target Scope: Applicable Systems: Domain Controllers (Forest-wide configuration) Operating Systems: Windows Server 2016 and above File Path: 01-architecture/keep-functional-levels-up-to-date.md The Domain Functional Level (DFL) and Forest Functional Level (FFL) dictate the capabilities of the Active Directory (AD) infrastructure. While upgrading the Operating System of Domain Controllers (DCs) improves the underlying OS security, the AD logic remains constrained by the functional level. Maintaining an obsolete DFL forces Domain Controllers to emulate legacy behaviors and protocols to ensure backward compatibility with non-existent older DCs. This emulation effectively creates a ceiling for your security posture, preventing the activation of modern identity protection mechanisms. Raising the functional level is critical for hardening because it unlocks architectural security changes that mitigate credential theft and lateral movement. Specifically, higher functional levels are prerequisites for: 1. Protected Users Group: Mandates restrictions that prevent caching of NTLM credentials, disable Kerberos DES/RC4 keys, and prevent caching of plaintext passwords. 2. Group Managed Service Accounts (gMSAs): Eliminates static service account passwords by automating 120-character key rotation. 3. Kerberos Armoring (FAST): Protects Kerberos tickets and exchanges against offline dictionary attacks and ticket manipulation. 4. Deprecating Legacy Replication: Disables insecure File Replication Service (FRS) in favor of DFS Replication (DFSR). Option A: Active Directory Domains and Trusts (Preferred) Log on to a Domain Controller or a management workstation with Enterprise Admins credentials. Open the Active Directory Domains and Trusts console (domain.msc). To raise the Domain Functional Level: In the console tree, right-click the domain for which you want to raise the functional level, and then click Raise Domain Functional Level*. Select Windows Server 2016 (or higher depending on your environment) from the list of available levels, and then click Raise*. Read the warning dialog and click OK* to confirm. To raise the Forest Functional Level: In the console tree, right-click Active Directory Domains and Trusts , and then click Raise Forest Functional Level*. Select Windows Server 2016 (or higher depending on your environment) from the list of available levels, and then click Raise*. Read the warning dialog and click OK* to confirm. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts to audit and raise the functional levels. 1. Local Audit (Audit-ADFunctionalLevels.ps1) Download Script: Audit-ADFunctionalLevels.ps1 # Audit-ADFunctionalLevels.ps1 # Description: Audits the current domain and forest functional levels. Import-Module ActiveDirectory Write-Host "--- Auditing Active Directory Functional Levels ---" -ForegroundColor Cyan $Domain = Get-ADDomain -ErrorAction SilentlyContinue $Forest = Get-ADForest -ErrorAction SilentlyContinue if ($Domain -and $Forest) { $DomainMode = $Domain.DomainMode $ForestMode = $Forest.ForestMode $MinDomainMode = [Microsoft.ActiveDirectory.Management.ADDomainMode]::Windows2016Domain $MinForestMode = [Microsoft.ActiveDirectory.Management.ADForestMode]::Windows2016Forest $DomainCompliant = [int]$DomainMode -ge [int]$MinDomainMode $ForestCompliant = [int]$ForestMode -ge [int]$MinForestMode if ($DomainCompliant) { Write-Host "Status: Domain Functional Level is compliant ($DomainMode)." -ForegroundColor Green } else { Write-Host "VULNERABLE: Domain Functional Level ($DomainMode) is below Windows Server 2016." -ForegroundColor Red } if ($ForestCompliant) { Write-Host "Status: Forest Functional Level is compliant ($ForestMode)." -ForegroundColor Green } else { Write-Host "VULNERABLE: Forest Functional Level ($ForestMode) is below Windows Server 2016." -ForegroundColor Red } } else { Write-Host "VULNERABLE: Could not retrieve Active Directory settings. Run on a domain-joined machine with AD module installed." -ForegroundColor Red } 2. Local Remediation (Set-ADFunctionalLevels.ps1) Download Script: Set-ADFunctionalLevels.ps1 # Set-ADFunctionalLevels.ps1 # Description: Raises Domain and Forest Functional Levels to Windows Server 2016. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Raise Functional Levels to Windows Server 2016..." -ForegroundColor Cyan $Domain = Get-ADDomain -ErrorAction SilentlyContinue $Forest = Get-ADForest -ErrorAction SilentlyContinue if (-not $Domain -or -not $Forest) { Write-Error "Could not retrieve Active Directory settings. Run on a Domain Controller with administrative privileges." exit 1 } # Raise Domain Functional Level if ($Domain.DomainMode -lt [Microsoft.ActiveDirectory.Management.ADDomainMode]::Windows2016Domain) { try { Set-ADDomainMode -Identity $Domain.DNSRoot -DomainMode Windows2016Domain -Confirm:$false -ErrorAction Stop Write-Host "Domain Functional Level successfully raised to Windows Server 2016." -ForegroundColor Green } catch { Write-Error "Failed to raise Domain Functional Level. Error: $($_.Exception.Message)" } } else { Write-Host "Domain Functional Level is already Windows Server 2016 or higher." -ForegroundColor Green } # Raise Forest Functional Level if ($Forest.ForestMode -lt [Microsoft.ActiveDirectory.Management.ADForestMode]::Windows2016Forest) { try { Set-ADForestMode -Identity $Forest.Name -ForestMode Windows2016Forest -Confirm:$false -ErrorAction Stop Write-Host "Forest Functional Level successfully raised to Windows Server 2016." -ForegroundColor Green } catch { Write-Error "Failed to raise Forest Functional Level. Error: $($_.Exception.Message)" } } else { Write-Host "Forest Functional Level is already Windows Server 2016 or higher." -ForegroundColor Green } # Set-ADFunctionalLevels.ps1 # Description: Raises Domain and Forest Functional Levels to Windows Server 2016. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Raise Functional Levels to Windows Server 2016..." -ForegroundColor Cyan $Domain = Get-ADDomain -ErrorAction SilentlyContinue $Forest = Get-ADForest -ErrorAction SilentlyContinue if (-not $Domain -or -not $Forest) { Write-Error "Could not retrieve Active Directory settings. Run on a Domain Controller with administrative privileges." exit 1 } # Raise Domain Functional Level if ($Domain.DomainMode -lt [Microsoft.ActiveDirectory.Management.ADDomainMode]::Windows2016Domain) { try { Set-ADDomainMode -Identity $Domain.DNSRoot -DomainMode Windows2016Domain -Confirm:$false -ErrorAction Stop Write-Host "Domain Functional Level successfully raised to Windows Server 2016." -ForegroundColor Green } catch { Write-Error "Failed to raise Domain Functional Level. Error: $($_.Exception.Message)" } } else { Write-Host "Domain Functional Level is already Windows Server 2016 or higher." -ForegroundColor Green } # Raise Forest Functional Level if ($Forest.ForestMode -lt [Microsoft.ActiveDirectory.Management.ADForestMode]::Windows2016Forest) { try { Set-ADForestMode -Identity $Forest.Name -ForestMode Windows2016Forest -Confirm:$false -ErrorAction Stop Write-Host "Forest Functional Level successfully raised to Windows Server 2016." -ForegroundColor Green } catch { Write-Error "Failed to raise Forest Functional Level. Error: $($_.Exception.Message)" } } else { Write-Host "Forest Functional Level is already Windows Server 2016 or higher." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers and Domain Members (Forest-wide) Operating Systems: Windows Server 2016 and above File Path: 01-architecture/default-policies-recommendations.md Modifying the Default Domain Policy (DDP) and Default Domain Controllers Policy (DDCP) introduces significant operational risks. These default policies define the core directory baseline configurations required for Active Directory to initialize, replicate, and authenticate. However, a critical exception to modular Group Policy design applies to Account Policies (Password, Account Lockout, and Kerberos settings) and Encrypting File System (EFS) policies. Windows operating systems only process domain-wide Account Policies from the GPO linked directly to the domain root (by default, the Default Domain Policy). Custom GPOs linked at lower levels containing these settings will be ignored for domain accounts. Therefore, these specific baselines must be configured directly within the Default Domain Policy itself. All other custom hardening settings (such as local User Rights Assignments, Audit Policies, and registry parameters) should be managed via dedicated modular GPOs (e.g., SEC_DomainControllers_Hardening) linked at higher precedence. Integrating the following controls inside the DDP/DDCP and custom GPOs completes the Active Directory management baseline: 1. Disabling Encrypting File System (EFS): EFS allows users to encrypt files on local drives. This makes files difficult to recover or back up securely. Enterprise environments should enforce full-disk encryption (BitLocker) rather than user-managed file-level encryption. Disabling EFS prevents unauthorized user-level encryption. 2. Enforcing Group Policy Background Refresh: Ensuring that Group Policy background refresh is active prevents unauthorized local overrides from persisting. Setting the policy Turn off background refresh of Group Policy to Disabled ensures that GPOs are reapplied every 90 minutes. 3. Mandating GPO Comments: Documenting the purpose, author, and revision history in the GPO comments field ensures accountability and prevents configuration drift. 4. Restricting gpupdate /force Overuse: Running gpupdate /force causes endpoints and servers to re-download all applied GPOs from Domain Controllers. In large environments, this can trigger severe network congestion and CPU spikes on DCs. Administrators should use standard gpupdate without the /force switch unless a full re-application of unchanged policies is required. Option A: Group Policy Management Console (GPMC) (Preferred) Step 1: Configure Default Domain Policy for Account and EFS Policies Log on to a management workstation or Domain Controller with Domain Admins credentials. Open the Group Policy Management Console (gpmc.msc). Right-click the Default Domain Policy and select Edit. Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies Right-click Encrypting File System and select Properties. In the General tab, under File encryption using Encrypting File System (EFS), select Disabled and click OK. Navigate to the Account Policies node to configure domain-wide Password and Lockout parameters as detailed in configure-account-policies.md. Step 2: Establish Modular GPOs for Non-Account Policies In the gpmc.msc console tree, right-click Group Policy Objects and select New. Name the GPO SEC_DomainControllers_Hardening (and SEC_Domain_Hardening for domain members) and click OK. Right-click the Domain Controllers OU (or root domain) and select Link an Existing GPO. Select SEC_DomainControllers_Hardening and click OK. Select the Domain Controllers OU in the left pane, navigate to the Linked Group Policy Objects tab, select the custom hardening GPO, and use the green up arrow to set its Link Order to 1 (highest precedence). Step 3: Configure Group Policy Background Refresh Edit your modular hardening GPO (e.g., SEC_DomainControllers_Hardening or SEC_Domain_Hardening). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Group Policy Double-click the policy Turn off background refresh of Group Policy and set it to Disabled. Step 4: Mandate GPO Comments for Accountability In GPMC, right-click your GPO, select Properties, and navigate to the Comment tab. Enter a structured comment containing: Purpose*: [Brief explanation of GPO controls] Author*: [Administrator Name or Security Team] Date*: [Creation/Modification Date] Reference Requirement*: [e.g., REQ-ARCH-005] Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts to audit and set up the GPO structure, EFS, and background refresh locally. 1. Local Audit (Audit-GPOPrecedence.ps1) Download Script: Audit-GPOPrecedence.ps1 # Audit-GPOPrecedence.ps1 # Description: Verifies GPO precedence on DC OU, and checks local EFS and background refresh registry configuration. Import-Module ActiveDirectory Import-Module GroupPolicy Write-Host "--- Auditing Default Policies and Precedence ---" -ForegroundColor Cyan # 1. Audit GPO Precedence on Domain Controllers OU $DomainInfo = Get-ADDomain $DCOUDN = "OU=Domain Controllers,$($DomainInfo.DistinguishedName)" try { $OUInfo = Get-GPInheritance -Target $DCOUDN -ErrorAction Stop Write-Host "`nLinked GPOs on Domain Controllers OU:" -ForegroundColor Yellow $HardeningGPOFound = $false $HardeningOrder = 999 $DefaultDCOrder = 999 foreach ($link in $OUInfo.GpoLinks) { $status = if ($link.Enabled) { "Enabled" } else { "Disabled" } Write-Host " - Link Order: $($link.Order) | GPO Name: $($link.DisplayName) | Status: $status" -ForegroundColor White if ($link.DisplayName -like "*Hardening*" -and $link.Enabled) { $HardeningGPOFound = $true $HardeningOrder = $link.Order } if ($link.DisplayName -eq "Default Domain Controllers Policy") { $DefaultDCOrder = $link.Order } } if ($HardeningGPOFound -and $HardeningOrder -lt $DefaultDCOrder) { Write-Host "`n[+] GPO Precedence: Compliant. Custom hardening GPO has higher precedence (Order $HardeningOrder) than Default DC Policy (Order $DefaultDCOrder)." -ForegroundColor Green } else { Write-Host "`n[!] VULNERABLE: No active dedicated hardening GPO found with higher precedence than Default DC Policy." -ForegroundColor Red } } catch { Write-Host "[!] Could not retrieve GPO information for DC OU. Error: $($_.Exception.Message)" -ForegroundColor Red } # 2. Audit EFS Registry status $EfsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\EFS" $EfsVal = Get-ItemProperty -Path $EfsPath -Name "EfsConfiguration" -ErrorAction SilentlyContinue if ($EfsVal -and $EfsVal.EfsConfiguration -eq 1) { Write-Host "[+] EFS Configuration: Secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: EFS is not disabled in registry policies." -ForegroundColor Red } # 3. Audit Background Refresh status $SysPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $BkgVal = Get-ItemProperty -Path $SysPath -Name "DisableBkGndGroupPolicy" -ErrorAction SilentlyContinue if ($BkgVal -and $BkgVal.DisableBkGndGroupPolicy -eq 0) { Write-Host "[+] Group Policy Background Refresh: Secure (Active)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Group Policy background refresh is turned off in registry." -ForegroundColor Red } 2. Local Remediation (Set-ADModularGPO.ps1) Download Script: Set-ADModularGPO.ps1 # Set-ADModularGPO.ps1 # Description: Creates DC hardening GPO with top precedence, disables EFS, and enables background refresh locally. Import-Module ActiveDirectory Import-Module GroupPolicy Write-Host "Applying Default Policies hardening baseline..." -ForegroundColor Cyan # 1. Create and Link DC Hardening GPO $DomainInfo = Get-ADDomain $DCOUDN = "OU=Domain Controllers,$($DomainInfo.DistinguishedName)" $GPOName = "SEC_DomainControllers_Hardening" try { $GPO = Get-GPO -Name $GPOName -ErrorAction SilentlyContinue if (-not $GPO) { $GPO = New-GPO -Name $GPOName -Comment "Dedicated GPO for Domain Controllers hardening. Requirements: REQ-ARCH-005." -ErrorAction Stop Write-Host "[+] GPO '$GPOName' created successfully." -ForegroundColor Green } else { Write-Host "[+] GPO '$GPOName' already exists." -ForegroundColor Yellow } $Links = (Get-GPInheritance -Target $DCOUDN).GpoLinks $IsLinked = $false foreach ($link in $Links) { if ($link.DisplayName -eq $GPOName) { $IsLinked = $true break } } if (-not $IsLinked) { New-GPLink -Name $GPOName -Target $DCOUDN -LinkEnabled Yes -ErrorAction Stop | Out-Null Write-Host "[+] GPO '$GPOName' linked to Domain Controllers OU." -ForegroundColor Green } else { Write-Host "[+] GPO '$GPOName' is already linked to Domain Controllers OU." -ForegroundColor Yellow } Set-GPLink -Name $GPOName -Target $DCOUDN -Order 1 -ErrorAction Stop | Out-Null Write-Host "[+] GPO '$GPOName' set to link order 1 (highest precedence)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure GPO structure. Error: $($_.Exception.Message)" -ForegroundColor Red } # 2. Configure Local Registry for EFS (Disable) $EfsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\EFS" if (-not (Test-Path $EfsPath)) { New-Item -Path $EfsPath -Force | Out-Null } Set-ItemProperty -Path $EfsPath -Name "EfsConfiguration" -Value 1 -Type DWord -Force Write-Host "[+] EFS registry policy configured to Disabled." -ForegroundColor Green # 3. Configure Local Registry for GP Background Refresh (Active) $SysPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" if (-not (Test-Path $SysPath)) { New-Item -Path $SysPath -Force | Out-Null } Set-ItemProperty -Path $SysPath -Name "DisableBkGndGroupPolicy" -Value 0 -Type DWord -Force Write-Host "[+] Group Policy background refresh registry policy enabled." -ForegroundColor Green # Set-ADModularGPO.ps1 # Description: Creates DC hardening GPO with top precedence, disables EFS, and enables background refresh locally. Import-Module ActiveDirectory Import-Module GroupPolicy Write-Host "Applying Default Policies hardening baseline..." -ForegroundColor Cyan # 1. Create and Link DC Hardening GPO $DomainInfo = Get-ADDomain $DCOUDN = "OU=Domain Controllers,$($DomainInfo.DistinguishedName)" $GPOName = "SEC_DomainControllers_Hardening" try { $GPO = Get-GPO -Name $GPOName -ErrorAction SilentlyContinue if (-not $GPO) { $GPO = New-GPO -Name $GPOName -Comment "Dedicated GPO for Domain Controllers hardening. Requirements: REQ-ARCH-005." -ErrorAction Stop Write-Host "[+] GPO '$GPOName' created successfully." -ForegroundColor Green } else { Write-Host "[+] GPO '$GPOName' already exists." -ForegroundColor Yellow } $Links = (Get-GPInheritance -Target $DCOUDN).GpoLinks $IsLinked = $false foreach ($link in $Links) { if ($link.DisplayName -eq $GPOName) { $IsLinked = $true break } } if (-not $IsLinked) { New-GPLink -Name $GPOName -Target $DCOUDN -LinkEnabled Yes -ErrorAction Stop | Out-Null Write-Host "[+] GPO '$GPOName' linked to Domain Controllers OU." -ForegroundColor Green } else { Write-Host "[+] GPO '$GPOName' is already linked to Domain Controllers OU." -ForegroundColor Yellow } Set-GPLink -Name $GPOName -Target $DCOUDN -Order 1 -ErrorAction Stop | Out-Null Write-Host "[+] GPO '$GPOName' set to link order 1 (highest precedence)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure GPO structure. Error: $($_.Exception.Message)" -ForegroundColor Red } # 2. Configure Local Registry for EFS (Disable) $EfsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\EFS" if (-not (Test-Path $EfsPath)) { New-Item -Path $EfsPath -Force | Out-Null } Set-ItemProperty -Path $EfsPath -Name "EfsConfiguration" -Value 1 -Type DWord -Force Write-Host "[+] EFS registry policy configured to Disabled." -ForegroundColor Green # 3. Configure Local Registry for GP Background Refresh (Active) $SysPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" if (-not (Test-Path $SysPath)) { New-Item -Path $SysPath -Force | Out-Null } Set-ItemProperty -Path $SysPath -Name "DisableBkGndGroupPolicy" -Value 0 -Type DWord -Force Write-Host "[+] Group Policy background refresh registry policy enabled." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 01-architecture/harden-domain-trusts.md Active Directory trust relationships permit authentication and resource access across domain or forest boundaries. However, weak trust configurations can serve as transit routes for attackers to compromise trusting domains. Specifically: 1. SID History: Enabling SID History allows users from a trusted forest to present security identifiers (SIDs) from other domains, bypass SID filtering, and potentially impersonate high-privilege administrators in the trusting forest. Disabling SID History on external/forest trusts prevents this path of escalation. 2. SID Filtering / Quarantine: Enabling Quarantine (SID Filtering) on external trusts ensures that the trusting domain filters out unauthorized SIDs presented in authorization packets, restricting access only to SIDs originating from the trusted domain itself. 3. Kerberos TGT Delegation: If TGT delegation is allowed on inbound trusts, a user authenticating from the trusted forest to a service in the trusting domain can have their Kerberos Ticket Granting Ticket (TGT) delegated to that service. If that service or host is compromised, the attacker can harvest the user's TGT and impersonate them. Blocking TGT delegation is critical to prevent credential exposure. 4. Selective Authentication: Enforcing selective authentication restricts cross-forest access, allowing administrators to explicitly define which users/groups from the trusted forest can authenticate to specific resources in the trusting forest. Option A: Active Directory Domains and Trusts GUI Configuration Open Active Directory Domains and Trusts (domain.msc) on a Domain Controller. Right-click the trusting domain and select Properties. Select the Trusts tab. Under either Domains that trust this domain (Inbound) or Domains trusted by this domain (Outbound), select the target trust and click Properties. Configure selective authentication: Select the Authentication* tab. Change the option from Forest-wide authentication to Selective authentication*. Enforce SID filtering and quarantine rules (usually performed automatically when establishing external trusts). Option B: PowerShell & netdom Configuration (Remediation / Non-GPO) Run the following script block to audit and harden trust relationships. The netdom utility is used to query and apply the trust settings. Download Script: Set-ADTrustHardening.ps1 # Set-ADTrustHardening.ps1 # Description: Hardens trust relationships by disabling SID History and TGT Delegation, and enabling Quarantine. Write-Host "Applying hardening requirement: Harden Active Directory Domain Trusts..." -ForegroundColor Cyan # Set target trust variables (replace with your domain names) $TrustingDomain = "corp.local" $TrustedDomain = "partner.local" # 1. Disable SID History on Forest/External Trust Write-Host "Disabling SID History on trust from $($TrustingDomain) to $($TrustedDomain)..." -ForegroundColor White netdom trust $TrustingDomain /domain:$TrustedDomain /EnableSIDHistory:no # 2. Enable Quarantine (SID Filtering) on External Domain Trust Write-Host "Enabling Quarantine on trust from $($TrustingDomain) to $($TrustedDomain)..." -ForegroundColor White netdom trust $TrustingDomain /domain:$TrustedDomain /Quarantine:yes # 3. Disable TGT Delegation over Inbound Trust Write-Host "Disabling Kerberos TGT Delegation on trust from $($TrustingDomain) to $($TrustedDomain)..." -ForegroundColor White netdom trust $TrustingDomain /domain:$TrustedDomain /EnableTGTDelegation:no Write-Host "Trust hardening commands executed." -ForegroundColor Green To verify the trust configuration state: Download Script: Get-ADTrustStatus.ps1 # Get-ADTrustStatus.ps1 # Description: Audits trust attributes and configuration settings. Import-Module ActiveDirectory Write-Host "--- Auditing Trust Relationships ---" -ForegroundColor Cyan $Trusts = Get-ADTrust -Filter * -Properties * if ($Trusts) { foreach ($Trust in $Trusts) { Write-Host "[+] Trust Name: $($Trust.Name)" -ForegroundColor Green Write-Host " - Trust Type: $($Trust.TrustType)" -ForegroundColor White Write-Host " - Direction: $($Trust.TrustDirection)" -ForegroundColor White Write-Host " - Selective Authentication: $($Trust.SelectiveAuthentication)" -ForegroundColor White Write-Host " - Disallow Transitivity: $($Trust.DisallowTransitivity)" -ForegroundColor White # Verify specific settings using netdom query Write-Host " - netdom Configuration Details:" -ForegroundColor White netdom trust $Trust.Source /domain:$Trust.Target /Query } } else { Write-Host "[-] No trust relationships found in the domain." -ForegroundColor Yellow } # Set-ADTrustHardening.ps1 # Description: Hardens trust relationships by disabling SID History and TGT Delegation, and enabling Quarantine. Write-Host "Applying hardening requirement: Harden Active Directory Domain Trusts..." -ForegroundColor Cyan # Set target trust variables (replace with your domain names) $TrustingDomain = "corp.local" $TrustedDomain = "partner.local" # 1. Disable SID History on Forest/External Trust Write-Host "Disabling SID History on trust from $($TrustingDomain) to $($TrustedDomain)..." -ForegroundColor White netdom trust $TrustingDomain /domain:$TrustedDomain /EnableSIDHistory:no # 2. Enable Quarantine (SID Filtering) on External Domain Trust Write-Host "Enabling Quarantine on trust from $($TrustingDomain) to $($TrustedDomain)..." -ForegroundColor White netdom trust $TrustingDomain /domain:$TrustedDomain /Quarantine:yes # 3. Disable TGT Delegation over Inbound Trust Write-Host "Disabling Kerberos TGT Delegation on trust from $($TrustingDomain) to $($TrustedDomain)..." -ForegroundColor White netdom trust $TrustingDomain /domain:$TrustedDomain /EnableTGTDelegation:no Write-Host "Trust hardening commands executed." -ForegroundColor Green Target Scope: Applicable Systems: Active Directory Domain Controllers and Domain Root Object (Tier 0). Operating Systems: Active Directory Domain Services (All supported functional levels). File Path: 01-architecture/harden-exchange-permissions.md By default, installing Microsoft Exchange Server in an Active Directory forest modifies the permissions of the domain root object. It grants the Exchange Windows Permissions group (and sometimes Exchange Servers) write permissions (WriteDacl and WriteOwner) over the domain root container. This configuration presents a critical security risk: 1. Privilege Escalation: Any user or service account with administrative control over Exchange, or any compromised Exchange server itself, can write new permissions to the domain root. 2. DCSync Exploitation: The attacker can grant their own account the ds-Replication-Get-Changes and ds-Replication-Get-Changes-All (DCSync) extended rights. This allows the attacker to dump password hashes directly from the domain controller database (NTDS.dit), leading to a complete forest compromise. Restricting these write permissions ensures that Exchange servers cannot modify domain-level security descriptors. Option A: Active Directory Users & Computers (GUI Configuration) Open Active Directory Users and Computers (dsa.msc) on a management console with Domain Admin privileges. Enable Advanced Features under the View menu. Right-click the root domain object (e.g., domain.local) and select Properties. Select the Security tab, then click Advanced. Locate the permission entries for Exchange Windows Permissions and Exchange Servers. Review the permissions: Remove any entries granting Modify permissions (`WriteDacl`) or Modify owner* (WriteOwner) on the domain root. * Ensure standard read and object creation permissions (such as writing specific user properties for mailbox management) remain unchanged. Click Apply, then OK. Option B: PowerShell & Active Directory Configuration (Remediation / Non-GPO) To automate verification and remediation of the domain root ACL: Download Script: Harden-ExchangePermissions.ps1 # Harden-ExchangePermissions.ps1 # Description: Removes WriteDacl and WriteOwner permissions for Exchange groups on the domain root. Import-Module ActiveDirectory $DomainDN = (Get-ADDomain).DistinguishedName $DomainPath = "AD:\$DomainDN" # Retrieve existing ACL $Acl = Get-Acl -Path $DomainPath $DangerousAcesToRemove = @() # Define Exchange groups to target $TargetGroups = @("Exchange Windows Permissions", "Exchange Servers") $TargetSids = @() foreach ($groupName in $TargetGroups) { try { $sid = (Get-ADGroup -Identity $groupName).SID.Value $TargetSids += $sid } catch { Write-Host "Group '$groupName' not found in this domain. Skipping." -ForegroundColor Yellow } } if ($TargetSids.Count -eq- 0) { Write-Host "No Exchange groups detected. No permissions to harden." -ForegroundColor Green exit 0 } # Scan ACL for dangerous ACEs foreach ($ace in $Acl.Access) { $identity = $ace.IdentityReference try { $sid = $identity.Translate([System.Security.Principal.SecurityIdentifier]).Value } catch { continue } if ($TargetSids -contains $sid) { # Check for WriteDacl or WriteOwner rights $hasWriteDacl = ($ace.ActiveDirectoryRights -band [System.DirectoryServices.ActiveDirectoryRights]::WriteDacl) -eq [System.DirectoryServices.ActiveDirectoryRights]::WriteDacl $hasWriteOwner = ($ace.ActiveDirectoryRights -band [System.DirectoryServices.ActiveDirectoryRights]::WriteOwner) -eq [System.DirectoryServices.ActiveDirectoryRights]::WriteOwner if ($hasWriteDacl -or $hasWriteOwner) { $DangerousAcesToRemove += $ace } } } if ($DangerousAcesToRemove.Count -eq 0) { Write-Host "[+] Domain root ACL is compliant. No dangerous Exchange write permissions found." -ForegroundColor Green } else { Write-Host "[-] Found $($DangerousAcesToRemove.Count) dangerous Exchange permissions. Removing..." -ForegroundColor Yellow foreach ($ace in $DangerousAcesToRemove) { $Acl.RemoveAccessRule($ace) | Out-Null } Set-Acl -Path $DomainPath -AclObject $Acl Write-Host "[+] Successfully removed dangerous Exchange WriteDacl/WriteOwner permissions from domain root." -ForegroundColor Green } To verify the domain root permissions: Download Script: Get-ExchangePermissionsStatus.ps1 # Get-ExchangePermissionsStatus.ps1 # Check if Exchange groups hold WriteDacl/WriteOwner permissions on the domain root. Import-Module ActiveDirectory $DomainDN = (Get-ADDomain).DistinguishedName $DomainPath = "AD:\$DomainDN" $Acl = Get-Acl -Path $DomainPath $TargetGroups = @("Exchange Windows Permissions", "Exchange Servers") $TargetSids = @() foreach ($groupName in $TargetGroups) { try { $sid = (Get-ADGroup -Identity $groupName).SID.Value $TargetSids += $sid } catch { Write-Verbose "Group '$groupName' not found in Active Directory." } } if ($TargetSids.Count -eq 0) { Write-Host "[+] COMPLIANT: Exchange groups are not present in this domain." exit 0 } $nonCompliantAces = 0 foreach ($ace in $Acl.Access) { $identity = $ace.IdentityReference try { $sid = $identity.Translate([System.Security.Principal.SecurityIdentifier]).Value } catch { continue } if ($TargetSids -contains $sid) { $hasWriteDacl = ($ace.ActiveDirectoryRights -band [System.DirectoryServices.ActiveDirectoryRights]::WriteDacl) -eq [System.DirectoryServices.ActiveDirectoryRights]::WriteDacl $hasWriteOwner = ($ace.ActiveDirectoryRights -band [System.DirectoryServices.ActiveDirectoryRights]::WriteOwner) -eq [System.DirectoryServices.ActiveDirectoryRights]::WriteOwner if ($hasWriteDacl -or $hasWriteOwner) { Write-Host "[!] NON-COMPLIANT: Group '$($identity.Value)' has permissions: $($ace.ActiveDirectoryRights)" -ForegroundColor Red $nonCompliantAces++ } } } if ($nonCompliantAces -eq 0) { Write-Host "[+] COMPLIANT: No Exchange groups have WriteDacl or WriteOwner permissions on the domain root." -ForegroundColor Green exit 0 } else { Write-Host "[!] NON-COMPLIANT: Dangerous Exchange write permissions detected on the domain root." -ForegroundColor Red exit 1 } # Harden-ExchangePermissions.ps1 # Description: Removes WriteDacl and WriteOwner permissions for Exchange groups on the domain root. Import-Module ActiveDirectory $DomainDN = (Get-ADDomain).DistinguishedName $DomainPath = "AD:\$DomainDN" # Retrieve existing ACL $Acl = Get-Acl -Path $DomainPath $DangerousAcesToRemove = @() # Define Exchange groups to target $TargetGroups = @("Exchange Windows Permissions", "Exchange Servers") $TargetSids = @() foreach ($groupName in $TargetGroups) { try { $sid = (Get-ADGroup -Identity $groupName).SID.Value $TargetSids += $sid } catch { Write-Host "Group '$groupName' not found in this domain. Skipping." -ForegroundColor Yellow } } if ($TargetSids.Count -eq- 0) { Write-Host "No Exchange groups detected. No permissions to harden." -ForegroundColor Green exit 0 } # Scan ACL for dangerous ACEs foreach ($ace in $Acl.Access) { $identity = $ace.IdentityReference try { $sid = $identity.Translate([System.Security.Principal.SecurityIdentifier]).Value } catch { continue } if ($TargetSids -contains $sid) { # Check for WriteDacl or WriteOwner rights $hasWriteDacl = ($ace.ActiveDirectoryRights -band [System.DirectoryServices.ActiveDirectoryRights]::WriteDacl) -eq [System.DirectoryServices.ActiveDirectoryRights]::WriteDacl $hasWriteOwner = ($ace.ActiveDirectoryRights -band [System.DirectoryServices.ActiveDirectoryRights]::WriteOwner) -eq [System.DirectoryServices.ActiveDirectoryRights]::WriteOwner if ($hasWriteDacl -or $hasWriteOwner) { $DangerousAcesToRemove += $ace } } } if ($DangerousAcesToRemove.Count -eq 0) { Write-Host "[+] Domain root ACL is compliant. No dangerous Exchange write permissions found." -ForegroundColor Green } else { Write-Host "[-] Found $($DangerousAcesToRemove.Count) dangerous Exchange permissions. Removing..." -ForegroundColor Yellow foreach ($ace in $DangerousAcesToRemove) { $Acl.RemoveAccessRule($ace) | Out-Null } Set-Acl -Path $DomainPath -AclObject $Acl Write-Host "[+] Successfully removed dangerous Exchange WriteDacl/WriteOwner permissions from domain root." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 File Path: 02-domain-controllers/disable-smbv1.md SMBv1 (Server Message Block version 1) is a legacy networking protocol designed over 30 years ago. It lacks modern security features such as packet encryption, cryptographic signing enforcement, and robust integrity verification. SMBv1 contains severe remote code execution (RCE) vulnerabilities (e.g., the EternalBlue vulnerability mitigated in MS17-010). Attackers can exploit SMBv1 to execute commands remotely, capture credentials, or perform lateral movement across the domain network. Domain Controllers (Tier 0) are highly sensitive targets, and keeping SMBv1 enabled presents an unacceptable risk. Disabling both the server protocol and the client driver eliminates this entire attack surface. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Group Policy Preferences to enforce the registry settings: Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference to disable the SMBv1 Server (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Value name*: SMB1 Value type*: REG_DWORD Value data*: 0 Create a second Registry Preference to disable the SMBv1 Client Driver (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\mrxsmb10 Value name*: Start Value type*: REG_DWORD Value data*: 4 Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally or if the control is not manageable via standard GPO GUI interfaces. Download Script: Configure-DisableSMBv1.ps1 # Configure-DisableSMBv1.ps1 # Description: Disables SMBv1 server protocol and mrxsmb10 client driver. Write-Host "Applying hardening requirement: Disable SMBv1..." -ForegroundColor Cyan # 1. Disable SMBv1 Server $srvRegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" if (-not (Test-Path $srvRegPath)) { New-Item -Path $srvRegPath -Force | Out-Null } Set-ItemProperty -Path $srvRegPath -Name "SMB1" -Value 0 -Type DWord Write-Host "SMBv1 Server registry configuration applied." -ForegroundColor Green # Use standard cmdlet if available if (Get-Command -Name Set-SmbServerConfiguration -ErrorAction SilentlyContinue) { Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force Write-Host "SMBv1 Server protocol disabled via cmdlet." -ForegroundColor Green } # 2. Disable SMBv1 Client Driver $clientRegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" if (Test-Path $clientRegPath) { Set-ItemProperty -Path $clientRegPath -Name "Start" -Value 4 -Type DWord Write-Host "SMBv1 Client mrxsmb10 driver disabled." -ForegroundColor Green } else { Write-Host "mrxsmb10 driver registry key not found (may already be removed)." -ForegroundColor Yellow } Write-Host "Hardening applied successfully. A system reboot is required." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-SMBv1Status.ps1 # Get-SMBv1Status.ps1 # Description: Audits the registry configuration of SMBv1 server and client components. Write-Host "--- Auditing SMBv1 Configuration ---" -ForegroundColor Cyan $vulnerable = $false # Check Server configuration if (Get-Command -Name Get-SmbServerConfiguration -ErrorAction SilentlyContinue) { $smbConfig = Get-SmbServerConfiguration if ($smbConfig.EnableSMB1Protocol -eq $true) { Write-Host "[!] VULNERABLE: SMBv1 Server protocol is enabled via configuration." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] SMBv1 Server protocol is disabled." -ForegroundColor Green } } else { $srvReg = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "SMB1" -ErrorAction SilentlyContinue if ($srvReg -and $srvReg.SMB1 -eq 1) { Write-Host "[!] VULNERABLE: SMB1 registry parameter is set to 1 (Enabled)." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] SMB1 registry parameter is disabled or not present." -ForegroundColor Green } } # Check Client configuration $driverReg = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" -Name "Start" -ErrorAction SilentlyContinue if ($driverReg -and $driverReg.Start -ne 4) { Write-Host "[!] VULNERABLE: mrxsmb10 client driver is not disabled (Start value: $($driverReg.Start))." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] mrxsmb10 client driver is disabled." -ForegroundColor Green } if ($vulnerable) { Write-Host "Audit result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit result: SECURE" -ForegroundColor Green } # Configure-DisableSMBv1.ps1 # Description: Disables SMBv1 server protocol and mrxsmb10 client driver. Write-Host "Applying hardening requirement: Disable SMBv1..." -ForegroundColor Cyan # 1. Disable SMBv1 Server $srvRegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" if (-not (Test-Path $srvRegPath)) { New-Item -Path $srvRegPath -Force | Out-Null } Set-ItemProperty -Path $srvRegPath -Name "SMB1" -Value 0 -Type DWord Write-Host "SMBv1 Server registry configuration applied." -ForegroundColor Green # Use standard cmdlet if available if (Get-Command -Name Set-SmbServerConfiguration -ErrorAction SilentlyContinue) { Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force Write-Host "SMBv1 Server protocol disabled via cmdlet." -ForegroundColor Green } # 2. Disable SMBv1 Client Driver $clientRegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" if (Test-Path $clientRegPath) { Set-ItemProperty -Path $clientRegPath -Name "Start" -Value 4 -Type DWord Write-Host "SMBv1 Client mrxsmb10 driver disabled." -ForegroundColor Green } else { Write-Host "mrxsmb10 driver registry key not found (may already be removed)." -ForegroundColor Yellow } Write-Host "Hardening applied successfully. A system reboot is required." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 File Path: 02-domain-controllers/disable-multicast-name-resolution.md Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Service (NBT-NS), and multicast DNS (mDNS) are fallback name resolution protocols. When a Windows host is unable to resolve a name via standard DNS, it broadcasts the query to the local subnet using these protocols. Adversaries on the same subnet can easily sniff these broadcast/multicast queries and respond with their own IP address (using tools such as Responder). When the requesting client attempts to authenticate to the fake host, its NTLM credentials (specifically NTLMv2 hashes) are captured by the attacker. These hashes can then be cracked offline or relayed to other hosts on the network (e.g., Active Directory Certificate Services or SMB servers) to achieve unauthorized administrative access. Disabling these legacy fallback protocols eliminates these name resolution spoofing attack vectors. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Group Policy to disable LLMNR, and Group Policy Preferences to disable NetBIOS and mDNS: Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\Network\DNS Client Configure the following policies: Policy*: Turn off multicast name resolution Setting*: Enabled Policy*: Configure NetBIOS settings Setting*: Enabled: Disable NetBIOS name resolution on public networks (Note: Requires newer Windows 11 / Server 2022 ADMX templates) Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a Registry Preference to disable mDNS (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\Dnscache\Parameters Value name*: EnableMDNS Value type*: REG_DWORD Value data*: 0 For NetBIOS, because adapter GUIDs vary, Group Policy Preferences can be configured with target registry keys, but NetBIOS disabling is often handled dynamically via DHCP scope options (Option 046 or by setting NetBIOS options via DHCP) or locally via scripting on server endpoints. Alternatively, create Registry Preferences for common interfaces or apply Option B locally. Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the settings locally. Download Script: Configure-DisableMulticastNameResolution.ps1 # Configure-DisableMulticastNameResolution.ps1 # Description: Disables LLMNR, NetBIOS over TCP/IP, and mDNS on all interfaces. Write-Host "Applying hardening requirement: Disable Multicast Name Resolution..." -ForegroundColor Cyan # 1. Disable LLMNR $llmnrPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" if (-not (Test-Path $llmnrPath)) { New-Item -Path $llmnrPath -Force | Out-Null } Set-ItemProperty -Path $llmnrPath -Name "EnableMulticast" -Value 0 -Type DWord Write-Host "LLMNR disabled via registry policy." -ForegroundColor Green # 2. Disable mDNS $mdnsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" if (-not (Test-Path $mdnsPath)) { New-Item -Path $mdnsPath -Force | Out-Null } Set-ItemProperty -Path $mdnsPath -Name "EnableMDNS" -Value 0 -Type DWord Write-Host "mDNS disabled via registry." -ForegroundColor Green # 3. Disable NetBIOS over TCP/IP on all Network Adapters $interfacesPath = "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces" if (Test-Path $interfacesPath) { $interfaces = Get-ChildItem -Path $interfacesPath foreach ($interface in $interfaces) { $intName = $interface.PSChildName $intPath = "$($interfacesPath)\$($intName)" Set-ItemProperty -Path $intPath -Name "NetbiosOptions" -Value 2 -Type DWord Write-Host " NetBIOS disabled on interface: $($intName)" -ForegroundColor Gray } Write-Host "NetBIOS over TCP/IP disabled on all active interfaces." -ForegroundColor Green } else { Write-Host "NetBIOS interfaces registry path not found." -ForegroundColor Yellow } Write-Host "Hardening applied successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-MulticastNameResolutionStatus.ps1 # Get-MulticastNameResolutionStatus.ps1 # Description: Audits LLMNR, NetBIOS, and mDNS registry settings. Write-Host "--- Auditing Multicast Name Resolution ---" -ForegroundColor Cyan $vulnerable = $false # 1. Audit LLMNR $llmnrReg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -ErrorAction SilentlyContinue if ($llmnrReg) { if ($llmnrReg.EnableMulticast -eq 1) { Write-Host "[!] VULNERABLE: LLMNR is explicitly enabled." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] LLMNR is disabled." -ForegroundColor Green } } else { Write-Host "[!] VULNERABLE: LLMNR policy key 'EnableMulticast' does not exist (default is enabled)." -ForegroundColor Red $vulnerable = $true } # 2. Audit mDNS $mdnsReg = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" -Name "EnableMDNS" -ErrorAction SilentlyContinue if ($mdnsReg) { if ($mdnsReg.EnableMDNS -ne 0) { Write-Host "[!] VULNERABLE: mDNS is enabled." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] mDNS is disabled." -ForegroundColor Green } } else { # Default is enabled on Windows Server 2022 / Windows 11 Write-Host "[!] VULNERABLE: mDNS key 'EnableMDNS' is missing (default is enabled)." -ForegroundColor Red $vulnerable = $true } # 3. Audit NetBIOS over TCP/IP $interfacesPath = "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces" if (Test-Path $interfacesPath) { $interfaces = Get-ChildItem -Path $interfacesPath $netbiosEnabledCount = 0 foreach ($interface in $interfaces) { $intName = $interface.PSChildName $intPath = "$($interfacesPath)\$($intName)" $optVal = Get-ItemProperty -Path $intPath -Name "NetbiosOptions" -ErrorAction SilentlyContinue if ($optVal) { if ($optVal.NetbiosOptions -ne 2) { Write-Host "[!] VULNERABLE: NetBIOS is enabled/default on interface: $($intName) (NetbiosOptions = $($optVal.NetbiosOptions))" -ForegroundColor Red $netbiosEnabledCount = $netbiosEnabledCount + 1 } } else { Write-Host "[!] VULNERABLE: NetbiosOptions value missing (default enabled) on interface: $($intName)" -ForegroundColor Red $netbiosEnabledCount = $netbiosEnabledCount + 1 } } if ($netbiosEnabledCount -gt 0) { Write-Host "[!] VULNERABLE: NetBIOS over TCP/IP is active on $($netbiosEnabledCount) interface(s)." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] NetBIOS over TCP/IP is disabled on all interfaces." -ForegroundColor Green } } if ($vulnerable) { Write-Host "Audit result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit result: SECURE" -ForegroundColor Green } # Configure-DisableMulticastNameResolution.ps1 # Description: Disables LLMNR, NetBIOS over TCP/IP, and mDNS on all interfaces. Write-Host "Applying hardening requirement: Disable Multicast Name Resolution..." -ForegroundColor Cyan # 1. Disable LLMNR $llmnrPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" if (-not (Test-Path $llmnrPath)) { New-Item -Path $llmnrPath -Force | Out-Null } Set-ItemProperty -Path $llmnrPath -Name "EnableMulticast" -Value 0 -Type DWord Write-Host "LLMNR disabled via registry policy." -ForegroundColor Green # 2. Disable mDNS $mdnsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" if (-not (Test-Path $mdnsPath)) { New-Item -Path $mdnsPath -Force | Out-Null } Set-ItemProperty -Path $mdnsPath -Name "EnableMDNS" -Value 0 -Type DWord Write-Host "mDNS disabled via registry." -ForegroundColor Green # 3. Disable NetBIOS over TCP/IP on all Network Adapters $interfacesPath = "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces" if (Test-Path $interfacesPath) { $interfaces = Get-ChildItem -Path $interfacesPath foreach ($interface in $interfaces) { $intName = $interface.PSChildName $intPath = "$($interfacesPath)\$($intName)" Set-ItemProperty -Path $intPath -Name "NetbiosOptions" -Value 2 -Type DWord Write-Host " NetBIOS disabled on interface: $($intName)" -ForegroundColor Gray } Write-Host "NetBIOS over TCP/IP disabled on all active interfaces." -ForegroundColor Green } else { Write-Host "NetBIOS interfaces registry path not found." -ForegroundColor Yellow } Write-Host "Hardening applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 File Path: 02-domain-controllers/disable-ntlmv1.md NTLMv1 (NT LAN Manager version 1) is a legacy authentication protocol that relies on weak cryptographic primitives (specifically MD4 and DES). Because of these mathematical weaknesses, an attacker who intercepts NTLMv1 network authentication traffic can decrypt the responses offline in a matter of minutes, recovering the user's plaintext password or NT hash. By configuring the system to send only NTLMv2 responses and refuse both LM and NTLMv1 negotiations (corresponding to LAN Manager Compatibility Level 5), the system enforces the use of NTLMv2, which implements HMAC-MD5 and provides significantly stronger protection against offline cryptographic analysis. It also ensures that the directory environment moves closer to Kerberos-exclusive authentication. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following setting: Policy*: Network security: LAN Manager authentication level Setting*: Send NTLMv2 response only. Refuse LM & NTLM Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally. Download Script: Configure-DisableNTLMv1.ps1 # Configure-DisableNTLMv1.ps1 # Description: Restricts NTLM authentication to NTLMv2 and refuses NTLMv1 / LM. Write-Host "Applying hardening requirement: Disable NTLMv1..." -ForegroundColor Cyan $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } Set-ItemProperty -Path $regPath -Name "LmCompatibilityLevel" -Value 5 -Type DWord Write-Host "LM Compatibility Level set to 5 (Send NTLMv2 response only. Refuse LM & NTLM)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-NTLMv1Status.ps1 # Get-NTLMv1Status.ps1 # Description: Audits the LM Compatibility Level setting in the registry. Write-Host "--- Auditing NTLMv1 Restriction ---" -ForegroundColor Cyan $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" $lsaReg = Get-ItemProperty -Path $regPath -Name "LmCompatibilityLevel" -ErrorAction SilentlyContinue if ($lsaReg) { $lmVal = $lsaReg.LmCompatibilityLevel if ($lmVal -eq 5) { Write-Host "[+] NTLMv1 is disabled. LM Compatibility Level is set to $($lmVal) (Secure)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: LM Compatibility Level is set to $($lmVal) (Required: 5)." -ForegroundColor Red } } else { Write-Host "[!] VULNERABLE: LmCompatibilityLevel key is missing. System is using the default value (allows NTLMv1)." -ForegroundColor Red } # Configure-DisableNTLMv1.ps1 # Description: Restricts NTLM authentication to NTLMv2 and refuses NTLMv1 / LM. Write-Host "Applying hardening requirement: Disable NTLMv1..." -ForegroundColor Cyan $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } Set-ItemProperty -Path $regPath -Name "LmCompatibilityLevel" -Value 5 -Type DWord Write-Host "LM Compatibility Level set to 5 (Send NTLMv2 response only. Refuse LM & NTLM)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 02-domain-controllers/enforce-ldap-signing.md Lightweight Directory Access Protocol (LDAP) traffic transmitted over cleartext (TCP port 389) without signing is vulnerable to eavesdropping and man-in-the-middle (MitM) attacks. An adversary in a position to intercept network traffic can inject malicious payload packets, modify directory responses, or perform session hijacking. Enforcing LDAP signing ensures that the LDAP server (Domain Controller) rejects simple binds that are not encrypted or signed. It mandates data integrity verification via cryptographically secure signatures on the network packets. This directly mitigates the threat of LDAP relay and injection attacks, securing the communication path between directory clients and Domain Controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the GPO linked to the Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following setting: Policy*: Domain controller: LDAP server signing requirements Setting*: Require signing Link the GPO to the Domain Controllers OU. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally. Download Script: Configure-LDAPSigning.ps1 # Configure-LDAPSigning.ps1 # Description: Configures the LDAP server signing requirement to Require Signing. Write-Host "Applying hardening requirement: Enforce LDAP Server Signing..." -ForegroundColor Cyan $regPath = "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } Set-ItemProperty -Path $regPath -Name "LDAPServerIntegrity" -Value 2 -Type DWord Write-Host "LDAP Server Integrity set to 2 (Require Signing)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-LDAPSigningStatus.ps1 # Get-LDAPSigningStatus.ps1 # Description: Audits the LDAP server signing configuration in the registry. Write-Host "--- Auditing LDAP Server Signing ---" -ForegroundColor Cyan $regPath = "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters" $ntdsReg = Get-ItemProperty -Path $regPath -Name "LDAPServerIntegrity" -ErrorAction SilentlyContinue if ($ntdsReg) { $integrityVal = $ntdsReg.LDAPServerIntegrity if ($integrityVal -eq 2) { Write-Host "[+] LDAP Server Signing is secure. LDAPServerIntegrity is set to $($integrityVal) (Require Signing)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: LDAPServerIntegrity is set to $($integrityVal) (Required: 2)." -ForegroundColor Red } } else { Write-Host "[!] VULNERABLE: LDAPServerIntegrity registry value is missing. The system uses default negotiation (allows unsigned connections)." -ForegroundColor Red } # Configure-LDAPSigning.ps1 # Description: Configures the LDAP server signing requirement to Require Signing. Write-Host "Applying hardening requirement: Enforce LDAP Server Signing..." -ForegroundColor Cyan $regPath = "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } Set-ItemProperty -Path $regPath -Name "LDAPServerIntegrity" -Value 2 -Type DWord Write-Host "LDAP Server Integrity set to 2 (Require Signing)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 02-domain-controllers/enforce-ldap-channel-binding.md Adversaries use credential relay attacks (such as NTLM relaying) to intercept authentication challenges and replay them to other network services. In a coercion attack (e.g., the PetitPotam technique), an attacker forces a Domain Controller to authenticate to a malicious listener using NTLM. The attacker then relays these credentials to Active Directory Certificate Services (ADCS) or an LDAPS server to issue administrative certificates or modify directory databases. LDAP Channel Binding Tokens (CBT) mitigate these relay attacks. CBT establishes a cryptographic link between the transport-level security channel (TLS/SSL) and the application-level authentication protocol (SASL/NTLM/Kerberos). By requiring CBT verification on the LDAP server, the Domain Controller verifies that the authentication request originated from within the specific TLS channel used to send it. If an attacker attempts to relay credentials from a different session, the channel parameters will not match, and the Domain Controller will reject the authentication request. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the GPO linked to the Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following setting: Policy*: Domain controller: LDAP server channel binding token requirements Setting*: Always Link the GPO to the Domain Controllers OU. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally. Download Script: Configure-LDAPChannelBinding.ps1 # Configure-LDAPChannelBinding.ps1 # Description: Enforces LDAP Channel Binding Token requirements to Always. Write-Host "Applying hardening requirement: Enforce LDAP Channel Binding..." -ForegroundColor Cyan $regPath = "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } Set-ItemProperty -Path $regPath -Name "LdapEnforceChannelBinding" -Value 2 -Type DWord Write-Host "LDAP Channel Binding requirements set to 2 (Always)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-LDAPChannelBindingStatus.ps1 # Get-LDAPChannelBindingStatus.ps1 # Description: Audits the LDAP Channel Binding Token configuration in the registry. Write-Host "--- Auditing LDAP Channel Binding ---" -ForegroundColor Cyan $regPath = "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters" $ntdsReg = Get-ItemProperty -Path $regPath -Name "LdapEnforceChannelBinding" -ErrorAction SilentlyContinue if ($ntdsReg) { $cbtVal = $ntdsReg.LdapEnforceChannelBinding if ($cbtVal -eq 2) { Write-Host "[+] LDAP Channel Binding is secure. LdapEnforceChannelBinding is set to $($cbtVal) (Always)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: LdapEnforceChannelBinding is set to $($cbtVal) (Required: 2)." -ForegroundColor Red } } else { Write-Host "[!] VULNERABLE: LdapEnforceChannelBinding registry value is missing. The system uses default settings (does not enforce CBT)." -ForegroundColor Red } # Configure-LDAPChannelBinding.ps1 # Description: Enforces LDAP Channel Binding Token requirements to Always. Write-Host "Applying hardening requirement: Enforce LDAP Channel Binding..." -ForegroundColor Cyan $regPath = "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } Set-ItemProperty -Path $regPath -Name "LdapEnforceChannelBinding" -Value 2 -Type DWord Write-Host "LDAP Channel Binding requirements set to 2 (Always)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 File Path: 02-domain-controllers/enable-lsa-protection.md The Local Security Authority Subsystem Service (LSASS) process (lsass.exe) is responsible for enforcing security policies, handling user authentication, and storing sensitive credential secrets (such as Kerberos tickets, NT hashes, and cached credentials) in memory. Adversaries who gain local administrative rights frequently target LSASS using memory-dumping tools (e.g., Mimikatz, Procdump) to extract these credentials, leading to domain-wide compromise and lateral movement. Enabling LSA Protection configures LSASS to run as a Protected Process Light (PPL). When running as a PPL, the operating system uses security boundaries to prevent non-protected processes (even those running with local administrator or SYSTEM privileges) from accessing LSASS memory space via debugging APIs (OpenProcess with read/write permissions) or injecting DLLs. This significantly increases the difficulty of offline credential harvesting. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Local Security Authority Set the following policy: Policy*: Configure LSA to run as a protected process Setting*: Enabled Choose one of the following options*: Enabled with LSA Protection Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally. Download Script: Configure-LSAProtection.ps1 # Configure-LSAProtection.ps1 # Description: Enables LSA Protection (RunAsPPL) in the registry. Write-Host "Applying hardening requirement: Enable LSA Protection..." -ForegroundColor Cyan $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } Set-ItemProperty -Path $regPath -Name "RunAsPPL" -Value 1 -Type DWord Write-Host "LSA Protection registry configuration applied. A reboot is required to activate." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-LSAProtectionStatus.ps1 # Get-LSAProtectionStatus.ps1 # Description: Audits LSA Protection (RunAsPPL) in the registry. Write-Host "--- Auditing LSA Protection ---" -ForegroundColor Cyan $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" $lsaReg = Get-ItemProperty -Path $regPath -Name "RunAsPPL" -ErrorAction SilentlyContinue if ($lsaReg) { $pplVal = $lsaReg.RunAsPPL if ($pplVal -eq 1) { Write-Host "[+] LSA Protection is enabled. RunAsPPL is set to $($pplVal) (Secure)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: RunAsPPL is set to $($pplVal) (Required: 1)." -ForegroundColor Red } } else { Write-Host "[!] VULNERABLE: RunAsPPL registry value is missing. LSA is not running as a protected process." -ForegroundColor Red } # Configure-LSAProtection.ps1 # Description: Enables LSA Protection (RunAsPPL) in the registry. Write-Host "Applying hardening requirement: Enable LSA Protection..." -ForegroundColor Cyan $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } Set-ItemProperty -Path $regPath -Name "RunAsPPL" -Value 1 -Type DWord Write-Host "LSA Protection registry configuration applied. A reboot is required to activate." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 File Path: 02-domain-controllers/disable-credential-guard.md Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) should be enabled on Domain Controllers to protect the integrity of the operating system kernel and enforce driver blocklists. However, Windows Defender Credential Guard must not be deployed on Active Directory domain controllers. Credential Guard is designed to isolate LSA secrets to prevent credential-dumping tools from harvesting password hashes from local memory. Domain controllers do not store user credentials in LSASS memory in the same way member servers do; instead, credentials are stored securely in the Active Directory database (ntds.dit). Furthermore, domain controllers run LSASS in a manner that requires active cryptographic operations and delegation capabilities that are incompatible with the restrictions imposed by Credential Guard. Enabling Credential Guard on a domain controller can lead to authentication failures, block Kerberos delegation features, and cause operational instability without providing any security benefits. For official warnings and product specifications, refer to the Microsoft documentation: Microsoft Security Guidance: Windows Defender Credential Guard Warnings Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Device Guard Set the following policy: Policy*: Turn On Virtualization-Based Security Setting*: Enabled Virtualization Based Protection of Code Integrity*: Enabled with UEFI lock Credential Guard Configuration*: Disabled Require UEFI Memory Attributes Table*: Enabled Secure Launch Configuration*: Enabled Select Platform Security Level*: Secure Boot Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the settings locally. Download Script: Configure-DisableCredentialGuard.ps1 # Configure-DisableCredentialGuard.ps1 # Description: Enables Virtualization-Based Security (VBS) and disables Credential Guard in the registry. Write-Host "Applying hardening requirement: Enable VBS Baseline and Disable Credential Guard..." -ForegroundColor Cyan # 1. Enable Virtualization-Based Security and related hypervisor options $vbsPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" if (-not (Test-Path $vbsPath)) { New-Item -Path $vbsPath -Force | Out-Null } $vbsSettings = @{ "EnableVirtualizationBasedSecurity" = 1 "HVCIMATRequired" = 1 "ConfigureSystemGuardLaunch" = 1 "RequirePlatformSecurityFeatures" = 1 "HypervisorEnforcedCodeIntegrity" = 1 } foreach ($Setting in $vbsSettings.Keys) { Set-ItemProperty -Path $vbsPath -Name $Setting -Value $vbsSettings[$Setting] -Type DWord -ErrorAction Stop } Write-Host "Virtualization-Based Security parameters enabled in registry." -ForegroundColor Green # 2. Disable Credential Guard (LsaCfgFlags: 0 = Disabled) $lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $lsaPath)) { New-Item -Path $lsaPath -Force | Out-Null } Set-ItemProperty -Path $lsaPath -Name "LsaCfgFlags" -Value 0 -Type DWord Write-Host "Credential Guard configured to Disabled in registry." -ForegroundColor Green Write-Host "Hardening applied successfully. A system reboot is required." -ForegroundColor Green To audit VBS and Credential Guard status using Registry and WMI: Download Script: Get-CredentialGuardStatus.ps1 # Get-CredentialGuardStatus.ps1 # Description: Audits the configuration and operational status of VBS and ensures Credential Guard is disabled. Write-Host "--- Auditing VBS and Credential Guard Status ---" -ForegroundColor Cyan $vulnerable = $false # 1. Audit Registry Settings $vbsRegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" $lsaReg = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LsaCfgFlags" -ErrorAction SilentlyContinue $ExpectedVbsSettings = @{ "EnableVirtualizationBasedSecurity" = 1 "HVCIMATRequired" = 1 "ConfigureSystemGuardLaunch" = 1 "RequirePlatformSecurityFeatures" = 1 "HypervisorEnforcedCodeIntegrity" = 1 } if (Test-Path $vbsRegPath) { $vbsValues = Get-ItemProperty -Path $vbsRegPath -ErrorAction SilentlyContinue foreach ($Setting in $ExpectedVbsSettings.Keys) { $Val = $vbsValues.$Setting $Expected = $ExpectedVbsSettings[$Setting] if ($Val -eq $Expected) { Write-Host "[+] VBS setting '$Setting' is correctly configured ($Val)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: VBS setting '$Setting' is missing or incorrect ($Val)." -ForegroundColor Red $vulnerable = $true } } } else { Write-Host "[!] VULNERABLE: Virtualization-Based Security registry path does not exist." -ForegroundColor Red $vulnerable = $true } # For DCs, Credential Guard (LsaCfgFlags) must be set to 0 (Disabled) if ($null -ne $lsaReg -and $lsaReg.LsaCfgFlags -ne 0) { Write-Host "[!] VULNERABLE: Credential Guard is enabled in registry (LsaCfgFlags = $($lsaReg.LsaCfgFlags))." -ForegroundColor Red $vulnerable = $true } else { $val = if ($null -eq $lsaReg) { "Not configured (Disabled)" } else { $lsaReg.LsaCfgFlags } Write-Host "[+] Credential Guard registry key 'LsaCfgFlags' is correctly set to disabled ($val)." -ForegroundColor Green } # 2. Audit WMI Operational State (if running) $deviceGuard = Get-CimInstance -Namespace "root\cimv2" -ClassName "Win32_DeviceGuard" -ErrorAction SilentlyContinue if ($deviceGuard) { # SecurityServicesRunning: 1 = Credential Guard $servicesRunning = $deviceGuard.SecurityServicesRunning $cgRunning = $false foreach ($service in $servicesRunning) { if ($service -eq 1) { $cgRunning = $true } } if ($cgRunning) { Write-Host "[!] VULNERABLE: Credential Guard is running operationally on this Domain Controller." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] Credential Guard is not running on this Domain Controller." -ForegroundColor Green } } else { Write-Host "[-] WMI class Win32_DeviceGuard is not available." -ForegroundColor Yellow } if ($vulnerable) { Write-Host "Audit result: VULNERABLE (Credential Guard enabled or VBS misconfigured)" -ForegroundColor Red } else { Write-Host "Audit result: SECURE (Credential Guard disabled and VBS configured)" -ForegroundColor Green } # Configure-DisableCredentialGuard.ps1 # Description: Enables Virtualization-Based Security (VBS) and disables Credential Guard in the registry. Write-Host "Applying hardening requirement: Enable VBS Baseline and Disable Credential Guard..." -ForegroundColor Cyan # 1. Enable Virtualization-Based Security and related hypervisor options $vbsPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" if (-not (Test-Path $vbsPath)) { New-Item -Path $vbsPath -Force | Out-Null } $vbsSettings = @{ "EnableVirtualizationBasedSecurity" = 1 "HVCIMATRequired" = 1 "ConfigureSystemGuardLaunch" = 1 "RequirePlatformSecurityFeatures" = 1 "HypervisorEnforcedCodeIntegrity" = 1 } foreach ($Setting in $vbsSettings.Keys) { Set-ItemProperty -Path $vbsPath -Name $Setting -Value $vbsSettings[$Setting] -Type DWord -ErrorAction Stop } Write-Host "Virtualization-Based Security parameters enabled in registry." -ForegroundColor Green # 2. Disable Credential Guard (LsaCfgFlags: 0 = Disabled) $lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $lsaPath)) { New-Item -Path $lsaPath -Force | Out-Null } Set-ItemProperty -Path $lsaPath -Name "LsaCfgFlags" -Value 0 -Type DWord Write-Host "Credential Guard configured to Disabled in registry." -ForegroundColor Green Write-Host "Hardening applied successfully. A system reboot is required." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 02-domain-controllers/disable-print-spooler.md The Windows Print Spooler service (Spooler) is enabled and running by default on Windows Server installations, including Domain Controllers. However, Domain Controllers do not print and should never act as print servers. The Print Spooler service has a history of high-severity vulnerabilities, including remote code execution exploits (e.g., the PrintNightmare vulnerability family - CVE-2021-1675 / CVE-2021-34527). Additionally, the service is exploited in coercion attacks such as the PetitPotam technique or printer-based authentication coercion. An attacker with low-privilege network access can send an RPC request to the DC's Print Spooler service (specifically utilizing APIs such as RpcRemoteFindFirstPrinterChangeNotificationEx), forcing the Domain Controller to authenticate to a malicious listener over NTLM. The attacker can then relay this authentication to take over the Active Directory domain. Disabling the service completely closes these high-risk vectors. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the GPO linked to the Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Find the Print Spooler service in the list and double-click it. Check Define this policy setting and select Disabled. Link the GPO to the Domain Controllers OU. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally. Download Script: Configure-DisablePrintSpooler.ps1 # Configure-DisablePrintSpooler.ps1 # Description: Stops and disables the Print Spooler service. Write-Host "Applying hardening requirement: Disable Print Spooler..." -ForegroundColor Cyan $serviceName = "Spooler" $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue if ($service) { if ($service.Status -eq "Running") { Write-Host "Stopping service $($serviceName)..." -ForegroundColor Gray Stop-Service -Name $serviceName -Force -ErrorAction SilentlyContinue } # Configure startup type to disabled Set-Service -Name $serviceName -StartupType Disabled Write-Host "Service $($serviceName) has been stopped and disabled." -ForegroundColor Green } else { Write-Host "Service $($serviceName) not found." -ForegroundColor Yellow } To verify the setting has been applied: Download Script: Get-PrintSpoolerStatus.ps1 # Get-PrintSpoolerStatus.ps1 # Description: Audits the operational status and startup type of the Print Spooler service. Write-Host "--- Auditing Print Spooler Service ---" -ForegroundColor Cyan $serviceName = "Spooler" $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue if ($service) { $status = $service.Status $startType = $service.StartType if ($status -eq "Stopped" -and $startType -eq "Disabled") { Write-Host "[+] Print Spooler is secure (Stopped and Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Print Spooler service status is $($status) and StartType is $($startType) (Required: Stopped & Disabled)." -ForegroundColor Red } } else { Write-Host "[+] Print Spooler service is not installed on this system (Secure)." -ForegroundColor Green } # Configure-DisablePrintSpooler.ps1 # Description: Stops and disables the Print Spooler service. Write-Host "Applying hardening requirement: Disable Print Spooler..." -ForegroundColor Cyan $serviceName = "Spooler" $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue if ($service) { if ($service.Status -eq "Running") { Write-Host "Stopping service $($serviceName)..." -ForegroundColor Gray Stop-Service -Name $serviceName -Force -ErrorAction SilentlyContinue } # Configure startup type to disabled Set-Service -Name $serviceName -StartupType Disabled Write-Host "Service $($serviceName) has been stopped and disabled." -ForegroundColor Green } else { Write-Host "Service $($serviceName) not found." -ForegroundColor Yellow } Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 File Path: 02-domain-controllers/enforce-smb-signing.md Server Message Block (SMB) authentication is vulnerable to man-in-the-middle (MitM) and relay attacks. If SMB signing is not enforced, an attacker positioned on the local network can intercept SMB authentication sessions from client systems and relay them to another host (e.g., a Domain Controller or high-value member server). If the relayed user credential possesses administrative rights on the target host, the attacker can execute commands remotely (e.g., via PsExec/WMI) and compromise the system without knowing the password. Enforcing SMB signing ensures that all SMB packets are digitally signed using session keys. This guarantees the authenticity of both the sender and the receiver and ensures packet integrity. If an attacker attempts to relay or modify the packets, the cryptographic signature check fails, and the session is terminated. Enforcing this on both server and client roles is a fundamental defense against lateral movement and domain takeover. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Policy*: Microsoft network server: Digitally sign communications (always) Setting*: Enabled Policy*: Microsoft network client: Digitally sign communications (always) Setting*: Enabled Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the settings locally. Download Script: Configure-SMBSigning.ps1 # Configure-SMBSigning.ps1 # Description: Enforces SMB signing for both SMB server and client. Write-Host "Applying hardening requirement: Enforce SMB Message Signing..." -ForegroundColor Cyan # 1. Enforce Server SMB Signing $srvRegPath = "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" if (-not (Test-Path $srvRegPath)) { New-Item -Path $srvRegPath -Force | Out-Null } Set-ItemProperty -Path $srvRegPath -Name "RequireSecuritySignature" -Value 1 -Type DWord Write-Host "SMB Server signing (always) enabled." -ForegroundColor Green # 2. Enforce Client SMB Signing $cliRegPath = "HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" if (-not (Test-Path $cliRegPath)) { New-Item -Path $cliRegPath -Force | Out-Null } Set-ItemProperty -Path $cliRegPath -Name "RequireSecuritySignature" -Value 1 -Type DWord Write-Host "SMB Client signing (always) enabled." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-SMBSigningStatus.ps1 # Get-SMBSigningStatus.ps1 # Description: Audits the registry settings for SMB server and client signing. Write-Host "--- Auditing SMB Message Signing ---" -ForegroundColor Cyan $vulnerable = $false # 1. Audit Server-side SMB Signing $srvReg = Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" -Name "RequireSecuritySignature" -ErrorAction SilentlyContinue if ($srvReg -and $srvReg.RequireSecuritySignature -eq 1) { Write-Host "[+] SMB Server signing is enforced (RequireSecuritySignature = 1)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: SMB Server signing is NOT enforced." -ForegroundColor Red $vulnerable = $true } # 2. Audit Client-side SMB Signing $cliReg = Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name "RequireSecuritySignature" -ErrorAction SilentlyContinue if ($cliReg -and $cliReg.RequireSecuritySignature -eq 1) { Write-Host "[+] SMB Client signing is enforced (RequireSecuritySignature = 1)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: SMB Client signing is NOT enforced." -ForegroundColor Red $vulnerable = $true } if ($vulnerable) { Write-Host "Audit result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit result: SECURE" -ForegroundColor Green } # Configure-SMBSigning.ps1 # Description: Enforces SMB signing for both SMB server and client. Write-Host "Applying hardening requirement: Enforce SMB Message Signing..." -ForegroundColor Cyan # 1. Enforce Server SMB Signing $srvRegPath = "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" if (-not (Test-Path $srvRegPath)) { New-Item -Path $srvRegPath -Force | Out-Null } Set-ItemProperty -Path $srvRegPath -Name "RequireSecuritySignature" -Value 1 -Type DWord Write-Host "SMB Server signing (always) enabled." -ForegroundColor Green # 2. Enforce Client SMB Signing $cliRegPath = "HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" if (-not (Test-Path $cliRegPath)) { New-Item -Path $cliRegPath -Force | Out-Null } Set-ItemProperty -Path $cliRegPath -Name "RequireSecuritySignature" -Value 1 -Type DWord Write-Host "SMB Client signing (always) enabled." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025, Windows 10, Windows 11 File Path: 02-domain-controllers/restrict-kerberos-encryption.md Active Directory uses the Kerberos version 5 protocol as its primary authentication mechanism. By default, Active Directory maintains backward compatibility with legacy cryptographic suites, including Data Encryption Standard (DES) and Rivest Cipher 4 (RC4-HMAC). Allowing these legacy ciphers introduces severe architectural vulnerabilities: Cryptographic Weaknesses of RC4-HMAC (RFC 4757): Key Derivation Flaw*: Under the RC4-HMAC Kerberos specification, the long-term secret key used to encrypt tickets is identical to the user's NTLM password hash (MD4(UTF-16LE(password))). No salt, no iteration count, and no cryptographic key derivation function (KDF) stretching are applied. AES vs. RC4 Cryptography*: In contrast, Kerberos AES encryption (RFC 3961 and RFC 3962) utilizes PBKDF2 with HMAC-SHA1, an account-specific salt (DOMAINusername), and a default work factor of 4,096 iterations. Cracking an AES Kerberos key requires exponentially more computational effort per guess than RC4. Kerberoasting & Cipher Downgrade Attacks (MITRE ATT&CK T1558.003): * Any authenticated domain user can request a Ticket Granting Service (TGS) ticket for any account with a registered Service Principal Name (SPN). * In a cipher downgrade attack, an attacker crafts a Kerberos TGS-REQ specifying only rc4-hmac (encryption type 23) in the requested encryption type list. If RC4 is permitted on the Key Distribution Center (KDC), the KDC issues an RC4-encrypted service ticket—even if the target service account supports AES. * Because RC4 tickets use the raw NTLM hash, attackers can crack the extracted ticket offline using modern GPU rigs (Hashcat mode 13100) at rates exceeding billions of guesses per second. By restricting KDC encryption types to AES-128 and AES-256, the KDC strictly rejects requests for weak ciphers, neutralizing Kerberoasting downgrade attacks. AS-REP Roasting Protection (MITRE ATT&CK T1558.004): * For accounts with Kerberos pre-authentication disabled (DONT_REQ_PREAUTH flag enabled), any domain user can request an AS-REP authentication ticket from the KDC without supplying credentials. * If RC4 is enabled, the returned AS-REP ticket is encrypted using the target account's RC4/NTLM hash, allowing high-speed offline dictionary attacks (Hashcat mode 18200). Enforcing AES ensures the KDC encrypts the AS-REP using PBKDF2-stretched AES keys. Mitigating Forged Golden & Silver Tickets (MITRE ATT&CK T1558.001 / T1558.002): * When an attacker extracts NTLM password hashes (e.g., via DCSync against krbtgt or a service account), they can forge arbitrary Kerberos Ticket Granting Tickets (TGTs - Golden Tickets) or Service Tickets (Silver Tickets) using RC4. * When RC4 is disabled domain-wide, domain members and Domain Controllers reject RC4-encrypted tickets outright. Attackers are forced to obtain the actual AES-128 or AES-256 keys, which are not exposed through simple NTLM hash dumping or relay mechanisms. PAC Signature Integrity & CVE-2022-37967 Enforcement: * The Privilege Attribute Certificate (PAC) contains the user's authorization data, security identifiers (SIDs), and group memberships. * Security updates for CVE-2022-37967 / KB5020805 require strong HMAC-SHA1 AES algorithms for PAC signatures (KERB_CHECKSUM_HMAC_SHA1_96_AES128 / KERB_CHECKSUM_HMAC_SHA1_96_AES256). Disabling RC4 guarantees consistent cryptographic security across ticket encryption, session key derivation, and PAC checksum verification. Overpass-the-Hash / Pass-the-Key Defense: * In an Overpass-the-Hash attack, an attacker uses an NTLM hash as the Kerberos RC4 key to request a valid TGT. Enforcing AES-only requires authentication to use AES keys, preventing attackers from converting raw NTLM hashes into Kerberos tickets. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following setting: Policy*: Network security: Configure encryption types allowed for Kerberos Setting*: Check only the following boxes: * AES128_HMAC_SHA1 * AES256_HMAC_SHA1 * Future encryption types Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally. Download Script: Configure-KerberosEncryptionTypes.ps1 # Configure-KerberosEncryptionTypes.ps1 # Description: Restricts Kerberos encryption types to AES128, AES256, and Future types. Write-Host "Applying hardening requirement: Restrict Kerberos Encryption Types..." -ForegroundColor Cyan $regPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } # 2147483640 (0x7FFFFFF8) enables AES128, AES256, and Future encryption types Set-ItemProperty -Path $regPath -Name "SupportedEncryptionTypes" -Value 2147483640 -Type DWord Write-Host "Kerberos encryption types restricted to AES and future types." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-KerberosEncryptionStatus.ps1 # Get-KerberosEncryptionStatus.ps1 # Description: Audits the allowed Kerberos encryption types in the registry. Write-Host "--- Auditing Kerberos Encryption Types ---" -ForegroundColor Cyan $regPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" $regVal = Get-ItemProperty -Path $regPath -Name "SupportedEncryptionTypes" -ErrorAction SilentlyContinue if ($regVal) { $encTypes = $regVal.SupportedEncryptionTypes # Check if weak algorithms are enabled (DES = 0x1, 0x2; RC4 = 0x4) $hasDES = ($encTypes -band 0x1) -or ($encTypes -band 0x2) $hasRC4 = ($encTypes -band 0x4) $hasAES128 = ($encTypes -band 0x8) $hasAES256 = ($encTypes -band 0x10) if ($hasDES -or $hasRC4) { Write-Host "[!] VULNERABLE: Weak Kerberos encryption algorithms are allowed (DES: $($hasDES), RC4: $($hasRC4)). SupportedEncryptionTypes raw value: $($encTypes)." -ForegroundColor Red } else { if ($hasAES128 -and $hasAES256) { Write-Host "[+] Kerberos encryption is secure. Restricting to AES128/AES256 (SupportedEncryptionTypes: $($encTypes))." -ForegroundColor Green } else { Write-Host "[-] Kerberos encryption configuration is custom. AES128: $($hasAES128), AES256: $($hasAES256) (SupportedEncryptionTypes: $($encTypes))." -ForegroundColor Yellow } } } else { Write-Host "[!] VULNERABLE: SupportedEncryptionTypes registry value is missing. Default behavior allows insecure RC4." -ForegroundColor Red } # Configure-KerberosEncryptionTypes.ps1 # Description: Restricts Kerberos encryption types to AES128, AES256, and Future types. Write-Host "Applying hardening requirement: Restrict Kerberos Encryption Types..." -ForegroundColor Cyan $regPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } # 2147483640 (0x7FFFFFF8) enables AES128, AES256, and Future encryption types Set-ItemProperty -Path $regPath -Name "SupportedEncryptionTypes" -Value 2147483640 -Type DWord Write-Host "Kerberos encryption types restricted to AES and future types." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10 (1607+), Windows 11 File Path: 02-domain-controllers/restrict-ntds-sam-api.md By default, the Security Account Manager (SAM) and NT Directory Services (NTDS) allow remote RPC connections from non-privileged accounts. Using these connections, an attacker who has established a foothold in the network (even with a basic, non-administrative domain user account) can query the Domain Controller or member servers to enumerate local users, group memberships, and security policies. Tools like BloodHound/SharpHound, or simple commands like net user /domain, rely on these remote SAM RPC interfaces to extract information for network profiling and lateral movement mapping. Restricting remote client access to the SAM API (utilizing RestrictRemoteSAM) ensures that only members of the built-in Administrators group can make remote RPC queries. This significantly reduces the recon capabilities of an internal attacker. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following setting: Policy*: Network access: Restrict clients allowed to make remote calls to SAM Setting : Click Edit Security* and configure the permissions. By default, only local Administrators are granted access. Ensure the SDDL translates to O:BAG:BAD:(A;;RC;;;BA). Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally. Download Script: Configure-RestrictRemoteSAM.ps1 # Configure-RestrictRemoteSAM.ps1 # Description: Restricts remote RPC access to the SAM database to local Administrators. Write-Host "Applying hardening requirement: Restrict Remote SAM API Access..." -ForegroundColor Cyan $regPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } $sddl = "O:BAG:BAD:(A;;RC;;;BA)" Set-ItemProperty -Path $regPath -Name "RestrictRemoteSAM" -Value $sddl -Type String Write-Host "SAM remote API access restricted to Administrators (SDDL applied)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-RestrictRemoteSAMStatus.ps1 # Get-RestrictRemoteSAMStatus.ps1 # Description: Audits the RestrictRemoteSAM registry value. Write-Host "--- Auditing RestrictRemoteSAM ---" -ForegroundColor Cyan $regPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $lsaReg = Get-ItemProperty -Path $regPath -Name "RestrictRemoteSAM" -ErrorAction SilentlyContinue if ($lsaReg) { $sddlVal = $lsaReg.RestrictRemoteSAM if ($sddlVal -eq "O:BAG:BAD:(A;;RC;;;BA)") { Write-Host "[+] Remote SAM access is secure. RestrictRemoteSAM matches expected SDDL: $($sddlVal)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: RestrictRemoteSAM is configured but has a different SDDL: $($sddlVal) (Expected: O:BAG:BAD:(A;;RC;;;BA))." -ForegroundColor Red } } else { Write-Host "[!] VULNERABLE: RestrictRemoteSAM registry key is missing. System allows remote SAM enumeration by standard users." -ForegroundColor Red } # Configure-RestrictRemoteSAM.ps1 # Description: Restricts remote RPC access to the SAM database to local Administrators. Write-Host "Applying hardening requirement: Restrict Remote SAM API Access..." -ForegroundColor Cyan $regPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null } $sddl = "O:BAG:BAD:(A;;RC;;;BA)" Set-ItemProperty -Path $regPath -Name "RestrictRemoteSAM" -Value $sddl -Type String Write-Host "SAM remote API access restricted to Administrators (SDDL applied)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 File Path: 02-domain-controllers/enable-kerberos-armoring.md Active Directory environments relying on standard Kerberos authentication are susceptible to offline brute-force, dictionary attacks, and credential harvesting. During the initial Kerberos pre-authentication phase, the client requests a Ticket Granting Ticket (TGT) in clear text by sending an AS-REQ containing encrypted timestamps. Attackers monitoring network traffic can intercept these exchanges, or perform AS-REP roasting against accounts that do not require pre-authentication, conducting offline password cracking to compromise credentials. Kerberos Armoring, also known as Flexible Authentication Secure Tunneling (FAST - RFC 6113), mitigates this vulnerability by establishing an encrypted channel (a secure tunnel) between the Kerberos client and the Key Distribution Center (KDC) on the Domain Controller. This tunnel is encrypted using the computer account's credential (or the local system's credential), protecting the pre-authentication messages (AS-REQ and AS-REP) from eavesdropping, offline dictionary attacks, and tampering. Additionally, Kerberos Armoring is a strict prerequisite for Dynamic Access Control (DAC), Compound Authentication (which validates both the user's and the device's identities before granting access), and Authentication Silos. On Windows Server 2016 and newer domain controllers, configuring KDC support for the PKInit Freshness Extension (RFC 8070) further strengthens public key authentication by ensuring that certificates cannot be reused in pre-authentication replay attacks. Domain Controllers function both as KDC servers handling authentication requests and as Kerberos clients during domain controller replication, directory operations, and inter-forest authentication. Consequently, both KDC-side and client-side Kerberos armoring policies must be enabled on all Domain Controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Domain Controller KDC Policy Open the Group Policy Management Console (gpmc.msc) on a domain management workstation. Edit the Domain Controllers hardening GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\System\KDC Configure the following settings: Policy*: KDC support for claims, compound authentication and Kerberos armoring Setting*: Enabled Options*: Select Supported from the dropdown list (upgrade to Fail unarmored authentication requests only after full client rollout and validation). Policy*: KDC support for PKInit Freshness Extension Setting*: Enabled Options*: Select Supported from the dropdown list. Link the GPO to the Domain Controllers Organizational Unit. Configure Domain Controller Client Policy In the same Domain Controllers hardening GPO, navigate to: Computer Configuration\Policies\Administrative Templates\System\Kerberos Configure the following settings: Policy : `Kerberos client support for claims, compound authentication and Kerberos armoring` -> Enabled Policy : `Support device authentication using certificate` -> Enabled* (Select Automatic in options) Ensure the GPO is enforced across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally (for testing or standalone systems) or if the control is not manageable via standard GPO GUI interfaces. Download Script: Configure-KerberosArmoring.ps1 # Configure-KerberosArmoring.ps1 # Description: Configures Kerberos Armoring (FAST) and PKInit Freshness Extension registry settings on Domain Controllers and Kerberos clients. Write-Host "Applying hardening requirement: Enable Kerberos Armoring (FAST) on Domain Controllers..." -ForegroundColor Cyan $ClientRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" $KdcRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters" # Configure client-side settings (applicable to all systems, including DCs for DC-to-DC authentication) if (-not (Test-Path $ClientRegPath)) { New-Item -Path $ClientRegPath -Force | Out-Null } Set-ItemProperty -Path $ClientRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitEnabled" -Value 1 -Type DWord Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitBehavior" -Value 0 -Type DWord Write-Host "Client-side Kerberos Armoring and Device Certificate Authentication enabled successfully." -ForegroundColor Green # Determine if the host is a Domain Controller $DomainRole = (Get-CimInstance -ClassName Win32_ComputerSystem).DomainRole $IsDC = ($DomainRole -eq 4) -or ($DomainRole -eq 5) if ($IsDC) { Write-Host "Domain Controller detected. Enabling KDC support for Kerberos Armoring and PKInit Freshness..." -ForegroundColor Cyan if (-not (Test-Path $KdcRegPath)) { New-Item -Path $KdcRegPath -Force | Out-Null } # Value 1 = Supported (Safe deployment baseline) # Value 3 = Fail unarmored authentication requests (Strict/Enforced state) Set-ItemProperty -Path $KdcRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord Set-ItemProperty -Path $KdcRegPath -Name "CbacAndArmorLevel" -Value 1 -Type DWord # Value 1 = Supported for PKInit Freshness Extension (RFC 8070) Set-ItemProperty -Path $KdcRegPath -Name "PKINITFreshness" -Value 1 -Type DWord Write-Host "KDC support for claims, armoring (Supported: 1), and PKInit Freshness enabled successfully." -ForegroundColor Green } To verify the setting has been applied: Download Script: Get-KerberosArmoringStatus.ps1 # Get-KerberosArmoringStatus.ps1 # Description: Audits the Kerberos Armoring (FAST) and PKInit Freshness configuration on Domain Controllers and clients. Write-Host "--- Auditing Kerberos Armoring (FAST) Configuration ---" -ForegroundColor Cyan $DomainRole = (Get-CimInstance -ClassName Win32_ComputerSystem).DomainRole $IsDC = ($DomainRole -eq 4) -or ($DomainRole -eq 5) $ClientRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" $KdcRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters" $Vulnerable = $false # 1. Audit Client-side support $ClientValue = Get-ItemProperty -Path $ClientRegPath -Name "EnableCbacAndArmor" -ErrorAction SilentlyContinue $DevicePKInit = Get-ItemProperty -Path $ClientRegPath -Name "DevicePKInitEnabled" -ErrorAction SilentlyContinue $DeviceBehavior = Get-ItemProperty -Path $ClientRegPath -Name "DevicePKInitBehavior" -ErrorAction SilentlyContinue if ($null -ne $ClientValue -and $ClientValue.EnableCbacAndArmor -eq 1) { Write-Host "[+] Client-side Kerberos Armoring is ENABLED (EnableCbacAndArmor = 1)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Client-side Kerberos Armoring is DISABLED or missing." -ForegroundColor Red $Vulnerable = $true } if ($null -ne $DevicePKInit -and $DevicePKInit.DevicePKInitEnabled -eq 1 -and $null -ne $DeviceBehavior -and $DeviceBehavior.DevicePKInitBehavior -eq 0) { Write-Host "[+] Certificate device authentication is ENABLED: Automatic." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Certificate device authentication is not compliant or not configured." -ForegroundColor Red $Vulnerable = $true } # 2. Audit KDC support if Domain Controller if ($IsDC) { Write-Host "Domain Controller detected. Auditing KDC support..." -ForegroundColor Cyan $KdcCbac = Get-ItemProperty -Path $KdcRegPath -Name "EnableCbacAndArmor" -ErrorAction SilentlyContinue $KdcLevel = Get-ItemProperty -Path $KdcRegPath -Name "CbacAndArmorLevel" -ErrorAction SilentlyContinue $KdcFresh = Get-ItemProperty -Path $KdcRegPath -Name "PKINITFreshness" -ErrorAction SilentlyContinue if ($null -ne $KdcCbac -and $KdcCbac.EnableCbacAndArmor -eq 1 -and $null -ne $KdcLevel) { $LevelVal = $KdcLevel.CbacAndArmorLevel if ($LevelVal -eq 1) { Write-Host "[+] KDC support for claims and armoring is ENABLED (Supported: 1)." -ForegroundColor Green } elseif ($LevelVal -eq 2) { Write-Host "[+] KDC support for claims and armoring is ENABLED (Always provide claims: 2)." -ForegroundColor Green } elseif ($LevelVal -eq 3) { Write-Host "[+] KDC support for claims and armoring is ENABLED and ENFORCED (Fail unarmored: 3)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: KDC CbacAndArmorLevel configured with invalid value: $($LevelVal)." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: KDC support for claims and armoring is MISSING or misconfigured." -ForegroundColor Red $Vulnerable = $true } if ($null -ne $KdcFresh -and ($KdcFresh.PKINITFreshness -eq 1 -or $KdcFresh.PKINITFreshness -eq 2)) { Write-Host "[+] KDC PKInit Freshness Extension is ENABLED (Value: $($KdcFresh.PKINITFreshness))." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: KDC PKInit Freshness Extension is MISSING or disabled." -ForegroundColor Red $Vulnerable = $true } } if ($Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-KerberosArmoring.ps1 # Description: Configures Kerberos Armoring (FAST) and PKInit Freshness Extension registry settings on Domain Controllers and Kerberos clients. Write-Host "Applying hardening requirement: Enable Kerberos Armoring (FAST) on Domain Controllers..." -ForegroundColor Cyan $ClientRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" $KdcRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters" # Configure client-side settings (applicable to all systems, including DCs for DC-to-DC authentication) if (-not (Test-Path $ClientRegPath)) { New-Item -Path $ClientRegPath -Force | Out-Null } Set-ItemProperty -Path $ClientRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitEnabled" -Value 1 -Type DWord Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitBehavior" -Value 0 -Type DWord Write-Host "Client-side Kerberos Armoring and Device Certificate Authentication enabled successfully." -ForegroundColor Green # Determine if the host is a Domain Controller $DomainRole = (Get-CimInstance -ClassName Win32_ComputerSystem).DomainRole $IsDC = ($DomainRole -eq 4) -or ($DomainRole -eq 5) if ($IsDC) { Write-Host "Domain Controller detected. Enabling KDC support for Kerberos Armoring and PKInit Freshness..." -ForegroundColor Cyan if (-not (Test-Path $KdcRegPath)) { New-Item -Path $KdcRegPath -Force | Out-Null } # Value 1 = Supported (Safe deployment baseline) # Value 3 = Fail unarmored authentication requests (Strict/Enforced state) Set-ItemProperty -Path $KdcRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord Set-ItemProperty -Path $KdcRegPath -Name "CbacAndArmorLevel" -Value 1 -Type DWord # Value 1 = Supported for PKInit Freshness Extension (RFC 8070) Set-ItemProperty -Path $KdcRegPath -Name "PKINITFreshness" -Value 1 -Type DWord Write-Host "KDC support for claims, armoring (Supported: 1), and PKInit Freshness enabled successfully." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 File Path: 02-domain-controllers/restrict-ntlm.md The NT LAN Manager (NTLM) authentication protocol is legacy, cryptographically weak, and lacks support for modern security primitives such as mutual authentication. Adversaries exploit NTLM through credential relaying attacks (e.g., replaying captured authentication responses to other network services) and coercion techniques (e.g., PetitPotam or printer spooler RPC abuse). By auditing and subsequently restricting NTLM authentication incoming to, outgoing from, and within the Active Directory domain, organizations significantly mitigate the risks of credential relaying, offline password cracking, and unauthorized lateral movement. Restricting NTLM pushes client machines and application servers to utilize Kerberos, which provides robust mutual authentication and support for advanced cryptographic algorithms. Microsoft has also announced the eventual deprecation of NTLM, making active restriction an essential step in future-proofing active directory directory services. Option A: Group Policy Object (GPO) Configuration (Preferred) Phase 1: Enable Auditing (Apply to Domain Controllers, Servers, and Clients) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following audit policies: Policy*: Network security: Restrict NTLM: Audit NTLM authentication in this domain Setting*: Enable all (Apply to Domain Controllers) Policy*: Network security: Restrict NTLM: Audit Incoming NTLM Traffic Setting*: Enable auditing for all accounts (Apply to DCs, member servers, and clients) Policy*: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers Setting*: Audit all (Apply to DCs, member servers, and clients) Phase 2: Enforce Restrictions (Apply after logs have been verified and exception lists populated) Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following restriction policies: Policy*: Network security: Restrict NTLM: NTLM authentication in this domain Setting*: Deny for domain accounts (Apply to Domain Controllers) Policy*: Network security: Restrict NTLM: Incoming NTLM Traffic Setting*: Deny all accounts (Apply to member servers and clients) Policy*: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers Setting*: Deny all (Apply to member servers and clients) Policy*: Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication Setting*: Configure the server hostnames or FQDNs that require exemption. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally (for testing or standalone systems) or if the control is not manageable via standard GPO GUI interfaces. Download Script: Configure-RestrictNTLM.ps1 # Configure-RestrictNTLM.ps1 # Description: Configures local registry values to enforce NTLM restrictions and auditing. Write-Host "Applying hardening requirement: Restrict NTLM..." -ForegroundColor Cyan $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" $NetlogonPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" # Ensure LSA MSV1_0 path exists and apply settings if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "AuditReceivingNTLMTraffic" -Value 2 -Type DWord Set-ItemProperty -Path $LsaPath -Name "RestrictReceivingNTLMTraffic" -Value 2 -Type DWord Set-ItemProperty -Path $LsaPath -Name "RestrictSendingNTLMTraffic" -Value 2 -Type DWord # Ensure Netlogon Parameters path exists and apply settings if (-not (Test-Path $NetlogonPath)) { New-Item -Path $NetlogonPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonPath -Name "AuditNTLMInDomain" -Value 7 -Type DWord Set-ItemProperty -Path $NetlogonPath -Name "RestrictNTLMInDomain" -Value 3 -Type DWord Write-Host "NTLM restriction registry configurations applied successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-RestrictNTLMStatus.ps1 # Get-RestrictNTLMStatus.ps1 # Description: Audits the registry configuration for NTLM auditing and restrictions. Write-Host "--- Auditing NTLM Restrictions ---" -ForegroundColor Cyan $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" $NetlogonPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" if (Test-Path $LsaPath) { $AuditRecv = Get-ItemProperty -Path $LsaPath -Name "AuditReceivingNTLMTraffic" -ErrorAction SilentlyContinue if ($AuditRecv) { Write-Host "[+] AuditReceivingNTLMTraffic is set to $($AuditRecv.AuditReceivingNTLMTraffic) (Secure)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: AuditReceivingNTLMTraffic is not configured." -ForegroundColor Red } $RestrictRecv = Get-ItemProperty -Path $LsaPath -Name "RestrictReceivingNTLMTraffic" -ErrorAction SilentlyContinue if ($RestrictRecv) { Write-Host "[+] RestrictReceivingNTLMTraffic is set to $($RestrictRecv.RestrictReceivingNTLMTraffic) (Secure)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: RestrictReceivingNTLMTraffic is not configured." -ForegroundColor Red } $RestrictSend = Get-ItemProperty -Path $LsaPath -Name "RestrictSendingNTLMTraffic" -ErrorAction SilentlyContinue if ($RestrictSend) { Write-Host "[+] RestrictSendingNTLMTraffic is set to $($RestrictSend.RestrictSendingNTLMTraffic) (Secure)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: RestrictSendingNTLMTraffic is not configured." -ForegroundColor Red } } else { Write-Host "[!] LSA MSV1_0 path does not exist." -ForegroundColor Red } if (Test-Path $NetlogonPath) { $AuditDomain = Get-ItemProperty -Path $NetlogonPath -Name "AuditNTLMInDomain" -ErrorAction SilentlyContinue if ($AuditDomain) { Write-Host "[+] AuditNTLMInDomain is set to $($AuditDomain.AuditNTLMInDomain) (Secure)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: AuditNTLMInDomain is not configured." -ForegroundColor Red } $RestrictDomain = Get-ItemProperty -Path $NetlogonPath -Name "RestrictNTLMInDomain" -ErrorAction SilentlyContinue if ($RestrictDomain) { Write-Host "[+] RestrictNTLMInDomain is set to $($RestrictDomain.RestrictNTLMInDomain) (Secure)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: RestrictNTLMInDomain is not configured." -ForegroundColor Red } } else { Write-Host "[!] Netlogon Parameters path does not exist." -ForegroundColor Red } # Configure-RestrictNTLM.ps1 # Description: Configures local registry values to enforce NTLM restrictions and auditing. Write-Host "Applying hardening requirement: Restrict NTLM..." -ForegroundColor Cyan $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" $NetlogonPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" # Ensure LSA MSV1_0 path exists and apply settings if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "AuditReceivingNTLMTraffic" -Value 2 -Type DWord Set-ItemProperty -Path $LsaPath -Name "RestrictReceivingNTLMTraffic" -Value 2 -Type DWord Set-ItemProperty -Path $LsaPath -Name "RestrictSendingNTLMTraffic" -Value 2 -Type DWord # Ensure Netlogon Parameters path exists and apply settings if (-not (Test-Path $NetlogonPath)) { New-Item -Path $NetlogonPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonPath -Name "AuditNTLMInDomain" -Value 7 -Type DWord Set-ItemProperty -Path $NetlogonPath -Name "RestrictNTLMInDomain" -Value 3 -Type DWord Write-Host "NTLM restriction registry configurations applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 02-domain-controllers/migrate-sysvol-replication-dfsr.md Active Directory domain environments rely on replication to synchronize GPO templates and scripts stored in the SYSVOL share across all Domain Controllers. Historically, this replication was managed by the File Replication Service (FRS). However, FRS is obsolete, does not support modern transport-layer security features, and is prone to replication database corruption. Migrating to Distributed File System Replication (DFSR): 1. Ensures Replication Integrity: DFSR uses remote differential compression algorithms and hash validation to verify that files are replicated securely and without corruption. 2. Minimizes Attack Surface: Transitioning to DFSR allows security administrators to completely disable and deprecate the legacy, insecure FRS service and its associated RPC endpoints. 3. Improves Diagnostics: DFSR provides comprehensive logging, system health auditing, and diagnostic reports, allowing quick identification of synchronization failures. Option A: Manual Step-by-Step Migration Command Line The migration process consists of transitioning the domain through four replication states (from State 0 to State 3) using the dfsrmig command line tool on a writable Domain Controller (typically the PDC Emulator). Verify Current State: Open an elevated command prompt on the DC and run: dfsrmig /getglobalstate Expected starting output: Current DFSR global state: 'Start' (State 0). Transition to Prepared State (State 1): This state creates a clone of the SYSVOL folder named SYSVOL_DFSR and begins DFSR replication in the background while keeping the original SYSVOL folder active via FRS. dfsrmig /setglobalstate 1 Verify State 1 Reachability: Query all Domain Controllers to ensure they have successfully transitioned to the Prepared state: dfsrmig /getmigrationstate Do not proceed to the next step until the output confirms: All Domain Controllers have migrated successfully to the Global state ('Prepared'). Transition to Redirected State (State 2): This state redirects the active SYSVOL network share mapping to point to the new SYSVOL_DFSR folder replicated by DFSR. FRS continues replication in the background for backward compatibility/rollback capability. dfsrmig /setglobalstate 2 Verify State 2 Reachability: Query the status to confirm all DCs have successfully redirected: dfsrmig /getmigrationstate Do not proceed until the output confirms: All Domain Controllers have migrated successfully to the Global state ('Redirected'). Transition to Eliminated State (State 3): This final stage commits the migration. It deletes the original SYSVOL directory, stops and disables the FRS service, and deletes the FRS replication configuration from Active Directory. dfsrmig /setglobalstate 3 Verify State 3 Committal: Confirm the migration is complete: dfsrmig /getmigrationstate Expected Output: All Domain Controllers have migrated successfully to the Global state ('Eliminated'). Option B: PowerShell Migration Status Auditing Use this PowerShell script to monitor the progress of the DFSR migration across all Domain Controllers in the forest. Download Script: Get-SYSVOLDfsrMigrationStatus.ps1 # Get-SYSVOLDfsrMigrationStatus.ps1 # Description: Checks the current SYSVOL replication migration state. Import-Module ActiveDirectory Write-Host "--- Auditing SYSVOL DFSR Migration Status ---" -ForegroundColor Cyan # Check if the FRS service is still running on this DC $FrsService = Get-Service -Name "NtFrs" -ErrorAction SilentlyContinue if ($null -ne $FrsService) { Write-Host "[*] FRS Service State: $($FrsService.Status)" -ForegroundColor White } else { Write-Host "[+] FRS Service is not installed (expected in modern server configurations)." -ForegroundColor Green } # Run dfsrmig validation checks $DfsMigOutput = & dfsrmig.exe /getglobalstate 2>&1 if ($DfsMigOutput -like "*Eliminated*") { Write-Host "[+] SYSVOL migration to DFSR is complete and finalized (State 3: Eliminated)." -ForegroundColor Green } else { Write-Host "[-] WARNING: SYSVOL replication is not fully migrated to DFSR." -ForegroundColor Red Write-Host " Current Status: $DfsMigOutput" -ForegroundColor Yellow } To verify active DFSR health on the server: Download Script: Get-DfsrHealthStatus.ps1 # Get-DfsrHealthStatus.ps1 # Description: Checks the event logs for DFSR replication errors. Write-Host "Checking DFSR replication event logs..." -ForegroundColor Cyan $DfsrEvents = Get-WinEvent -LogName "DFS Replication" -MaxEvents 10 -ErrorAction SilentlyContinue if ($DfsrEvents) { foreach ($DfsrEvent in $DfsrEvents) { $EventColor = if ($DfsrEvent.LevelDisplayName -eq "Error") { "Red" } else { "White" } Write-Host "[$($DfsrEvent.TimeCreated)] [$($DfsrEvent.LevelDisplayName)] ID: $($DfsrEvent.Id) - $($DfsrEvent.Message)" -ForegroundColor $EventColor } } else { Write-Host "[+] No recent DFSR events or errors detected." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 02-domain-controllers/harden-adminsdholder-permissions.md In Active Directory, the adminSDHolder object acts as a security template for administrative accounts and groups (known as protected objects). Every hour, a background system thread (the AdminSDHolder task, also referred to as the ProtectAdminGroups task) running on the Domain Controller holding the PDC Emulator role compares the Access Control Lists (ACLs) of all protected objects against the ACL of the adminSDHolder object. If they differ, the ACL on the protected object is overwritten by the ACL on adminSDHolder, and security inheritance is disabled. A common misconception is that the Security Descriptor Propagator (SDProp) thread enforces this protection. In reality, SDProp is a separate background thread on all Domain Controllers whose sole job is to propagate inheritable Access Control Entries (ACEs) when an object is moved or a parent ACL is modified. The actual enforcement of the adminSDHolder template is performed exclusively by the AdminSDHolder background task. If an attacker gains temporary write permissions on the adminSDHolder object, they can inject a backdoor Access Control Entry (ACE) granting their account write permissions. Within an hour, the AdminSDHolder background task will apply this backdoor ACE to all protected groups (e.g., Domain Admins, Schema Admins, Enterprise Admins). Even if the administrator cleans up permissions on a Domain Admin account directly, the AdminSDHolder task will restore the backdoor ACE on its next run. Option A: Active Directory Users and Computers (ADUC) Console Configuration Open Active Directory Users and Computers (dsa.msc) on a Domain Controller. Select View and click Advanced Features (if not already enabled). Navigate to: System\adminSDHolder Right-click adminSDHolder and select Properties. Select the Security tab. Click Advanced. Enforce inheritance blocking: Verify that the button at the bottom reads Enable Inheritance . If it reads Disable Inheritance*, click it to block inheritance. * When prompted, choose to convert inherited permissions into explicit permissions to avoid losing default settings, then prune any non-compliant explicit permissions. Review the permission entries: * Ensure only highly privileged built-in groups (e.g., Domain Admins, Enterprise Admins, SYSTEM) have Write, Modify, or Full Control permissions. * Remove any entries granting permissions to non-Tier 0 accounts, such as delegated helpdesk groups, Account Operators, Print Operators, or custom service accounts. Click OK to save changes. Option B: PowerShell Configuration (Remediation / Non-GPO) Run the following script to audit and remediate unauthorized permissions on the adminSDHolder object. Download Script: Harden-AdminSDHolder.ps1 # Harden-AdminSDHolder.ps1 # Description: Hardens the adminSDHolder ACL by auditing permissions, blocking inheritance, and removing delegated helpdesk groups. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Harden adminSDHolder Permissions..." -ForegroundColor Cyan # Set target DN $DomainDN = (Get-ADRootDSE).defaultNamingContext $AdminSDPath = "AD:\CN=adminSDHolder,CN=System,$($DomainDN)" # Define allowed high-privilege built-in identities (SIDs or names) $AllowedTrustees = @( "SYSTEM", "Domain Admins", "Enterprise Admins", "Administrators" ) # Fetch ACL $Acl = Get-Acl -Path $AdminSDPath $AclModified = $false # 1. Enforce inheritance blocking (DACL_Protected flag) if ($Acl.AreAccessRulesProtected) { Write-Host "[+] Inheritance is already blocked (protected) on the adminSDHolder container." -ForegroundColor Green } else { Write-Host "[-] adminSDHolder container has inheritance enabled. Blocking inheritance..." -ForegroundColor Yellow # Block inheritance ($true) and copy existing rules as explicit ($true) $Acl.SetAccessRuleProtection($true, $true) $AclModified = $true } # 2. Prune non-compliant permissions foreach ($Rule in $Acl.Access) { $Identity = $Rule.IdentityReference.Value # Check if trustee is allowed to write if ($Rule.ActiveDirectoryRights -match "WriteProperty|WriteDacl|WriteOwner|GenericAll|GenericWrite") { $IsAllowed = $false foreach ($Allowed in $AllowedTrustees) { if ($Identity -match $Allowed) { $IsAllowed = $true break } } if (-not $IsAllowed) { Write-Host "[-] Unauthorized write permission found: Account '$($Identity)' has rights: $($Rule.ActiveDirectoryRights)" -ForegroundColor Yellow # Remove rule $Acl.RemoveAccessRule($Rule) | Out-Null $AclModified = $true } } } if ($AclModified) { Set-Acl -Path $AdminSDPath -AclObject $Acl -ErrorAction Stop Write-Host "[+] adminSDHolder ACL hardened successfully." -ForegroundColor Green } else { Write-Host "[+] adminSDHolder ACL is already clean." -ForegroundColor Green } To verify current adminSDHolder permissions: Download Script: Get-AdminSDHolderAudit.ps1 # Get-AdminSDHolderAudit.ps1 # Description: Audits and prints all active permission entries and the inheritance block status on adminSDHolder. Import-Module ActiveDirectory Write-Host "--- Auditing adminSDHolder Permissions ---" -ForegroundColor Cyan $DomainDN = (Get-ADRootDSE).defaultNamingContext $AdminSDPath = "AD:\CN=adminSDHolder,CN=System,$($DomainDN)" $Acl = Get-Acl -Path $AdminSDPath # Check inheritance block status if ($Acl.AreAccessRulesProtected) { Write-Host "[+] Inheritance is BLOCKED (Protected) on the adminSDHolder container (Secure)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Inheritance is ENABLED (Unprotected) on the adminSDHolder container. Permissions may inherit from parent objects." -ForegroundColor Red } foreach ($Rule in $Acl.Access) { $Identity = $Rule.IdentityReference.Value $Rights = $Rule.ActiveDirectoryRights $Inheritance = $Rule.InheritanceType $Color = if ($Rights -match "WriteProperty|WriteDacl|WriteOwner|GenericAll") { "Yellow" } else { "Gray" } Write-Host "[*] Trustee: $($Identity)" -ForegroundColor White Write-Host " - Rights: $($Rights)" -ForegroundColor $Color Write-Host " - Inheritance: $($Inheritance)" -ForegroundColor Gray } # Harden-AdminSDHolder.ps1 # Description: Hardens the adminSDHolder ACL by auditing permissions, blocking inheritance, and removing delegated helpdesk groups. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Harden adminSDHolder Permissions..." -ForegroundColor Cyan # Set target DN $DomainDN = (Get-ADRootDSE).defaultNamingContext $AdminSDPath = "AD:\CN=adminSDHolder,CN=System,$($DomainDN)" # Define allowed high-privilege built-in identities (SIDs or names) $AllowedTrustees = @( "SYSTEM", "Domain Admins", "Enterprise Admins", "Administrators" ) # Fetch ACL $Acl = Get-Acl -Path $AdminSDPath $AclModified = $false # 1. Enforce inheritance blocking (DACL_Protected flag) if ($Acl.AreAccessRulesProtected) { Write-Host "[+] Inheritance is already blocked (protected) on the adminSDHolder container." -ForegroundColor Green } else { Write-Host "[-] adminSDHolder container has inheritance enabled. Blocking inheritance..." -ForegroundColor Yellow # Block inheritance ($true) and copy existing rules as explicit ($true) $Acl.SetAccessRuleProtection($true, $true) $AclModified = $true } # 2. Prune non-compliant permissions foreach ($Rule in $Acl.Access) { $Identity = $Rule.IdentityReference.Value # Check if trustee is allowed to write if ($Rule.ActiveDirectoryRights -match "WriteProperty|WriteDacl|WriteOwner|GenericAll|GenericWrite") { $IsAllowed = $false foreach ($Allowed in $AllowedTrustees) { if ($Identity -match $Allowed) { $IsAllowed = $true break } } if (-not $IsAllowed) { Write-Host "[-] Unauthorized write permission found: Account '$($Identity)' has rights: $($Rule.ActiveDirectoryRights)" -ForegroundColor Yellow # Remove rule $Acl.RemoveAccessRule($Rule) | Out-Null $AclModified = $true } } } if ($AclModified) { Set-Acl -Path $AdminSDPath -AclObject $Acl -ErrorAction Stop Write-Host "[+] adminSDHolder ACL hardened successfully." -ForegroundColor Green } else { Write-Host "[+] adminSDHolder ACL is already clean." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 File Path: 02-domain-controllers/harden-dns-container-permissions.md In Active Directory-integrated DNS environments, DNS configuration settings, zones, and resource records are stored directly within the directory and managed via the Microsoft DNS Server service. By default, the built-in DnsAdmins group possesses management rights over the DNS service, while standard authenticated domain users possess rights to register new DNS records in AD-integrated zones. This configuration exposes Domain Controllers and Active Directory to critical attack vectors: 1. DNS Service DLL Hijacking (`ServerLevelPluginDll`): The Microsoft DNS Server management RPC interface permits members of DnsAdmins (and accounts with write control over the DNS server configuration) to set the ServerLevelPluginDll parameter using dnscmd.exe /config /serverlevelplugindll \\path\to\malicious.dll. Because the DNS Server service runs as NT AUTHORITY\SYSTEM on Domain Controllers, the service loads this DLL upon restart or server reboot, executing arbitrary code with SYSTEM privileges and granting full Domain Controller compromise (effectively making DnsAdmins a Tier 0 equivalent group). 2. ADIDNS Record Spoofing & Kerberos Reflection (Ghost-SPN): In Active Directory Integrated DNS (ADIDNS) zones, the root container DACL grants Authenticated Users the Create all child objects right (specifically Create dnsNode objects) by default. This allows any standard domain user or compromised workstation account to register arbitrary DNS records. Attackers exploit this capability to register Unicode homoglyphs (such as ․ U+2024 or Ⓡ U+00AE) matching high-value servers or Domain Controllers. When clients request Kerberos service tickets (TGS-REQ) for an SPN like HOST/target, Kerberos linguistic normalization canonicalizes the homoglyph SPN to ASCII (matching the legitimate target), while the Windows DNS client resolves the IP via the attacker's ADIDNS homoglyph record, allowing Kerberos AP-REQ reflection attacks (CVE-2025-58726 / Synacktiv research) and WPAD hijacking. 3. Partition Directory DACL Tampering: Modern AD environments store DNS zones across dedicated Application Directory Partitions (DomainDnsZones and ForestDnsZones) as well as the legacy CN=System container. Write access on these containers allows non-Tier 0 identities to modify zone delegations, poison records, manipulate SOA/NS records, or grant themselves persistent backdoor rights. Enforcing GPO-based restriction on DnsAdmins, purging ServerLevelPluginDll, enforcing Secure Dynamic Updates, and removing arbitrary child record creation rights on ADIDNS zones ensures that the directory DNS infrastructure strictly adheres to the Tier 0 administrative boundary. Option A: Group Policy Object (GPO) & Active Directory Console Configuration 1. Enforce DnsAdmins Group Hygiene via GPO Restricted Groups Open Group Policy Management (gpmc.msc). Edit the baseline GPO applied to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups Right-click Restricted Groups and select Add Group.... Type DnsAdmins and click OK. Under Members of this group, leave the member list empty (or populate it strictly with verified Tier 0 accounts such as Domain Admins). Click OK. 2. Prevent DNS DLL Hijacking via GPO Preferences Registry Policy In the same GPO, navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click Registry -> New -> Registry Item. Configure the following properties: Action*: Delete Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\DNS\Parameters Value Name*: ServerLevelPluginDll Click OK. 3. Enforce Secure Dynamic Updates on All AD-Integrated Zones Open the DNS Manager console (dnsmgmt.msc) on a Domain Controller. Expand the Domain Controller node -> Forward Lookup Zones. Right-click each AD-integrated zone and select Properties. On the General tab, set Dynamic updates to Secure only. Repeat this configuration for all Forward and Reverse Lookup Zones. Click OK. 4. Restrict Arbitrary Record Creation & Ghost-SPN on ADIDNS Zones In DNS Manager, right-click the domain DNS zone and select Properties. Select the Security tab, then click Advanced. Select the entry for Authenticated Users and click Edit. Clear the Create all child objects (or Create dnsNode objects) permission to prevent standard domain users from creating arbitrary DNS records or Unicode homoglyphs. Ensure machine accounts retain permissions to register their own hostname records, or utilize DHCP servers with dedicated service account credentials for dynamic updates. Click OK to apply. 5. Audit & Restrict Permissions on MicrosoftDNS Containers Open Active Directory Users and Computers (dsa.msc) with View -> Advanced Features enabled. Check permissions on System\MicrosoftDNS: Right-click MicrosoftDNS -> Properties -> Security*. Verify that non-Tier 0 identities and `DnsAdmins` do not hold Write all properties , Modify permissions , or Full Control*. To inspect Application Partitions (DomainDnsZones and ForestDnsZones): Open ADSI Edit* (adsiedit.msc). * Connect to Naming Context: DC=DomainDnsZones,DC=[Domain] and navigate to CN=MicrosoftDNS. * Connect to Naming Context: DC=ForestDnsZones,DC=[ForestRootDomain] and navigate to CN=MicrosoftDNS. Right-click MicrosoftDNS -> Properties -> Security -> Advanced* and verify that only Tier 0 accounts possess write access. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script block to remove the ServerLevelPluginDll backdoor, enforce Secure Dynamic Updates on all AD-integrated zones, and audit DnsAdmins membership. Download Script: Harden-DnsServerConfiguration.ps1 # Harden-DnsServerConfiguration.ps1 # Description: Hardens Microsoft DNS on Domain Controllers by removing ServerLevelPluginDll backdoors, enforcing Secure Dynamic Updates on AD-integrated zones, and verifying DnsAdmins membership. Import-Module ActiveDirectory -ErrorAction SilentlyContinue Import-Module DnsServer -ErrorAction SilentlyContinue Write-Host "Applying hardening requirement: Harden Microsoft DNS AD Container..." -ForegroundColor Cyan # 1. Clean up ServerLevelPluginDll Registry Key $RegPath = "HKLM:\System\CurrentControlSet\Services\DNS\Parameters" $ValueName = "ServerLevelPluginDll" if (Test-Path -Path $RegPath) { $PluginDll = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $PluginDll -and $null -ne $PluginDll.ServerLevelPluginDll -and $PluginDll.ServerLevelPluginDll -ne "") { Write-Host "[-] WARNING: Potentially unauthorized DNS plugin detected: $($PluginDll.ServerLevelPluginDll)" -ForegroundColor Yellow Remove-ItemProperty -Path $RegPath -Name $ValueName -Force -ErrorAction Stop Write-Host "[+] ServerLevelPluginDll registry parameter removed successfully." -ForegroundColor Green } else { Write-Host "[+] No ServerLevelPluginDll registry parameter found (clean configuration)." -ForegroundColor Green } } # 2. Enforce Secure Dynamic Updates on Active Directory-Integrated Zones if (Get-Command -Name "Get-DnsServerZone" -ErrorAction SilentlyContinue) { Write-Host "Checking Dynamic Update settings on AD-integrated DNS zones..." -ForegroundColor White $Zones = Get-DnsServerZone -ErrorAction SilentlyContinue | Where-Object { $_.IsDsIntegrated -eq $true -and $_.ZoneType -eq "Primary" } foreach ($Zone in $Zones) { if ($Zone.DynamicUpdate -ne "Secure") { Write-Host "[-] Zone '$($Zone.ZoneName)' has DynamicUpdate set to '$($Zone.DynamicUpdate)'. Enforcing Secure only..." -ForegroundColor Yellow Set-DnsServerPrimaryZone -Name $Zone.ZoneName -DynamicUpdate "Secure" -ErrorAction SilentlyContinue Write-Host "[+] Zone '$($Zone.ZoneName)' DynamicUpdate set to Secure." -ForegroundColor Green } else { Write-Host "[+] Zone '$($Zone.ZoneName)' DynamicUpdate is Secure." -ForegroundColor Green } } } # 3. Audit and Alert on DnsAdmins Membership if (Get-Command -Name "Get-ADGroup" -ErrorAction SilentlyContinue) { $DnsAdminsGroup = Get-ADGroup -Filter "Name -eq 'DnsAdmins'" -ErrorAction SilentlyContinue if ($null -ne $DnsAdminsGroup) { $Members = Get-ADGroupMember -Identity $DnsAdminsGroup -ErrorAction SilentlyContinue if ($null -ne $Members -and @($Members).Count -gt 0) { Write-Host "[-] WARNING: The DnsAdmins group contains active members. Ensure all members are verified Tier 0 identities:" -ForegroundColor Yellow foreach ($Member in $Members) { Write-Host " - Member: $($Member.SamAccountName) ($($Member.objectClass))" -ForegroundColor White } } else { Write-Host "[+] The DnsAdmins group is empty (recommended Tier 0 posture)." -ForegroundColor Green } } } To audit active DNS parameters, AD container permissions, dynamic updates, and homoglyph records: Download Script: Get-DnsAuditStatus.ps1 # Get-DnsAuditStatus.ps1 # Description: Queries the DNS registry parameter settings, AD container ACLs, dynamic updates, and homoglyph records. Import-Module ActiveDirectory -ErrorAction SilentlyContinue Import-Module DnsServer -ErrorAction SilentlyContinue Write-Host "--- Auditing DNS Security Parameters ---" -ForegroundColor Cyan $isVulnerable = $false # 1. Check ServerLevelPluginDll Registry Backdoor $RegPath = "HKLM:\System\CurrentControlSet\Services\DNS\Parameters" $ValueName = "ServerLevelPluginDll" if (Test-Path -Path $RegPath) { $Val = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Val -and $null -ne $Val.ServerLevelPluginDll -and $Val.ServerLevelPluginDll -ne "") { Write-Host "[!] VULNERABLE: ServerLevelPluginDll is configured: $($Val.ServerLevelPluginDll)" -ForegroundColor Red $isVulnerable = $true } else { Write-Host "[+] ServerLevelPluginDll: Not configured (Secure)." -ForegroundColor Green } } # 2. Check DnsAdmins Membership if (Get-Command -Name "Get-ADGroup" -ErrorAction SilentlyContinue) { $DnsAdminsGroup = Get-ADGroup -Filter "Name -eq 'DnsAdmins'" -ErrorAction SilentlyContinue if ($null -ne $DnsAdminsGroup) { $Members = Get-ADGroupMember -Identity $DnsAdminsGroup -ErrorAction SilentlyContinue if ($null -ne $Members -and @($Members).Count -gt 0) { Write-Host "[-] WARNING: DnsAdmins group contains active members (Verify Tier 0 boundary):" -ForegroundColor Yellow foreach ($Member in $Members) { Write-Host " - Member: $($Member.SamAccountName)" -ForegroundColor Yellow } } else { Write-Host "[+] DnsAdmins group is empty (Secure)." -ForegroundColor Green } } } # 3. Check Dynamic Updates on AD-Integrated Zones if (Get-Command -Name "Get-DnsServerZone" -ErrorAction SilentlyContinue) { $Zones = Get-DnsServerZone -ErrorAction SilentlyContinue | Where-Object { $_.IsDsIntegrated -eq $true -and $_.ZoneType -eq "Primary" } foreach ($Zone in $Zones) { if ($Zone.DynamicUpdate -ne "Secure") { Write-Host "[!] VULNERABLE: Zone '$($Zone.ZoneName)' DynamicUpdate is set to '$($Zone.DynamicUpdate)' (Expected: Secure)." -ForegroundColor Red $isVulnerable = $true } else { Write-Host "[+] Zone '$($Zone.ZoneName)': DynamicUpdate is Secure." -ForegroundColor Green } } } # 4. Check AD Container Write ACLs (System, DomainDnsZones, ForestDnsZones) if (Get-Command -Name "Get-ADRootDSE" -ErrorAction SilentlyContinue) { $RootDSE = Get-ADRootDSE -ErrorAction SilentlyContinue if ($null -ne $RootDSE) { $DomainDN = $RootDSE.defaultNamingContext $RootDomainDN = $RootDSE.rootDomainNamingContext $Containers = @( "AD:\CN=MicrosoftDNS,CN=System,$DomainDN", "AD:\CN=MicrosoftDNS,DC=DomainDnsZones,$DomainDN", "AD:\CN=MicrosoftDNS,DC=ForestDnsZones,$RootDomainDN" ) $AllowedTrustees = @( "NT AUTHORITY\SYSTEM", "BUILTIN\Administrators", "Enterprise Domain Controllers", "Domain Admins", "Enterprise Admins" ) foreach ($ContainerPath in $Containers) { if (Test-Path -Path $ContainerPath) { Write-Host "Reviewing AD container permissions: $($ContainerPath)..." -ForegroundColor White $Acl = Get-Acl -Path $ContainerPath -ErrorAction SilentlyContinue if ($null -ne $Acl) { foreach ($Rule in $Acl.Access) { $Identity = $Rule.IdentityReference.Value $Rights = $Rule.ActiveDirectoryRights if ($Rights -match "WriteProperty|WriteDacl|WriteOwner|GenericAll|GenericWrite") { $IsAllowed = $false foreach ($Allowed in $AllowedTrustees) { if ($Identity -match [regex]::Escape($Allowed)) { $IsAllowed = $true break } } if (-not $IsAllowed) { Write-Host "[!] VULNERABLE: Unauthorized write permission on $($ContainerPath) - Trustee: $($Identity) - Rights: $($Rights)" -ForegroundColor Red $isVulnerable = $true } } } } } } } } # 5. Check for Non-ASCII / Unicode Homoglyph Records (Ghost-SPN / CVE-2025-58726) if (Get-Command -Name "Get-DnsServerResourceRecord" -ErrorAction SilentlyContinue) { $Zones = Get-DnsServerZone -ErrorAction SilentlyContinue | Where-Object { $_.IsDsIntegrated -eq $true -and $_.ZoneType -eq "Primary" } foreach ($Zone in $Zones) { $Records = Get-DnsServerResourceRecord -ZoneName $Zone.ZoneName -ErrorAction SilentlyContinue if ($null -ne $Records) { foreach ($Record in $Records) { if ($Record.HostName -match "[^\x20-\x7E]") { Write-Host "[!] VULNERABLE: Potential Ghost-SPN homoglyph record detected in zone '$($Zone.ZoneName)': $($Record.HostName)" -ForegroundColor Red $isVulnerable = $true } } } } } # Final Compliance Verdict if ($isVulnerable) { Write-Host "[!] Audit Result: VULNERABLE" -ForegroundColor Red } else { Write-Host "[+] Audit Result: SECURE" -ForegroundColor Green } # Harden-DnsServerConfiguration.ps1 # Description: Hardens Microsoft DNS on Domain Controllers by removing ServerLevelPluginDll backdoors, enforcing Secure Dynamic Updates on AD-integrated zones, and verifying DnsAdmins membership. Import-Module ActiveDirectory -ErrorAction SilentlyContinue Import-Module DnsServer -ErrorAction SilentlyContinue Write-Host "Applying hardening requirement: Harden Microsoft DNS AD Container..." -ForegroundColor Cyan # 1. Clean up ServerLevelPluginDll Registry Key $RegPath = "HKLM:\System\CurrentControlSet\Services\DNS\Parameters" $ValueName = "ServerLevelPluginDll" if (Test-Path -Path $RegPath) { $PluginDll = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $PluginDll -and $null -ne $PluginDll.ServerLevelPluginDll -and $PluginDll.ServerLevelPluginDll -ne "") { Write-Host "[-] WARNING: Potentially unauthorized DNS plugin detected: $($PluginDll.ServerLevelPluginDll)" -ForegroundColor Yellow Remove-ItemProperty -Path $RegPath -Name $ValueName -Force -ErrorAction Stop Write-Host "[+] ServerLevelPluginDll registry parameter removed successfully." -ForegroundColor Green } else { Write-Host "[+] No ServerLevelPluginDll registry parameter found (clean configuration)." -ForegroundColor Green } } # 2. Enforce Secure Dynamic Updates on Active Directory-Integrated Zones if (Get-Command -Name "Get-DnsServerZone" -ErrorAction SilentlyContinue) { Write-Host "Checking Dynamic Update settings on AD-integrated DNS zones..." -ForegroundColor White $Zones = Get-DnsServerZone -ErrorAction SilentlyContinue | Where-Object { $_.IsDsIntegrated -eq $true -and $_.ZoneType -eq "Primary" } foreach ($Zone in $Zones) { if ($Zone.DynamicUpdate -ne "Secure") { Write-Host "[-] Zone '$($Zone.ZoneName)' has DynamicUpdate set to '$($Zone.DynamicUpdate)'. Enforcing Secure only..." -ForegroundColor Yellow Set-DnsServerPrimaryZone -Name $Zone.ZoneName -DynamicUpdate "Secure" -ErrorAction SilentlyContinue Write-Host "[+] Zone '$($Zone.ZoneName)' DynamicUpdate set to Secure." -ForegroundColor Green } else { Write-Host "[+] Zone '$($Zone.ZoneName)' DynamicUpdate is Secure." -ForegroundColor Green } } } # 3. Audit and Alert on DnsAdmins Membership if (Get-Command -Name "Get-ADGroup" -ErrorAction SilentlyContinue) { $DnsAdminsGroup = Get-ADGroup -Filter "Name -eq 'DnsAdmins'" -ErrorAction SilentlyContinue if ($null -ne $DnsAdminsGroup) { $Members = Get-ADGroupMember -Identity $DnsAdminsGroup -ErrorAction SilentlyContinue if ($null -ne $Members -and @($Members).Count -gt 0) { Write-Host "[-] WARNING: The DnsAdmins group contains active members. Ensure all members are verified Tier 0 identities:" -ForegroundColor Yellow foreach ($Member in $Members) { Write-Host " - Member: $($Member.SamAccountName) ($($Member.objectClass))" -ForegroundColor White } } else { Write-Host "[+] The DnsAdmins group is empty (recommended Tier 0 posture)." -ForegroundColor Green } } } Target Scope: Applicable Systems: Virtualization Hosts (Hyper-V / VMware ESXi hosting Domain Controllers) Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, VMware vSphere ESXi 6.7+ File Path: 02-domain-controllers/harden-dc-virtualization-hosts.md In modern IT environments, Domain Controllers (DCs) are frequently virtualized. However, a virtualized DC is only as secure as the physical host and hypervisor running it. If a hypervisor hosting a DC is compromised, an attacker can: 1. Harvest NTDS.dit Offline: Copy the virtual hard disk file (VHDX/VMDK) of the running DC and extract all domain password hashes offline. 2. Manipulate Memory: Dump the guest DC's LSASS memory directly from the hypervisor console, exposing active Tier 0 administrator credentials. 3. Inject Arbitrary Commands: Use integration tools (like Hyper-V Integration Services or VMware Tools) to run code within the guest OS without authenticating. To mitigate these risks: Host Segregation : Hypervisors hosting Tier 0 Domain Controllers must be dedicated exclusively to Tier 0 workloads. Lower-tier virtual machines (Tier 1/2) must never run on the same physical host clusters. Administrative Isolation: The virtualization hosts and management consoles (e.g., vCenter, Hyper-V Manager) must be managed exclusively by Tier 0 administrative accounts. Virtual Machine Security*: Enable shielded VMs or VM encryption options to cryptographically lock the guest OS resources and protect virtual disks from unauthorized access. Option A: Manual Virtualization Host Isolation (Preferred) Identify all physical hosts running virtualized Domain Controllers. Move all non-Tier 0 virtual machines off these hosts using live migration (vMotion/Live Migration). Place these hosts into a dedicated, isolated hypervisor cluster (e.g., Cluster-Tier0). Reconfigure management permissions on the virtualization console: * Remove standard admin permissions from the cluster. * Restrict access rights exclusively to a dedicated Tier 0 virtualization administrator group. Disable unnecessary virtual integration services in the VM settings: In Hyper-V Manager, open DC VM Properties -> Integration Services -> Uncheck Guest services and Time synchronization* (if relying on NTP domain hierarchy). Option B: PowerShell Host Configuration Auditing Run the following script block on a Domain Controller to determine if it is virtualized, identify the hypervisor type, and audit key integration parameters. Download Script: Get-DcVirtualizationStatus.ps1 # Get-DcVirtualizationStatus.ps1 # Description: Audits the virtualization environment of the Domain Controller. Write-Host "--- Auditing DC Virtualization Status ---" -ForegroundColor Cyan # 1. Determine if running on physical or virtual hardware $ComputerSystem = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop $Model = $ComputerSystem.Model $Manufacturer = $ComputerSystem.Manufacturer Write-Host "[*] Host Manufacturer: $($Manufacturer)" -ForegroundColor White Write-Host "[*] System Model: $($Model)" -ForegroundColor White $IsVirtual = $false $HypervisorType = "Unknown" if ($Model -match "Virtual Machine|VMware|VirtualBox|Xen") { $IsVirtual = $true if ($Manufacturer -match "Microsoft") { $HypervisorType = "Hyper-V" } elseif ($Manufacturer -match "VMware") { $HypervisorType = "VMware ESXi" } } if ($IsVirtual) { Write-Host "[-] WARNING: Domain Controller is virtualized on $($HypervisorType)." -ForegroundColor Yellow Write-Host " Ensure the underlying host is secured as a Tier 0 asset." -ForegroundColor Yellow # 2. Check VM integration service settings if Hyper-V guest if ($HypervisorType -eq "Hyper-V") { $IntegrationServices = Get-Service -Name "vm*" -ErrorAction SilentlyContinue if ($IntegrationServices) { Write-Host " Integration Services detected:" -ForegroundColor White foreach ($Svc in $IntegrationServices) { Write-Host " - $($Svc.Name): $($Svc.Status)" -ForegroundColor White } } } } else { Write-Host "[+] Domain Controller is running on physical hardware (secure boundary)." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients, PAWs Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10/11 Enterprise File Path: 02-domain-controllers/enforce-rdp-restricted-admin.md Remote Desktop Protocol (RDP) is a standard tool for administrative sessions. However, by default, RDP authenticates users by placing their credentials (NTLM hashes or Kerberos tickets) directly in the Local Security Authority Subsystem Service (LSASS) memory of the destination host. If an administrator connects to a compromised host (such as a Tier 1 server or Tier 2 workstation) from their workstation using standard RDP, an attacker with local administrator privileges on that target system can dump LSASS and harvest the administrator's credentials. This allows the attacker to compromise the administrator's account and move laterally or escalate privileges. Enforcing RDP Restricted Admin Mode (RDP RA) prevents credential harvesting: 1. Blocks Credential Transmission: Under Restricted Admin mode, the client does not send the user's plaintext password, NTLM hash, or Kerberos TGT to the remote host. The host validates the connection without caching reusable credentials in its LSASS database. 2. Limits Remote Session Privilege: In network access attempts initiated from within the RDP session, the remote session runs in the security context of the destination machine's computer account ($MachineName$) rather than the administrator's user account. Option A: Group Policy Object (GPO) Configuration 1. Enforce Client-Side Connection Restriction (PAWs & Workstations) To force administrative workstations to use Restricted Admin mode for all remote RDP sessions: Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting administrative hosts (e.g., GPO_Workstation_Hardening). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Credentials Delegation Double-click the Restrict delegation of credentials to remote servers policy. Set it to Enabled. In the options dropdown, select Require Restricted Admin. Click OK and link the GPO to your PAW / Workstation OUs. 2. Configure Server-Side Support (Domain Controllers & Member Servers) Ensure that all target hosts are configured to permit Restricted Admin connections: Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting servers (e.g., GPO_Server_Hardening). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Credentials Delegation Double-click Restrict delegation of credentials to remote servers. Set it to Enabled. Select Require Remote Credential Guard or Restricted Admin (or Require Restricted Admin). Navigate to: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Connection Client Configure the setting: Policy*: Do not allow passwords to be saved Setting*: Enabled 8b. Navigate to: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections 8c. Configure the setting: Policy*: Restrict Remote Desktop Services users to a single Remote Desktop Services session Setting*: Enabled Navigate to: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection Configure the settings: Policy : `Do not allow drive redirection` -> Enabled Policy : `Do not allow COM port redirection` -> Enabled Policy : `Do not allow LPT port redirection` -> Enabled Policy : `Do not allow supported Plug and Play device redirection` -> Enabled Navigate to: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security Configure the following settings: Policy : `Always prompt for password upon connection` -> Enabled Policy : `Require secure RPC communication` -> Enabled Policy : `Set client connection encryption level` -> Enabled* (Select High Level in the options dropdown) 12b. Navigate to: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits 12c. Configure the following settings: Policy : `Set time limit for active but idle Remote Desktop Services sessions` -> Enabled* (Select 15 minutes in the options dropdown) Policy : `Set time limit for disconnected sessions` -> Enabled* (Select 1 minute in the options dropdown) Click OK and link the GPO to your Domain Controllers and Member Servers OUs. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script to configure the local host registry to allow and enforce Restricted Admin mode. Download Script: Set-RdpRestrictedAdmin.ps1 # Set-RdpRestrictedAdmin.ps1 # Description: Enables RDP Restricted Admin mode support and hardens RDP session options. Write-Host "Applying hardening requirement: Enforce RDP Restricted Admin Mode and Session Controls..." -ForegroundColor Cyan # 1. Enable Restricted Admin support $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $ValueName = "DisableRestrictedAdmin" $ValueData = 0 if (Test-Path $LsaPath) { Set-ItemProperty -Path $LsaPath -Name $ValueName -Value $ValueData -Type DWord -ErrorAction Stop Write-Host "[+] Local system configured to accept RDP Restricted Admin connections." -ForegroundColor Green } else { Write-Warning "LSA Registry path not found." } # 2. Harden RDP Session options in registry $RdpPolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" if (-not (Test-Path $RdpPolicyPath)) { New-Item -Path $RdpPolicyPath -Force | Out-Null } $RdpSettings = @{ "DisablePasswordSaving" = 1 "fSingleSessionPerUser" = 1 "fDisableCdm" = 1 "fDisableCcm" = 1 "fDisableLpt" = 1 "fDisablePNPRedir" = 1 "fPromptForPassword" = 1 "fEncryptRPCTraffic" = 1 "MinEncryptionLevel" = 3 "MaxIdleTime" = 900000 "MaxDisconnectionTime" = 60000 } foreach ($Setting in $RdpSettings.Keys) { Set-ItemProperty -Path $RdpPolicyPath -Name $Setting -Value $RdpSettings[$Setting] -Type DWord -ErrorAction Stop } Write-Host "[+] RDP session security controls applied to registry." -ForegroundColor Green To verify the local RDP configuration status: Download Script: Get-RdpRestrictedAdminStatus.ps1 # Get-RdpRestrictedAdminStatus.ps1 # Description: Checks the configuration state of RDP Restricted Admin and session security settings. $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $ValueName = "DisableRestrictedAdmin" Write-Host "Checking local LSA registry settings..." -ForegroundColor Cyan if (Test-Path $LsaPath) { $Value = Get-ItemProperty -Path $LsaPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Value) { if ($Value.DisableRestrictedAdmin -eq 0) { Write-Host "[+] RDP Restricted Admin Mode: Enabled (Value = 0)." -ForegroundColor Green } else { Write-Host "[-] RDP Restricted Admin Mode: Disabled (Value = $($Value.DisableRestrictedAdmin))." -ForegroundColor Red } } else { Write-Host "[+] RDP Restricted Admin Mode: Enabled (Default state: No registry restriction)." -ForegroundColor Green } } Write-Host "Checking RDP Session Security registry settings..." -ForegroundColor Cyan $RdpPolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" $ExpectedRdpSettings = @{ "DisablePasswordSaving" = 1 "fSingleSessionPerUser" = 1 "fDisableCdm" = 1 "fDisableCcm" = 1 "fDisableLpt" = 1 "fDisablePNPRedir" = 1 "fPromptForPassword" = 1 "fEncryptRPCTraffic" = 1 "MinEncryptionLevel" = 3 "MaxIdleTime" = 900000 "MaxDisconnectionTime" = 60000 } if (Test-Path $RdpPolicyPath) { $PolicyValues = Get-ItemProperty -Path $RdpPolicyPath -ErrorAction SilentlyContinue foreach ($Setting in $ExpectedRdpSettings.Keys) { $Val = $PolicyValues.$Setting $Expected = $ExpectedRdpSettings[$Setting] $Color = if ($Val -eq $Expected) { "Green" } else { "Red" } Write-Host " - $($Setting): $Val (Expected: $Expected)" -ForegroundColor $Color } } else { Write-Host "[-] RDP Session Policies path not found." -ForegroundColor Red } To establish a remote connection with Restricted Admin manually from the command line: cmd mstsc.exe /RestrictedAdmin # Set-RdpRestrictedAdmin.ps1 # Description: Enables RDP Restricted Admin mode support and hardens RDP session options. Write-Host "Applying hardening requirement: Enforce RDP Restricted Admin Mode and Session Controls..." -ForegroundColor Cyan # 1. Enable Restricted Admin support $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $ValueName = "DisableRestrictedAdmin" $ValueData = 0 if (Test-Path $LsaPath) { Set-ItemProperty -Path $LsaPath -Name $ValueName -Value $ValueData -Type DWord -ErrorAction Stop Write-Host "[+] Local system configured to accept RDP Restricted Admin connections." -ForegroundColor Green } else { Write-Warning "LSA Registry path not found." } # 2. Harden RDP Session options in registry $RdpPolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" if (-not (Test-Path $RdpPolicyPath)) { New-Item -Path $RdpPolicyPath -Force | Out-Null } $RdpSettings = @{ "DisablePasswordSaving" = 1 "fSingleSessionPerUser" = 1 "fDisableCdm" = 1 "fDisableCcm" = 1 "fDisableLpt" = 1 "fDisablePNPRedir" = 1 "fPromptForPassword" = 1 "fEncryptRPCTraffic" = 1 "MinEncryptionLevel" = 3 "MaxIdleTime" = 900000 "MaxDisconnectionTime" = 60000 } foreach ($Setting in $RdpSettings.Keys) { Set-ItemProperty -Path $RdpPolicyPath -Name $Setting -Value $RdpSettings[$Setting] -Type DWord -ErrorAction Stop } Write-Host "[+] RDP session security controls applied to registry." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/configure-applocker-policies.md Domain Controllers are Tier 0 administrative assets and must never be used for general-purpose tasks like web browsing, document viewing, or running unapproved utilities. Attackers who compromise a Domain Controller or obtain administrative access often attempt to execute custom binaries, remote access tools (RATs), or script-based tools to pivot, establish persistence, or extract the Active Directory database (NTDS.dit). Enforcing AppLocker policies on Domain Controllers provides the following defense-in-depth security benefits: 1. Restricts Execution to Authorized Software: Prevents execution of unapproved software, preventing standard user directories (such as C:\Users\ or C:\Windows\Temp\) from being used to launch malicious binaries or scripts. 2. Blocks Browser Execution: Prevents administrative users from launching web browsers (Chrome, Edge, Firefox, Internet Explorer) directly on Domain Controllers, shutting down web-based drive-by downloads and browser-based credential leakage. 3. Restricts Windows Installer and Script Execution: Prevents unauthorized .msi installations and unauthorized PowerShell or VBScript scripts from running, reducing the likelihood of successful exploitation via living-off-the-land techniques. 4. Defends Against AppLocker Bypasses: Abusing trusted, signed Microsoft binaries (such as msbuild.exe, installutil.exe, regasm.exe, regsvcs.exe, mshta.exe, regsvr32.exe, rundll32.exe) allows attackers to execute arbitrary code bypassing default AppLocker rules. This control blocks these "Living off the Land" binaries (LOLBins) and prevents execution from user-writeable paths under %WINDIR% (such as Tasks, Temp, tracing, spool\drivers\color, etc.). Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Enable Application Identity Service Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting Domain Controllers (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Double-click Application Identity. Select Define this policy setting and configure the startup mode to Automatic. 2. Configure AppLocker Enforcement Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Application Control Policies\AppLocker Right-click AppLocker and select Properties. Under the Enforcement tab, check Configured for the following rule collections: Executable rules -> Select Enforce rules (or Audit only* for baseline testing) Windows Installer rules -> Select Enforce rules (or Audit only*) Script rules -> Select Enforce rules (or Audit only*) Packaged app rules -> Select Enforce rules (or Audit only*) Click OK. 3. Create Default and Exception Rules Expand AppLocker and select Executable Rules. Right-click Executable Rules and select Create Default Rules (allows all files in Windows and Program Files directories, and allows local Administrators to run all files). Per ANSSI R2 recommendation, do not create standalone Deny rules. Instead, configure the following path Exceptions on the default Allow rule for the Windows folder: Right-click the rule `(Default Rule) All files located in the Windows folder` and select Properties*. On the Exceptions* tab, add path exceptions for writeable directories under %WINDIR%: `%WINDIR%\Tasks\ `%WINDIR%\Temp\ `%WINDIR%\tracing\ `%WINDIR%\System32\spool\drivers\color\ `%WINDIR%\System32\Tasks\Microsoft\Windows\SyncCenter\ `%WINDIR%\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ On the same Exceptions* tab, add path exceptions for the following bypass binaries (LOLBins): `\msbuild.exe` `\installutil.exe` `\mshta.exe` `\regasm.exe` `\regsvcs.exe` `\regsvr32.exe` `\rundll32.exe` `\bginfo.exe` `\cdb.exe` `\cmstp.exe` `\control.exe` `\csi.exe` `\dfsvc.exe` `\dnx.exe` `\fsi.exe` `\ie4unit.exe` `\ieexec.exe` `\infdefaultinstall.exe` `\mavinject.exe` `\msdeploy.exe` `\msdt.exe` `\msxsl.exe` `\odbcconf.exe` `\presentationhost.exe` `\rcsi.exe` `\rsi.exe` `\runscripthelper.exe` `\te.exe` `\tracker.exe` `\xwizard.exe` Repeat the process for Script Rules by creating default rules and adding exceptions to the %WINDIR%\* Allow rule for script execution from user-writeable paths (such as %WINDIR%\Temp\* and %WINDIR%\Tasks\*). Disable NTVDM (16-bit application support) to prevent AppLocker bypasses via 16-bit binaries: * Navigate to: Computer Configuration\Administrative Templates\System\16-bit Application Compatibility Configure Prevent access to 16-bit applications to Enabled*. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure the Application Identity service and import a robust local AppLocker policy. Download Script: Set-AppLockerDCPolicy.ps1 # Set-AppLockerDCPolicy.ps1 # Description: Configures the Application Identity service and imports a robust local AppLocker XML policy. Write-Host "Applying hardening requirement: Configure AppLocker on Domain Controllers..." -ForegroundColor Cyan # 1. Enable Application Identity service (AppIDSvc) $Service = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue if ($Service) { Set-Service -Name AppIDSvc -StartupType Automatic if ($Service.Status -ne "Running") { Start-Service -Name AppIDSvc } Write-Host "[+] Application Identity service configured to start automatically and is running." -ForegroundColor Green } else { Write-Error "Application Identity service (AppIDSvc) is not present on this system." } # 2. Configure local AppLocker policy XML content $AppLockerXml = @" <AppLockerPolicy Version="1"> <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e1e-453f-b3a5-bc4f4a38674d" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-6d8f-4ad9-acbc-467b78a7f7b4" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> <FilePathCondition Path="%WINDIR%\System32\spool\drivers\color\*" /> <FilePathCondition Path="%WINDIR%\System32\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="%WINDIR%\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="*\msbuild.exe" /> <FilePathCondition Path="*\installutil.exe" /> <FilePathCondition Path="*\mshta.exe" /> <FilePathCondition Path="*\regasm.exe" /> <FilePathCondition Path="*\regsvcs.exe" /> <FilePathCondition Path="*\regsvr32.exe" /> <FilePathCondition Path="*\rundll32.exe" /> <FilePathCondition Path="*\bginfo.exe" /> <FilePathCondition Path="*\cdb.exe" /> <FilePathCondition Path="*\cmstp.exe" /> <FilePathCondition Path="*\control.exe" /> <FilePathCondition Path="*\csi.exe" /> <FilePathCondition Path="*\dfsvc.exe" /> <FilePathCondition Path="*\dnx.exe" /> <FilePathCondition Path="*\fsi.exe" /> <FilePathCondition Path="*\ie4unit.exe" /> <FilePathCondition Path="*\ieexec.exe" /> <FilePathCondition Path="*\infdefaultinstall.exe" /> <FilePathCondition Path="*\mavinject.exe" /> <FilePathCondition Path="*\msdeploy.exe" /> <FilePathCondition Path="*\msdt.exe" /> <FilePathCondition Path="*\msxsl.exe" /> <FilePathCondition Path="*\odbcconf.exe" /> <FilePathCondition Path="*\presentationhost.exe" /> <FilePathCondition Path="*\rcsi.exe" /> <FilePathCondition Path="*\rsi.exe" /> <FilePathCondition Path="*\runscripthelper.exe" /> <FilePathCondition Path="*\te.exe" /> <FilePathCondition Path="*\tracker.exe" /> <FilePathCondition Path="*\xwizard.exe" /> </Exceptions> </FilePathRule> <FilePathRule Id="fd686d83-a829-4351-8ff4-27c1de5732e9" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePathRule Id="5b8fa8b3-3a5e-4c7a-9cb8-b223ff9db271" Name="(Default Rule) All Windows Installer files in Program Files" Description="Allows everyone to run Windows Installer files in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="6b8fa8b3-3a5e-4c7a-9cb8-b223ff9db272" Name="(Default Rule) All Windows Installer files in Windows" Description="Allows everyone to run Windows Installer files in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="7b8fa8b3-3a5e-4c7a-9cb8-b223ff9db273" Name="(Default Rule) All Windows Installer files" Description="Allows administrators to run all Windows Installer files." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Script" EnforcementMode="Enabled"> <FilePathRule Id="1c8fa8b3-3a5e-4c7a-9cb8-b223ff9db274" Name="(Default Rule) All scripts located in the Program Files folder" Description="Allows everyone to run scripts in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="2c8fa8b3-3a5e-4c7a-9cb8-b223ff9db275" Name="(Default Rule) All scripts located in the Windows folder" Description="Allows everyone to run scripts in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="3c8fa8b3-3a5e-4c7a-9cb8-b223ff9db276" Name="(Default Rule) All scripts" Description="Allows administrators to run all scripts." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="1d8fa8b3-3a5e-4c7a-9cb8-b223ff9db279" Name="(Default Rule) All signed packaged apps" Description="Allows everyone to run signed packaged apps." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> </AppLockerPolicy> "@ # Write the temporary XML and import it $TempPath = Join-Path -Path $env:TEMP -ChildPath "AppLockerDCPolicy.xml" $AppLockerXml | Out-File -FilePath $TempPath -Encoding UTF8 -Force # 3. Validate policy using Test-AppLockerPolicy before importing try { Import-Module AppLocker -ErrorAction Stop } catch { Write-Error "AppLocker module is not available on this system. Cannot configure or validate policy." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } $TestPaths = @( # Expected: Allowed "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe", # Expected: DeniedByDefault or ExplicitlyDenied (since it is an exception to an Allow rule) "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) $ValidationFailed = $false try { $TestResults = Test-AppLockerPolicy -XmlPolicy $TempPath -Path $TestPaths -User Everyone -ErrorAction Stop $ExpectedAllow = @( "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe" ) $ExpectedDeny = @( "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) foreach ($Result in $TestResults) { $Path = $Result.FilePath $Decision = $Result.PolicyDecision if ($ExpectedAllow -contains $Path) { if ($Decision -ne "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Allow for: $Path (got: $Decision)" $ValidationFailed = $true } } if ($ExpectedDeny -contains $Path) { if ($Decision -eq "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Deny/Not Allowed for: $Path (got: $Decision)" $ValidationFailed = $true } } } } catch { Write-Warning "Could not perform policy validation tests: $($_.Exception.Message)" $ValidationFailed = $true } if ($ValidationFailed) { Write-Error "AppLocker policy validation failed. Policy was NOT imported." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } Write-Host "[+] AppLocker policy validation passed. Proceeding with import." -ForegroundColor Green # 4. Import the validated AppLocker policy try { Set-AppLockerPolicy -XmlPolicy $TempPath -ErrorAction Stop Write-Host "[+] Local AppLocker policy imported and enforced successfully." -ForegroundColor Green } catch { Write-Error "Failed to import AppLocker policy: $($_.Exception.Message)" } finally { if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } } # 5. Disable NTVDM (16-bit compatibility) via Registry $NtvdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" if (-not (Test-Path $NtvdmPath)) { New-Item -Path $NtvdmPath -Force | Out-Null } Set-ItemProperty -Path $NtvdmPath -Name "Prevent16BitApp" -Value 1 -Type DWord Write-Host "[+] 16-bit NTVDM compatibility disabled in registry." -ForegroundColor Green To audit the Application Identity service and AppLocker registry configuration: Download Script: Get-AppLockerDCStatus.ps1 # Get-AppLockerDCStatus.ps1 # Description: Checks the configuration state of the AppIDSvc service and AppLocker registry paths. Write-Host "--- Auditing AppLocker Configuration ---" -ForegroundColor Cyan # 1. Audit service state $AppIDSvc = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue if ($AppIDSvc) { $SvcColor = if ($AppIDSvc.Status -eq "Running" -and $AppIDSvc.StartType -eq "Automatic") { "Green" } else { "Yellow" } Write-Host " - Application Identity Service: $($AppIDSvc.Status) | Startup: $($AppIDSvc.StartType) (Expected: Running | Automatic)" -ForegroundColor $SvcColor } else { Write-Host " - Application Identity Service: NOT INSTALLED" -ForegroundColor Red } # 2. Audit enforcement registry settings $SrpPath = "HKLM:\Software\Policies\Microsoft\Windows\SrpV2" $Collections = @("Exe", "Msi", "Script", "Appx") if (Test-Path $SrpPath) { foreach ($Col in $Collections) { $ColPath = "$SrpPath\$Col" if (Test-Path $ColPath) { $Val = Get-ItemProperty -Path $ColPath -Name "EnforcementMode" -ErrorAction SilentlyContinue if ($null -ne $Val) { $Mode = if ($Val.EnforcementMode -eq 1) { "Enforced" } else { "Audit Only" } $Color = if ($Val.EnforcementMode -eq 1) { "Green" } else { "Yellow" } Write-Host " - Collection $Col Enforcement: $Mode (Value: $($Val.EnforcementMode))" -ForegroundColor $Color } else { Write-Host " - Collection $Col Enforcement: NOT CONFIGURED" -ForegroundColor Red } } else { Write-Host " - Collection $Col Path: NOT FOUND" -ForegroundColor Red } } } else { Write-Host "[-] AppLocker registry base path (SrpV2) not found. Policy is not deployed." -ForegroundColor Red } # 3. Audit NTVDM Disable Status $NtvdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" if (Test-Path $NtvdmPath) { $AppCompatVal = Get-ItemProperty -Path $NtvdmPath -Name "Prevent16BitApp" -ErrorAction SilentlyContinue if ($null -ne $AppCompatVal -and $AppCompatVal.Prevent16BitApp -eq 1) { Write-Host " - NTVDM (16-bit AppCompat): Disabled (Secure)" -ForegroundColor Green } else { Write-Host " - NTVDM (16-bit AppCompat): Enabled or Not Configured (Expected: Disabled)" -ForegroundColor Yellow } } else { Write-Host " - NTVDM (16-bit AppCompat): Not Configured (Expected: Disabled)" -ForegroundColor Yellow } # Set-AppLockerDCPolicy.ps1 # Description: Configures the Application Identity service and imports a robust local AppLocker XML policy. Write-Host "Applying hardening requirement: Configure AppLocker on Domain Controllers..." -ForegroundColor Cyan # 1. Enable Application Identity service (AppIDSvc) $Service = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue if ($Service) { Set-Service -Name AppIDSvc -StartupType Automatic if ($Service.Status -ne "Running") { Start-Service -Name AppIDSvc } Write-Host "[+] Application Identity service configured to start automatically and is running." -ForegroundColor Green } else { Write-Error "Application Identity service (AppIDSvc) is not present on this system." } # 2. Configure local AppLocker policy XML content $AppLockerXml = @" <AppLockerPolicy Version="1"> <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e1e-453f-b3a5-bc4f4a38674d" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-6d8f-4ad9-acbc-467b78a7f7b4" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> <FilePathCondition Path="%WINDIR%\System32\spool\drivers\color\*" /> <FilePathCondition Path="%WINDIR%\System32\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="%WINDIR%\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="*\msbuild.exe" /> <FilePathCondition Path="*\installutil.exe" /> <FilePathCondition Path="*\mshta.exe" /> <FilePathCondition Path="*\regasm.exe" /> <FilePathCondition Path="*\regsvcs.exe" /> <FilePathCondition Path="*\regsvr32.exe" /> <FilePathCondition Path="*\rundll32.exe" /> <FilePathCondition Path="*\bginfo.exe" /> <FilePathCondition Path="*\cdb.exe" /> <FilePathCondition Path="*\cmstp.exe" /> <FilePathCondition Path="*\control.exe" /> <FilePathCondition Path="*\csi.exe" /> <FilePathCondition Path="*\dfsvc.exe" /> <FilePathCondition Path="*\dnx.exe" /> <FilePathCondition Path="*\fsi.exe" /> <FilePathCondition Path="*\ie4unit.exe" /> <FilePathCondition Path="*\ieexec.exe" /> <FilePathCondition Path="*\infdefaultinstall.exe" /> <FilePathCondition Path="*\mavinject.exe" /> <FilePathCondition Path="*\msdeploy.exe" /> <FilePathCondition Path="*\msdt.exe" /> <FilePathCondition Path="*\msxsl.exe" /> <FilePathCondition Path="*\odbcconf.exe" /> <FilePathCondition Path="*\presentationhost.exe" /> <FilePathCondition Path="*\rcsi.exe" /> <FilePathCondition Path="*\rsi.exe" /> <FilePathCondition Path="*\runscripthelper.exe" /> <FilePathCondition Path="*\te.exe" /> <FilePathCondition Path="*\tracker.exe" /> <FilePathCondition Path="*\xwizard.exe" /> </Exceptions> </FilePathRule> <FilePathRule Id="fd686d83-a829-4351-8ff4-27c1de5732e9" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePathRule Id="5b8fa8b3-3a5e-4c7a-9cb8-b223ff9db271" Name="(Default Rule) All Windows Installer files in Program Files" Description="Allows everyone to run Windows Installer files in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="6b8fa8b3-3a5e-4c7a-9cb8-b223ff9db272" Name="(Default Rule) All Windows Installer files in Windows" Description="Allows everyone to run Windows Installer files in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="7b8fa8b3-3a5e-4c7a-9cb8-b223ff9db273" Name="(Default Rule) All Windows Installer files" Description="Allows administrators to run all Windows Installer files." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Script" EnforcementMode="Enabled"> <FilePathRule Id="1c8fa8b3-3a5e-4c7a-9cb8-b223ff9db274" Name="(Default Rule) All scripts located in the Program Files folder" Description="Allows everyone to run scripts in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="2c8fa8b3-3a5e-4c7a-9cb8-b223ff9db275" Name="(Default Rule) All scripts located in the Windows folder" Description="Allows everyone to run scripts in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="3c8fa8b3-3a5e-4c7a-9cb8-b223ff9db276" Name="(Default Rule) All scripts" Description="Allows administrators to run all scripts." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="1d8fa8b3-3a5e-4c7a-9cb8-b223ff9db279" Name="(Default Rule) All signed packaged apps" Description="Allows everyone to run signed packaged apps." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> </AppLockerPolicy> "@ # Write the temporary XML and import it $TempPath = Join-Path -Path $env:TEMP -ChildPath "AppLockerDCPolicy.xml" $AppLockerXml | Out-File -FilePath $TempPath -Encoding UTF8 -Force # 3. Validate policy using Test-AppLockerPolicy before importing try { Import-Module AppLocker -ErrorAction Stop } catch { Write-Error "AppLocker module is not available on this system. Cannot configure or validate policy." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } $TestPaths = @( # Expected: Allowed "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe", # Expected: DeniedByDefault or ExplicitlyDenied (since it is an exception to an Allow rule) "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) $ValidationFailed = $false try { $TestResults = Test-AppLockerPolicy -XmlPolicy $TempPath -Path $TestPaths -User Everyone -ErrorAction Stop $ExpectedAllow = @( "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe" ) $ExpectedDeny = @( "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) foreach ($Result in $TestResults) { $Path = $Result.FilePath $Decision = $Result.PolicyDecision if ($ExpectedAllow -contains $Path) { if ($Decision -ne "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Allow for: $Path (got: $Decision)" $ValidationFailed = $true } } if ($ExpectedDeny -contains $Path) { if ($Decision -eq "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Deny/Not Allowed for: $Path (got: $Decision)" $ValidationFailed = $true } } } } catch { Write-Warning "Could not perform policy validation tests: $($_.Exception.Message)" $ValidationFailed = $true } if ($ValidationFailed) { Write-Error "AppLocker policy validation failed. Policy was NOT imported." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } Write-Host "[+] AppLocker policy validation passed. Proceeding with import." -ForegroundColor Green # 4. Import the validated AppLocker policy try { Set-AppLockerPolicy -XmlPolicy $TempPath -ErrorAction Stop Write-Host "[+] Local AppLocker policy imported and enforced successfully." -ForegroundColor Green } catch { Write-Error "Failed to import AppLocker policy: $($_.Exception.Message)" } finally { if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } } # 5. Disable NTVDM (16-bit compatibility) via Registry $NtvdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" if (-not (Test-Path $NtvdmPath)) { New-Item -Path $NtvdmPath -Force | Out-Null } Set-ItemProperty -Path $NtvdmPath -Name "Prevent16BitApp" -Value 1 -Type DWord Write-Host "[+] 16-bit NTVDM compatibility disabled in registry." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 File Path: 02-domain-controllers/enable-wdac-driver-blocklist.md Attackers frequently employ "Bring Your Own Vulnerable Driver" (BYOVD) attacks to bypass Windows kernel protections. In a BYOVD attack, an adversary with administrative privileges installs a legitimate, cryptographically signed third-party driver that contains a known, exploitable vulnerability. The attacker then exploits this vulnerability to execute arbitrary code with kernel privileges, allowing them to disable security agents, dump LSASS memory, or tamper with system integrity. Enforcing the Microsoft Vulnerable Driver Blocklist via Windows Defender Application Control (WDAC) prevents known vulnerable or malicious drivers from loading in kernel space. By restricting the WDAC policy to Kernel Mode Code Integrity (KMCI) only (omitting user-mode enforcement), the control shields the system kernel from driver-based exploits without introducing administrative overhead or blocking standard user-mode server applications and utilities. Option A: Group Policy Object (GPO) Configuration (Preferred) To enforce the driver blocklist across all Domain Controllers, you can deploy the Microsoft recommended block rules as a custom WDAC policy. Download the Microsoft recommended driver block rules XML from the official Microsoft documentation. Edit the XML to ensure it operates in Audit Mode first, then convert the XML configuration into a binary format: `powershell ConvertFrom-CIPolicy -XmlFilePath "C:\WDAC\DriverBlocklist.xml" -BinaryFilePath "C:\WDAC\SIPolicy.p7b" Copy the compiled SIPolicy.p7b file to a secure local path on all target Domain Controllers (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b) or a share. Open the Group Policy Management Console (gpmc.msc) on a domain management host. Create or edit a GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the following setting: Policy*: Deploy Windows Defender Application Control Setting*: Enabled Code Integrity Policy File Path*: Enter the local or network path to the policy file (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b). To ensure the built-in system driver blocklist is active on modern builds, configure the following registry setting via Group Policy Preferences: Path*: Computer Configuration\Preferences\Windows Settings\Registry Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\CI\Config Value Name*: VulnerableDriverBlocklistEnable Value Type*: REG_DWORD Value Data*: 1 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to enable the Vulnerable Driver Blocklist registry key and ensure proper configuration. Download Script: Configure-DriverBlocklist.ps1 # Configure-DriverBlocklist.ps1 # Description: Enables the Microsoft Vulnerable Driver Blocklist in the registry and validates VBS/HVCI settings. Write-Host "Applying hardening requirement: Enable WDAC Driver Blocklist..." -ForegroundColor Cyan # 1. Configure the registry settings to enable the blocklist $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" $ValueName = "VulnerableDriverBlocklistEnable" if (-not (Test-Path $RegPath)) { Write-Host "[+] Creating registry path: $RegPath" -ForegroundColor Gray New-Item -Path $RegPath -Force | Out-Null } Write-Host "[+] Setting registry value: $ValueName = 1" -ForegroundColor Gray Set-ItemProperty -Path $RegPath -Name $ValueName -Value 1 -Type DWord -ErrorAction Stop # 2. Validate VBS / HVCI Configuration $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Pre-requisite Check: Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] Warning: Memory Integrity (HVCI) is disabled. The blocklist requires HVCI for hypervisor enforcement." -ForegroundColor Yellow } } else { Write-Host "[!] Warning: Memory Integrity scenario configuration not found. Check VBS settings." -ForegroundColor Yellow } Write-Host "[+] Configuration applied successfully. A reboot is required to activate the blocklist." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-DriverBlocklistStatus.ps1 # Get-DriverBlocklistStatus.ps1 # Description: Audits the configuration of the Microsoft Vulnerable Driver Blocklist and HVCI state. Write-Host "--- Auditing Vulnerable Driver Blocklist ---" -ForegroundColor Cyan $Vulnerable = $false # 1. Check registry value $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" $ValueName = "VulnerableDriverBlocklistEnable" if (Test-Path $RegPath) { $RegValue = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $RegValue -and $RegValue.$ValueName -eq 1) { Write-Host "[+] Vulnerable Driver Blocklist is enabled in the registry." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Vulnerable Driver Blocklist is disabled or not set in the registry." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: Code Integrity Config registry key does not exist." -ForegroundColor Red $Vulnerable = $true } # 2. Check HVCI Status $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Memory Integrity (HVCI) is disabled in the registry." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: Memory Integrity scenario registry path does not exist." -ForegroundColor Red $Vulnerable = $true } # 3. Final Verdict if ($Vulnerable) { Write-Host "`n[!] Verification FAILED: The Vulnerable Driver Blocklist is not fully secured." -ForegroundColor Red } else { Write-Host "`n[+] Verification PASSED: The Vulnerable Driver Blocklist and HVCI are correctly configured." -ForegroundColor Green } # Configure-DriverBlocklist.ps1 # Description: Enables the Microsoft Vulnerable Driver Blocklist in the registry and validates VBS/HVCI settings. Write-Host "Applying hardening requirement: Enable WDAC Driver Blocklist..." -ForegroundColor Cyan # 1. Configure the registry settings to enable the blocklist $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" $ValueName = "VulnerableDriverBlocklistEnable" if (-not (Test-Path $RegPath)) { Write-Host "[+] Creating registry path: $RegPath" -ForegroundColor Gray New-Item -Path $RegPath -Force | Out-Null } Write-Host "[+] Setting registry value: $ValueName = 1" -ForegroundColor Gray Set-ItemProperty -Path $RegPath -Name $ValueName -Value 1 -Type DWord -ErrorAction Stop # 2. Validate VBS / HVCI Configuration $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Pre-requisite Check: Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] Warning: Memory Integrity (HVCI) is disabled. The blocklist requires HVCI for hypervisor enforcement." -ForegroundColor Yellow } } else { Write-Host "[!] Warning: Memory Integrity scenario configuration not found. Check VBS settings." -ForegroundColor Yellow } Write-Host "[+] Configuration applied successfully. A reboot is required to activate the blocklist." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 02-domain-controllers/configure-dsheuristics.md The dSHeuristics attribute is a Unicode string that defines forest-wide heuristic configuration settings for Active Directory. Individual characters at specific indices (1-based) modify security and protocol behaviors on Domain Controllers: fLDAPBlockAnonOps (7th character): Controls anonymous LDAP operations. If set to 2, anonymous binds and searches are permitted, allowing unauthorized users to map out directory structures. Setting it to 0 blocks anonymous operations. fAllowAnonNSPI (8th character): Controls anonymous access to the Name Service Provider Interface (NSPI). If set to 1 or any value other than 0, anonymous clients can query address books, which allows user enumeration. Setting it to 0 restricts NSPI queries to authenticated users. dwAdminSDExMask (16th character): Excludes administrative groups from the automatic security descriptor protection mechanism (the AdminSDHolder background task). By default (0), groups like Account Operators, Server Operators, Print Operators, and Backup Operators are protected. If set to non-zero, this protection is bypassed, risking privilege escalation. DoNotVerifyUPNAndOrSPNUniqueness (21st character): Controls uniqueness enforcement for User Principal Names (UPN) and Service Principal Names (SPN). Disabling this check (1 or non-zero) can lead to identity spoofing or credential hijacking by registering duplicate names (KB5008382). AttributeAuthorizationOnLDAPAdd (28th character) and BlockOwnerImplicitRights (29th character): Introduced in KB5008383. Setting these to 1 enforces strict authorization validations and auditing during LDAP Add operations, preventing malicious creators from abusing implicit owner privileges. DisableConfidentialAttributeEncryptionRequirements (31st character): Controls connection security requirements for retrieving or writing confidential attributes. Allowing unencrypted connections (non-zero) risks exposing sensitive information such as password hashes or BitLocker recovery keys on the network. To reach the maximum Level 5 security state, all dangerous features must be disabled, and KB5008383 protections must be explicitly set to 1. Option A: Graphical Tools (ADSI Edit / Ldp.exe) Open ADSI Edit (adsiedit.msc) with Enterprise Administrator or Domain Administrator (of the forest root) privileges. Right-click ADSI Edit in the left pane and select Connect to.... Under Connection Point, choose Select a well-known Naming Context and select Configuration. Click OK. In the left pane, expand the tree: Configuration -> CN=Configuration,DC=... -> CN=Services -> CN=Windows NT -> CN=Directory Service Right-click CN=Directory Service and select Properties. Locate the dSHeuristics attribute in the Attribute Editor list and click Edit. If the current value is <not set>, set it to the standard Level 5 string: 0000000001000000000200000001130 If a value is already present, modify it carefully by preserving existing non-security related positions, updating only the specific security positions: 7th character* (fLDAPBlockAnonOps): Must not be 2 (change to 0) 8th character* (fAllowAnonNSPI): Must be 0 16th character* (dwAdminSDExMask): Must be 0 21st character* (DoNotVerifyUPNAndOrSPNUniqueness): Must be 0 28th character* (AttributeAuthorizationOnLDAPAdd): Must be 1 29th character* (BlockOwnerImplicitRights): Must be 1 31st character* (DisableConfidentialAttributeEncryptionRequirements): Must be 0 Ensure control characters 10th is `1`, 20th is `2`, and 30th* is 3 if the string length reaches those values. Click OK and apply the changes. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting programmatically. Download Script: Configure-dSHeuristics.ps1 # Configure-dSHeuristics.ps1 # Description: Configures the dSHeuristics attribute to reach Level 5 security. Write-Host "Applying hardening requirement: Configure dSHeuristics..." -ForegroundColor Cyan # Ensure we can read the Configuration naming context $rootDSE = [ADSI]"LDAP://RootDSE" $configNamingContext = $rootDSE.configurationNamingContext[0] $dsPath = "LDAP://CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$configNamingContext" $dsObject = [ADSI]$dsPath $currentHeuristics = $dsObject.Properties["dSHeuristics"].Value $newHeuristics = "" if ($null -eq $currentHeuristics -or $currentHeuristics -eq "") { # Initialize with default 31-character Level 5 string if not already configured $newHeuristics = "0000000001000000000200000001130" } else { # If already set, we need to modify specific indices while preserving other values $charArray = $currentHeuristics.ToCharArray() # Pad array to at least 31 characters to support all configurations if ($charArray.Length -lt 31) { $tempArray = [char[]](New-Object char[] 31) for ($i = 0; $i -lt 31; $i++) { if ($i -lt $charArray.Length) { $tempArray[$i] = $charArray[$i] } else { $tempArray[$i] = [char]"0" } } $charArray = $tempArray } # 7: fLDAPBlockAnonOps (Index 6) if ($charArray[6] -eq [char]"2") { $charArray[6] = [char]"0" } # 8: fAllowAnonNSPI (Index 7) -> must be "0" $charArray[7] = [char]"0" # 10: tenthChar (Index 9) -> control character, must be "1" $charArray[9] = [char]"1" # 16: dwAdminSDExMask (Index 15) -> must be "0" $charArray[15] = [char]"0" # 20: twentiethChar (Index 19) -> control character, must be "2" $charArray[19] = [char]"2" # 21: DoNotVerifyUPNAndOrSPNUniqueness (Index 20) -> must be "0" $charArray[20] = [char]"0" # 28: AttributeAuthorizationOnLDAPAdd (Index 27) -> must be "1" for Level 5 $charArray[27] = [char]"1" # 29: BlockOwnerImplicitRights (Index 28) -> must be "1" for Level 5 $charArray[28] = [char]"1" # 30: thirtiethChar (Index 29) -> control character, must be "3" $charArray[29] = [char]"3" # 31: DisableConfidentialAttributeEncryptionRequirements (Index 30) -> must be "0" $charArray[30] = [char]"0" $newHeuristics = [string]::new($charArray) } if ($currentHeuristics -ne $newHeuristics) { Write-Host "Updating dSHeuristics from '$currentHeuristics' to '$newHeuristics'..." -ForegroundColor Yellow $dsObject.Properties["dSHeuristics"].Value = $newHeuristics $dsObject.CommitChanges() Write-Host "dSHeuristics updated successfully." -ForegroundColor Green } else { Write-Host "dSHeuristics is already configured securely ('$currentHeuristics'). No action required." -ForegroundColor Green } To verify the setting has been applied: Download Script: Get-dSHeuristicsStatus.ps1 # Get-dSHeuristicsStatus.ps1 # Description: Audits the dSHeuristics attribute settings for security compliance. Write-Host "--- Auditing dSHeuristics Configuration ---" -ForegroundColor Cyan $rootDSE = [ADSI]"LDAP://RootDSE" $configNamingContext = $rootDSE.configurationNamingContext[0] $dsPath = "LDAP://CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$configNamingContext" $dsObject = [ADSI]$dsPath $dsHeuristics = $dsObject.Properties["dSHeuristics"].Value function Get-HeuristicChar { param( [string]$String, [int]$Index, # 0-based index [char]$Default = [char]"0" ) if ($null -ne $String -and $String.Length -gt $Index) { return $String.Substring($Index, 1) } return $Default } $vulnerable = $false $nonLevel5 = $false if ($null -eq $dsHeuristics -or $dsHeuristics -eq "") { Write-Host "[!] dSHeuristics is not set. Default settings apply." -ForegroundColor Yellow Write-Host " - AttributeAuthorizationOnLDAPAdd: Not Set (defaults to 0, which is Level 3/4 but NOT Level 5)" -ForegroundColor Yellow Write-Host " - BlockOwnerImplicitRights: Not Set (defaults to 0, which is Level 3/4 but NOT Level 5)" -ForegroundColor Yellow $nonLevel5 = $true } else { Write-Host "[+] Current dSHeuristics string: $dsHeuristics" -ForegroundColor Green # 7. fLDAPBlockAnonOps (Index 6) $val = Get-HeuristicChar -String $dsHeuristics -Index 6 if ($val -eq "2") { Write-Host "[!] VULNERABLE: fLDAPBlockAnonOps is set to '2' (Allows anonymous LDAP operations)." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] fLDAPBlockAnonOps (Index 6): Set to '$val' (Anonymous LDAP operations blocked)." -ForegroundColor Green } # 8. fAllowAnonNSPI (Index 7) $val = Get-HeuristicChar -String $dsHeuristics -Index 7 if ($val -ne "0") { Write-Host "[!] VULNERABLE: fAllowAnonNSPI is set to '$val' (Allows anonymous NSPI access; must be 0)." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] fAllowAnonNSPI (Index 7): Set to '0' (Anonymous NSPI blocked)." -ForegroundColor Green } # 16. dwAdminSDExMask (Index 15) $val = Get-HeuristicChar -String $dsHeuristics -Index 15 if ($val -ne "0") { Write-Host "[!] VULNERABLE: dwAdminSDExMask is set to '$val' (Disables protection for administrative groups; must be 0)." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] dwAdminSDExMask (Index 15): Set to '0' (All default admin groups protected)." -ForegroundColor Green } # 21. DoNotVerifyUPNAndOrSPNUniqueness (Index 20) $val = Get-HeuristicChar -String $dsHeuristics -Index 20 if ($val -ne "0") { Write-Host "[!] VULNERABLE: DoNotVerifyUPNAndOrSPNUniqueness is set to '$val' (Bypasses UPN/SPN uniqueness checks; must be 0)." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] DoNotVerifyUPNAndOrSPNUniqueness (Index 20): Set to '0' (Uniqueness checks active)." -ForegroundColor Green } # 28. AttributeAuthorizationOnLDAPAdd (Index 27) $val = Get-HeuristicChar -String $dsHeuristics -Index 27 if ($val -eq "2") { Write-Host "[!] VULNERABLE: AttributeAuthorizationOnLDAPAdd is set to '2' (Bypasses LDAP Add authorization checks)." -ForegroundColor Red $vulnerable = $true } elseif ($val -ne "1") { Write-Host "[!] WARNING: AttributeAuthorizationOnLDAPAdd is set to '$val' (Must be set to '1' for Level 5 security)." -ForegroundColor Yellow $nonLevel5 = $true } else { Write-Host "[+] AttributeAuthorizationOnLDAPAdd (Index 27): Set to '1' (Level 5 secure)." -ForegroundColor Green } # 29. BlockOwnerImplicitRights (Index 28) $val = Get-HeuristicChar -String $dsHeuristics -Index 28 if ($val -eq "2") { Write-Host "[!] VULNERABLE: BlockOwnerImplicitRights is set to '2' (Bypasses owner implicit rights protection)." -ForegroundColor Red $vulnerable = $true } elseif ($val -ne "1") { Write-Host "[!] WARNING: BlockOwnerImplicitRights is set to '$val' (Must be set to '1' for Level 5 security)." -ForegroundColor Yellow $nonLevel5 = $true } else { Write-Host "[+] BlockOwnerImplicitRights (Index 28): Set to '1' (Level 5 secure)." -ForegroundColor Green } # 31. DisableConfidentialAttributeEncryptionRequirements (Index 30) $val = Get-HeuristicChar -String $dsHeuristics -Index 30 if ($val -ne "0") { Write-Host "[!] VULNERABLE: DisableConfidentialAttributeEncryptionRequirements is set to '$val' (Allows unencrypted transmission of confidential attributes; must be 0)." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] DisableConfidentialAttributeEncryptionRequirements (Index 30): Set to '0' (Requires encrypted connection)." -ForegroundColor Green } } if ($vulnerable) { Write-Host "[!] Result: VULNERABLE (Dangerous settings detected in dSHeuristics)." -ForegroundColor Red } elseif ($nonLevel5) { Write-Host "[!] Result: Partially Secure (No highly dangerous settings, but Level 5 maximum security is not reached)." -ForegroundColor Yellow } else { Write-Host "[+] Result: SECURE (Level 5 security reached)." -ForegroundColor Green } # Configure-dSHeuristics.ps1 # Description: Configures the dSHeuristics attribute to reach Level 5 security. Write-Host "Applying hardening requirement: Configure dSHeuristics..." -ForegroundColor Cyan # Ensure we can read the Configuration naming context $rootDSE = [ADSI]"LDAP://RootDSE" $configNamingContext = $rootDSE.configurationNamingContext[0] $dsPath = "LDAP://CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$configNamingContext" $dsObject = [ADSI]$dsPath $currentHeuristics = $dsObject.Properties["dSHeuristics"].Value $newHeuristics = "" if ($null -eq $currentHeuristics -or $currentHeuristics -eq "") { # Initialize with default 31-character Level 5 string if not already configured $newHeuristics = "0000000001000000000200000001130" } else { # If already set, we need to modify specific indices while preserving other values $charArray = $currentHeuristics.ToCharArray() # Pad array to at least 31 characters to support all configurations if ($charArray.Length -lt 31) { $tempArray = [char[]](New-Object char[] 31) for ($i = 0; $i -lt 31; $i++) { if ($i -lt $charArray.Length) { $tempArray[$i] = $charArray[$i] } else { $tempArray[$i] = [char]"0" } } $charArray = $tempArray } # 7: fLDAPBlockAnonOps (Index 6) if ($charArray[6] -eq [char]"2") { $charArray[6] = [char]"0" } # 8: fAllowAnonNSPI (Index 7) -> must be "0" $charArray[7] = [char]"0" # 10: tenthChar (Index 9) -> control character, must be "1" $charArray[9] = [char]"1" # 16: dwAdminSDExMask (Index 15) -> must be "0" $charArray[15] = [char]"0" # 20: twentiethChar (Index 19) -> control character, must be "2" $charArray[19] = [char]"2" # 21: DoNotVerifyUPNAndOrSPNUniqueness (Index 20) -> must be "0" $charArray[20] = [char]"0" # 28: AttributeAuthorizationOnLDAPAdd (Index 27) -> must be "1" for Level 5 $charArray[27] = [char]"1" # 29: BlockOwnerImplicitRights (Index 28) -> must be "1" for Level 5 $charArray[28] = [char]"1" # 30: thirtiethChar (Index 29) -> control character, must be "3" $charArray[29] = [char]"3" # 31: DisableConfidentialAttributeEncryptionRequirements (Index 30) -> must be "0" $charArray[30] = [char]"0" $newHeuristics = [string]::new($charArray) } if ($currentHeuristics -ne $newHeuristics) { Write-Host "Updating dSHeuristics from '$currentHeuristics' to '$newHeuristics'..." -ForegroundColor Yellow $dsObject.Properties["dSHeuristics"].Value = $newHeuristics $dsObject.CommitChanges() Write-Host "dSHeuristics updated successfully." -ForegroundColor Green } else { Write-Host "dSHeuristics is already configured securely ('$currentHeuristics'). No action required." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers, Member Servers. Operating Systems: Windows Server 2016 and above. File Path: 02-domain-controllers/configure-security-options.md Windows Security Options control critical security settings such as anonymous access to Named Pipes, remote access to the registry (winreg), and domain member secure channel parameters. Restricting these options prevents credential sniffing, service enumeration, and remote unauthorized inspection of local configurations. Specifically, the following settings are configured to protect the Tier 0 administrative boundary: 1. Server Operator Task Scheduling (`SubmitQueue`): Restricting Server Operators from scheduling tasks on Domain Controllers prevents privilege escalation and command execution pathways. 2. Secure Channel Protection (`RequireStrongKey` / `AllowVulnerableChannel`): Restricting secure channels to strong session keys and blocking vulnerable connections mitigates coercion and impersonation attacks. 3. Machine Password Change (`RefusePasswordChange` / `DisablePasswordChange` / `MaximumPasswordAge`): Ensuring domain members rotate machine account passwords at regular intervals prevents offline account hijacking while forcing the DC to process password changes correctly. 4. Anonymous Named Pipe Restricting (`NullSessionPipes`): Setting NullSessionPipes to a minimum required list prevents anonymous callers from enumerating user SIDs or directories on Domain Controllers. 5. Remote Registry Restrictions (`winreg` Exact Paths and Paths): Restricting remote WinReg operations prevents information disclosure and configuration scanning. 6. Network Credentials Storage Restrictions (`DisableDomainCreds`): Blocking the local storage of credentials or passwords for network authentication prevents local security databases from caching reusable network hashes, hindering lateral movement. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management workstation. Edit the modular Domain Controllers GPO (e.g., SEC_DomainControllers_Hardening). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies as specified: | Policy Setting | Setting Value | | :--- | :--- | | Domain controller: Allow server operators to schedule tasks | Disabled | | Domain controller: Allow vulnerable Netlogon secure channel connections | Not Configured | | Domain controller: Refuse machine account password changes | Disabled | | Domain member: Disable machine account password changes | Disabled | | Domain member: Maximum machine account password age | 30 | | Domain member: Require strong (Windows 2000 or later) session key | Enabled | | Network access: Do not allow storage of passwords and credentials for network authentication | Enabled | | Network access: Named Pipes that can be accessed anonymously | netlogon, samr, lsarpc | | Network access: Remotely accessible registry paths | System\CurrentControlSet\Control\ProductOptions, System\CurrentControlSet\Control\Server Applications, Software\Microsoft\Windows NT\CurrentVersion | | Network access: Remotely accessible registry paths and sub-paths | System\CurrentControlSet\Control\Print\Printers, System\CurrentControlSet\Services\Eventlog, Software\Microsoft\OLAP Server, Software\Microsoft\Windows NT\CurrentVersion\Print, Software\Microsoft\Windows NT\CurrentVersion\Windows, System\CurrentControlSet\Control\ContentIndex, System\CurrentControlSet\Control\Terminal Server, System\CurrentControlSet\Control\Terminal Server\UserConfig, System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration, Software\Microsoft\Windows NT\CurrentVersion\Perflib, System\CurrentControlSet\Services\SysmonLog | Link the GPO to the appropriate Organizational Unit. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the registry configuration locally. Download Script: Configure-DCSecurityOptions.ps1 # Configure-DCSecurityOptions.ps1 # Description: Configures GPO Security Options registry keys for Domain Controllers. Write-Host "Applying hardening requirement: Configure Security Options for Domain Controllers..." -ForegroundColor Cyan # 1. Domain controller: Allow server operators to schedule tasks = Disabled (SubmitQueue = 0) $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "SubmitQueue" -Value 0 -Type DWord -Force Write-Host " Domain controller: Allow server operators to schedule tasks set to Disabled." -ForegroundColor Green # 1b. Network access: Do not allow storage of passwords and credentials for network authentication = Enabled (DisableDomainCreds = 1) Set-ItemProperty -Path $LsaPath -Name "DisableDomainCreds" -Value 1 -Type DWord -Force Write-Host " Network access: Do not allow storage of credentials set to Enabled." -ForegroundColor Green # 2. Domain controller: Allow vulnerable Netlogon secure channel connections = Not Configured / Explicitly Blocked $NetlogonParamsPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" if (-not (Test-Path $NetlogonParamsPath)) { New-Item -Path $NetlogonParamsPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonParamsPath -Name "AllowVulnerableChannel" -Value 0 -Type DWord -Force Write-Host " Domain controller: Allow vulnerable Netlogon connections set to Disabled." -ForegroundColor Green # 3. Domain controller: Refuse machine account password changes = Disabled Set-ItemProperty -Path $NetlogonParamsPath -Name "RefusePasswordChange" -Value 0 -Type DWord -Force Write-Host " Domain controller: Refuse machine account password changes set to Disabled." -ForegroundColor Green # 4. Domain member: Disable machine account password changes = Disabled Set-ItemProperty -Path $NetlogonParamsPath -Name "DisablePasswordChange" -Value 0 -Type DWord -Force Write-Host " Domain member: Disable machine account password changes set to Disabled." -ForegroundColor Green # 5. Domain member: Maximum machine account password age = 30 Set-ItemProperty -Path $NetlogonParamsPath -Name "MaximumPasswordAge" -Value 30 -Type DWord -Force Write-Host " Domain member: Maximum machine account password age set to 30." -ForegroundColor Green # 6. Domain member: Require strong (Windows 2000 or later) session key = Enabled Set-ItemProperty -Path $NetlogonParamsPath -Name "RequireStrongKey" -Value 1 -Type DWord -Force Write-Host " Domain member: Require strong session key set to Enabled." -ForegroundColor Green # 7. Network access: Named Pipes that can be accessed anonymously (netlogon, samr, lsarpc) $LanmanServerParamsPath = "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" if (-not (Test-Path $LanmanServerParamsPath)) { New-Item -Path $LanmanServerParamsPath -Force | Out-Null } $NullSessionPipes = @("netlogon", "samr", "lsarpc") Set-ItemProperty -Path $LanmanServerParamsPath -Name "NullSessionPipes" -Value $NullSessionPipes -Type MultiString -Force Write-Host " Network access: Named Pipes that can be accessed anonymously configured." -ForegroundColor Green # 8. Network access: Remotely accessible registry paths $WinregExactPath = "HKLM:\System\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedExactPaths" if (-not (Test-Path $WinregExactPath)) { New-Item -Path $WinregExactPath -Force | Out-Null } $AllowedExactPaths = @( "System\CurrentControlSet\Control\ProductOptions", "System\CurrentControlSet\Control\Server Applications", "Software\Microsoft\Windows NT\CurrentVersion" ) Set-ItemProperty -Path $WinregExactPath -Name "Machine" -Value $AllowedExactPaths -Type MultiString -Force Write-Host " Network access: Remotely accessible registry paths configured." -ForegroundColor Green # 9. Network access: Remotely accessible registry paths and sub-paths $WinregPath = "HKLM:\System\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths" if (-not (Test-Path $WinregPath)) { New-Item -Path $WinregPath -Force | Out-Null } $AllowedPaths = @( "System\CurrentControlSet\Control\Print\Printers", "System\CurrentControlSet\Services\Eventlog", "Software\Microsoft\OLAP Server", "Software\Microsoft\Windows NT\CurrentVersion\Print", "Software\Microsoft\Windows NT\CurrentVersion\Windows", "System\CurrentControlSet\Control\ContentIndex", "System\CurrentControlSet\Control\Terminal Server", "System\CurrentControlSet\Control\Terminal Server\UserConfig", "System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration", "Software\Microsoft\Windows NT\CurrentVersion\Perflib", "System\CurrentControlSet\Services\SysmonLog" ) # Optional AD CS or WINS sub-paths $CertSvc = Get-Service -Name "CertSvc" -ErrorAction SilentlyContinue if ($null -ne $CertSvc) { $AllowedPaths += "System\CurrentControlSet\Services\CertSvc" Write-Host " AD CS detected: adding CertSvc registry path." -ForegroundColor Gray } $WinsSvc = Get-Service -Name "WINS" -ErrorAction SilentlyContinue if ($null -ne $WinsSvc) { $AllowedPaths += "System\CurrentControlSet\Services\WINS" Write-Host " WINS detected: adding WINS registry path." -ForegroundColor Gray } Set-ItemProperty -Path $WinregPath -Name "Machine" -Value $AllowedPaths -Type MultiString -Force Write-Host " Network access: Remotely accessible registry paths and sub-paths configured." -ForegroundColor Green Write-Host "Domain Controller Security Options configuration completed." -ForegroundColor Green To audit local configurations, execute the following script: Download Script: Get-DCSecurityOptionsStatus.ps1 # Get-DCSecurityOptionsStatus.ps1 # Description: Audits GPO Security Options registry keys for Domain Controllers. Write-Host "--- Auditing Domain Controller Security Options ---" -ForegroundColor Cyan $vulnerable = $false # Helper function to check DWORD value function Test-DwordValue { param( [string]$Path, [string]$ValueName, [int]$ExpectedValue ) $Val = Get-ItemProperty -Path $Path -Name $ValueName -ErrorAction SilentlyContinue if ($null -eq $Val) { Write-Host " [!] VULNERABLE: $($ValueName) under $($Path) is not configured." -ForegroundColor Red return $true } $ActualVal = $Val.$ValueName if ($ActualVal -ne $ExpectedValue) { Write-Host " [!] VULNERABLE: $($ValueName) is set to $($ActualVal) (Expected: $($ExpectedValue))" -ForegroundColor Red return $true } Write-Host " [+] $($ValueName) is set to $($ActualVal) (Compliant)." -ForegroundColor Green return $false } # 1. Domain controller: Allow server operators to schedule tasks (SubmitQueue = 0) if (Test-DwordValue -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -ValueName "SubmitQueue" -ExpectedValue 0) { $vulnerable = $true } # 1b. Network access: Do not allow storage of passwords and credentials for network authentication (DisableDomainCreds = 1) if (Test-DwordValue -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -ValueName "DisableDomainCreds" -ExpectedValue 1) { $vulnerable = $true } # 2. Domain controller: Allow vulnerable Netlogon connections (AllowVulnerableChannel = 0) if (Test-DwordValue -Path "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" -ValueName "AllowVulnerableChannel" -ExpectedValue 0) { $vulnerable = $true } # 3. Domain controller: Refuse machine account password changes (RefusePasswordChange = 0) if (Test-DwordValue -Path "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" -ValueName "RefusePasswordChange" -ExpectedValue 0) { $vulnerable = $true } # 4. Domain member: Disable machine account password changes (DisablePasswordChange = 0) if (Test-DwordValue -Path "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" -ValueName "DisablePasswordChange" -ExpectedValue 0) { $vulnerable = $true } # 5. Domain member: Maximum machine account password age (MaximumPasswordAge = 30) $MaxAgeVal = Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" -Name "MaximumPasswordAge" -ErrorAction SilentlyContinue if ($null -eq $MaxAgeVal) { Write-Host " [!] VULNERABLE: MaximumPasswordAge is not configured." -ForegroundColor Red $vulnerable = $true } else { $ActualAge = $MaxAgeVal.MaximumPasswordAge if ($ActualAge -gt 30 -or $ActualAge -eq 0) { Write-Host " [!] VULNERABLE: MaximumPasswordAge is $($ActualAge) (Expected: 30 or fewer, but not 0)" -ForegroundColor Red $vulnerable = $true } else { Write-Host " [+] MaximumPasswordAge is $($ActualAge) (Compliant)." -ForegroundColor Green } } # 6. Domain member: Require strong session key (RequireStrongKey = 1) if (Test-DwordValue -Path "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" -ValueName "RequireStrongKey" -ExpectedValue 1) { $vulnerable = $true } # Helper function to check MultiString value function Test-MultiStringValue { param( [string]$Path, [string]$ValueName, [string[]]$ExpectedElements ) $Val = Get-ItemProperty -Path $Path -Name $ValueName -ErrorAction SilentlyContinue if ($null -eq $Val) { Write-Host " [!] VULNERABLE: $($ValueName) under $($Path) is not configured." -ForegroundColor Red return $true } $ActualList = $Val.$ValueName $Missing = @() foreach ($E in $ExpectedElements) { $Found = $false foreach ($A in $ActualList) { if ($A.Trim().ToLower() -eq $E.ToLower()) { $Found = $true break } } if (-not $Found) { $Missing += $E } } if ($Missing.Count -gt 0) { Write-Host " [!] VULNERABLE: $($ValueName) is missing elements: $($Missing -join ', ')" -ForegroundColor Red return $true } Write-Host " [+] $($ValueName) contains all required elements (Compliant)." -ForegroundColor Green return $false } # 7. Network access: Named Pipes that can be accessed anonymously $RequiredPipes = @("netlogon", "samr", "lsarpc") if (Test-MultiStringValue -Path "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" -ValueName "NullSessionPipes" -ExpectedElements $RequiredPipes) { $vulnerable = $true } # 8. Network access: Remotely accessible registry paths $RequiredExactPaths = @( "System\CurrentControlSet\Control\ProductOptions", "System\CurrentControlSet\Control\Server Applications", "Software\Microsoft\Windows NT\CurrentVersion" ) if (Test-MultiStringValue -Path "HKLM:\System\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedExactPaths" -ValueName "Machine" -ExpectedElements $RequiredExactPaths) { $vulnerable = $true } # 9. Network access: Remotely accessible registry paths and sub-paths $RequiredPaths = @( "System\CurrentControlSet\Control\Print\Printers", "System\CurrentControlSet\Services\Eventlog", "Software\Microsoft\OLAP Server", "Software\Microsoft\Windows NT\CurrentVersion\Print", "Software\Microsoft\Windows NT\CurrentVersion\Windows", "System\CurrentControlSet\Control\ContentIndex", "System\CurrentControlSet\Control\Terminal Server", "System\CurrentControlSet\Control\Terminal Server\UserConfig", "System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration", "Software\Microsoft\Windows NT\CurrentVersion\Perflib", "System\CurrentControlSet\Services\SysmonLog" ) # Optional AD CS or WINS sub-paths $CertSvc = Get-Service -Name "CertSvc" -ErrorAction SilentlyContinue if ($null -ne $CertSvc) { $RequiredPaths += "System\CurrentControlSet\Services\CertSvc" } $WinsSvc = Get-Service -Name "WINS" -ErrorAction SilentlyContinue if ($null -ne $WinsSvc) { $RequiredPaths += "System\CurrentControlSet\Services\WINS" } if (Test-MultiStringValue -Path "HKLM:\System\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths" -ValueName "Machine" -ExpectedElements $RequiredPaths) { $vulnerable = $true } if ($vulnerable) { Write-Host "Audit result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit result: SECURE" -ForegroundColor Green } # Configure-DCSecurityOptions.ps1 # Description: Configures GPO Security Options registry keys for Domain Controllers. Write-Host "Applying hardening requirement: Configure Security Options for Domain Controllers..." -ForegroundColor Cyan # 1. Domain controller: Allow server operators to schedule tasks = Disabled (SubmitQueue = 0) $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "SubmitQueue" -Value 0 -Type DWord -Force Write-Host " Domain controller: Allow server operators to schedule tasks set to Disabled." -ForegroundColor Green # 1b. Network access: Do not allow storage of passwords and credentials for network authentication = Enabled (DisableDomainCreds = 1) Set-ItemProperty -Path $LsaPath -Name "DisableDomainCreds" -Value 1 -Type DWord -Force Write-Host " Network access: Do not allow storage of credentials set to Enabled." -ForegroundColor Green # 2. Domain controller: Allow vulnerable Netlogon secure channel connections = Not Configured / Explicitly Blocked $NetlogonParamsPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" if (-not (Test-Path $NetlogonParamsPath)) { New-Item -Path $NetlogonParamsPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonParamsPath -Name "AllowVulnerableChannel" -Value 0 -Type DWord -Force Write-Host " Domain controller: Allow vulnerable Netlogon connections set to Disabled." -ForegroundColor Green # 3. Domain controller: Refuse machine account password changes = Disabled Set-ItemProperty -Path $NetlogonParamsPath -Name "RefusePasswordChange" -Value 0 -Type DWord -Force Write-Host " Domain controller: Refuse machine account password changes set to Disabled." -ForegroundColor Green # 4. Domain member: Disable machine account password changes = Disabled Set-ItemProperty -Path $NetlogonParamsPath -Name "DisablePasswordChange" -Value 0 -Type DWord -Force Write-Host " Domain member: Disable machine account password changes set to Disabled." -ForegroundColor Green # 5. Domain member: Maximum machine account password age = 30 Set-ItemProperty -Path $NetlogonParamsPath -Name "MaximumPasswordAge" -Value 30 -Type DWord -Force Write-Host " Domain member: Maximum machine account password age set to 30." -ForegroundColor Green # 6. Domain member: Require strong (Windows 2000 or later) session key = Enabled Set-ItemProperty -Path $NetlogonParamsPath -Name "RequireStrongKey" -Value 1 -Type DWord -Force Write-Host " Domain member: Require strong session key set to Enabled." -ForegroundColor Green # 7. Network access: Named Pipes that can be accessed anonymously (netlogon, samr, lsarpc) $LanmanServerParamsPath = "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" if (-not (Test-Path $LanmanServerParamsPath)) { New-Item -Path $LanmanServerParamsPath -Force | Out-Null } $NullSessionPipes = @("netlogon", "samr", "lsarpc") Set-ItemProperty -Path $LanmanServerParamsPath -Name "NullSessionPipes" -Value $NullSessionPipes -Type MultiString -Force Write-Host " Network access: Named Pipes that can be accessed anonymously configured." -ForegroundColor Green # 8. Network access: Remotely accessible registry paths $WinregExactPath = "HKLM:\System\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedExactPaths" if (-not (Test-Path $WinregExactPath)) { New-Item -Path $WinregExactPath -Force | Out-Null } $AllowedExactPaths = @( "System\CurrentControlSet\Control\ProductOptions", "System\CurrentControlSet\Control\Server Applications", "Software\Microsoft\Windows NT\CurrentVersion" ) Set-ItemProperty -Path $WinregExactPath -Name "Machine" -Value $AllowedExactPaths -Type MultiString -Force Write-Host " Network access: Remotely accessible registry paths configured." -ForegroundColor Green # 9. Network access: Remotely accessible registry paths and sub-paths $WinregPath = "HKLM:\System\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths" if (-not (Test-Path $WinregPath)) { New-Item -Path $WinregPath -Force | Out-Null } $AllowedPaths = @( "System\CurrentControlSet\Control\Print\Printers", "System\CurrentControlSet\Services\Eventlog", "Software\Microsoft\OLAP Server", "Software\Microsoft\Windows NT\CurrentVersion\Print", "Software\Microsoft\Windows NT\CurrentVersion\Windows", "System\CurrentControlSet\Control\ContentIndex", "System\CurrentControlSet\Control\Terminal Server", "System\CurrentControlSet\Control\Terminal Server\UserConfig", "System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration", "Software\Microsoft\Windows NT\CurrentVersion\Perflib", "System\CurrentControlSet\Services\SysmonLog" ) # Optional AD CS or WINS sub-paths $CertSvc = Get-Service -Name "CertSvc" -ErrorAction SilentlyContinue if ($null -ne $CertSvc) { $AllowedPaths += "System\CurrentControlSet\Services\CertSvc" Write-Host " AD CS detected: adding CertSvc registry path." -ForegroundColor Gray } $WinsSvc = Get-Service -Name "WINS" -ErrorAction SilentlyContinue if ($null -ne $WinsSvc) { $AllowedPaths += "System\CurrentControlSet\Services\WINS" Write-Host " WINS detected: adding WINS registry path." -ForegroundColor Gray } Set-ItemProperty -Path $WinregPath -Name "Machine" -Value $AllowedPaths -Type MultiString -Force Write-Host " Network access: Remotely accessible registry paths and sub-paths configured." -ForegroundColor Green Write-Host "Domain Controller Security Options configuration completed." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/configure-telemetry-privacy.md Restricting telemetry, remote help channels, data sharing features, and diagnostic logs on Domain Controllers limits target exposure and data leakage: 1. Minimize Telemetry and Personalization Leakage: Domain Controllers process highly sensitive security directory events, administrative tasks, and structural secrets. Personalization telemetry (such as handwriting sharing, speech data, and Customer Experience Improvement Programs) sends host telemetry to external cloud endpoints. 2. Disable Non-Essential Network Services: Features like Online Help, printing over HTTP, and Windows Spotlight create unauthenticated outbound connections to cloud platforms. 3. Restrict Diagnostic Tools: Interactive diagnostic channels like the Microsoft Support Diagnostic Tool (MSDT) have been targeted in remote execution exploits (e.g., Follina). Restricting interactive troubleshooting tools prevents adversaries from utilizing diagnostic capabilities for code execution. 4. Prevent Cloud Synchronization: Message cloud synchronization, push-to-install services, and cloud-based search highlights run background processes that expose local queries and operations to external networks. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Group Policy settings to disable telemetry and cloud services: Open the Group Policy Management Console (gpmc.msc). Edit the appropriate GPO targeting the Domain Controllers (e.g., GPO_Hardening_DomainControllers). Configure the following settings under Computer Configuration: `Control Panel\Allow Online Tips` -> Disabled `Network\Fonts\Enable Font Providers` -> Disabled `Start Menu and Taskbar\Turn off notifications network usage` -> Enabled * System\Internet Communication Management\Internet Communication settings: `Turn off handwriting personalization data sharing` -> Enabled `Turn off handwriting recognition error reporting` -> Enabled `Turn off printing over HTTP` -> Enabled `Turn off Search Companion content file updates` -> Enabled `Turn off the "Order Prints" picture task` -> Enabled `Turn off the "Publish to Web" task for files and folders` -> Enabled `Turn off the Windows Messenger Customer Experience Improvement Program` -> Enabled `Turn off Windows Customer Experience Improvement Program` -> Enabled `Turn off Windows Error Reporting` -> Enabled `System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool\Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider` -> Disabled `System\User Profiles\Turn off the advertising ID` -> Enabled `Windows Components\App Package Deployment\Allow a Windows app to share application data between users` -> Disabled `Windows Components\Camera\Allow Use of Camera` -> Disabled `Windows Components\Data Collection and Preview Builds\Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service` -> Enabled: Disable Authenticated Proxy usage `Windows Components\Location and Sensors\Turn off location` -> Enabled `Windows Components\Messaging\Allow Message Service Cloud Sync` -> Disabled `Windows Components\Push to Install\Turn off Push To Install service` -> Enabled `Windows Components\Search\Allow Cloud Search` -> Enabled: Disable Cloud Search `Windows Components\Search\Allow search highlights` -> Disabled `Windows Components\Software Protection Platform\Turn off KMS Client Online AVS Validation` -> Enabled `Windows Components\Windows Ink Workspace\Allow suggested apps in Windows Ink Workspace` -> Disabled Configure the following settings under User Configuration (or configure via GPO Preferences Registry if Loopback Processing is not active): `System\Internet Communication Management\Internet Communication Settings\Turn off Help Experience Improvement Program` -> Enabled `Windows Components\Cloud Content\Do not use diagnostic data for tailored experiences` -> Enabled `Windows Components\Cloud Content\Turn off all Windows spotlight features` -> Enabled `Windows Components\Windows Media Player\Playback\Prevent Codec Download` -> Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to enforce telemetry and privacy registry hardening. Download Script: Configure-DCTelemetryPrivacy.ps1 # Configure-DCTelemetryPrivacy.ps1 # Description: Configures telemetry, diagnostic, and privacy options for Domain Controllers. Write-Host "Applying Telemetry and Privacy baseline settings..." -ForegroundColor Cyan # Helper function to create keys and set values safely function Set-RegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$path, [string]$name, [int]$value ) if ($PSCmdlet.ShouldProcess($path, "Set registry DWORD value $name to $value")) { $parent = Split-Path -Path $path if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null } Set-ItemProperty -Path $path -Name $name -Value $value -Type DWord -Force } } # 1. HKLM Policy Configurations Set-RegDWord "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "AllowOnlineTips" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" "EnableFontProviders" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoCloudApplicationNotification" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC" "PreventHandwritingDataSharing" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports" "PreventHandwritingErrorReports" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableHTTPPrinting" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion" "DisableContentFileUpdates" 1 Set-RegDWord "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoOnlinePrintsWizard" 1 Set-RegDWord "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoPublishingWizard" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Messenger\Client" "CEIP" 2 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows" "CEIPEnable" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" "Disabled" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" "DoReport" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy" "DisableQueryRemoteServer" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" "DisabledByGroupPolicy" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager" "AllowSharedLocalAppData" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Camera" "AllowCamera" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" "DisableEnterpriseAuthProxy" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" "DisableLocation" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging" "AllowMessageSync" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall" "DisablePushToInstall" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" "AllowCloudSearch" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" "EnableDynamicContentInWSB" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" "NoGenTicket" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" "AllowSuggestedAppsInWindowsInkWorkspace" 0 Write-Host "HKLM telemetry parameters configured." -ForegroundColor Green # 2. Configure Current User Settings (HKCU) $AssistancePath = "HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0" Set-RegDWord $AssistancePath "NoImplicitFeedback" 1 $CloudContentPath = "HKCU:\Software\Policies\Microsoft\Windows\CloudContent" Set-RegDWord $CloudContentPath "DisableTailoredExperiencesWithDiagnosticData" 1 Set-RegDWord $CloudContentPath "DisableWindowsSpotlightFeatures" 1 $MediaPlayerPath = "HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer" Set-RegDWord $MediaPlayerPath "PreventCodecDownload" 1 Write-Host "HKCU telemetry parameters configured." -ForegroundColor Green # 3. Configure Default User Hive Settings (HKU\DefaultUser) $DefaultUserHive = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultUserHive) { Write-Host "Loading Default User hive..." -ForegroundColor Gray reg load HKU\DefaultUser $DefaultUserHive | Out-Null Set-RegDWord "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Assistance\Client\1.0" "NoImplicitFeedback" 1 Set-RegDWord "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" "DisableTailoredExperiencesWithDiagnosticData" 1 Set-RegDWord "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" "DisableWindowsSpotlightFeatures" 1 Set-RegDWord "Registry::HKU\DefaultUser\Software\Policies\Microsoft\WindowsMediaPlayer" "PreventCodecDownload" 1 [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null Write-Host "Default User hive configurations applied." -ForegroundColor Green } else { Write-Warning "Default User hive not found." } Write-Host "Telemetry and privacy settings applied successfully." -ForegroundColor Green To verify the settings have been applied: Download Script: Get-DCTelemetryPrivacyStatus.ps1 # Get-DCTelemetryPrivacyStatus.ps1 # Description: Audits registry configuration of telemetry, diagnostic, and privacy settings on Domain Controllers. Write-Host "--- Auditing Domain Controller Telemetry and Privacy Settings ---" -ForegroundColor Cyan $script:Vulnerable = $false # Helper function to audit registry properties function Test-RegistryValue ($path, $name, $expectedValue) { $val = Get-ItemProperty -Path $path -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } $color = "Red" if ($actual -eq $expectedValue) { $color = "Green" } else { $script:Vulnerable = $true } Write-Host " - Registry Setting: $($name) | Actual: '$($actual)' (Expected: '$($expectedValue)')" -ForegroundColor $color } # 1. HKLM Audits Write-Host "Auditing HKLM Settings..." -ForegroundColor Gray Test-RegistryValue "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "AllowOnlineTips" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" "EnableFontProviders" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoCloudApplicationNotification" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC" "PreventHandwritingDataSharing" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports" "PreventHandwritingErrorReports" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableHTTPPrinting" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion" "DisableContentFileUpdates" 1 Test-RegistryValue "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoOnlinePrintsWizard" 1 Test-RegistryValue "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoPublishingWizard" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Messenger\Client" "CEIP" 2 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows" "CEIPEnable" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" "Disabled" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" "DoReport" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy" "DisableQueryRemoteServer" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" "DisabledByGroupPolicy" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager" "AllowSharedLocalAppData" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Camera" "AllowCamera" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" "DisableEnterpriseAuthProxy" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" "DisableLocation" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging" "AllowMessageSync" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall" "DisablePushToInstall" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" "AllowCloudSearch" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" "EnableDynamicContentInWSB" 0 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" "NoGenTicket" 1 Test-RegistryValue "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" "AllowSuggestedAppsInWindowsInkWorkspace" 0 # 2. HKCU Audits Write-Host "Auditing HKCU Settings..." -ForegroundColor Gray Test-RegistryValue "HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0" "NoImplicitFeedback" 1 Test-RegistryValue "HKCU:\Software\Policies\Microsoft\Windows\CloudContent" "DisableTailoredExperiencesWithDiagnosticData" 1 Test-RegistryValue "HKCU:\Software\Policies\Microsoft\Windows\CloudContent" "DisableWindowsSpotlightFeatures" 1 Test-RegistryValue "HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer" "PreventCodecDownload" 1 if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green } # Configure-DCTelemetryPrivacy.ps1 # Description: Configures telemetry, diagnostic, and privacy options for Domain Controllers. Write-Host "Applying Telemetry and Privacy baseline settings..." -ForegroundColor Cyan # Helper function to create keys and set values safely function Set-RegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$path, [string]$name, [int]$value ) if ($PSCmdlet.ShouldProcess($path, "Set registry DWORD value $name to $value")) { $parent = Split-Path -Path $path if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null } Set-ItemProperty -Path $path -Name $name -Value $value -Type DWord -Force } } # 1. HKLM Policy Configurations Set-RegDWord "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "AllowOnlineTips" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" "EnableFontProviders" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoCloudApplicationNotification" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC" "PreventHandwritingDataSharing" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports" "PreventHandwritingErrorReports" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableHTTPPrinting" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\SearchCompanion" "DisableContentFileUpdates" 1 Set-RegDWord "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoOnlinePrintsWizard" 1 Set-RegDWord "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoPublishingWizard" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Messenger\Client" "CEIP" 2 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows" "CEIPEnable" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" "Disabled" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" "DoReport" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy" "DisableQueryRemoteServer" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" "DisabledByGroupPolicy" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\AppModel\StateManager" "AllowSharedLocalAppData" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Camera" "AllowCamera" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" "DisableEnterpriseAuthProxy" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" "DisableLocation" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Messaging" "AllowMessageSync" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\PushToInstall" "DisablePushToInstall" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" "AllowCloudSearch" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" "EnableDynamicContentInWSB" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" "NoGenTicket" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" "AllowSuggestedAppsInWindowsInkWorkspace" 0 Write-Host "HKLM telemetry parameters configured." -ForegroundColor Green # 2. Configure Current User Settings (HKCU) $AssistancePath = "HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0" Set-RegDWord $AssistancePath "NoImplicitFeedback" 1 $CloudContentPath = "HKCU:\Software\Policies\Microsoft\Windows\CloudContent" Set-RegDWord $CloudContentPath "DisableTailoredExperiencesWithDiagnosticData" 1 Set-RegDWord $CloudContentPath "DisableWindowsSpotlightFeatures" 1 $MediaPlayerPath = "HKCU:\Software\Policies\Microsoft\WindowsMediaPlayer" Set-RegDWord $MediaPlayerPath "PreventCodecDownload" 1 Write-Host "HKCU telemetry parameters configured." -ForegroundColor Green # 3. Configure Default User Hive Settings (HKU\DefaultUser) $DefaultUserHive = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultUserHive) { Write-Host "Loading Default User hive..." -ForegroundColor Gray reg load HKU\DefaultUser $DefaultUserHive | Out-Null Set-RegDWord "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Assistance\Client\1.0" "NoImplicitFeedback" 1 Set-RegDWord "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" "DisableTailoredExperiencesWithDiagnosticData" 1 Set-RegDWord "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" "DisableWindowsSpotlightFeatures" 1 Set-RegDWord "Registry::HKU\DefaultUser\Software\Policies\Microsoft\WindowsMediaPlayer" "PreventCodecDownload" 1 [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null Write-Host "Default User hive configurations applied." -ForegroundColor Green } else { Write-Warning "Default User hive not found." } Write-Host "Telemetry and privacy settings applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers and Member Servers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/configure-untrusted-font-blocking.md Font files (TrueType, OpenType, and others) are highly complex formats that require advanced parsing logic. Historically, font parsing in Windows was performed by the Graphics Device Interface (GDI) within the operating system kernel. Vulnerabilities in the kernel-mode font parser (such as buffer overflows or remote code execution) have been frequently exploited by threat actors to execute arbitrary code with kernel-level privileges. Enabling Untrusted Font Blocking limits the attack surface of the graphics subsystem on Domain Controllers: 1. Kernel Attack Surface Reduction: Restricting the system to only load trusted fonts installed in the %windir%\Fonts system directory prevents the processing of malicious, web-delivered, or embedded font files. 2. Mitigation of Document-Based Exploits: Prevents malicious font files embedded in Microsoft Office documents, PDFs, or web pages from triggering parsing vulnerabilities in the context of administrative sessions on the Domain Controller. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a domain controller or management host. Create a new GPO or edit an existing one (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Mitigation Options Configure the following setting: Policy*: Untrusted Font Blocking Setting*: Enabled Mitigation Options*: Block untrusted fonts and log events Link the GPO to the Domain Controllers Organizational Unit (OU) containing the target servers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally on standalone systems or during reference image build phases. Download Script: Configure-UntrustedFontBlocking.ps1 # Configure-UntrustedFontBlocking.ps1 # Description: Configures Untrusted Font Blocking mitigation to block untrusted fonts and log events on Domain Controllers. $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions" $ValueName = "MitigationOptions_FontBocking" $ValueData = "1000000000000" Write-Host "Applying hardening requirement: Configure Untrusted Font Blocking..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type String -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-UntrustedFontBlockingStatus.ps1 # Get-UntrustedFontBlockingStatus.ps1 # Description: Checks the current configuration state of Untrusted Font Blocking registry setting on Domain Controllers. $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions" $ValueName = "MitigationOptions_FontBocking" $ExpectedValue = "1000000000000" Write-Host "Auditing hardening requirement: Configure Untrusted Font Blocking..." -ForegroundColor Cyan if (Test-Path $RegPath) { $value = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $value -and $value.$ValueName -eq $ExpectedValue) { Write-Host "Audit Result: Compliant. Untrusted fonts are blocked and logged ($($ValueName) = $($ExpectedValue))." -ForegroundColor Green exit 0 } } Write-Host "Audit Result: Non-Compliant. Untrusted fonts are not configured to block and log." -ForegroundColor Red exit 1 # Configure-UntrustedFontBlocking.ps1 # Description: Configures Untrusted Font Blocking mitigation to block untrusted fonts and log events on Domain Controllers. $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions" $ValueName = "MitigationOptions_FontBocking" $ValueData = "1000000000000" Write-Host "Applying hardening requirement: Configure Untrusted Font Blocking..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type String -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers (Tier 0) and Domain Member Servers (Tier 1). (For Privileged Access Workstations, refer to [REQ-PAW-017](../07-paws/configure-svchost-mitigation.md); for Tier 2 Client Workstations, refer to [REQ-END-030](../08-endpoints/configure-svchost-mitigation.md)). Operating Systems: Windows Server 2022, Windows Server 2025, Windows Server Semi-Annual Channel (1903 and above). File Path: 02-domain-controllers/configure-svchost-mitigation.md The Service Host (svchost.exe) process is an essential operating system component responsible for hosting multiple background services in Windows. Because svchost.exe processes execute with the highest operating system privileges (typically NT AUTHORITY\SYSTEM, NT AUTHORITY\LOCAL SERVICE, or NT AUTHORITY\NETWORK SERVICE), they represent high-value targets for adversaries seeking privilege escalation, persistence, and defense evasion across both Domain Controllers and enterprise Domain Member Servers. Option A: Group Policy Object (GPO) Configuration (Preferred) To ensure operational stability and permit phased deployment, configure separate GPOs for Tier 0 Domain Controllers and Tier 1 Member Servers. 1. Configure GPO for Domain Controllers (Tier 0) Open the Group Policy Management Console (gpmc.msc) on a Domain Controller or management workstation. Edit the baseline Domain Controller hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Service Control Manager Settings\Security Settings Double-click Enable svchost.exe mitigation options. Select Enabled. Click Apply, then OK. Link the GPO to the Domain Controllers Organizational Unit (OU=Domain Controllers,DC=contoso,DC=com). 2. Configure GPO for Domain Member Servers (Tier 1) In gpmc.msc, edit the baseline Member Server hardening GPO (e.g., GPO_Hardening_MemberServers). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Service Control Manager Settings\Security Settings Configure Enable svchost.exe mitigation options to Enabled. Link the GPO to your Member Servers Organizational Units (e.g., OU=Tier1_Servers,OU=Servers,DC=contoso,DC=com). Stage deployment across non-production and pilot server groups before enabling domain-wide. Perform a scheduled server restart during an authorized maintenance window to apply process mitigations across all system services. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally during base image creation, automated provisioning, or standalone server testing. Download Script: Configure-SvchostMitigation.ps1 # Configure-SvchostMitigation.ps1 # Description: Configures svchost.exe mitigation options to enforce Microsoft-signed binaries and block dynamic code. [CmdletBinding()] param() $ErrorActionPreference = "Stop" Write-Host "Applying hardening requirement: Configure svchost.exe mitigation options..." -ForegroundColor Cyan # Verify minimum operating system build compatibility (Windows 10 1903 / Build 18362 or Windows Server 2022 / Build 20348) $osVersion = [System.Environment]::OSVersion.Version $osBuild = $osVersion.Build if ($osBuild -lt 18362) { Write-Warning "The operating system build ($($osBuild)) does not support EnableSvchostMitigationPolicy (requires Windows Server 2022+ or Windows 10 1903+)." exit 1 } $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig" $ValueName = "EnableSvchostMitigationPolicy" $ValueData = 1 try { if (-not (Test-Path -Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null Write-Host "Created registry key: $($RegPath)" -ForegroundColor Gray } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null # Validate written value $configuredValue = (Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction Stop).$ValueName if ($configuredValue -eq $ValueData) { Write-Host "Hardening applied successfully: $($ValueName) set to 1." -ForegroundColor Green Write-Host "Note: This policy applies to newly created svchost.exe instances. A full system restart is required to protect services initialized at system boot." -ForegroundColor Yellow exit 0 } else { throw "Failed to verify registry property value after write." } } catch { Write-Error "Error configuring svchost.exe mitigation options: $($_.Exception.Message)" exit 1 } To verify the setting has been applied: Download Script: Get-SvchostMitigationStatus.ps1 # Get-SvchostMitigationStatus.ps1 # Description: Audits the configuration state of svchost.exe mitigation options. [CmdletBinding()] param() $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig" $ValueName = "EnableSvchostMitigationPolicy" $ExpectedValue = 1 Write-Host "Auditing hardening requirement: Configure svchost.exe mitigation options..." -ForegroundColor Cyan $osVersion = [System.Environment]::OSVersion.Version $osBuild = $osVersion.Build if ($osBuild -lt 18362) { Write-Warning "Audit Result: Non-Applicable / Unsupported. OS build $($osBuild) precedes the introduction of svchost mitigation policy (requires Windows Server 2022+ or Windows 10 1903+)." exit 1 } if (Test-Path -Path $RegPath) { $item = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $item -and $item.$ValueName -eq $ExpectedValue) { Write-Host "Audit Result: Compliant. svchost.exe mitigation policy is enabled in registry ($($RegPath)\$($ValueName) = 1)." -ForegroundColor Green # Optional check for running svchost processes $svchostProcesses = Get-Process -Name "svchost" -ErrorAction SilentlyContinue if ($svchostProcesses) { Write-Host "Found $($svchostProcesses.Count) running svchost.exe process instances. Process mitigation flags are enforced dynamically at process spawn by the Service Control Manager." -ForegroundColor Gray } exit 0 } } Write-Host "Audit Result: Non-Compliant. svchost.exe mitigation options are disabled or not configured ($($RegPath)\$($ValueName))." -ForegroundColor Red exit 1 # Configure-SvchostMitigation.ps1 # Description: Configures svchost.exe mitigation options to enforce Microsoft-signed binaries and block dynamic code. [CmdletBinding()] param() $ErrorActionPreference = "Stop" Write-Host "Applying hardening requirement: Configure svchost.exe mitigation options..." -ForegroundColor Cyan # Verify minimum operating system build compatibility (Windows 10 1903 / Build 18362 or Windows Server 2022 / Build 20348) $osVersion = [System.Environment]::OSVersion.Version $osBuild = $osVersion.Build if ($osBuild -lt 18362) { Write-Warning "The operating system build ($($osBuild)) does not support EnableSvchostMitigationPolicy (requires Windows Server 2022+ or Windows 10 1903+)." exit 1 } $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig" $ValueName = "EnableSvchostMitigationPolicy" $ValueData = 1 try { if (-not (Test-Path -Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null Write-Host "Created registry key: $($RegPath)" -ForegroundColor Gray } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null # Validate written value $configuredValue = (Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction Stop).$ValueName if ($configuredValue -eq $ValueData) { Write-Host "Hardening applied successfully: $($ValueName) set to 1." -ForegroundColor Green Write-Host "Note: This policy applies to newly created svchost.exe instances. A full system restart is required to protect services initialized at system boot." -ForegroundColor Yellow exit 0 } else { throw "Failed to verify registry property value after write." } } catch { Write-Error "Error configuring svchost.exe mitigation options: $($_.Exception.Message)" exit 1 } Target Scope: Applicable Systems: Domain Controllers (Tier 0). Operating Systems: Windows Server 2016, 2019, 2022, 2025. File Path: 02-domain-controllers/harden-dsrm-recovery-mode.md Directory Services Restore Mode (DSRM) is a special boot mode for Domain Controllers that allows administrators to repair or restore the Active Directory database (NTDS.dit). DSRM uses a local Administrator account separate from the AD directory. If DSRM is not secured: 1. Network Authentication Abuse: By default, or if misconfigured (e.g. DsrmAdminLogonBehavior set to 0 or 2), the local DSRM administrator account can authenticate over the network to the Domain Controller. Since this account has a static password (often never changed since DC promotion), it can be targeted for brute-forcing, pass-the-hash, or DCSync credential retrieval. 2. Offline Recovery Attacks: If the DC is booted in Safe Mode/DSRM, local controls are reduced. Setting DsrmAdminLogonBehavior to 1 ensures the DSRM Administrator account can only log on locally, and only when the DC is booted into DSRM mode. Setting it to 2 allows logon when the AD service is stopped, which is also a risk. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Create or edit a GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Item with the following properties: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: System\CurrentControlSet\Control\Lsa Value Name*: DsrmAdminLogonBehavior Value Type*: REG_DWORD Value Data*: 00000001 (Hexadecimal) Deploy and link the GPO to enforce the registry setting domain-wide. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) To automate verification and local remediation of the DSRM configuration: Download Script: Set-DsrmHardening.ps1 # Set-DsrmHardening.ps1 # Description: Configures DsrmAdminLogonBehavior to restrict network logons. $RegPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $ValueName = "DsrmAdminLogonBehavior" $ValueData = 1 # Restrict network logons Write-Host "Applying hardening: Restricting DSRM Admin Logon Behavior..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord Write-Host "[+] Registry parameter set successfully: $ValueName = $ValueData" -ForegroundColor Green # Instructions for DSRM password sync Write-Host "`n[NOTE] Ensure that you synchronize the DSRM Administrator password with the Domain Administrator account." -ForegroundColor Yellow Write-Host "Run the following command to sync passwords:" -ForegroundColor Yellow Write-Host " ntdsutil `"set dsrm password`" `"sync from domain account administrator`" q q" -ForegroundColor Yellow To verify the DSRM configuration status: Download Script: Get-DsrmHardeningStatus.ps1 # Get-DsrmHardeningStatus.ps1 # Check if DsrmAdminLogonBehavior registry parameter is set to 1. $RegPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $ValueName = "DsrmAdminLogonBehavior" if (-not (Test-Path $RegPath)) { Write-Host "[!] NON-COMPLIANT: Registry key '$RegPath' does not exist." -ForegroundColor Red exit 1 } $Value = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -eq $Value -or $Value.$ValueName -ne 1) { Write-Host "[!] NON-COMPLIANT: DSRM network logon is not restricted (DsrmAdminLogonBehavior is not 1)." -ForegroundColor Red exit 1 } else { Write-Host "[+] COMPLIANT: DSRM network logon is restricted (DsrmAdminLogonBehavior = 1)." -ForegroundColor Green exit 0 } # Set-DsrmHardening.ps1 # Description: Configures DsrmAdminLogonBehavior to restrict network logons. $RegPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $ValueName = "DsrmAdminLogonBehavior" $ValueData = 1 # Restrict network logons Write-Host "Applying hardening: Restricting DSRM Admin Logon Behavior..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord Write-Host "[+] Registry parameter set successfully: $ValueName = $ValueData" -ForegroundColor Green # Instructions for DSRM password sync Write-Host "`n[NOTE] Ensure that you synchronize the DSRM Administrator password with the Domain Administrator account." -ForegroundColor Yellow Write-Host "Run the following command to sync passwords:" -ForegroundColor Yellow Write-Host " ntdsutil `"set dsrm password`" `"sync from domain account administrator`" q q" -ForegroundColor Yellow Target Scope: Applicable Systems: Domain Controllers (specifically the PDC Emulator FSMO role owner) Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 File Path: 02-domain-controllers/configure-pdc-time-sync.md Active Directory relies heavily on Kerberos authentication, which has a default maximum clock skew limit of 5 minutes to prevent replay attacks. If the system clocks of Domain Controllers and member endpoints drift, authentication will fail, causing directory service outages. The Domain Controller holding the Primary Domain Controller (PDC) Emulator FSMO role acts as the root time source for the entire Active Directory forest. All other Domain Controllers synchronize their time from the PDC Emulator, and member servers and workstations synchronize their time from their local authenticating Domain Controllers (using the NT5DS domain hierarchy). If the PDC Emulator is not configured to synchronize with a reliable external time source or hardware clock: 1. Clock Drift Outages: The entire forest clock can drift over time, eventually exceeding the 5-minute skew limit for external integrations or causing authentication failures. 2. Replay Attacks: A lack of synchronized time compromises the security of Kerberos tokens, leaving the environment vulnerable to replay attacks. Configuring the PDC Emulator as a reliable NTP server synchronizing with a secure, trusted reference clock prevents time drift and secures Kerberos transactions. Option A: Group Policy Object (GPO) Configuration (Preferred) To configure the PDC Emulator time synchronization via a dedicated GPO linked to the Domain Controllers OU (utilizing WMI filtering to target only the PDC Emulator): 1. Create a WMI Filter for the PDC Emulator Role Open the Group Policy Management Console (gpmc.msc). Right-click WMI Filters in the console tree and select New. Name the filter Target PDC Emulator. Add the following WQL query: `sql Select * from Win32_DirectoryServerInfo where DomainRole = 5 Click Save. 2. Configure Windows Time Service Policy Create a new GPO named SEC_DomainControllers_TimeSync and link it to the Domain Controllers OU. Under the WMI Filtering section of the GPO, select the Target PDC Emulator filter. Edit the GPO and navigate to: Computer Configuration\Policies\Administrative Templates\System\Windows Time Service\Time Providers Configure the following policies: Configure Windows NTP Client*: Set to Enabled*. NtpServer*: time.windows.com,0x8 (or the IP/FQDN of your local hardware NTP server in air-gapped systems). Type*: NTP. CrossSiteSyncFlags*: 2 (All). ResolvePeerBackoffMinutes*: 15. ResolvePeerBackoffMaxTimes*: 7. SpecialPollInterval*: 3600. EventLogFlags*: 3. Enable Windows NTP Client*: Set to Enabled*. Enable Windows NTP Server*: Set to Enabled*. Navigate to: Computer Configuration\Policies\Administrative Templates\System\Windows Time Service Configure the settings: Global Configuration Settings*: Set to Enabled*. AnnounceFlags*: 5 (Reliable Time Server). Force update policy on the PDC Emulator. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally on the active PDC Emulator. Download Script: Configure-PdcTimeSync.ps1 # Configure-PdcTimeSync.ps1 # Description: Configures Windows Time Service on the PDC Emulator or default DC time settings. Write-Host "Applying hardening: Configure NTP Time Synchronization on PDC Emulator..." -ForegroundColor Cyan # 1. Determine if local computer is the PDC Emulator try { $Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() $PdcName = $Domain.PdcRoleOwner.Name $ComputerFQDN = "$env:COMPUTERNAME.$env:USERDNSDOMAIN" $IsPdc = ($PdcName -eq $ComputerFQDN) -or ($PdcName.Split(".")[0] -eq $env:COMPUTERNAME) } catch { Write-Warning "Could not dynamically determine PDC Emulator FSMO role owner. Defaulting to NT5DS client mode." $IsPdc = $false } $W32TimeParams = "HKLM:\System\CurrentControlSet\Services\W32Time\Parameters" $W32TimeConfig = "HKLM:\System\CurrentControlSet\Services\W32Time\Config" if ($IsPdc) { Write-Host "[+] This system is the active PDC Emulator. Configuring as reliable NTP source..." -ForegroundColor Green # Configure parameters Set-ItemProperty -Path $W32TimeParams -Name "Type" -Value "NTP" -Type String -Force # Set default external NTP source (e.g. time.windows.com or local air-gapped clock) Set-ItemProperty -Path $W32TimeParams -Name "NtpServer" -Value "time.windows.com,0x8" -Type String -Force # Configure AnnounceFlags to 5 (Reliable Time Server) Set-ItemProperty -Path $W32TimeConfig -Name "AnnounceFlags" -Value 5 -Type DWord -Force # Apply changes to w32time service $Null = Start-Process w32tm -ArgumentList "/config /manualpeerlist:`"time.windows.com,0x8`" /syncfromflags:manual /reliable:yes /update" -Wait -NoNewWindow Write-Host "[+] System w32tm manual peer list updated to time.windows.com." -ForegroundColor Green } else { Write-Host "[-] This system is NOT the PDC Emulator. Enforcing NT5DS domain hierarchy sync..." -ForegroundColor Yellow # Configure parameters Set-ItemProperty -Path $W32TimeParams -Name "Type" -Value "NT5DS" -Type String -Force Set-ItemProperty -Path $W32TimeConfig -Name "AnnounceFlags" -Value 10 -Type DWord -Force # Apply changes to w32time service $Null = Start-Process w32tm -ArgumentList "/config /syncfromflags:domhier /reliable:no /update" -Wait -NoNewWindow Write-Host "[+] System w32tm configured to synchronize from domain hierarchy." -ForegroundColor Green } # Restart Windows Time Service to apply settings Restart-Service w32time -Force Write-Host "[+] Windows Time Service (w32time) restarted." -ForegroundColor Green To verify time synchronization status: Download Script: Get-PdcTimeSyncStatus.ps1 # Get-PdcTimeSyncStatus.ps1 # Description: Audits Windows Time Service configuration on the local Domain Controller. Write-Host "--- Auditing PDC Time Synchronization Status ---" -ForegroundColor Cyan # 1. Determine if local computer is the PDC Emulator try { $Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() $PdcName = $Domain.PdcRoleOwner.Name $ComputerFQDN = "$env:COMPUTERNAME.$env:USERDNSDOMAIN" $IsPdc = ($PdcName -eq $ComputerFQDN) -or ($PdcName.Split(".")[0] -eq $env:COMPUTERNAME) } catch { Write-Warning "Could not dynamically determine PDC Emulator FSMO role owner." $IsPdc = $false } $W32TimeParams = "HKLM:\System\CurrentControlSet\Services\W32Time\Parameters" $W32TimeConfig = "HKLM:\System\CurrentControlSet\Services\W32Time\Config" $TypeVal = Get-ItemProperty -Path $W32TimeParams -Name "Type" -ErrorAction SilentlyContinue $AnnounceVal = Get-ItemProperty -Path $W32TimeConfig -Name "AnnounceFlags" -ErrorAction SilentlyContinue $Service = Get-Service -Name w32time -ErrorAction SilentlyContinue if ($null -eq $Service -or $Service.Status -ne "Running") { Write-Host "[!] VULNERABLE: Windows Time Service (w32time) is not running." -ForegroundColor Red exit 1 } if ($IsPdc) { Write-Host "[*] Active role: PDC Emulator FSMO owner." -ForegroundColor White if ($TypeVal.Type -eq "NTP" -and $AnnounceVal.AnnounceFlags -eq 5) { Write-Host "[+] Compliant: PDC Emulator configured as reliable NTP source (Type: NTP, Announce: 5)." -ForegroundColor Green exit 0 } else { Write-Host "[!] NON-COMPLIANT: PDC Emulator has incorrect settings (Type: $($TypeVal.Type), Announce: $($AnnounceVal.AnnounceFlags))." -ForegroundColor Red exit 1 } } else { Write-Host "[*] Active role: Standard Domain Controller." -ForegroundColor White if ($TypeVal.Type -eq "NT5DS" -and $AnnounceVal.AnnounceFlags -eq 10) { Write-Host "[+] Compliant: Standard Domain Controller using NT5DS domain hierarchy." -ForegroundColor Green exit 0 } else { Write-Host "[!] NON-COMPLIANT: DC is not using standard NT5DS settings (Type: $($TypeVal.Type), Announce: $($AnnounceVal.AnnounceFlags))." -ForegroundColor Red exit 1 } } # Configure-PdcTimeSync.ps1 # Description: Configures Windows Time Service on the PDC Emulator or default DC time settings. Write-Host "Applying hardening: Configure NTP Time Synchronization on PDC Emulator..." -ForegroundColor Cyan # 1. Determine if local computer is the PDC Emulator try { $Domain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() $PdcName = $Domain.PdcRoleOwner.Name $ComputerFQDN = "$env:COMPUTERNAME.$env:USERDNSDOMAIN" $IsPdc = ($PdcName -eq $ComputerFQDN) -or ($PdcName.Split(".")[0] -eq $env:COMPUTERNAME) } catch { Write-Warning "Could not dynamically determine PDC Emulator FSMO role owner. Defaulting to NT5DS client mode." $IsPdc = $false } $W32TimeParams = "HKLM:\System\CurrentControlSet\Services\W32Time\Parameters" $W32TimeConfig = "HKLM:\System\CurrentControlSet\Services\W32Time\Config" if ($IsPdc) { Write-Host "[+] This system is the active PDC Emulator. Configuring as reliable NTP source..." -ForegroundColor Green # Configure parameters Set-ItemProperty -Path $W32TimeParams -Name "Type" -Value "NTP" -Type String -Force # Set default external NTP source (e.g. time.windows.com or local air-gapped clock) Set-ItemProperty -Path $W32TimeParams -Name "NtpServer" -Value "time.windows.com,0x8" -Type String -Force # Configure AnnounceFlags to 5 (Reliable Time Server) Set-ItemProperty -Path $W32TimeConfig -Name "AnnounceFlags" -Value 5 -Type DWord -Force # Apply changes to w32time service $Null = Start-Process w32tm -ArgumentList "/config /manualpeerlist:`"time.windows.com,0x8`" /syncfromflags:manual /reliable:yes /update" -Wait -NoNewWindow Write-Host "[+] System w32tm manual peer list updated to time.windows.com." -ForegroundColor Green } else { Write-Host "[-] This system is NOT the PDC Emulator. Enforcing NT5DS domain hierarchy sync..." -ForegroundColor Yellow # Configure parameters Set-ItemProperty -Path $W32TimeParams -Name "Type" -Value "NT5DS" -Type String -Force Set-ItemProperty -Path $W32TimeConfig -Name "AnnounceFlags" -Value 10 -Type DWord -Force # Apply changes to w32time service $Null = Start-Process w32tm -ArgumentList "/config /syncfromflags:domhier /reliable:no /update" -Wait -NoNewWindow Write-Host "[+] System w32tm configured to synchronize from domain hierarchy." -ForegroundColor Green } # Restart Windows Time Service to apply settings Restart-Service w32time -Force Write-Host "[+] Windows Time Service (w32time) restarted." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/enable-secure-boot.md Secure Boot is a security standard developed by members of the PC industry to help ensure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system. For Tier 0 assets like Domain Controllers, firmware integrity is critical. If Secure Boot is disabled: 1. Bootkits & Rootkits: Attackers with physical access or hosting infrastructure control (in virtual environments) can replace the boot manager with a malicious bootloader (bootkit) to bypass LSASS protections and all OS security controls before the Windows kernel loads. 2. Virtualization-Based Security: Advanced security boundaries (like LSA Protection and Device Guard) depend on hardware-rooted trust. Without UEFI Secure Boot active, virtualization-based security capabilities cannot execute with proper system measurements. Option A: Firmware / Hypervisor Configuration (Preferred) UEFI Secure Boot must be configured at the hardware or hypervisor layer: Physical Servers: Access the UEFI firmware configuration utility during POST (Delete, F2, F10, or F12) and enable Secure Boot in the Security settings. Hyper-V Gen 2 Virtual Machines: 1. Open Hyper-V Manager. 2. Select the Domain Controller VM and open its Settings. 3. Navigate to Security -> check Enable Secure Boot -> select Microsoft Windows template. VMware vSphere Virtual Machines: 1. Open the vSphere Client. 2. Edit settings of the Domain Controller VM -> go to VM Options -> Boot Options. 3. Set Firmware to EFI and check Enable UEFI Secure Boot. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Secure Boot cannot be configured from within the OS using registry settings. However, you must programmatically audit the state of Secure Boot to flag non-compliant hardware. Run the following script to check the status of Secure Boot on the Domain Controller: Download Script: Audit-DcSecureBoot.ps1 # Audit-DcSecureBoot.ps1 # Description: Queries UEFI Secure Boot parameters and audits UEFI Secure Boot status. Write-Host "--- Auditing UEFI Secure Boot ---" -ForegroundColor Cyan $script:NonCompliant = $false # 1. Verify boot environment type if ($env:firmware_type -eq "UEFI") { Write-Host " - Boot Environment Type: UEFI" -ForegroundColor Green } else { Write-Host " - VULNERABLE: System booted in Legacy BIOS mode (CSM enabled) or firmware type is unrecognized." -ForegroundColor Red $script:NonCompliant = $true } # 2. Verify Secure Boot status try { # Confirm-SecureBootUEFI returns $true if Secure Boot is active, $false if disabled, # and throws an exception if the platform does not support UEFI or Secure Boot. $SecureBootState = Confirm-SecureBootUEFI -ErrorAction Stop $Color = if ($SecureBootState -eq $true) { "Green" } else { "Red" } Write-Host " - Secure Boot Active: $SecureBootState" -ForegroundColor $Color if ($SecureBootState -eq $false) { $script:NonCompliant = $true } } catch [System.PlatformNotSupportedException] { Write-Host " - VULNERABLE: UEFI Secure Boot is not supported on this platform (Legacy BIOS mode)." -ForegroundColor Red $script:NonCompliant = $true } catch { # If cmdlet throws unauthorized access or not enabled error Write-Host " - VULNERABLE: Secure Boot is disabled in firmware or cannot be verified. Error: $($_.Exception.Message)" -ForegroundColor Red $script:NonCompliant = $true } if ($script:NonCompliant) { exit 1 } Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/configure-secure-boot-revocations.md A vulnerability in the Windows Boot Manager allows an attacker with physical access or local administrative rights to bypass UEFI Secure Boot and execute unsigned code during the boot process (BlackLotus bootkit). To fully mitigate this threat (CVE-2023-24932), Windows update revocations must be applied to the UEFI variables (DBX list) and code integrity SVN policies must be updated. This is managed via the AvailableUpdates registry key, which instructs the OS boot manager to write the revocation variables to firmware. According to the latest Microsoft guidelines, the recommended trigger value for enterprise deployments to apply all security updates (including the new Windows UEFI CA 2023 certificates and boot manager updates) is `0x5944` (hex) / `22852` (decimal). As the OS processes this bitmask, the value is cleared incrementally, ending up at `0x4000` (hex) / `16384` (decimal) upon successful completion. Option A: Group Policy Object (GPO) Configuration (Preferred) To configure the update triggers for the DBX and Code Integrity boot manager revocations, define Registry GPO Preferences inside the Domain Controllers GPO: Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a registry item to deploy the AvailableUpdates DWORD under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot. Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Secureboot Value Name*: AvailableUpdates Value Type*: REG_DWORD Value Data*: 22852 (Decimal) or 5944 (Hex) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the BlackLotus mitigation update trigger: Download Script: Set-DcSecureBootRevocations.ps1 # Set-DcSecureBootRevocations.ps1 # Description: Triggers Secure Boot DBX and Code Integrity revocation updates for BlackLotus mitigation. Write-Host "--- Configuring BlackLotus Secure Boot Mitigations ---" -ForegroundColor Cyan $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } # Trigger updates (0x5944 = 22852) Set-ItemProperty -Path $Path -Name "AvailableUpdates" -Value 22852 -Type DWord -Force | Out-Null Write-Host "[+] BlackLotus DBX and 2023 CA revocation updates configured in registry. A system reboot is required." -ForegroundColor Green Audit Script Run the following script to check the status of Secure Boot revocations on the local machine: Download Script: Audit-DcSecureBootRevocations.ps1 # Audit-DcSecureBootRevocations.ps1 # Description: Queries UEFI Secure Boot parameters and audits BlackLotus mitigation registry settings. Write-Host "--- Auditing BlackLotus Mitigations ---" -ForegroundColor Cyan $script:NonCompliant = $false # 1. Audit AvailableUpdates registry key $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot" if (Test-Path $Path) { $Val = Get-ItemProperty -Path $Path -Name "AvailableUpdates" -ErrorAction SilentlyContinue $UpdateVal = if ($Val) { $Val.AvailableUpdates } else { 0 } # Check if configured (>= 0x4000 / 16384) if ($UpdateVal -ge 16384) { Write-Host " - BlackLotus Revocation Updates (AvailableUpdates): $UpdateVal (Compliant)" -ForegroundColor Green } else { Write-Host " - BlackLotus Revocation Updates (AvailableUpdates): $UpdateVal (Non-Compliant - DBX/SVN revocations not triggered)" -ForegroundColor Red $script:NonCompliant = $true } } else { Write-Host " - BlackLotus Revocation Updates: Registry path not found (Non-Compliant)" -ForegroundColor Red $script:NonCompliant = $true } # 2. Audit UEFICA2023Status (if present) $ServicingPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" if (Test-Path $ServicingPath) { $ServVal = Get-ItemProperty -Path $ServicingPath -Name "UEFICA2023Status" -ErrorAction SilentlyContinue if ($ServVal) { $Status = $ServVal.UEFICA2023Status $Color = if ($Status -eq "Updated") { "Green" } else { "Yellow" } Write-Host " - UEFI CA 2023 Update Status: $Status" -ForegroundColor $Color } } if ($script:NonCompliant) { exit 1 } # Set-DcSecureBootRevocations.ps1 # Description: Triggers Secure Boot DBX and Code Integrity revocation updates for BlackLotus mitigation. Write-Host "--- Configuring BlackLotus Secure Boot Mitigations ---" -ForegroundColor Cyan $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } # Trigger updates (0x5944 = 22852) Set-ItemProperty -Path $Path -Name "AvailableUpdates" -Value 22852 -Type DWord -Force | Out-Null Write-Host "[+] BlackLotus DBX and 2023 CA revocation updates configured in registry. A system reboot is required." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 File Path: 02-domain-controllers/configure-wdac.md Domain Controllers represent the highest privilege tier (Tier 0) in an Active Directory forest. Traditional signature-based antivirus solutions are easily bypassed by custom, compiled executables, memory injection scripts, or zero-day payloads. Windows Defender Application Control (WDAC) enforces a strict trust-based model for binary and script execution. By restricting the operating system to only run signed, trusted system files and administrative utilities, WDAC blocks unauthorized software, remote access tools, and custom malware. Deploying WDAC on Domain Controllers mitigates administrative credential dumping, domain compromises, and malware execution in kernel or user space. Option A: Group Policy Object (GPO) Configuration (Preferred) To deploy WDAC via Group Policy, the policy XML must first be generated, compiled, and placed in a secure shared intranet network path or local path on Domain Controllers. 1. Generate and Compile the Policy (on a Reference Domain Controller) Run the following PowerShell commands to generate the Microsoft Default Windows baseline policy: powershell # Generate the baseline policy XML New-CIPolicy -MultiplePolicyFormat -Level FilePublisher -FilePath "C:\WDAC\DCBaselinePolicy.xml" -UserPEs # Compile the XML policy into a binary CIP file ConvertFrom-CIPolicy -XmlFilePath "C:\WDAC\DCBaselinePolicy.xml" -BinaryFilePath "C:\WDAC\DCBaselinePolicy.cip" 2. Deploy the Policy via GPO Copy the compiled DCBaselinePolicy.cip file to a local secure directory on all target Domain Controllers (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b) or host it on a network share. Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the following setting: Policy*: Deploy Windows Defender Application Control Setting*: Enabled Code Integrity Policy File Path*: Enter the local path (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b) or network share path. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to generate a baseline WDAC policy, enable Audit Mode, and configure local parameters. Configure-DCWDACLocalPolicy.ps1 Download Script: Configure-DCWDACLocalPolicy.ps1 # Configure-DCWDACLocalPolicy.ps1 # Description: Generates a baseline local Code Integrity policy for Domain Controllers, sets it to Audit Mode, and compiles it. Write-Host "--- Configuring Domain Controller WDAC Local Policy Baseline ---" -ForegroundColor Cyan # Create working directories $WdacDir = "C:\Windows\System32\CodeIntegrity" if (-not (Test-Path $WdacDir)) { New-Item -Path $WdacDir -ItemType Directory -Force | Out-Null } # 1. Generate the Default Windows Policy Write-Host "[+] Generating Default Windows code integrity rules..." -ForegroundColor Gray $PolicyXml = "C:\Windows\Temp\DCDefaultWindows.xml" $PolicyBin = "$WdacDir\SIPolicy.p7b" # Create a policy based on Microsoft's default rules (trusts Windows, Store, and Driver files) New-CIPolicy -FilePath $PolicyXml -Level Windows -UserPEs -ErrorAction Stop # 2. Set Policy to Audit Mode (Rule Option 3 represents Audit Mode) Write-Host "[+] Setting WDAC policy to Audit Mode for baseline logging..." -ForegroundColor Gray Set-RuleOption -FilePath $PolicyXml -Option 3 -ErrorAction SilentlyContinue # 3. Compile the XML into the binary policy expected by the bootloader Write-Host "[+] Compiling Code Integrity XML into SIPolicy.p7b..." -ForegroundColor Gray ConvertFrom-CIPolicy -XmlFilePath $PolicyXml -BinaryFilePath $PolicyBin -ErrorAction Stop # Cleanup temp files if (Test-Path $PolicyXml) { Remove-Item $PolicyXml -Force } Write-Host "[+] Local WDAC baseline policy configured. Reboot required." -ForegroundColor Green To verify the setting has been applied: Test-DCWDACStatus.ps1 Download Script: Test-DCWDACStatus.ps1 # Test-DCWDACStatus.ps1 # Description: Audits the local Domain Controller to check if Code Integrity policies and HVCI are active. Write-Host "--- Auditing Domain Controller WDAC State ---" -ForegroundColor Cyan $Vulnerable = $false # 1. Query WMI class for Code Integrity status try { $CI = Get-CimInstance -Namespace "Root\Microsoft\Windows\CI" -ClassName "MSFT_Sipolicy" -ErrorAction Stop if ($null -ne $CI -and $CI.Count -gt 0) { Write-Host "`n[+] Found $($CI.Count) active Code Integrity policies." -ForegroundColor Green foreach ($Policy in $CI) { Write-Host " - Policy: $($Policy.FriendlyName) | ID: $($Policy.PolicyID) | Enforced: $($Policy.EnforcementMode)" -ForegroundColor Green } } else { Write-Host "`n[-] No active Code Integrity / WDAC policies detected via WMI." -ForegroundColor Yellow } } catch { Write-Host "`n[-] Could not query WMI MSFT_Sipolicy. This is expected if no WDAC policies are currently deployed." -ForegroundColor Gray } # 2. Check Memory Integrity (HVCI) configuration $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Memory Integrity (HVCI) is disabled in the registry." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: Memory Integrity scenario registry path does not exist." -ForegroundColor Red $Vulnerable = $true } # 3. Final Verdict if ($Vulnerable) { Write-Host "`n[!] Verification FAILED: One or more driver security controls are not configured." -ForegroundColor Red } else { Write-Host "`n[+] Verification PASSED: WDAC driver settings and HVCI are correctly configured." -ForegroundColor Green } # Configure-DCWDACLocalPolicy.ps1 # Description: Generates a baseline local Code Integrity policy for Domain Controllers, sets it to Audit Mode, and compiles it. Write-Host "--- Configuring Domain Controller WDAC Local Policy Baseline ---" -ForegroundColor Cyan # Create working directories $WdacDir = "C:\Windows\System32\CodeIntegrity" if (-not (Test-Path $WdacDir)) { New-Item -Path $WdacDir -ItemType Directory -Force | Out-Null } # 1. Generate the Default Windows Policy Write-Host "[+] Generating Default Windows code integrity rules..." -ForegroundColor Gray $PolicyXml = "C:\Windows\Temp\DCDefaultWindows.xml" $PolicyBin = "$WdacDir\SIPolicy.p7b" # Create a policy based on Microsoft's default rules (trusts Windows, Store, and Driver files) New-CIPolicy -FilePath $PolicyXml -Level Windows -UserPEs -ErrorAction Stop # 2. Set Policy to Audit Mode (Rule Option 3 represents Audit Mode) Write-Host "[+] Setting WDAC policy to Audit Mode for baseline logging..." -ForegroundColor Gray Set-RuleOption -FilePath $PolicyXml -Option 3 -ErrorAction SilentlyContinue # 3. Compile the XML into the binary policy expected by the bootloader Write-Host "[+] Compiling Code Integrity XML into SIPolicy.p7b..." -ForegroundColor Gray ConvertFrom-CIPolicy -XmlFilePath $PolicyXml -BinaryFilePath $PolicyBin -ErrorAction Stop # Cleanup temp files if (Test-Path $PolicyXml) { Remove-Item $PolicyXml -Force } Write-Host "[+] Local WDAC baseline policy configured. Reboot required." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers (Tier 0). (For Privileged Access Workstations, refer to [REQ-PAW-014](../07-paws/configure-elam.md); for Tier 2 Client Workstations and Member Servers, refer to [REQ-END-028](../08-endpoints/configure-elam.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025. File Path: 02-domain-controllers/configure-elam.md Active Directory Domain Controllers serve as the root of trust (Tier 0) for the entire enterprise directory. Early-stage boot integrity is critical to prevent kernel-level compromise before security subsystems initialize. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) with Domain Admin credentials. Edit the baseline Domain Controller hardening GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Early Launch Antimalware In the right pane, double-click Boot-Start Driver Initialization Policy. Select Enabled. In the Choose the boot-start drivers that can be initialized dropdown, select: Good, unknown and bad but critical Click Apply, then OK. Link the GPO to the Domain Controllers Organizational Unit (OU=Domain Controllers,DC=domain,DC=com). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally on Domain Controllers to configure the ELAM boot-start driver policy. Download Script: Configure-DcElamPolicy.ps1 # Configure-DcElamPolicy.ps1 # Description: Configures the Early Launch Antimalware (ELAM) boot-start driver initialization policy on Domain Controllers. Write-Host "Applying ELAM Boot-Start driver initialization policy on Domain Controller..." -ForegroundColor Cyan $ElamPath = "HKLM:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch" if (-not (Test-Path $ElamPath)) { New-Item -Path $ElamPath -Force | Out-Null } Set-ItemProperty -Path $ElamPath -Name "DriverLoadPolicy" -Value 3 -Type DWord -ErrorAction Stop Write-Host "[+] ELAM Boot-Start driver initialization policy set to 'Good, unknown and bad but critical' (Value = 3)." -ForegroundColor Green # Configure-DcElamPolicy.ps1 # Description: Configures the Early Launch Antimalware (ELAM) boot-start driver initialization policy on Domain Controllers. Write-Host "Applying ELAM Boot-Start driver initialization policy on Domain Controller..." -ForegroundColor Cyan $ElamPath = "HKLM:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch" if (-not (Test-Path $ElamPath)) { New-Item -Path $ElamPath -Force | Out-Null } Set-ItemProperty -Path $ElamPath -Name "DriverLoadPolicy" -Value 3 -Type DWord -ErrorAction Stop Write-Host "[+] ELAM Boot-Start driver initialization policy set to 'Good, unknown and bad but critical' (Value = 3)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers (both physical bare-metal enterprise servers and hypervisor-hosted virtual machines). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-005](../07-paws/configure-uefi-security.md); for Tier 2 Client Workstations and Member Servers, refer to [REQ-END-013](../08-endpoints/configure-uefi-security.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025. File Path: 02-domain-controllers/configure-uefi-security.md Domain Controllers are Tier 0 crown jewels that store the directory database (NTDS.dit), Kerberos key distribution services (KDC), and enterprise authentication secrets. If the underlying platform firmware or virtual machine boot configuration is compromised, an attacker can subvert all operating system and hypervisor defenses before the Windows kernel loads. Option A: Hardware & Hypervisor Firmware Configuration (Preferred) For Physical Servers (Dell PowerEdge, HPE ProLiant, Lenovo ThinkSystem): Restart the server and enter system setup during POST (typically F2 on Dell, F9 on HPE, F1 on Lenovo). Security Settings: Set a strong System Password / Setup Password* (Administrator/Supervisor). Record it in the Tier 0 credential vault. Verify TPM 2.0 Security is Enabled and Activated* with SHA-256 PCR bank. Enable Memory Overwrite Request (MOR)* or Memory Clearing on boot. Boot Settings: Set Boot Mode to UEFI*. Disable Legacy BIOS / CSM*. Set Boot Sequence* to primary internal storage (RAID/SAN). Disable USB and Network PXE boot options. * Enable password prompt on Boot Override Menu (F11/F12). Processor / Virtualization Settings: Enable Intel Virtualization Technology (VT-x) or AMD-V*. Enable Intel VT for Directed I/O (VT-d) or AMD IOMMU*. Secure Boot Settings: Enable Secure Boot . Ensure Secure Boot Mode is set to Deployed Mode*. Firmware Rollback: Enable BIOS Flash Protection / Rollback Prevention*. Baseboard Management Controller (BMC / iDRAC / iLO): Navigate to BMC network settings -> Disable IPMI over LAN* (UDP 623). Ensure web server enforces HTTPS (TLS 1.2/1.3)*. Detach and disable Virtual Media*. For Virtual Domain Controllers (Hyper-V Gen 2 / VMware ESXi): Hyper-V: 1. Open Hyper-V Manager, select the Domain Controller VM, and open Settings. 2. Navigate to Security -> check Enable Secure Boot (Template: Microsoft Windows). 3. Under Security Support, check Enable Trusted Platform Module (vTPM). 4. Navigate to Firmware -> verify boot order has the virtual hard drive (.vhdx) at the top, and remove network adapter and virtual DVD drive from the boot list. VMware vSphere: 1. Open the vSphere Client, edit VM settings. 2. Under VM Options -> Boot Options -> set Firmware to EFI and check Enable UEFI Secure Boot. 3. Under Virtual Hardware -> click Add New Device -> select Trusted Platform Module (vTPM). 4. Remove or disconnect virtual CD/DVD drives and disable network boot in VM boot options. Option B: PowerShell Remediation & OS Boot Hardening Run the following script to configure OS-level boot parameters (disabling Windows Fast Startup, ensuring Device Guard platform flags), detect whether the Domain Controller is running on physical hardware or a virtual hypervisor, and display appropriate firmware configuration guidance. Download Script: Set-DcUefiSecurity.ps1 # Set-DcUefiSecurity.ps1 # Description: Configures OS-level boot parameters and audits platform firmware configuration on Domain Controllers. Write-Host "--- Configuring Domain Controller UEFI & Boot Security Baseline ---" -ForegroundColor Cyan # 1. Disable Windows Fast Startup (forces full cold boot and fresh TPM PCR measurements) $PowerPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" if (-not (Test-Path $PowerPath)) { New-Item -Path $PowerPath -Force | Out-Null } try { Set-ItemProperty -Path $PowerPath -Name "HiberbootEnabled" -Value 0 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Windows Fast Startup disabled (HiberbootEnabled = 0)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure HiberbootEnabled: $($_.Exception.Message)" -ForegroundColor Red } # 2. Configure Device Guard Platform Security Flags $DeviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } try { # 1 = Secure Boot, 3 = Secure Boot and DMA Protection Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Device Guard required platform security features configured (Value = 1)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure RequirePlatformSecurityFeatures: $($_.Exception.Message)" -ForegroundColor Red } # 3. Detect Server Environment (Physical vs Virtual) $ComputerSystem = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction SilentlyContinue $Bios = Get-CimInstance -ClassName Win32_Bios -ErrorAction SilentlyContinue Write-Host "`nPlatform Environment Detection:" -ForegroundColor Cyan Write-Host " Model: $($ComputerSystem.Model)" -ForegroundColor White Write-Host " Manufacturer: $($Bios.Manufacturer)" -ForegroundColor White Write-Host " BIOS Version: $($Bios.SMBIOSBIOSVersion)" -ForegroundColor White if ($ComputerSystem.Model -match "Virtual Machine|VMware|KVM|Hyper-V") { Write-Host " [i] Virtual Domain Controller detected." -ForegroundColor Yellow Write-Host " Ensure VM is Generation 2 (UEFI) with Secure Boot enabled and a virtual TPM (vTPM 2.0) attached." -ForegroundColor Gray Write-Host " Hyper-V PowerShell: Set-VMFirmware -VMName '<DC>' -EnableSecureBoot On -SecureBootTemplate MicrosoftWindows" -ForegroundColor Gray Write-Host " Hyper-V PowerShell: Enable-VMTPM -VMName '<DC>'" -ForegroundColor Gray } else { Write-Host " [i] Physical Bare-Metal Server detected." -ForegroundColor Yellow Write-Host " Ensure BIOS supervisor password is set, CSM is disabled, boot order is locked to RAID," -ForegroundColor Gray Write-Host " VT-x/VT-d is enabled, and Out-of-Band BMC (iDRAC/iLO) has IPMI over LAN disabled." -ForegroundColor Gray } Write-Host "`n[+] Remediation script completed." -ForegroundColor Green # Set-DcUefiSecurity.ps1 # Description: Configures OS-level boot parameters and audits platform firmware configuration on Domain Controllers. Write-Host "--- Configuring Domain Controller UEFI & Boot Security Baseline ---" -ForegroundColor Cyan # 1. Disable Windows Fast Startup (forces full cold boot and fresh TPM PCR measurements) $PowerPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" if (-not (Test-Path $PowerPath)) { New-Item -Path $PowerPath -Force | Out-Null } try { Set-ItemProperty -Path $PowerPath -Name "HiberbootEnabled" -Value 0 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Windows Fast Startup disabled (HiberbootEnabled = 0)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure HiberbootEnabled: $($_.Exception.Message)" -ForegroundColor Red } # 2. Configure Device Guard Platform Security Flags $DeviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } try { # 1 = Secure Boot, 3 = Secure Boot and DMA Protection Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Device Guard required platform security features configured (Value = 1)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure RequirePlatformSecurityFeatures: $($_.Exception.Message)" -ForegroundColor Red } # 3. Detect Server Environment (Physical vs Virtual) $ComputerSystem = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction SilentlyContinue $Bios = Get-CimInstance -ClassName Win32_Bios -ErrorAction SilentlyContinue Write-Host "`nPlatform Environment Detection:" -ForegroundColor Cyan Write-Host " Model: $($ComputerSystem.Model)" -ForegroundColor White Write-Host " Manufacturer: $($Bios.Manufacturer)" -ForegroundColor White Write-Host " BIOS Version: $($Bios.SMBIOSBIOSVersion)" -ForegroundColor White if ($ComputerSystem.Model -match "Virtual Machine|VMware|KVM|Hyper-V") { Write-Host " [i] Virtual Domain Controller detected." -ForegroundColor Yellow Write-Host " Ensure VM is Generation 2 (UEFI) with Secure Boot enabled and a virtual TPM (vTPM 2.0) attached." -ForegroundColor Gray Write-Host " Hyper-V PowerShell: Set-VMFirmware -VMName '<DC>' -EnableSecureBoot On -SecureBootTemplate MicrosoftWindows" -ForegroundColor Gray Write-Host " Hyper-V PowerShell: Enable-VMTPM -VMName '<DC>'" -ForegroundColor Gray } else { Write-Host " [i] Physical Bare-Metal Server detected." -ForegroundColor Yellow Write-Host " Ensure BIOS supervisor password is set, CSM is disabled, boot order is locked to RAID," -ForegroundColor Gray Write-Host " VT-x/VT-d is enabled, and Out-of-Band BMC (iDRAC/iLO) has IPMI over LAN disabled." -ForegroundColor Gray } Write-Host "`n[+] Remediation script completed." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers (both physical bare-metal enterprise servers and hypervisor-hosted virtual machines). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-011](../07-paws/harden-dma-and-physical-security.md); for Tier 2 Client Workstations and Member Servers, refer to [REQ-END-017](../08-endpoints/harden-dma-and-physical-security.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025. File Path: 02-domain-controllers/harden-dma-and-physical-security.md Domain Controllers represent Tier 0 identity stores hosting the directory database (NTDS.dit), Kerberos Ticket Granting Service keys (krbtgt), and password hashes for all enterprise principals. While enterprise servers reside in datacenters or branch office wiring closets, physical access threats remain a critical attack vector: Direct Memory Access (DMA) Threat Vectors: Hot-plug expansion ports and external peripheral interfaces (such as PCIe hot-plug slots, Thunderbolt, USB4, or external storage expansion cards) permit connected hardware to bypass operating system access controls and perform direct read/write operations against physical DRAM. Attackers utilizing physical DMA consoles (e.g., PCILeech or malicious PCIe expansion cards inserted into physical server chassis) can dump LSASS memory and extract volatile Kerberos keys: Device Setup Class Lockdown*: Disabling the SBP-2 protocol class ({d48179be-ec20-11d1-b6b8-00c04fa372a7}) and IEEE 1394 host controller class ({6bdd1fc1-810f-11d0-bec7-08002be2092f}) prevents Windows Server from mounting legacy FireWire storage devices. Hardware ID Blocking*: Explicitly blocking hardware IDs PCI\CC_0C0A (Thunderbolt), PCI\CC_0C0010 (FireWire), PCI\CC_0607 (CardBus), and PCI\CC_0605 (PCMCIA) prevents the installation of unapproved expansion controllers at the hardware bus layer. BitLocker DMA Under Lock*: Enforcing DisableExternalDMAUnderLock blocks DMA device enumeration when the server console is locked, mitigating drive-by hardware attacks on unattended consoles. Kernel DMA Protection Enforcement*: Enforcing DeviceEnumerationPolicy = 0 (Block all) guarantees that any peripheral device whose drivers do not explicitly support IOMMU DMA remapping is strictly blocked from executing DMA memory transfers. Cold Boot & Standby Attacks: In standard standby sleep states (S1-S3), system RAM remains powered and unencrypted. If an attacker gains physical access to a server in a standby state, they can execute cold-boot extraction or memory analysis to harvest sensitive directory keys. Domain Controllers must operate continuously in full runtime execution states. Disabling standby sleep states forces servers to remain fully operational or enter clean shutdown, ensuring BitLocker encryption keys are sealed by the TPM 2.0 module. Enforcing wake password verification guarantees that any power-state transition requires re-authentication. Physical USB Exfiltration of Directory Databases: Rogue insiders or unauthorized datacenter personnel with physical console access can insert USB flash drives to exfiltrate ntds.dit, Active Directory backups, or system state data. Enforcing RDVDenyWriteAccess = 1 prevents writing to removable drives unless protected by BitLocker, while RDVDenyCrossOrg = 0 eliminates unauthorized cross-organization exceptions. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the Domain Controllers GPO (e.g., Default Domain Controllers Policy or GPO_Hardening_DC). Configure the following settings: 1. Power Management (Disable Standby & Require Wake Password) Navigate to: Computer Configuration\Administrative Templates\System\Power Management\Sleep Settings Policy : `Allow standby states (S1-S3) when sleeping (plugged in)` -> Disabled Policy: Allow standby states (S1-S3) when sleeping (on battery) -> Disabled Policy : `Require a password when a computer wakes (plugged in)` -> Enabled Policy: Require a password when a computer wakes (on battery) -> Enabled 2. BitLocker Removable Storage & DMA Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption Policy : `Disable new DMA devices when this computer is locked` -> Enabled Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives Policy : `Deny write access to removable drives not protected by BitLocker` -> Enabled Check Do not allow write access to devices configured in another organization -> Disabled (value 0 / False) 3. Device Installation Restrictions (Block SBP-2, 1394, Thunderbolt, and PCI Bridges) Navigate to: Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions Policy : `Prevent installation of devices using drivers that match these device setup classes` -> Enabled Click Show... and enter: `{d48179be-ec20-11d1-b6b8-00c04fa372a7}` {6bdd1fc1-810f-11d0-bec7-08002be2092f} Check Also apply to matching devices that are already installed -> Enabled (value 1 / True) Policy: Prevent installation of devices that match any of these device IDs -> Enabled Click Show... and enter: PCI\CC_0C0A `PCI\CC_0C0010` PCI\CC_0607 `PCI\CC_0605` Check Also apply to matching devices that are already installed -> Enabled (value 1 / True) 4. Kernel DMA Protection (Block All) Navigate to: Computer Configuration\Administrative Templates\System\Kernel DMA Protection Policy : `Enable Kernel DMA Protection` -> Enabled Enumeration policy: Set to Block all (value 0) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally on the Domain Controller to apply DMA, Sleep, Device Restriction, and BitLocker USB registry parameters. Download Script: Configure-DcDMAPhysicalSecurity.ps1 # Configure-DcDMAPhysicalSecurity.ps1 # Description: Hardens local registry keys on Domain Controllers to mitigate DMA attacks, disable standby sleep states, enforce wake password, restrict device classes/IDs, and block unencrypted USB writing. Write-Host "Applying Domain Controller DMA and physical security hardening..." -ForegroundColor Cyan # 1. Disable Standby Sleep States (S1-S3) $SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" if (-not (Test-Path $SleepPath)) { New-Item -Path $SleepPath -Force | Out-Null } Set-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -Value 0 -Type DWord Set-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -Value 0 -Type DWord Write-Host "[+] Standby sleep states (S1-S3) disabled." -ForegroundColor Green # 2. Configure Wake Password Requirement $WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" if (-not (Test-Path $WakePath)) { New-Item -Path $WakePath -Force | Out-Null } Set-ItemProperty -Path $WakePath -Name "ACSettingIndex" -Value 1 -Type DWord Set-ItemProperty -Path $WakePath -Name "DCSettingIndex" -Value 1 -Type DWord Write-Host "[+] Wake password requirement enforced." -ForegroundColor Green # 3. BitLocker DMA and Removable Storage Settings $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FvePath)) { New-Item -Path $FvePath -Force | Out-Null } Set-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -Value 0 -Type DWord $FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" if (-not (Test-Path $FvePolicyPath)) { New-Item -Path $FvePolicyPath -Force | Out-Null } Set-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -Value 1 -Type DWord Write-Host "[+] BitLocker DMA under lock and unencrypted USB write blocks configured." -ForegroundColor Green # 4. Device Installation Restrictions (Classes and Hardware IDs) $RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" if (-not (Test-Path $RestrictPath)) { New-Item -Path $RestrictPath -Force | Out-Null } Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClassesRetroactive" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDsRetroactive" -Value 1 -Type DWord $DenyClassPath = Join-Path $RestrictPath "DenyDeviceClasses" if (-not (Test-Path $DenyClassPath)) { New-Item -Path $DenyClassPath -Force | Out-Null } Set-ItemProperty -Path $DenyClassPath -Name "1" -Value "{d48179be-ec20-11d1-b6b8-00c04fa372a7}" -Type String Set-ItemProperty -Path $DenyClassPath -Name "2" -Value "{6bdd1fc1-810f-11d0-bec7-08002be2092f}" -Type String $DenyIdPath = Join-Path $RestrictPath "DenyDeviceIDs" if (-not (Test-Path $DenyIdPath)) { New-Item -Path $DenyIdPath -Force | Out-Null } Set-ItemProperty -Path $DenyIdPath -Name "1" -Value "PCI\CC_0C0A" -Type String Set-ItemProperty -Path $DenyIdPath -Name "2" -Value "PCI\CC_0C0010" -Type String Set-ItemProperty -Path $DenyIdPath -Name "3" -Value "PCI\CC_0607" -Type String Set-ItemProperty -Path $DenyIdPath -Name "4" -Value "PCI\CC_0605" -Type String Write-Host "[+] Device installation blocks for SBP-2, 1394 host controllers, Thunderbolt, and PCI bridges enabled." -ForegroundColor Green # 5. Kernel DMA Protection (Block all external DMA) $KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $KDmaPath)) { New-Item -Path $KDmaPath -Force | Out-Null } Set-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "[+] Kernel DMA Protection DeviceEnumerationPolicy set to 0 (Block all)." -ForegroundColor Green Write-Host "Domain Controller DMA and physical security settings applied successfully." -ForegroundColor Green To audit local Domain Controller DMA and physical security configuration: Download Script: Test-DcDMAPhysicalSecurity.ps1 # Test-DcDMAPhysicalSecurity.ps1 # Description: Audits local registry configuration for standby settings, wake password, DMA protection under lock, USB restrictions, and blocked device classes/IDs on Domain Controllers. Write-Host "--- Auditing Domain Controller DMA and Physical Security ---" -ForegroundColor Cyan $isCompliant = $true # 1. Audit Standby Settings $SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" $AcSleep = Get-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -ErrorAction SilentlyContinue $DcSleep = Get-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -ErrorAction SilentlyContinue $AcSleepVal = if ($AcSleep) { $AcSleep.ACSettingIndex } else { 1 } $DcSleepVal = if ($DcSleep) { $DcSleep.DCSettingIndex } else { 1 } $AcSleepColor = if ($AcSleepVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } $DcSleepColor = if ($DcSleepVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Standby Sleep State (Plugged In) Setting: $($AcSleepVal) (Required = 0 [Disabled])" -ForegroundColor $AcSleepColor Write-Host " - Standby Sleep State (On Battery) Setting: $($DcSleepVal) (Required = 0 [Disabled])" -ForegroundColor $DcSleepColor # 2. Audit Wake Password Requirement $WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" $AcWake = Get-ItemProperty -Path $WakePath -Name "ACSettingIndex" -ErrorAction SilentlyContinue $DcWake = Get-ItemProperty -Path $WakePath -Name "DCSettingIndex" -ErrorAction SilentlyContinue $AcWakeVal = if ($AcWake) { $AcWake.ACSettingIndex } else { 0 } $DcWakeVal = if ($DcWake) { $DcWake.DCSettingIndex } else { 0 } $AcWakeColor = if ($AcWakeVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } $DcWakeColor = if ($DcWakeVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Wake Password Required (Plugged In): $($AcWakeVal) (Required = 1 [Enabled])" -ForegroundColor $AcWakeColor Write-Host " - Wake Password Required (On Battery): $($DcWakeVal) (Required = 1 [Enabled])" -ForegroundColor $DcWakeColor # 3. Audit BitLocker Settings $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" $DmaLock = Get-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -ErrorAction SilentlyContinue $DmaLockVal = if ($DmaLock) { $DmaLock.DisableExternalDMAUnderLock } else { 0 } $DmaLockColor = if ($DmaLockVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } $CrossOrg = Get-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -ErrorAction SilentlyContinue $CrossOrgVal = if ($CrossOrg) { $CrossOrg.RDVDenyCrossOrg } else { 1 } $CrossOrgColor = if ($CrossOrgVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } $FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" $UsbWrite = Get-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -ErrorAction SilentlyContinue $UsbWriteVal = if ($UsbWrite) { $UsbWrite.RDVDenyWriteAccess } else { 0 } $UsbWriteColor = if ($UsbWriteVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Disable DMA Under Lock: $($DmaLockVal) (Required = 1)" -ForegroundColor $DmaLockColor Write-Host " - USB Deny Cross Org Removable Drives: $($CrossOrgVal) (Required = 0)" -ForegroundColor $CrossOrgColor Write-Host " - USB Unencrypted Write Block: $($UsbWriteVal) (Required = 1)" -ForegroundColor $UsbWriteColor # 4. Audit Device Restriction Settings $RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" $DenyDev = Get-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -ErrorAction SilentlyContinue $DenyDevVal = if ($DenyDev) { $DenyDev.DenyDeviceClasses } else { 0 } $DenyDevColor = if ($DenyDevVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } $DenyId = Get-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -ErrorAction SilentlyContinue $DenyIdVal = if ($DenyId) { $DenyId.DenyDeviceIDs } else { 0 } $DenyIdColor = if ($DenyIdVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Prevent Device Setup Class Installation: $($DenyDevVal) (Required = 1)" -ForegroundColor $DenyDevColor Write-Host " - Prevent Device ID Installation: $($DenyIdVal) (Required = 1)" -ForegroundColor $DenyIdColor $DenyClassPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses" $Sbp2 = Get-ItemProperty -Path $DenyClassPath -Name "1" -ErrorAction SilentlyContinue $Sbp2Val = if ($Sbp2) { $Sbp2."1" } else { "" } $Sbp2Color = if ($Sbp2Val -eq "{d48179be-ec20-11d1-b6b8-00c04fa372a7}") { "Green" } else { $isCompliant = $false; "Red" } $Host1394 = Get-ItemProperty -Path $DenyClassPath -Name "2" -ErrorAction SilentlyContinue $Host1394Val = if ($Host1394) { $Host1394."2" } else { "" } $Host1394Color = if ($Host1394Val -eq "{6bdd1fc1-810f-11d0-bec7-08002be2092f}") { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Blocked SBP-2 Setup Class: '$($Sbp2Val)' (Required = '{d48179be-ec20-11d1-b6b8-00c04fa372a7}')" -ForegroundColor $Sbp2Color Write-Host " - Blocked 1394 Host Setup Class: '$($Host1394Val)' (Required = '{6bdd1fc1-810f-11d0-bec7-08002be2092f}')" -ForegroundColor $Host1394Color $DenyIdPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs" $DId1 = Get-ItemProperty -Path $DenyIdPath -Name "1" -ErrorAction SilentlyContinue $DId1Val = if ($DId1) { $DId1."1" } else { "" } $DId1Color = if ($DId1Val -eq "PCI\CC_0C0A") { "Green" } else { $isCompliant = $false; "Red" } $DId2 = Get-ItemProperty -Path $DenyIdPath -Name "2" -ErrorAction SilentlyContinue $DId2Val = if ($DId2) { $DId2."2" } else { "" } $DId2Color = if ($DId2Val -eq "PCI\CC_0C0010") { "Green" } else { $isCompliant = $false; "Red" } $DId3 = Get-ItemProperty -Path $DenyIdPath -Name "3" -ErrorAction SilentlyContinue $DId3Val = if ($DId3) { $DId3."3" } else { "" } $DId3Color = if ($DId3Val -eq "PCI\CC_0607") { "Green" } else { $isCompliant = $false; "Red" } $DId4 = Get-ItemProperty -Path $DenyIdPath -Name "4" -ErrorAction SilentlyContinue $DId4Val = if ($DId4) { $DId4."4" } else { "" } $DId4Color = if ($DId4Val -eq "PCI\CC_0605") { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Blocked Device ID PCI\CC_0C0A: '$($DId1Val)' (Required = 'PCI\CC_0C0A')" -ForegroundColor $DId1Color Write-Host " - Blocked Device ID PCI\CC_0C0010: '$($DId2Val)' (Required = 'PCI\CC_0C0010')" -ForegroundColor $DId2Color Write-Host " - Blocked Device ID PCI\CC_0607: '$($DId3Val)' (Required = 'PCI\CC_0607')" -ForegroundColor $DId3Color Write-Host " - Blocked Device ID PCI\CC_0605: '$($DId4Val)' (Required = 'PCI\CC_0605')" -ForegroundColor $DId4Color # 5. Audit Kernel DMA Protection Setting $KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" $EnumPol = Get-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -ErrorAction SilentlyContinue $EnumPolVal = if ($EnumPol) { $EnumPol.DeviceEnumerationPolicy } else { 2 } $EnumPolColor = if ($EnumPolVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Kernel DMA Protection Policy: $($EnumPolVal) (Required = 0 [Block all])" -ForegroundColor $EnumPolColor # 6. Final Compliance Assessment if ($isCompliant) { Write-Host "[+] Audit Result: SECURE - Domain Controller DMA and physical security controls are fully compliant." -ForegroundColor Green } else { Write-Host "[-] Audit Result: VULNERABLE - One or more Domain Controller DMA or physical security settings do not meet baseline requirements." -ForegroundColor Red } # Configure-DcDMAPhysicalSecurity.ps1 # Description: Hardens local registry keys on Domain Controllers to mitigate DMA attacks, disable standby sleep states, enforce wake password, restrict device classes/IDs, and block unencrypted USB writing. Write-Host "Applying Domain Controller DMA and physical security hardening..." -ForegroundColor Cyan # 1. Disable Standby Sleep States (S1-S3) $SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" if (-not (Test-Path $SleepPath)) { New-Item -Path $SleepPath -Force | Out-Null } Set-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -Value 0 -Type DWord Set-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -Value 0 -Type DWord Write-Host "[+] Standby sleep states (S1-S3) disabled." -ForegroundColor Green # 2. Configure Wake Password Requirement $WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" if (-not (Test-Path $WakePath)) { New-Item -Path $WakePath -Force | Out-Null } Set-ItemProperty -Path $WakePath -Name "ACSettingIndex" -Value 1 -Type DWord Set-ItemProperty -Path $WakePath -Name "DCSettingIndex" -Value 1 -Type DWord Write-Host "[+] Wake password requirement enforced." -ForegroundColor Green # 3. BitLocker DMA and Removable Storage Settings $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FvePath)) { New-Item -Path $FvePath -Force | Out-Null } Set-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -Value 0 -Type DWord $FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" if (-not (Test-Path $FvePolicyPath)) { New-Item -Path $FvePolicyPath -Force | Out-Null } Set-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -Value 1 -Type DWord Write-Host "[+] BitLocker DMA under lock and unencrypted USB write blocks configured." -ForegroundColor Green # 4. Device Installation Restrictions (Classes and Hardware IDs) $RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" if (-not (Test-Path $RestrictPath)) { New-Item -Path $RestrictPath -Force | Out-Null } Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClassesRetroactive" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDsRetroactive" -Value 1 -Type DWord $DenyClassPath = Join-Path $RestrictPath "DenyDeviceClasses" if (-not (Test-Path $DenyClassPath)) { New-Item -Path $DenyClassPath -Force | Out-Null } Set-ItemProperty -Path $DenyClassPath -Name "1" -Value "{d48179be-ec20-11d1-b6b8-00c04fa372a7}" -Type String Set-ItemProperty -Path $DenyClassPath -Name "2" -Value "{6bdd1fc1-810f-11d0-bec7-08002be2092f}" -Type String $DenyIdPath = Join-Path $RestrictPath "DenyDeviceIDs" if (-not (Test-Path $DenyIdPath)) { New-Item -Path $DenyIdPath -Force | Out-Null } Set-ItemProperty -Path $DenyIdPath -Name "1" -Value "PCI\CC_0C0A" -Type String Set-ItemProperty -Path $DenyIdPath -Name "2" -Value "PCI\CC_0C0010" -Type String Set-ItemProperty -Path $DenyIdPath -Name "3" -Value "PCI\CC_0607" -Type String Set-ItemProperty -Path $DenyIdPath -Name "4" -Value "PCI\CC_0605" -Type String Write-Host "[+] Device installation blocks for SBP-2, 1394 host controllers, Thunderbolt, and PCI bridges enabled." -ForegroundColor Green # 5. Kernel DMA Protection (Block all external DMA) $KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $KDmaPath)) { New-Item -Path $KDmaPath -Force | Out-Null } Set-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "[+] Kernel DMA Protection DeviceEnumerationPolicy set to 0 (Block all)." -ForegroundColor Green Write-Host "Domain Controller DMA and physical security settings applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers and Member Servers (Tier 0 Identity Infrastructure). (For Tier 0 Privileged Access Workstations, refer to [REQ-PAW-034](../07-paws/disable-windows-script-host.md); for Tier 2 Client Workstations, refer to [REQ-END-034](../08-endpoints/disable-windows-script-host.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025. File Path: 02-domain-controllers/disable-windows-script-host.md Domain Controllers host the Active Directory directory database (NTDS.dit), Kerberos ticket-granting service keys (krbtgt), and credentials for all domain identities. Protecting these Tier 0 identity stores requires aggressive operating system minimization and the systematic neutralization of Living-off-the-Land Binaries (LOLBins / LOLBAS) that adversaries leverage during post-exploitation, lateral movement, and defense evasion: Mitigation of LOLBin Abuse on Critical Servers: Windows Script Host binaries (cscript.exe and wscript.exe) execute legacy VBScript (vbscript.dll) and JScript (jscript.dll) engines. Threat actors targeting Domain Controllers frequently invoke cscript.exe or mshta.exe to execute obfuscated staging scripts, query Active Directory via legacy ADSI/WMI interfaces, or execute memory injection routines while attempting to evade standard binary application allowlisting (MITRE ATT&CK T1059.005, T1059.007, T1218). Elimination of Untrusted Script Execution: Disabling WSH system-wide via the Enabled = 0 registry setting prevents the execution of all .vbs, .vbe, .js, .jse, .wsf, and .wsh files through the primary scripting host, returning an immediate administrative blocking error. Comprehensive 64-Bit and 32-Bit WOW6432Node Coverage: In 64-bit Windows Server environments, threat actors often invoke 32-bit binaries (%SystemRoot%\SysWOW64\cscript.exe or wscript.exe) to evade 64-bit security monitoring tools and API hooks. Configuring Enabled = 0 and TrustPolicy = 2 across both the native 64-bit registry branch (HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings) and the 32-bit subsystem branch (HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings) closes this evasion vector. TrustPolicy Hardening: Setting TrustPolicy = 2 enforces restrictions that disallow untrusted scripts system-wide, establishing defense-in-depth even if individual registry keys are tampered with. Accidental Double-Click Prevention: Remapping legacy scripting extensions (.vbs, .vbe, .js, .jse, .wsf, .wsh, .hta) to txtfile (notepad.exe) ensures that if an administrator inspects an administrative script or diagnostic file on the DC console, opening the file in Windows Explorer displays plain text in Notepad rather than silently triggering code execution. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Disable WSH via GPO Computer Preferences Open the Group Policy Management Console (gpmc.msc). Edit the Domain Controller GPO (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Item for the native 64-bit hive: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: Enabled Value Type*: REG_DWORD Value Data*: 0 Create a second Registry Item for TrustPolicy: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: TrustPolicy Value Type*: REG_DWORD Value Data*: 2 Create a third Registry Item for 32-bit WOW64 disablement: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings Value Name*: Enabled Value Type*: REG_DWORD Value Data*: 0 Create a fourth Registry Item for 32-bit WOW64 TrustPolicy: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings Value Name*: TrustPolicy Value Type*: REG_DWORD Value Data*: 2 Step 2: Disable WSH in User Configuration Preferences Navigate to: User Configuration\Preferences\Windows Settings\Registry Create a new Registry Item: Action*: Update Hive*: HKEY_CURRENT_USER Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: Enabled Value Type*: REG_DWORD Value Data*: 0 Create a second Registry Item: Action*: Update Hive*: HKEY_CURRENT_USER Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: TrustPolicy Value Type*: REG_DWORD Value Data*: 2 Step 3: Remap Script File Extensions to Notepad Navigate to: User Configuration\Preferences\Control Panel Settings\Folder Options Right-click and select New -> Open With: File Extension*: vbs Associated Program*: %SystemRoot%\System32\notepad.exe Set as default*: Check Repeat for vbe, js, jse, wsf, wsh, and hta. Alternatively, configure system-wide registry preferences under HKLM\SOFTWARE\Classes\.<ext> setting the default string value to txtfile. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the local registry settings to disable WSH and remap associations. Download Script: Disable-DcWsh.ps1 # Disable-DcWsh.ps1 # Description: Disables Windows Script Host globally across 64-bit and 32-bit registry hives, enforces TrustPolicy, and remaps script file associations to Notepad on Domain Controllers. Write-Host "Applying Windows Script Host and file association hardening for Domain Controllers..." -ForegroundColor Cyan # 1. Disable WSH globally in 64-bit HKLM $RegistryHklm = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHklm)) { New-Item -Path $RegistryHklm -Force | Out-Null } Set-ItemProperty -Path $RegistryHklm -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHklm -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM." -ForegroundColor Green # 2. Disable WSH in WOW6432Node on 64-bit systems if ([Environment]::Is64BitOperatingSystem) { $RegistryWow64 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryWow64)) { New-Item -Path $RegistryWow64 -Force | Out-Null } Set-ItemProperty -Path $RegistryWow64 -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryWow64 -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM WOW6432Node." -ForegroundColor Green } # 3. Disable WSH in current user HKCU hive $RegistryHkcu = "HKCU:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHkcu)) { New-Item -Path $RegistryHkcu -Force | Out-Null } Set-ItemProperty -Path $RegistryHkcu -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHkcu -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH disabled in current user HKCU hive." -ForegroundColor Green # 4. Remap script file extensions to notepad $Extensions = @("vbs", "vbe", "js", "jse", "wsf", "wsh", "hta") foreach ($Ext in $Extensions) { $ProgIdPath = "HKLM:\SOFTWARE\Classes\.$Ext" # Update Class Association to Notepad if (-not (Test-Path $ProgIdPath)) { New-Item -Path $ProgIdPath -Force | Out-Null } Set-ItemProperty -Path $ProgIdPath -Name "" -Value "txtfile" -Type String -Force Write-Host " Mapped .$Ext extension to txtfile handler." -ForegroundColor Gray } Write-Host "[+] Script file extension handlers mapped to Notepad." -ForegroundColor Green Write-Host "[i] Note: Software Licensing Management Tool (slmgr.vbs) requires ADBA or KMS. Use Get-CimInstance SoftwareLicensingProduct for querying status." -ForegroundColor Yellow To verify the WSH configuration state: Download Script: Get-DcWshStatus.ps1 # Get-DcWshStatus.ps1 # Description: Audits Windows Script Host registry state across 64-bit and 32-bit hives and script file extension association handlers on Domain Controllers. Write-Host "--- Auditing Windows Script Host Hardening on Domain Controllers ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit WSH Registry settings in 64-bit HKLM $RegistryHklm = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (Test-Path $RegistryHklm) { $ValHklm = (Get-ItemProperty -Path $RegistryHklm -Name "Enabled" -ErrorAction SilentlyContinue).Enabled if ($ValHklm -eq 0) { Write-Host " - HKLM WSH Enabled: 0 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: HKLM WSH is enabled or not configured (Value: '$($ValHklm)')" -ForegroundColor Red $script:Vulnerable = $true } $TrustHklm = (Get-ItemProperty -Path $RegistryHklm -Name "TrustPolicy" -ErrorAction SilentlyContinue).TrustPolicy if ($TrustHklm -eq 2) { Write-Host " - HKLM WSH TrustPolicy: 2 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: HKLM WSH TrustPolicy is not set to 2 (Value: '$($TrustHklm)')" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: HKLM WSH settings key is missing (Expected: Enabled = 0, TrustPolicy = 2)" -ForegroundColor Red $script:Vulnerable = $true } # 2. Audit WSH Registry settings in WOW6432Node on 64-bit systems if ([Environment]::Is64BitOperatingSystem) { $RegistryWow64 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" if (Test-Path $RegistryWow64) { $ValWow64 = (Get-ItemProperty -Path $RegistryWow64 -Name "Enabled" -ErrorAction SilentlyContinue).Enabled if ($ValWow64 -eq 0) { Write-Host " - WOW6432Node WSH Enabled: 0 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: WOW6432Node WSH is enabled or not configured (Value: '$($ValWow64)')" -ForegroundColor Red $script:Vulnerable = $true } $TrustWow64 = (Get-ItemProperty -Path $RegistryWow64 -Name "TrustPolicy" -ErrorAction SilentlyContinue).TrustPolicy if ($TrustWow64 -eq 2) { Write-Host " - WOW6432Node WSH TrustPolicy: 2 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: WOW6432Node WSH TrustPolicy is not set to 2 (Value: '$($TrustWow64)')" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: WOW6432Node WSH settings key is missing (Expected: Enabled = 0, TrustPolicy = 2)" -ForegroundColor Red $script:Vulnerable = $true } } # 3. Audit file associations $Extensions = @("vbs", "vbe", "js", "jse", "wsf", "wsh", "hta") foreach ($Ext in $Extensions) { $ProgIdPath = "HKLM:\SOFTWARE\Classes\.$Ext" if (Test-Path $ProgIdPath) { $Handler = (Get-ItemProperty -Path $ProgIdPath -Name "" -ErrorAction SilentlyContinue)."" if ($Handler -eq "txtfile" -or $Handler -match "notepad") { Write-Host " - Extension .$Ext Handler: $Handler (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: Extension .$Ext Handler is '$($Handler)' (Expected: txtfile/notepad)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: Extension .$Ext Class Registry key not found." -ForegroundColor Red $script:Vulnerable = $true } } if ($script:Vulnerable) { Write-Host "[-] Audit Result: VULNERABLE - Windows Script Host hardening controls on Domain Controller do not meet baseline requirements." -ForegroundColor Red } else { Write-Host "[+] Audit Result: SECURE - Windows Script Host hardening controls on Domain Controller are fully compliant." -ForegroundColor Green } # Disable-DcWsh.ps1 # Description: Disables Windows Script Host globally across 64-bit and 32-bit registry hives, enforces TrustPolicy, and remaps script file associations to Notepad on Domain Controllers. Write-Host "Applying Windows Script Host and file association hardening for Domain Controllers..." -ForegroundColor Cyan # 1. Disable WSH globally in 64-bit HKLM $RegistryHklm = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHklm)) { New-Item -Path $RegistryHklm -Force | Out-Null } Set-ItemProperty -Path $RegistryHklm -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHklm -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM." -ForegroundColor Green # 2. Disable WSH in WOW6432Node on 64-bit systems if ([Environment]::Is64BitOperatingSystem) { $RegistryWow64 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryWow64)) { New-Item -Path $RegistryWow64 -Force | Out-Null } Set-ItemProperty -Path $RegistryWow64 -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryWow64 -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM WOW6432Node." -ForegroundColor Green } # 3. Disable WSH in current user HKCU hive $RegistryHkcu = "HKCU:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHkcu)) { New-Item -Path $RegistryHkcu -Force | Out-Null } Set-ItemProperty -Path $RegistryHkcu -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHkcu -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH disabled in current user HKCU hive." -ForegroundColor Green # 4. Remap script file extensions to notepad $Extensions = @("vbs", "vbe", "js", "jse", "wsf", "wsh", "hta") foreach ($Ext in $Extensions) { $ProgIdPath = "HKLM:\SOFTWARE\Classes\.$Ext" # Update Class Association to Notepad if (-not (Test-Path $ProgIdPath)) { New-Item -Path $ProgIdPath -Force | Out-Null } Set-ItemProperty -Path $ProgIdPath -Name "" -Value "txtfile" -Type String -Force Write-Host " Mapped .$Ext extension to txtfile handler." -ForegroundColor Gray } Write-Host "[+] Script file extension handlers mapped to Notepad." -ForegroundColor Green Write-Host "[i] Note: Software Licensing Management Tool (slmgr.vbs) requires ADBA or KMS. Use Get-CimInstance SoftwareLicensingProduct for querying status." -ForegroundColor Yellow Target Scope: Applicable Systems: Active Directory Domain Controllers. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025. File Path: 02-domain-controllers/configure-event-log-sizes.md Active Directory Domain Controllers are the highest-value targets (Tier 0) in an enterprise forest. In addition to serving as the central authentication authority, Domain Controllers continuously process authentication requests, Kerberos ticket issuances, directory service modifications, and directory replication. When comprehensive security audit policies are enforced on Domain Controllers (such as Kerberos Service Ticket operations [Event ID 4769], Account Logon events [Event ID 4768/4771], Directory Service Object Access [Event ID 4662], and Group Membership changes [Event ID 4728/4738]), Domain Controllers generate between 500 MB and multiple gigabytes of security telemetry daily. Default event log capacities (20 MB for standard channels, 16 MB to 32 MB for role channels) roll over in a matter of minutes to hours during production load. This creates severe security vulnerabilities: 1. Mitigation of Log-Flushing Attacks: Adversaries executing high-frequency attacks (e.g., Kerberoasting, AS-REP Roasting, password spraying, or DCSync via DsGetNCChanges) frequently attempt to "flush" the Security log by generating floods of benign authentication or LDAP requests to overwrite compromise indicators before detection. Expanding the Security log to 4 GB (4,194,304 KB) provides a resilient on-box buffer that retains weeks of forensic evidence even under heavy attack activity. 2. Preservation of System and Replication Diagnostics: Domain Controllers log extensive Netlogon, KDC, DNS, DFS Replication, and NTDS replication events into the System, Directory Service, DNS Server, and DFS Replication event channels. Allocating 256 MB to System, Directory Service, and DNS Server logs prevents replication failures and tombstone synchronization issues from being overwritten during diagnostic troubleshooting. 3. 64 KB Boundary Alignment: The Windows Event Log service allocates memory in 64 KB blocks. Configured sizes must be exact integer multiples of 64 (SizeKB % 64 == 0). Non-aligned values will be automatically truncated or rounded by the operating system (4,194,304 / 64 = 65,536; 262,144 / 64 = 4,096; 131,072 / 64 = 2,048; 32,768 / 64 = 512). 4. Retention Policy: Enforcing retention method 0 (GPO: Disabled / Overwrite events as needed) guarantees that new security audits are continuously recorded rather than halted when log capacity is reached. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Configure the core Event Log Administrative Template policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Application Specify the maximum log file size (KB): Set to Enabled (131072 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Security Specify the maximum log file size (KB): Set to Enabled (4194304 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Setup Specify the maximum log file size (KB): Set to Enabled (32768 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\System Specify the maximum log file size (KB): Set to Enabled (262144 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Configure Active Directory role-specific channels via Group Policy Preferences (Registry): * Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Add Registry Item*: * Action: Update * Hive: HKEY_LOCAL_MACHINE * Key Path: SYSTEM\CurrentControlSet\Services\EventLog\Directory Service * Value Name: MaxSize * Value Type: REG_DWORD * Value Data: 268435456 (Decimal) Add Registry Item*: * Action: Update * Hive: HKEY_LOCAL_MACHINE * Key Path: SYSTEM\CurrentControlSet\Services\EventLog\Directory Service * Value Name: Retention * Value Type: REG_DWORD * Value Data: 0 (Decimal) Add Registry Item*: * Action: Update * Hive: HKEY_LOCAL_MACHINE * Key Path: SYSTEM\CurrentControlSet\Services\EventLog\DNS Server * Value Name: MaxSize * Value Type: REG_DWORD * Value Data: 268435456 (Decimal) Add Registry Item*: * Action: Update * Hive: HKEY_LOCAL_MACHINE * Key Path: SYSTEM\CurrentControlSet\Services\EventLog\DNS Server * Value Name: Retention * Value Type: REG_DWORD * Value Data: 0 (Decimal) Add Registry Item*: * Action: Update * Hive: HKEY_LOCAL_MACHINE * Key Path: SYSTEM\CurrentControlSet\Services\EventLog\DFS Replication * Value Name: MaxSize * Value Type: REG_DWORD * Value Data: 134217728 (Decimal) Add Registry Item*: * Action: Update * Hive: HKEY_LOCAL_MACHINE * Key Path: SYSTEM\CurrentControlSet\Services\EventLog\DFS Replication * Value Name: Retention * Value Type: REG_DWORD * Value Data: 0 (Decimal) Link the GPO to the Domain Controllers OU and verify replication. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally on Domain Controllers to configure the event log maximum sizes and retention policies: Download Script: Configure-DcEventLogSizes.ps1 #Configure-DcEventLogSizes.ps1 # Description: Configures Event Log Maximum File Sizes and Retention Policies on Domain Controllers. Write-Host "Configuring Event Log Maximum File Sizes and Retention Policies on Domain Controllers..." -ForegroundColor Cyan # 1. Core Channels via Policy Registry Branch (values in KB) if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Name "MaxSize" -Value 131072 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Name "MaxSize" -Value 4194304 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Name "MaxSize" -Value 32768 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Name "MaxSize" -Value 262144 -Type DWord -Force # 2. Active Directory Role Channels via Service Registry Branch (values in bytes) $RoleChannels = @( @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Directory Service"; MaxSizeBytes = 268435456 }, @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\DNS Server"; MaxSizeBytes = 268435456 }, @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\DFS Replication"; MaxSizeBytes = 134217728 } ) foreach ($Channel in $RoleChannels) { if (Test-Path -Path $Channel.Path) { Set-ItemProperty -Path $Channel.Path -Name "Retention" -Value 0 -Type DWord -Force Set-ItemProperty -Path $Channel.Path -Name "MaxSize" -Value $Channel.MaxSizeBytes -Type DWord -Force Write-Host " [+] Configured $($Channel.Path) MaxSize to $($Channel.MaxSizeBytes) bytes" -ForegroundColor Green } } Write-Host "[+] Domain Controller Event Log Maximum File Sizes and Retention Policies applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-DcEventLogSizesStatus.ps1 #Get-DcEventLogSizesStatus.ps1 # Description: Audits Event Log Maximum File Sizes and Retention Policies on Domain Controllers. Write-Host "--- Auditing Domain Controller Event Log Maximum File Sizes and Retention Policies ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit Application Log $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] Application $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: Application $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: Application $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $ValueName = "MaxSize" $ExpectedValue = 131072 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ([int64]$Actual -ge [int64]$ExpectedValue) { Write-Host " [+] Application $ValueName = $($Actual) KB (Secure - Meets or exceeds threshold $($ExpectedValue) KB)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: Application $ValueName = $($Actual) KB (Expected: >= $($ExpectedValue) KB)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: Application $ValueName (Expected: >= $($ExpectedValue) KB)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } # 2. Audit Security Log $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] Security $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: Security $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: Security $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $ValueName = "MaxSize" $ExpectedValue = 4194304 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ([int64]$Actual -ge [int64]$ExpectedValue) { Write-Host " [+] Security $ValueName = $($Actual) KB (Secure - Meets or exceeds threshold $($ExpectedValue) KB)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: Security $ValueName = $($Actual) KB (Expected: >= $($ExpectedValue) KB)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: Security $ValueName (Expected: >= $($ExpectedValue) KB)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } # 3. Audit Setup Log $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] Setup $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: Setup $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: Setup $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $ValueName = "MaxSize" $ExpectedValue = 32768 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ([int64]$Actual -ge [int64]$ExpectedValue) { Write-Host " [+] Setup $ValueName = $($Actual) KB (Secure - Meets or exceeds threshold $($ExpectedValue) KB)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: Setup $ValueName = $($Actual) KB (Expected: >= $($ExpectedValue) KB)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: Setup $ValueName (Expected: >= $($ExpectedValue) KB)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } # 4. Audit System Log $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] System $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: System $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: System $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $ValueName = "MaxSize" $ExpectedValue = 262144 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ([int64]$Actual -ge [int64]$ExpectedValue) { Write-Host " [+] System $ValueName = $($Actual) KB (Secure - Meets or exceeds threshold $($ExpectedValue) KB)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: System $ValueName = $($Actual) KB (Expected: >= $($ExpectedValue) KB)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: System $ValueName (Expected: >= $($ExpectedValue) KB)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } # 5. Audit Role-Specific Channels (Directory Service, DNS Server, DFS Replication) $RoleAudit = @( @{ Name = "Directory Service"; Path = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Directory Service"; MinBytes = 268435456 }, @{ Name = "DNS Server"; Path = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\DNS Server"; MinBytes = 268435456 }, @{ Name = "DFS Replication"; Path = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\DFS Replication"; MinBytes = 134217728 } ) foreach ($Item in $RoleAudit) { if (Test-Path -Path $Item.Path) { $Prop = Get-ItemProperty -Path $Item.Path -ErrorAction SilentlyContinue if ($null -ne $Prop) { $ActualSize = $Prop.MaxSize $ActualRetention = $Prop.Retention if ($null -ne $ActualRetention -and $ActualRetention -eq 0) { Write-Host " [+] $($Item.Name) Retention = $($ActualRetention) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $($Item.Name) Retention = $($ActualRetention) (Expected: 0)" -ForegroundColor Red $script:Vulnerable = $true } if ($null -ne $ActualSize -and [int64]$ActualSize -ge [int64]$Item.MinBytes) { Write-Host " [+] $($Item.Name) MaxSize = $($ActualSize) bytes (Secure - Meets or exceeds threshold $($Item.MinBytes) bytes)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $($Item.Name) MaxSize = $($ActualSize) bytes (Expected: >= $($Item.MinBytes) bytes)" -ForegroundColor Red $script:Vulnerable = $true } } } } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } #Configure-DcEventLogSizes.ps1 # Description: Configures Event Log Maximum File Sizes and Retention Policies on Domain Controllers. Write-Host "Configuring Event Log Maximum File Sizes and Retention Policies on Domain Controllers..." -ForegroundColor Cyan # 1. Core Channels via Policy Registry Branch (values in KB) if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Name "MaxSize" -Value 131072 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Name "MaxSize" -Value 4194304 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Name "MaxSize" -Value 32768 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Name "MaxSize" -Value 262144 -Type DWord -Force # 2. Active Directory Role Channels via Service Registry Branch (values in bytes) $RoleChannels = @( @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Directory Service"; MaxSizeBytes = 268435456 }, @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\DNS Server"; MaxSizeBytes = 268435456 }, @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\DFS Replication"; MaxSizeBytes = 134217728 } ) foreach ($Channel in $RoleChannels) { if (Test-Path -Path $Channel.Path) { Set-ItemProperty -Path $Channel.Path -Name "Retention" -Value 0 -Type DWord -Force Set-ItemProperty -Path $Channel.Path -Name "MaxSize" -Value $Channel.MaxSizeBytes -Type DWord -Force Write-Host " [+] Configured $($Channel.Path) MaxSize to $($Channel.MaxSizeBytes) bytes" -ForegroundColor Green } } Write-Host "[+] Domain Controller Event Log Maximum File Sizes and Retention Policies applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/disable-real-time-monitoring-and-behavior-monitoring-override.md Real-time scanning, behavior monitoring, and script checking are the core dynamic defense mechanisms of Windows Defender. Disabling or bypassing these controls allows malicious scripts, file-based attacks, and unauthorized in-memory activities to execute undetected. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Real-time Protection Set 'Turn off real-time protection' to 'Disabled' Set 'Turn on behavior monitoring' to 'Enabled' Set 'Scan all downloaded files and attachments' to 'Enabled' Set 'Turn on script scanning' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderRtpDC.ps1 # Configure-DefenderRtpDC.ps1 Set-MpPreference -DisableRealtimeMonitoring $false Set-MpPreference -DisableBehaviorMonitoring $false Set-MpPreference -DisableIOAVProtection $false Set-MpPreference -DisableScriptScanning $false $DefenderPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $DefenderPath)) { New-Item -Path $DefenderPath -Force | Out-Null } Set-ItemProperty -Path $DefenderPath -Name "DisableAntiSpyware" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderRtpDCStatus.ps1 # Get-DefenderRtpDCStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -ErrorAction SilentlyContinue if ($Pref.DisableRealtimeMonitoring -eq $false -and $Pref.DisableBehaviorMonitoring -eq $false -and $Pref.DisableIOAVProtection -eq $false -and $Pref.DisableScriptScanning -eq $false -and ($Reg -and $Reg.DisableAntiSpyware -eq 0)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderRtpDC.ps1 Set-MpPreference -DisableRealtimeMonitoring $false Set-MpPreference -DisableBehaviorMonitoring $false Set-MpPreference -DisableIOAVProtection $false Set-MpPreference -DisableScriptScanning $false $DefenderPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $DefenderPath)) { New-Item -Path $DefenderPath -Force | Out-Null } Set-ItemProperty -Path $DefenderPath -Name "DisableAntiSpyware" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-potentially-unwanted-applications-pua-protection.md Potentially Unwanted Applications (PUA) include adware, torrent clients, cryptominers, and system optimizers that increase risk and resource consumption. Forcing PUA blocking stops standard vectors of shadow IT and unauthorized utility tool execution. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus Set 'Configure detection for potentially unwanted applications' to 'Enabled' Select 'Block' in the options dropdown list Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderPUA.ps1 # Configure-DefenderPUA.ps1 Set-MpPreference -PUAProtection 1 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "PUAProtection" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderPUAStatus.ps1 # Get-DefenderPUAStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "PUAProtection" -ErrorAction SilentlyContinue if ($Pref.PUAProtection -eq 1 -or ($Reg -and $Reg.PUAProtection -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderPUA.ps1 Set-MpPreference -PUAProtection 1 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "PUAProtection" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/prevent-local-list-merging-and-exclusions-configuration.md If local administrators or compromised administrative accounts can modify Defender exclusions or merge local lists, they can authorize malicious folders or tools. Restricting list configuration to central GPOs ensures consistent security enforcement. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus Set 'Configure local administrator merge behavior for lists' to 'Disabled' Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Exclusions Set 'Prevent users from configuring exclusions' to 'Enabled' Set 'Control whether or not exclusions are visible to Local Admins' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderLocalExclusions.ps1 # Configure-DefenderLocalExclusions.ps1 Set-MpPreference -DisableLocalAdminMerge $true Set-MpPreference -DisableExclusionRestriction $false $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableLocalAdminMerge" -Value 1 -Type DWord -Force Set-ItemProperty -Path $Path -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableLocalAdminConfiguration" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderLocalExclusionsStatus.ps1 # Get-DefenderLocalExclusionsStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableLocalAdminMerge" -ErrorAction SilentlyContinue $RegHide = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "HideExclusionsFromLocalAdmins" -ErrorAction SilentlyContinue $RegConfig = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" -Name "DisableLocalAdminConfiguration" -ErrorAction SilentlyContinue if (($Pref.DisableLocalAdminMerge -eq $true -or ($Reg -and $Reg.DisableLocalAdminMerge -eq 1)) -and ($RegHide -and $RegHide.HideExclusionsFromLocalAdmins -eq 1) -and ($RegConfig -and $RegConfig.DisableLocalAdminConfiguration -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderLocalExclusions.ps1 Set-MpPreference -DisableLocalAdminMerge $true Set-MpPreference -DisableExclusionRestriction $false $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableLocalAdminMerge" -Value 1 -Type DWord -Force Set-ItemProperty -Path $Path -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableLocalAdminConfiguration" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-auto-exclusions-configuration.md Auto Exclusions automatically configure exclusions for known safe system folders or server roles to reduce performance overhead. Enforcing that auto exclusions are not disabled ensures server performance stability and proper system scanning. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Exclusions Set 'Turn off Auto Exclusions' to 'Disabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderAutoExclusions.ps1 # Configure-DefenderAutoExclusions.ps1 $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableAutoExclusions" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderAutoExclusionsStatus.ps1 # Get-DefenderAutoExclusionsStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" -Name "DisableAutoExclusions" -ErrorAction SilentlyContinue if ($Reg -and $Reg.DisableAutoExclusions -eq 0) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderAutoExclusions.ps1 $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableAutoExclusions" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/prevent-maps-local-setting-override.md Preventing local overrides of Microsoft Active Protection Service (MAPS) reporting ensures that Domain Controllers consistently report telemetry and signature feedback to cloud resources, preserving centralized protective visibility. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\MAPS Set 'Join Microsoft MAPS' to 'Disabled' (or prevent override to SpynetReporting = 0) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderSpynetDC.ps1 # Configure-DefenderSpynetDC.ps1 $SpynetPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" if (-not (Test-Path $SpynetPath)) { New-Item -Path $SpynetPath -Force | Out-Null } Set-ItemProperty -Path $SpynetPath -Name "SpynetReporting" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderSpynetDCStatus.ps1 # Get-DefenderSpynetDCStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" -Name "SpynetReporting" -ErrorAction SilentlyContinue if ($Reg -and $Reg.SpynetReporting -eq 0) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderSpynetDC.ps1 $SpynetPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" if (-not (Test-Path $SpynetPath)) { New-Item -Path $SpynetPath -Force | Out-Null } Set-ItemProperty -Path $SpynetPath -Name "SpynetReporting" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/enable-edr-in-block-mode.md Endpoint Detection and Response (EDR) in Block Mode allows Defender to take remediation actions on malicious artifacts detected by Microsoft Defender for Endpoint even if another non-Microsoft antivirus is primary. This establishes secondary defensive block capabilities. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Features Set 'Enable EDR in block mode' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderEdrBlockMode.ps1 # Configure-DefenderEdrBlockMode.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } Set-ItemProperty -Path $FeaturesPath -Name "PassiveRemediation" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderEdrBlockModeStatus.ps1 # Get-DefenderEdrBlockModeStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features" -Name "PassiveRemediation" -ErrorAction SilentlyContinue if ($Reg -and $Reg.PassiveRemediation -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderEdrBlockMode.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } Set-ItemProperty -Path $FeaturesPath -Name "PassiveRemediation" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/allow-network-protection-on-windows-server.md Network Protection blocks processes from accessing malicious domains, phishing sites, and host IP ranges. Allowing Network Protection on Windows Server ensures that member servers running server workloads possess the same IP filter protections as client platforms. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Network Protection Set 'This setting controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderNetworkProtectionServer.ps1 # Configure-DefenderNetworkProtectionServer.ps1 $NetProtPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" if (-not (Test-Path $NetProtPath)) { New-Item -Path $NetProtPath -Force | Out-Null } Set-ItemProperty -Path $NetProtPath -Name "AllowNetworkProtectionOnWinServer" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderNetworkProtectionServerStatus.ps1 # Get-DefenderNetworkProtectionServerStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" -Name "AllowNetworkProtectionOnWinServer" -ErrorAction SilentlyContinue if ($Reg -and $Reg.AllowNetworkProtectionOnWinServer -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderNetworkProtectionServer.ps1 $NetProtPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" if (-not (Test-Path $NetProtPath)) { New-Item -Path $NetProtPath -Force | Out-Null } Set-ItemProperty -Path $NetProtPath -Name "AllowNetworkProtectionOnWinServer" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/enable-file-hash-computation.md Computing cryptographic file hashes allows Defender to pass hashes of scanned files to cloud and SIEM Domain Controllers. This enables precise IOC matches, file tracking, and correlation with threat intelligence repositories. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\MpEngine Set 'Enable file hash computation feature' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderFileHash.ps1 # Configure-DefenderFileHash.ps1 Set-MpPreference -EnableFileHashComputation $true $MpEnginePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" if (-not (Test-Path $MpEnginePath)) { New-Item -Path $MpEnginePath -Force | Out-Null } Set-ItemProperty -Path $MpEnginePath -Name "EnableFileHashComputation" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderFileHashStatus.ps1 # Get-DefenderFileHashStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" -Name "EnableFileHashComputation" -ErrorAction SilentlyContinue if ($Pref.EnableFileHashComputation -eq $true -or ($Reg -and $Reg.EnableFileHashComputation -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderFileHash.ps1 Set-MpPreference -EnableFileHashComputation $true $MpEnginePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" if (-not (Test-Path $MpEnginePath)) { New-Item -Path $MpEnginePath -Force | Out-Null } Set-ItemProperty -Path $MpEnginePath -Name "EnableFileHashComputation" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-network-inspection-system-nis-settings.md The Network Inspection System (NIS) inspects network traffic patterns for known exploits. Converting warning verdicts to block enforces inline blocking of zero-day exploits, while allowing async inspection prevents performance overhead from slowing local network interfaces. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Network Inspection System Set 'Convert warn verdict to block' to 'Enabled' Set 'Turn on asynchronous inspection' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderNis.ps1 # Configure-DefenderNis.ps1 $NisPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" if (-not (Test-Path $NisPath)) { New-Item -Path $NisPath -Force | Out-Null } Set-ItemProperty -Path $NisPath -Name "EnableConvertWarnToBlock" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NisPath -Name "AllowSwitchToAsyncInspection" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderNisStatus.ps1 # Get-DefenderNisStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" -Name "EnableConvertWarnToBlock" -ErrorAction SilentlyContinue $RegAsync = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" -Name "AllowSwitchToAsyncInspection" -ErrorAction SilentlyContinue if (($Reg -and $Reg.EnableConvertWarnToBlock -eq 1) -and ($RegAsync -and $RegAsync.AllowSwitchToAsyncInspection -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderNis.ps1 $NisPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" if (-not (Test-Path $NisPath)) { New-Item -Path $NisPath -Force | Out-Null } Set-ItemProperty -Path $NisPath -Name "EnableConvertWarnToBlock" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NisPath -Name "AllowSwitchToAsyncInspection" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-oobe-real-time-protection-and-security-intelligence.md Enabling real-time protection and intelligence updates during the Out-of-Box Experience (OOBE) ensures that the system is fully updated and protected before the initial administrative user signs in or connects to enterprise network nodes. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Real-time Protection Set 'Configure real-time protection and Security Intelligence Updates during OOBE' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderOobeRtp.ps1 # Configure-DefenderOobeRtp.ps1 $RtpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" if (-not (Test-Path $RtpPath)) { New-Item -Path $RtpPath -Force | Out-Null } Set-ItemProperty -Path $RtpPath -Name "OobeEnableRtpAndSigUpdate" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderOobeRtpStatus.ps1 # Get-DefenderOobeRtpStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "OobeEnableRtpAndSigUpdate" -ErrorAction SilentlyContinue if ($Reg -and $Reg.OobeEnableRtpAndSigUpdate -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderOobeRtp.ps1 $RtpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" if (-not (Test-Path $RtpPath)) { New-Item -Path $RtpPath -Force | Out-Null } Set-ItemProperty -Path $RtpPath -Name "OobeEnableRtpAndSigUpdate" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/enable-dynamic-signature-dropped-event-reporting.md Enabling this log report generation triggers explicit events when a dynamic scan ruleset signature is dropped. This ensures SIEM integrations can immediately log changes in the local threat signatures dataset. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Reporting Set 'Configure whether to report Dynamic Signature dropped events' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderDynamicReporting.ps1 # Configure-DefenderDynamicReporting.ps1 $RepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" if (-not (Test-Path $RepPath)) { New-Item -Path $RepPath -Force | Out-Null } Set-ItemProperty -Path $RepPath -Name "EnableDynamicSignatureDroppedEventReporting" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderDynamicReportingStatus.ps1 # Get-DefenderDynamicReportingStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" -Name "EnableDynamicSignatureDroppedEventReporting" -ErrorAction SilentlyContinue if ($Reg -and $Reg.EnableDynamicSignatureDroppedEventReporting -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderDynamicReporting.ps1 $RepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" if (-not (Test-Path $RepPath)) { New-Item -Path $RepPath -Force | Out-Null } Set-ItemProperty -Path $RepPath -Name "EnableDynamicSignatureDroppedEventReporting" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-quick-scan-and-scanning-exclusions.md Malware frequently tries to establish persistence in excluded directories or inside packed/compressed executables. Forcing quick scans to include excluded files and ensuring packed file structures are recursively scanned prevents malware evasion. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Scan Set 'Scan excluded files and directories during quick scans' to 'Enabled' Set 'Turn off scanning of packed executables' to 'Disabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderQuickScan.ps1 # Configure-DefenderQuickScan.ps1 Set-MpPreference -DisablePackedExeScanning $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "QuickScanIncludeExclusions" -Value 1 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisablePackedExeScanning" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderQuickScanStatus.ps1 # Get-DefenderQuickScanStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "QuickScanIncludeExclusions" -ErrorAction SilentlyContinue $RegPack = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisablePackedExeScanning" -ErrorAction SilentlyContinue if (($Pref.DisablePackedExeScanning -eq $false -or ($RegPack -and $RegPack.DisablePackedExeScanning -eq 0)) -and ($Reg -and $Reg.QuickScanIncludeExclusions -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderQuickScan.ps1 Set-MpPreference -DisablePackedExeScanning $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "QuickScanIncludeExclusions" -Value 1 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisablePackedExeScanning" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-scheduled-scan-parameters.md Ensuring daily scheduled scans, enabling heuristics for behavioral anomaly detection, scan mail attachments, and forcing a catchup scan after at most 7 days ensures system integrity is continually validated. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Scan Set 'Specify the day of the week to run a scheduled scan' to 'Enabled' (Select 'Every day' or '0') Set 'Turn on e-mail scanning' to 'Enabled' Set 'Turn on heuristics' to 'Enabled' Set 'Trigger a quick scan after X days without any scans' to 'Enabled' (7 days) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderScheduledScan.ps1 # Configure-DefenderScheduledScan.ps1 Set-MpPreference -DisableEmailScanning $false Set-MpPreference -DisableHeuristics $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "ScheduleDay" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableEmailScanning" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableHeuristics" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DaysWithoutCatchupQuickScan" -Value 7 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderScheduledScanStatus.ps1 # Get-DefenderScheduledScanStatus.ps1 $Pref = Get-MpPreference $RegDays = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DaysWithoutCatchupQuickScan" -ErrorAction SilentlyContinue if ($Pref.DisableEmailScanning -eq $false -and $Pref.DisableHeuristics -eq $false -and ($RegDays -and $RegDays.DaysWithoutCatchupQuickScan -eq 7)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderScheduledScan.ps1 Set-MpPreference -DisableEmailScanning $false Set-MpPreference -DisableHeuristics $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "ScheduleDay" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableEmailScanning" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableHeuristics" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DaysWithoutCatchupQuickScan" -Value 7 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-security-intelligence-update-schedule.md Antivirus signatures must remain fresh to block the latest published threats. Mandating daily checks for updates and marking signatures older than 7 days as out-of-date ensures continuous defense parity. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Security Intelligence Updates Set 'Define the number of days before spyware security intelligence is considered out of date' to 'Enabled' (7 days) Set 'Define the number of days before virus security intelligence is considered out of date' to 'Enabled' (7 days) Set 'Specify the day of the week to check for security intelligence updates' to 'Enabled' (Every day or 0) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderUpdateSchedule.ps1 # Configure-DefenderUpdateSchedule.ps1 $SigPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" if (-not (Test-Path $SigPath)) { New-Item -Path $SigPath -Force | Out-Null } Set-ItemProperty -Path $SigPath -Name "ASSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "AVSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "ScheduleDay" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderUpdateScheduleStatus.ps1 # Get-DefenderUpdateScheduleStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "ASSignatureDue" -ErrorAction SilentlyContinue $RegAV = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "AVSignatureDue" -ErrorAction SilentlyContinue $RegDay = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "ScheduleDay" -ErrorAction SilentlyContinue if (($Reg -and $Reg.ASSignatureDue -eq 7) -and ($RegAV -and $RegAV.AVSignatureDue -eq 7) -and ($RegDay -and $RegDay.ScheduleDay -eq 0)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderUpdateSchedule.ps1 $SigPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" if (-not (Test-Path $SigPath)) { New-Item -Path $SigPath -Force | Out-Null } Set-ItemProperty -Path $SigPath -Name "ASSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "AVSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "ScheduleDay" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-threat-severity-default-quarantine-actions.md By default, Defender may prompt users or take actions (like clean/ignore) that leave malware remnants on the filesystem. Configuring default quarantine actions for all severities (low, medium, high, severe) ensures automated containment. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Threats Set 'Specify threat alert levels at which default action should not be taken when detected' to 'Enabled' Click 'Show...' and enter threat levels (1 -> 2, 2 -> 2, 4 -> 2, 5 -> 2) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderThreatActions.ps1 # Configure-DefenderThreatActions.ps1 $ThreatsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats" if (-not (Test-Path $ThreatsPath)) { New-Item -Path $ThreatsPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsPath -Name "Threats_ThreatSeverityDefaultAction" -Value 1 -Type DWord -Force $ThreatsSevPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" if (-not (Test-Path $ThreatsSevPath)) { New-Item -Path $ThreatsSevPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsSevPath -Name "1" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "2" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "4" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "5" -Value 2 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderThreatActionsStatus.ps1 # Get-DefenderThreatActionsStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats" -Name "Threats_ThreatSeverityDefaultAction" -ErrorAction SilentlyContinue $RegSev = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" -ErrorAction SilentlyContinue if (($Reg -and $Reg.Threats_ThreatSeverityDefaultAction -eq 1) -and ($RegSev -and $RegSev.1 -eq 2 -and $RegSev.2 -eq 2 -and $RegSev.4 -eq 2 -and $RegSev.5 -eq 2)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderThreatActions.ps1 $ThreatsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats" if (-not (Test-Path $ThreatsPath)) { New-Item -Path $ThreatsPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsPath -Name "Threats_ThreatSeverityDefaultAction" -Value 1 -Type DWord -Force $ThreatsSevPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" if (-not (Test-Path $ThreatsSevPath)) { New-Item -Path $ThreatsSevPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsSevPath -Name "1" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "2" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "4" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "5" -Value 2 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-family-options-ui-lockdown.md Locking down non-essential components of the Windows Security Center interface prevents users from tampering with parental or diagnostic UI controls on enterprise assets. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Security\Family options Set 'Hide the Family options area' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderFamilyLockdown.ps1 # Configure-DefenderFamilyLockdown.ps1 $FamilyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" if (-not (Test-Path $FamilyPath)) { New-Item -Path $FamilyPath -Force | Out-Null } Set-ItemProperty -Path $FamilyPath -Name "UILockdown" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderFamilyLockdownStatus.ps1 # Get-DefenderFamilyLockdownStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" -Name "UILockdown" -ErrorAction SilentlyContinue if ($Reg -and $Reg.UILockdown -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderFamilyLockdown.ps1 $FamilyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" if (-not (Test-Path $FamilyPath)) { New-Item -Path $FamilyPath -Force | Out-Null } Set-ItemProperty -Path $FamilyPath -Name "UILockdown" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-tamper-protection.md Tamper Protection prevents local administrators or compromised system accounts from disabling Windows Defender services, real-time scanning, or modifying active exclusions locally. This blocks a primary malware persistence vector. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Security\Tamper Protection Set 'Protect Windows Security settings from tampering' to 'Enabled' (Block or On depending on ADMX version) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderTamperProtection.ps1 # Configure-DefenderTamperProtection.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } try { Set-ItemProperty -Path $FeaturesPath -Name "TamperProtection" -Value 5 -Type DWord -ErrorAction Stop -Force } catch { Write-Warning "Registry blocked. Tamper Protection registry key is normally protected by TrustedInstaller. Ensure GPO setting is applied." } To audit the hardening status: Download Script: Get-DefenderTamperProtectionStatus.ps1 # Get-DefenderTamperProtectionStatus.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" $TamperVal = Get-ItemProperty -Path $FeaturesPath -Name "TamperProtection" -ErrorAction SilentlyContinue if ($TamperVal -and $TamperVal.TamperProtection -eq 5) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderTamperProtection.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } try { Set-ItemProperty -Path $FeaturesPath -Name "TamperProtection" -Value 5 -Type DWord -ErrorAction Stop -Force } catch { Write-Warning "Registry blocked. Tamper Protection registry key is normally protected by TrustedInstaller. Ensure GPO setting is applied." } Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-sandbox-execution-environment.md Forcing the Windows Defender scanning service (MsMpEng.exe) to run in a restricted AppContainer sandbox prevents privilege escalation. If an attacker exploits a parsing vulnerability in the engine, the compromise is contained inside the sandbox. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Preferences\Windows Settings\Environment Right-click and select New -> Environment Variable Configure Action: Update, Type: System, Name: MP_FORCE_USE_SANDBOX, Value: 1 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderSandbox.ps1 # Configure-DefenderSandbox.ps1 $EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" if (-not (Test-Path $EnvPath)) { New-Item -Path $EnvPath -Force | Out-Null } Set-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-DefenderSandboxStatus.ps1 # Get-DefenderSandboxStatus.ps1 $EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" $SandboxVar = Get-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -ErrorAction SilentlyContinue if ($SandboxVar -and $SandboxVar.MP_FORCE_USE_SANDBOX -eq "1") { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderSandbox.ps1 $EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" if (-not (Test-Path $EnvPath)) { New-Item -Path $EnvPath -Force | Out-Null } Set-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -Value "1" -Type String -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-amsi-authenticode-signature-verification.md Enforcing signature checks on registered Antimalware Scan Interface (AMSI) providers blocks attackers from registering unsigned rogue AMSI provider DLLs to bypass script analysis. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click and select New -> Registry Item Configure Action: Update, Hive: HKEY_LOCAL_MACHINE, Key Path: SOFTWARE\Microsoft\AMSI, Value Name: FeatureBits, Value Type: REG_DWORD, Value Data: 2 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderAmsiSignature.ps1 # Configure-DefenderAmsiSignature.ps1 $AmsiPath = "HKLM:\SOFTWARE\Microsoft\AMSI" if (-not (Test-Path $AmsiPath)) { New-Item -Path $AmsiPath -Force | Out-Null } Set-ItemProperty -Path $AmsiPath -Name "FeatureBits" -Value 2 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderAmsiSignatureStatus.ps1 # Get-DefenderAmsiSignatureStatus.ps1 $AmsiPath = "HKLM:\SOFTWARE\Microsoft\AMSI" if (Test-Path $AmsiPath) { $AmsiBits = Get-ItemProperty -Path $AmsiPath -Name "FeatureBits" -ErrorAction SilentlyContinue if ($AmsiBits -and $AmsiBits.FeatureBits -eq 2) { Write-Output "Compliant" exit 0 } } Write-Output "Non-Compliant" exit 1 # Configure-DefenderAmsiSignature.ps1 $AmsiPath = "HKLM:\SOFTWARE\Microsoft\AMSI" if (-not (Test-Path $AmsiPath)) { New-Item -Path $AmsiPath -Force | Out-Null } Set-ItemProperty -Path $AmsiPath -Name "FeatureBits" -Value 2 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/disable-generic-reports.md Disabling generic telemetry and reports on Domain Controllers restricts the transmission of potentially sensitive metadata or environment data regarding Tier 0 directory services to external cloud resources. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Reporting Set 'Configure generic reports' to 'Disabled' (or set DisableGenericRePorts = 1) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderDisableGenericReports.ps1 # Configure-DefenderDisableGenericReports.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableGenericRePorts" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderDisableGenericReportsStatus.ps1 # Get-DefenderDisableGenericReportsStatus.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" $Reg = Get-ItemProperty -Path $Path -Name "DisableGenericRePorts" -ErrorAction SilentlyContinue if ($Reg -and $Reg.DisableGenericRePorts -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderDisableGenericReports.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableGenericRePorts" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-brute-force-protection.md Active Directory Domain Controllers are prime targets for automated password brute-forcing and Kerberos pre-authentication spraying attacks. Setting brute force protection aggressiveness to 1 enables immediate behavioral blocks against network authentication flood sources. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Remediation\Behavioral Network Blocks Set 'Configure behavioral network brute force protection aggressiveness' to 'Enabled' (Select '1') Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderBruteForceProtection.ps1 # Configure-DefenderBruteForceProtection.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "BruteForceProtectionAggressiveness" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderBruteForceProtectionStatus.ps1 # Get-DefenderBruteForceProtectionStatus.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection" $Reg = Get-ItemProperty -Path $Path -Name "BruteForceProtectionAggressiveness" -ErrorAction SilentlyContinue if ($Reg -and $Reg.BruteForceProtectionAggressiveness -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderBruteForceProtection.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "BruteForceProtectionAggressiveness" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/configure-remote-encryption-protection.md Ransomware groups target SYSVOL and SYSVOL shares on Domain Controllers to deploy encrypted templates or payloads. Enabling remote encryption protection aggressiveness blocks remote network-driven encryption attempts immediately. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Remediation\Behavioral Network Blocks Set 'Configure behavioral network remote encryption protection aggressiveness' to 'Enabled' (Select '1') Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderRemoteEncryptionProtection.ps1 # Configure-DefenderRemoteEncryptionProtection.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "RemoteEncryptionProtectionAggressiveness" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderRemoteEncryptionProtectionStatus.ps1 # Get-DefenderRemoteEncryptionProtectionStatus.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection" $Reg = Get-ItemProperty -Path $Path -Name "RemoteEncryptionProtectionAggressiveness" -ErrorAction SilentlyContinue if ($Reg -and $Reg.RemoteEncryptionProtectionAggressiveness -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderRemoteEncryptionProtection.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "RemoteEncryptionProtectionAggressiveness" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/asr/block-vulnerable-signed-drivers.md Prevents an application from writing a vulnerable signed driver to disk. Attackers use Bring Your Own Vulnerable Driver (BYOVD) techniques to bypass Windows kernel protections by loading legitimate, signed third-party drivers that contain known vulnerabilities, allowing them to disable security agents and gain kernel-level privileges. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 56a863a9-875e-4185-98a7-b882c64b5ce5 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAsrVulnerableDrivers.ps1 # Configure-DcAsrVulnerableDrivers.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "56a863a9-875e-4185-98a7-b882c64b5ce5" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-DcAsrVulnerableDriversStatus.ps1 # Get-DcAsrVulnerableDriversStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "56a863a9-875e-4185-98a7-b882c64b5ce5" -ErrorAction SilentlyContinue if ($Value -and ($Value."56a863a9-875e-4185-98a7-b882c64b5ce5" -eq "1" -or $Value."56a863a9-875e-4185-98a7-b882c64b5ce5" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcAsrVulnerableDrivers.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "56a863a9-875e-4185-98a7-b882c64b5ce5" -Value "1" -Type String -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/asr/block-lsass-credential-stealing.md Blocks attempts to open or dump the memory of the Local Security Authority Subsystem Service (lsass.exe). Attackers dump LSASS memory using tools like Mimikatz or Task Manager to extract plaintext credentials, Kerberos tickets, or NTLM password hashes from system memory for lateral movement. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAsrLsassDump.ps1 # Configure-DcAsrLsassDump.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-DcAsrLsassDumpStatus.ps1 # Get-DcAsrLsassDumpStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -ErrorAction SilentlyContinue if ($Value -and ($Value."9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -eq "1" -or $Value."9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcAsrLsassDump.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -Value "1" -Type String -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/asr/block-obfuscated-scripts.md Blocks execution of obfuscated or encrypted scripts (such as PowerShell, VBScript, or JavaScript). Threat actors obfuscate their scripts using base64 encoding, custom string manipulation, or encryption to hide the intent of their code and bypass static file scanning and network detection engines. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 5beb7efe-fd9a-4556-801d-275e5ffc04cc as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAsrObfuscatedScripts.ps1 # Configure-DcAsrObfuscatedScripts.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "5beb7efe-fd9a-4556-801d-275e5ffc04cc" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-DcAsrObfuscatedScriptsStatus.ps1 # Get-DcAsrObfuscatedScriptsStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "5beb7efe-fd9a-4556-801d-275e5ffc04cc" -ErrorAction SilentlyContinue if ($Value -and ($Value."5beb7efe-fd9a-4556-801d-275e5ffc04cc" -eq "1" -or $Value."5beb7efe-fd9a-4556-801d-275e5ffc04cc" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcAsrObfuscatedScripts.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "5beb7efe-fd9a-4556-801d-275e5ffc04cc" -Value "1" -Type String -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/asr/block-wmi-event-subscription-persistence.md Blocks threat actors from achieving system persistence by registering permanent Windows Management Instrumentation (WMI) event subscriptions. WMI event subscriptions allow attackers to automatically launch malicious payloads when system triggers occur (like system boot or user logon) without using traditional startup registry keys. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID e6db77e5-3df2-4cf1-b95a-636979351e5b as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAsrWmiPersistence.ps1 # Configure-DcAsrWmiPersistence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "e6db77e5-3df2-4cf1-b95a-636979351e5b" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-DcAsrWmiPersistenceStatus.ps1 # Get-DcAsrWmiPersistenceStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "e6db77e5-3df2-4cf1-b95a-636979351e5b" -ErrorAction SilentlyContinue if ($Value -and ($Value."e6db77e5-3df2-4cf1-b95a-636979351e5b" -eq "1" -or $Value."e6db77e5-3df2-4cf1-b95a-636979351e5b" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcAsrWmiPersistence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "e6db77e5-3df2-4cf1-b95a-636979351e5b" -Value "1" -Type String -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/asr/block-psexec-wmi-process-creations.md Blocks processes created via WMI commands or PSExec remote execution utilities. This directly stops lateral movement attacks where compromised accounts or threat actors attempt to start commands, backdoors, or credential dumpers remotely across domain-joined servers and Domain Controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID d1e49aac-8f56-4280-b9ba-993a6d77406c as Value Name, with Value set to 2 (Audit). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAsrPsexecWmi.ps1 # Configure-DcAsrPsexecWmi.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d1e49aac-8f56-4280-b9ba-993a6d77406c" -Value "2" -Type String -Force To audit the hardening status: Download Script: Get-DcAsrPsexecWmiStatus.ps1 # Get-DcAsrPsexecWmiStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "d1e49aac-8f56-4280-b9ba-993a6d77406c" -ErrorAction SilentlyContinue if ($Value -and ($Value."d1e49aac-8f56-4280-b9ba-993a6d77406c" -eq "2" -or $Value."d1e49aac-8f56-4280-b9ba-993a6d77406c" -eq 2)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcAsrPsexecWmi.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d1e49aac-8f56-4280-b9ba-993a6d77406c" -Value "2" -Type String -Force Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/defender/asr/use-advanced-protection-against-ransomware.md Enables advanced behavioral heuristics and cloud analytics checks on files that attempt to modify multiple user files, detect signature-less encryption behavior, and block rapid write activity to prevent ransomware from encrypting system and user documents. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID c1db55ab-c21a-4637-bb3f-a12568109d35 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAsrRansomware.ps1 # Configure-DcAsrRansomware.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "c1db55ab-c21a-4637-bb3f-a12568109d35" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-DcAsrRansomwareStatus.ps1 # Get-DcAsrRansomwareStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "c1db55ab-c21a-4637-bb3f-a12568109d35" -ErrorAction SilentlyContinue if ($Value -and ($Value."c1db55ab-c21a-4637-bb3f-a12568109d35" -eq "1" -or $Value."c1db55ab-c21a-4637-bb3f-a12568109d35" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcAsrRansomware.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "c1db55ab-c21a-4637-bb3f-a12568109d35" -Value "1" -Type String -Force Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-093](../../07-paws/user-rights/configure-ura-senetworklogonright.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-097](../../08-endpoints/user-rights/configure-ura-senetworklogonright.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-senetworklogonright.md The SeNetworkLogonRight determines which security principals are permitted to authenticate and establish network logon sessions (Logon Type 3) across the network over protocols like SMB, RPC, WMI, WinRM, and LDAP. Network logons authenticate users without creating an interactive desktop shell, enabling file share access, remote management, and inter-system synchronization. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Access this computer from the network`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-9 (Enterprise Domain Controllers), *S-1-5-11 (Authenticated Users), *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeNetworkLogonRight.ps1 # Configure-DcUraSeNetworkLogonRight.ps1 # Configure-DcUraSeNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_senetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_senetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeNetworkLogonRight\s*=") { $NewLines += "SeNetworkLogonRight = *S-1-5-9,*S-1-5-11,*S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeNetworkLogonRight = *S-1-5-9,*S-1-5-11,*S-1-5-32-544") } else { $NewLines += "SeNetworkLogonRight = *S-1-5-9,*S-1-5-11,*S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeNetworkLogonRightStatus.ps1 # Get-DcUraSeNetworkLogonRightStatus.ps1 # Get-DcUraSeNetworkLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_senetworklogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeNetworkLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-9,*S-1-5-11,*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeNetworkLogonRight.ps1 # Configure-DcUraSeNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_senetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_senetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeNetworkLogonRight\s*=") { $NewLines += "SeNetworkLogonRight = *S-1-5-9,*S-1-5-11,*S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeNetworkLogonRight = *S-1-5-9,*S-1-5-11,*S-1-5-32-544") } else { $NewLines += "SeNetworkLogonRight = *S-1-5-9,*S-1-5-11,*S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-094](../../07-paws/user-rights/configure-ura-setcbprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-098](../../08-endpoints/user-rights/configure-ura-setcbprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-setcbprivilege.md The SeTcbPrivilege identifies its holder as part of the Trusted Computer Base (TCB)—the core inner ring of the operating system. A process possessing this privilege can register as a trusted logon process with the Local Security Authority via LsaRegisterLogonProcess and invoke LsaLogonUser to create an arbitrary, fully authenticated access token for any user without knowing the user's password or requiring credentials. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Act as part of the operating system`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeTcbPrivilege.ps1 # Configure-DcUraSeTcbPrivilege.ps1 # Configure-DcUraSeTcbPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setcbprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setcbprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTcbPrivilege\s*=") { $NewLines += "SeTcbPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTcbPrivilege = ") } else { $NewLines += "SeTcbPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeTcbPrivilegeStatus.ps1 # Get-DcUraSeTcbPrivilegeStatus.ps1 # Get-DcUraSeTcbPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_setcbprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeTcbPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeTcbPrivilege.ps1 # Configure-DcUraSeTcbPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setcbprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setcbprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTcbPrivilege\s*=") { $NewLines += "SeTcbPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTcbPrivilege = ") } else { $NewLines += "SeTcbPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-semachineaccountprivilege.md The SeMachineAccountPrivilege allows an authenticated domain user to join computer accounts to the Active Directory domain, creating new computer objects in the default CN=Computers container up to the limit defined by ms-DS-MachineAccountQuota (default: 10). This privilege is governed by the Domain Controllers policy and domain-level schema. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Add workstations to domain`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeMachineAccountPrivilege.ps1 # Configure-DcUraSeMachineAccountPrivilege.ps1 # Configure-DcUraSeMachineAccountPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_semachineaccountprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_semachineaccountprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeMachineAccountPrivilege\s*=") { $NewLines += "SeMachineAccountPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeMachineAccountPrivilege = *S-1-5-32-544") } else { $NewLines += "SeMachineAccountPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeMachineAccountPrivilegeStatus.ps1 # Get-DcUraSeMachineAccountPrivilegeStatus.ps1 # Get-DcUraSeMachineAccountPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_semachineaccountprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeMachineAccountPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeMachineAccountPrivilege.ps1 # Configure-DcUraSeMachineAccountPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_semachineaccountprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_semachineaccountprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeMachineAccountPrivilege\s*=") { $NewLines += "SeMachineAccountPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeMachineAccountPrivilege = *S-1-5-32-544") } else { $NewLines += "SeMachineAccountPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seincreasequotaprivilege.md The SeIncreaseQuotaPrivilege grants a process the capability to increase the maximum memory quota (working set size and page pool limits) allocated to a process via SetProcessWorkingSetSize or NtSetInformationProcess. The memory manager enforces memory quotas to prevent individual processes from monopolizing system memory pools. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Adjust memory quotas for a process`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-19 (LocalService), *S-1-5-20 (NetworkService), *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeIncreaseQuotaPrivilege.ps1 # Configure-DcUraSeIncreaseQuotaPrivilege.ps1 # Configure-DcUraSeIncreaseQuotaPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seincreasequotaprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seincreasequotaprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeIncreaseQuotaPrivilege\s*=") { $NewLines += "SeIncreaseQuotaPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeIncreaseQuotaPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544") } else { $NewLines += "SeIncreaseQuotaPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeIncreaseQuotaPrivilegeStatus.ps1 # Get-DcUraSeIncreaseQuotaPrivilegeStatus.ps1 # Get-DcUraSeIncreaseQuotaPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seincreasequotaprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeIncreaseQuotaPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-19,*S-1-5-20,*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeIncreaseQuotaPrivilege.ps1 # Configure-DcUraSeIncreaseQuotaPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seincreasequotaprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seincreasequotaprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeIncreaseQuotaPrivilege\s*=") { $NewLines += "SeIncreaseQuotaPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeIncreaseQuotaPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544") } else { $NewLines += "SeIncreaseQuotaPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-095](../../07-paws/user-rights/configure-ura-seinteractivelogonright.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-099](../../08-endpoints/user-rights/configure-ura-seinteractivelogonright.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seinteractivelogonright.md The SeInteractiveLogonRight determines which security principals are permitted to start an interactive logon session (Logon Type 2) at the physical keyboard, display, or virtual machine console. An interactive logon spawns a graphical user shell (explorer.exe) and interactive desktop session. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Allow log on locally`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-9 (Enterprise Domain Controllers), *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeInteractiveLogonRight.ps1 # Configure-DcUraSeInteractiveLogonRight.ps1 # Configure-DcUraSeInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeInteractiveLogonRight\s*=") { $NewLines += "SeInteractiveLogonRight = *S-1-5-9,*S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeInteractiveLogonRight = *S-1-5-9,*S-1-5-32-544") } else { $NewLines += "SeInteractiveLogonRight = *S-1-5-9,*S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeInteractiveLogonRightStatus.ps1 # Get-DcUraSeInteractiveLogonRightStatus.ps1 # Get-DcUraSeInteractiveLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seinteractivelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeInteractiveLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-9,*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeInteractiveLogonRight.ps1 # Configure-DcUraSeInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeInteractiveLogonRight\s*=") { $NewLines += "SeInteractiveLogonRight = *S-1-5-9,*S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeInteractiveLogonRight = *S-1-5-9,*S-1-5-32-544") } else { $NewLines += "SeInteractiveLogonRight = *S-1-5-9,*S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seremoteinteractivelogonright.md The SeRemoteInteractiveLogonRight determines which security principals are permitted to establish interactive Remote Desktop Protocol (RDP) sessions (Logon Type 10) on the target host. RDP provides full remote graphical desktop access, loading interactive user credentials into LSASS memory. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Allow log on through Remote Desktop Services`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeRemoteInteractiveLogonRight.ps1 # Configure-DcUraSeRemoteInteractiveLogonRight.ps1 # Configure-DcUraSeRemoteInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seremoteinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seremoteinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRemoteInteractiveLogonRight\s*=") { $NewLines += "SeRemoteInteractiveLogonRight = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRemoteInteractiveLogonRight = *S-1-5-32-544") } else { $NewLines += "SeRemoteInteractiveLogonRight = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeRemoteInteractiveLogonRightStatus.ps1 # Get-DcUraSeRemoteInteractiveLogonRightStatus.ps1 # Get-DcUraSeRemoteInteractiveLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seremoteinteractivelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeRemoteInteractiveLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeRemoteInteractiveLogonRight.ps1 # Configure-DcUraSeRemoteInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seremoteinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seremoteinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRemoteInteractiveLogonRight\s*=") { $NewLines += "SeRemoteInteractiveLogonRight = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRemoteInteractiveLogonRight = *S-1-5-32-544") } else { $NewLines += "SeRemoteInteractiveLogonRight = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-096](../../07-paws/user-rights/configure-ura-sebackupprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-100](../../08-endpoints/user-rights/configure-ura-sebackupprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sebackupprivilege.md The SeBackupPrivilege grants the caller the capability to bypass all read-access security controls (Discretionary Access Control Lists - DACLs) across the entire NTFS filesystem and Windows Registry. When an application opens a file handle specifying the FILE_FLAG_BACKUP_SEMANTICS flag in Win32 CreateFile calls, the Windows kernel I/O manager and Object Manager explicitly bypass standard security descriptor evaluation. This design allows legitimate backup utilities to archive files without requiring explicit read permissions on every individual object. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Back up files and directories`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeBackupPrivilege.ps1 # Configure-DcUraSeBackupPrivilege.ps1 # Configure-DcUraSeBackupPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sebackupprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sebackupprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeBackupPrivilege\s*=") { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeBackupPrivilege = *S-1-5-32-544") } else { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeBackupPrivilegeStatus.ps1 # Get-DcUraSeBackupPrivilegeStatus.ps1 # Get-DcUraSeBackupPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sebackupprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeBackupPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeBackupPrivilege.ps1 # Configure-DcUraSeBackupPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sebackupprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sebackupprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeBackupPrivilege\s*=") { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeBackupPrivilege = *S-1-5-32-544") } else { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sechangenotifyprivilege.md The SeChangeNotifyPrivilege grants the caller the ability to traverse directory trees to access child objects (files and subdirectories) even if the user lacks explicit 'Traverse Folder / Execute File' permissions on parent directories in the path. In addition, this privilege enables applications to register for file system change notifications via APIs such as ReadDirectoryChangesW. While enabled broadly on workstations for user convenience, on Domain Controllers and hardened infrastructure, directory navigation paths must be securely bounded. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Bypass traverse checking`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-554 (Pre-Windows 2000 Compatible Access), *S-1-5-11 (Authenticated Users), *S-1-5-32-544 (Administrators), *S-1-5-20 (NetworkService), *S-1-5-19 (LocalService), *S-1-1-0 (Everyone). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeChangeNotifyPrivilege.ps1 # Configure-DcUraSeChangeNotifyPrivilege.ps1 # Configure-DcUraSeChangeNotifyPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sechangenotifyprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sechangenotifyprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeChangeNotifyPrivilege\s*=") { $NewLines += "SeChangeNotifyPrivilege = *S-1-5-32-554,*S-1-5-11,*S-1-5-32-544,*S-1-5-20,*S-1-5-19,*S-1-1-0" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeChangeNotifyPrivilege = *S-1-5-32-554,*S-1-5-11,*S-1-5-32-544,*S-1-5-20,*S-1-5-19,*S-1-1-0") } else { $NewLines += "SeChangeNotifyPrivilege = *S-1-5-32-554,*S-1-5-11,*S-1-5-32-544,*S-1-5-20,*S-1-5-19,*S-1-1-0" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeChangeNotifyPrivilegeStatus.ps1 # Get-DcUraSeChangeNotifyPrivilegeStatus.ps1 # Get-DcUraSeChangeNotifyPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sechangenotifyprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeChangeNotifyPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-554,*S-1-5-11,*S-1-5-32-544,*S-1-5-20,*S-1-5-19,*S-1-1-0" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeChangeNotifyPrivilege.ps1 # Configure-DcUraSeChangeNotifyPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sechangenotifyprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sechangenotifyprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeChangeNotifyPrivilege\s*=") { $NewLines += "SeChangeNotifyPrivilege = *S-1-5-32-554,*S-1-5-11,*S-1-5-32-544,*S-1-5-20,*S-1-5-19,*S-1-1-0" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeChangeNotifyPrivilege = *S-1-5-32-554,*S-1-5-11,*S-1-5-32-544,*S-1-5-20,*S-1-5-19,*S-1-1-0") } else { $NewLines += "SeChangeNotifyPrivilege = *S-1-5-32-554,*S-1-5-11,*S-1-5-32-544,*S-1-5-20,*S-1-5-19,*S-1-1-0" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-101](../../08-endpoints/user-rights/configure-ura-sesystemtimeprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sesystemtimeprivilege.md The SeSystemtimePrivilege allows a security principal to adjust the internal hardware clock and system time of the computer via Win32 APIs SetSystemTime or SetLocalTime. Accurate time synchronization is foundational to the Windows distributed security architecture. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Change the system time`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators), *S-1-5-19 (LocalService). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeSystemtimePrivilege.ps1 # Configure-DcUraSeSystemtimePrivilege.ps1 # Configure-DcUraSeSystemtimePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemtimeprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemtimeprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemtimePrivilege\s*=") { $NewLines += "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19") } else { $NewLines += "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeSystemtimePrivilegeStatus.ps1 # Get-DcUraSeSystemtimePrivilegeStatus.ps1 # Get-DcUraSeSystemtimePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesystemtimeprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSystemtimePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544,*S-1-5-19" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeSystemtimePrivilege.ps1 # Configure-DcUraSeSystemtimePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemtimeprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemtimeprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemtimePrivilege\s*=") { $NewLines += "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19") } else { $NewLines += "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-097](../../07-paws/user-rights/configure-ura-secreatepagefileprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-103](../../08-endpoints/user-rights/configure-ura-secreatepagefileprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-secreatepagefileprivilege.md The SeCreatePagefilePrivilege allows a process to create, delete, and modify the parameters and allocation sizes of system paging files (pagefile.sys) via the NtCreatePagingFile API. The Windows virtual memory manager uses paging files as secondary backing storage for memory pages that are not backed by files. Paging files contain sensitive plaintext data, including process heap allocations, cached authentication tokens, cryptographic keys, and unencrypted file contents. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create a pagefile`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeCreatePagefilePrivilege.ps1 # Configure-DcUraSeCreatePagefilePrivilege.ps1 # Configure-DcUraSeCreatePagefilePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepagefileprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepagefileprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePagefilePrivilege\s*=") { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePagefilePrivilege = *S-1-5-32-544") } else { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeCreatePagefilePrivilegeStatus.ps1 # Get-DcUraSeCreatePagefilePrivilegeStatus.ps1 # Get-DcUraSeCreatePagefilePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatepagefileprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreatePagefilePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeCreatePagefilePrivilege.ps1 # Configure-DcUraSeCreatePagefilePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepagefileprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepagefileprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePagefilePrivilege\s*=") { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePagefilePrivilege = *S-1-5-32-544") } else { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-098](../../07-paws/user-rights/configure-ura-secreatetokenprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-104](../../08-endpoints/user-rights/configure-ura-secreatetokenprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-secreatetokenprivilege.md The SeCreateTokenPrivilege allows a process to invoke the native API NtCreateToken to forge an arbitrary Windows primary or impersonation access token from scratch. An access token defines an entity's complete security context, including User SID, Group SIDs, Privileges, Default DACL, Token Type, and Mandatory Integrity Level. Normally, tokens are manufactured exclusively by the Local Security Authority Subsystem Service (lsass.exe) following successful authentication. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create a token object`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeCreateTokenPrivilege.ps1 # Configure-DcUraSeCreateTokenPrivilege.ps1 # Configure-DcUraSeCreateTokenPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatetokenprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatetokenprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateTokenPrivilege\s*=") { $NewLines += "SeCreateTokenPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateTokenPrivilege = ") } else { $NewLines += "SeCreateTokenPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeCreateTokenPrivilegeStatus.ps1 # Get-DcUraSeCreateTokenPrivilegeStatus.ps1 # Get-DcUraSeCreateTokenPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatetokenprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreateTokenPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeCreateTokenPrivilege.ps1 # Configure-DcUraSeCreateTokenPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatetokenprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatetokenprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateTokenPrivilege\s*=") { $NewLines += "SeCreateTokenPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateTokenPrivilege = ") } else { $NewLines += "SeCreateTokenPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-100](../../07-paws/user-rights/configure-ura-secreatepermanentprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-106](../../08-endpoints/user-rights/configure-ura-secreatepermanentprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-secreatepermanentprivilege.md The SeCreatePermanentPrivilege allows a process to create permanent object directory objects in the Windows Object Manager namespace (\DirectoryObject) via APIs like NtCreateDirectoryObject. Unlike standard kernel objects which are automatically destroyed when their last handle is closed, permanent objects persist in the object manager namespace across process terminations until explicitly unlinked or until system reboot. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create permanent shared objects`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeCreatePermanentPrivilege.ps1 # Configure-DcUraSeCreatePermanentPrivilege.ps1 # Configure-DcUraSeCreatePermanentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepermanentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepermanentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePermanentPrivilege\s*=") { $NewLines += "SeCreatePermanentPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePermanentPrivilege = ") } else { $NewLines += "SeCreatePermanentPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeCreatePermanentPrivilegeStatus.ps1 # Get-DcUraSeCreatePermanentPrivilegeStatus.ps1 # Get-DcUraSeCreatePermanentPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatepermanentprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreatePermanentPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeCreatePermanentPrivilege.ps1 # Configure-DcUraSeCreatePermanentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepermanentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepermanentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePermanentPrivilege\s*=") { $NewLines += "SeCreatePermanentPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePermanentPrivilege = ") } else { $NewLines += "SeCreatePermanentPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-101](../../07-paws/user-rights/configure-ura-sedebugprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-108](../../08-endpoints/user-rights/configure-ura-sedebugprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sedebugprivilege.md The SeDebugPrivilege allows a process to attach a debugger to any running process on the system, completely overriding the target process security descriptor and Discretionary Access Control List (DACL). When enabled, calls to OpenProcess with permissions such as PROCESS_ALL_ACCESS or PROCESS_VM_READ succeed even against processes owned by other users or NT AUTHORITY\SYSTEM. This privilege is intended strictly for kernel/application developers debugging live processes. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Debug programs`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeDebugPrivilege.ps1 # Configure-DcUraSeDebugPrivilege.ps1 # Configure-DcUraSeDebugPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedebugprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedebugprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDebugPrivilege\s*=") { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDebugPrivilege = *S-1-5-32-544") } else { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeDebugPrivilegeStatus.ps1 # Get-DcUraSeDebugPrivilegeStatus.ps1 # Get-DcUraSeDebugPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedebugprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDebugPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeDebugPrivilege.ps1 # Configure-DcUraSeDebugPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedebugprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedebugprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDebugPrivilege\s*=") { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDebugPrivilege = *S-1-5-32-544") } else { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-113](../../07-paws/user-rights/configure-ura-sedenynetworklogonright.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-124](../../08-endpoints/user-rights/configure-ura-sedenynetworklogonright.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sedenynetworklogonright.md The SeDenyNetworkLogonRight explicitly prevents specified security principals from authenticating over network protocols (SMB, RPC, WMI, WinRM, LDAP, etc. - Logon Type 3). Network logons represent the primary highway for lateral movement and remote compromise in Active Directory environments. Enforcing an explicit deny stops network authentication regardless of share-level or NTFS-level permissions. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Deny access to this computer from the network`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-546 (Guests). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeDenyNetworkLogonRight.ps1 # Configure-DcUraSeDenyNetworkLogonRight.ps1 # Configure-DcUraSeDenyNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenynetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenynetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyNetworkLogonRight\s*=") { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyNetworkLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeDenyNetworkLogonRightStatus.ps1 # Get-DcUraSeDenyNetworkLogonRightStatus.ps1 # Get-DcUraSeDenyNetworkLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedenynetworklogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDenyNetworkLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-546" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeDenyNetworkLogonRight.ps1 # Configure-DcUraSeDenyNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenynetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenynetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyNetworkLogonRight\s*=") { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyNetworkLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sedenybatchlogonright.md The SeDenyBatchLogonRight explicitly denies designated security principals the ability to authenticate and run batch or scheduled workloads (Logon Type 4). In Windows security, an explicit 'Deny' right takes precedence over any conflicting 'Allow' right (SeBatchLogonRight), ensuring that restricted accounts cannot be granted batch execution through nested group memberships. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Deny log on as a batch job`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-546 (Guests). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeDenyBatchLogonRight.ps1 # Configure-DcUraSeDenyBatchLogonRight.ps1 # Configure-DcUraSeDenyBatchLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenybatchlogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenybatchlogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyBatchLogonRight\s*=") { $NewLines += "SeDenyBatchLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyBatchLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyBatchLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeDenyBatchLogonRightStatus.ps1 # Get-DcUraSeDenyBatchLogonRightStatus.ps1 # Get-DcUraSeDenyBatchLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedenybatchlogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDenyBatchLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-546" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeDenyBatchLogonRight.ps1 # Configure-DcUraSeDenyBatchLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenybatchlogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenybatchlogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyBatchLogonRight\s*=") { $NewLines += "SeDenyBatchLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyBatchLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyBatchLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sedenyservicelogonright.md The SeDenyServiceLogonRight explicitly prevents designated accounts from registering and executing as a Windows service process (Logon Type 5). Windows services run unattended in the background under designated security contexts, typically with persistent execution privileges across reboots. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Deny log on as a service`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-546 (Guests). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeDenyServiceLogonRight.ps1 # Configure-DcUraSeDenyServiceLogonRight.ps1 # Configure-DcUraSeDenyServiceLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyservicelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyservicelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyServiceLogonRight\s*=") { $NewLines += "SeDenyServiceLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyServiceLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyServiceLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeDenyServiceLogonRightStatus.ps1 # Get-DcUraSeDenyServiceLogonRightStatus.ps1 # Get-DcUraSeDenyServiceLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedenyservicelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDenyServiceLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-546" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeDenyServiceLogonRight.ps1 # Configure-DcUraSeDenyServiceLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyservicelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyservicelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyServiceLogonRight\s*=") { $NewLines += "SeDenyServiceLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyServiceLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyServiceLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sedenyinteractivelogonright.md The SeDenyInteractiveLogonRight explicitly blocks designated accounts and groups from establishing an interactive logon session (Logon Type 2) at the physical keyboard, mouse, or virtual machine console. Because an explicit deny overrides any allow right, this policy establishes a foolproof security boundary against unauthorized console access. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Deny log on locally`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-546 (Guests). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeDenyInteractiveLogonRight.ps1 # Configure-DcUraSeDenyInteractiveLogonRight.ps1 # Configure-DcUraSeDenyInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyInteractiveLogonRight\s*=") { $NewLines += "SeDenyInteractiveLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyInteractiveLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyInteractiveLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeDenyInteractiveLogonRightStatus.ps1 # Get-DcUraSeDenyInteractiveLogonRightStatus.ps1 # Get-DcUraSeDenyInteractiveLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedenyinteractivelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDenyInteractiveLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-546" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeDenyInteractiveLogonRight.ps1 # Configure-DcUraSeDenyInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyInteractiveLogonRight\s*=") { $NewLines += "SeDenyInteractiveLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyInteractiveLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyInteractiveLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-114](../../07-paws/user-rights/configure-ura-sedenyremoteinteractivelogonright.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-125](../../08-endpoints/user-rights/configure-ura-sedenyremoteinteractivelogonright.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sedenyremoteinteractivelogonright.md The SeDenyRemoteInteractiveLogonRight explicitly denies designated accounts the ability to establish Remote Desktop Protocol (RDP) sessions (Logon Type 10) on the target system. RDP exposes a full graphical interactive session over TCP port 3389, providing an attacker with interactive desktop capabilities and loading user credentials into memory. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Deny log on through Remote Desktop Services`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-546 (Guests). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeDenyRemoteInteractiveLogonRight.ps1 # Configure-DcUraSeDenyRemoteInteractiveLogonRight.ps1 # Configure-DcUraSeDenyRemoteInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyremoteinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyremoteinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyRemoteInteractiveLogonRight\s*=") { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyRemoteInteractiveLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeDenyRemoteInteractiveLogonRightStatus.ps1 # Get-DcUraSeDenyRemoteInteractiveLogonRightStatus.ps1 # Get-DcUraSeDenyRemoteInteractiveLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedenyremoteinteractivelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDenyRemoteInteractiveLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-546" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeDenyRemoteInteractiveLogonRight.ps1 # Configure-DcUraSeDenyRemoteInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyremoteinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyremoteinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyRemoteInteractiveLogonRight\s*=") { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-32-546" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyRemoteInteractiveLogonRight = *S-1-5-32-546") } else { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-32-546" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-102](../../07-paws/user-rights/configure-ura-seenabledelegationprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-109](../../08-endpoints/user-rights/configure-ura-seenabledelegationprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seenabledelegationprivilege.md The SeEnableDelegationPrivilege allows a security principal to modify the userAccountControl attribute on Active Directory user and computer objects to enable Kerberos Delegation flags: (1) TRUSTED_FOR_DELEGATION (Unconstrained Delegation); (2) TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (Constrained Delegation with Protocol Transition / S4U2Self). Kerberos delegation permits a service to impersonate an authenticated user to access back-end resources on their behalf. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Enable computer and user accounts to be trusted for delegation`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeEnableDelegationPrivilege.ps1 # Configure-DcUraSeEnableDelegationPrivilege.ps1 # Configure-DcUraSeEnableDelegationPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seenabledelegationprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seenabledelegationprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeEnableDelegationPrivilege\s*=") { $NewLines += "SeEnableDelegationPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeEnableDelegationPrivilege = *S-1-5-32-544") } else { $NewLines += "SeEnableDelegationPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeEnableDelegationPrivilegeStatus.ps1 # Get-DcUraSeEnableDelegationPrivilegeStatus.ps1 # Get-DcUraSeEnableDelegationPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seenabledelegationprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeEnableDelegationPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeEnableDelegationPrivilege.ps1 # Configure-DcUraSeEnableDelegationPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seenabledelegationprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seenabledelegationprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeEnableDelegationPrivilege\s*=") { $NewLines += "SeEnableDelegationPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeEnableDelegationPrivilege = *S-1-5-32-544") } else { $NewLines += "SeEnableDelegationPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-103](../../07-paws/user-rights/configure-ura-seremoteshutdownprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-110](../../08-endpoints/user-rights/configure-ura-seremoteshutdownprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seremoteshutdownprivilege.md The SeRemoteShutdownPrivilege allows a user authenticating over the network to invoke remote system shutdown and reboot APIs (such as InitiateSystemShutdownEx or shutdown.exe /m \\computer). This function is exposed over named pipe \PIPE\InitShutdown and RPC interface winreg/shutdown. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Force shutdown from a remote system`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeRemoteShutdownPrivilege.ps1 # Configure-DcUraSeRemoteShutdownPrivilege.ps1 # Configure-DcUraSeRemoteShutdownPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seremoteshutdownprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seremoteshutdownprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRemoteShutdownPrivilege\s*=") { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRemoteShutdownPrivilege = *S-1-5-32-544") } else { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeRemoteShutdownPrivilegeStatus.ps1 # Get-DcUraSeRemoteShutdownPrivilegeStatus.ps1 # Get-DcUraSeRemoteShutdownPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seremoteshutdownprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeRemoteShutdownPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeRemoteShutdownPrivilege.ps1 # Configure-DcUraSeRemoteShutdownPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seremoteshutdownprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seremoteshutdownprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRemoteShutdownPrivilege\s*=") { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRemoteShutdownPrivilege = *S-1-5-32-544") } else { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seauditprivilege.md The SeAuditPrivilege allows a process to write synthetic records directly into the Windows Security Event Log (Security.evtx) by invoking the Local Security Authority (LSA) and Authz APIs, specifically AuthzReportSecurityEvent or LsaRegisterLogonProcess. The Windows Security event log is the primary tamper-resistant telemetry source for forensic investigations, compliance audits, and Security Information and Event Management (SIEM) ingest. Access to inject events directly into this log without generating standard OS audit trails represents a critical security hazard. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Generate security audits`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-19 (LocalService), *S-1-5-20 (NetworkService). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeAuditPrivilege.ps1 # Configure-DcUraSeAuditPrivilege.ps1 # Configure-DcUraSeAuditPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seauditprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seauditprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeAuditPrivilege\s*=") { $NewLines += "SeAuditPrivilege = *S-1-5-19,*S-1-5-20" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeAuditPrivilege = *S-1-5-19,*S-1-5-20") } else { $NewLines += "SeAuditPrivilege = *S-1-5-19,*S-1-5-20" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeAuditPrivilegeStatus.ps1 # Get-DcUraSeAuditPrivilegeStatus.ps1 # Get-DcUraSeAuditPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seauditprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeAuditPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-19,*S-1-5-20" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeAuditPrivilege.ps1 # Configure-DcUraSeAuditPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seauditprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seauditprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeAuditPrivilege\s*=") { $NewLines += "SeAuditPrivilege = *S-1-5-19,*S-1-5-20" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeAuditPrivilege = *S-1-5-19,*S-1-5-20") } else { $NewLines += "SeAuditPrivilege = *S-1-5-19,*S-1-5-20" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-105](../../07-paws/user-rights/configure-ura-seloaddriverprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-113](../../08-endpoints/user-rights/configure-ura-seloaddriverprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seloaddriverprivilege.md The SeLoadDriverPrivilege allows a process to dynamically load and unload kernel-mode device drivers (.sys files) via NtLoadDriver or the Service Control Manager (CreateService with SERVICE_KERNEL_DRIVER). Kernel-mode drivers execute in Ring 0 with unrestricted hardware access, full kernel memory read/write permissions, and the ability to execute any CPU instruction. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Load and unload device drivers`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeLoadDriverPrivilege.ps1 # Configure-DcUraSeLoadDriverPrivilege.ps1 # Configure-DcUraSeLoadDriverPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seloaddriverprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seloaddriverprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLoadDriverPrivilege\s*=") { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLoadDriverPrivilege = *S-1-5-32-544") } else { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeLoadDriverPrivilegeStatus.ps1 # Get-DcUraSeLoadDriverPrivilegeStatus.ps1 # Get-DcUraSeLoadDriverPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seloaddriverprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeLoadDriverPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeLoadDriverPrivilege.ps1 # Configure-DcUraSeLoadDriverPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seloaddriverprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seloaddriverprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLoadDriverPrivilege\s*=") { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLoadDriverPrivilege = *S-1-5-32-544") } else { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-106](../../07-paws/user-rights/configure-ura-selockmemoryprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-114](../../08-endpoints/user-rights/configure-ura-selockmemoryprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-selockmemoryprivilege.md The SeLockMemoryPrivilege allows a process to lock physical memory pages in RAM using APIs such as VirtualLock and Address Windowing Extensions (AWE) via AllocateUserPhysicalPages. Locking pages prevents the Windows virtual memory manager from paging data out to disk in pagefile.sys, ensuring high-performance memory retention. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Lock pages in memory`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeLockMemoryPrivilege.ps1 # Configure-DcUraSeLockMemoryPrivilege.ps1 # Configure-DcUraSeLockMemoryPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_selockmemoryprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_selockmemoryprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLockMemoryPrivilege\s*=") { $NewLines += "SeLockMemoryPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLockMemoryPrivilege = ") } else { $NewLines += "SeLockMemoryPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeLockMemoryPrivilegeStatus.ps1 # Get-DcUraSeLockMemoryPrivilegeStatus.ps1 # Get-DcUraSeLockMemoryPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_selockmemoryprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeLockMemoryPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeLockMemoryPrivilege.ps1 # Configure-DcUraSeLockMemoryPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_selockmemoryprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_selockmemoryprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLockMemoryPrivilege\s*=") { $NewLines += "SeLockMemoryPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLockMemoryPrivilege = ") } else { $NewLines += "SeLockMemoryPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sebatchlogonright.md The SeBatchLogonRight determines which security principals can authenticate and establish non-interactive batch logon sessions (Logon Type 4). Batch logons are utilized by the Task Scheduler (taskschd.msc) and batch queuing subsystems to execute scheduled tasks, maintenance scripts, and background workloads without requiring an interactive desktop session or terminal connection. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Log on as a batch job`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeBatchLogonRight.ps1 # Configure-DcUraSeBatchLogonRight.ps1 # Configure-DcUraSeBatchLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sebatchlogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sebatchlogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeBatchLogonRight\s*=") { $NewLines += "SeBatchLogonRight = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeBatchLogonRight = *S-1-5-32-544") } else { $NewLines += "SeBatchLogonRight = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeBatchLogonRightStatus.ps1 # Get-DcUraSeBatchLogonRightStatus.ps1 # Get-DcUraSeBatchLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sebatchlogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeBatchLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeBatchLogonRight.ps1 # Configure-DcUraSeBatchLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sebatchlogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sebatchlogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeBatchLogonRight\s*=") { $NewLines += "SeBatchLogonRight = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeBatchLogonRight = *S-1-5-32-544") } else { $NewLines += "SeBatchLogonRight = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seservicelogonright.md The SeServiceLogonRight determines which security principals are permitted to register and authenticate as background Windows service accounts (Logon Type 5). When the Service Control Manager (services.exe) starts a service configured with a user account, it initiates a service logon session. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Log on as a service`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeServiceLogonRight.ps1 # Configure-DcUraSeServiceLogonRight.ps1 # Configure-DcUraSeServiceLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seservicelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seservicelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeServiceLogonRight\s*=") { $NewLines += "SeServiceLogonRight = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeServiceLogonRight = ") } else { $NewLines += "SeServiceLogonRight = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeServiceLogonRightStatus.ps1 # Get-DcUraSeServiceLogonRightStatus.ps1 # Get-DcUraSeServiceLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seservicelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeServiceLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeServiceLogonRight.ps1 # Configure-DcUraSeServiceLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seservicelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seservicelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeServiceLogonRight\s*=") { $NewLines += "SeServiceLogonRight = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeServiceLogonRight = ") } else { $NewLines += "SeServiceLogonRight = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-107](../../07-paws/user-rights/configure-ura-sesecurityprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-115](../../08-endpoints/user-rights/configure-ura-sesecurityprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sesecurityprivilege.md The SeSecurityPrivilege controls access to the Windows Security Event Log (Security.evtx) and governs the ability to view, configure, and clear the security log, as well as specify object auditing options (System Access Control Lists - SACLs) on files, registry keys, and directory objects via ACCESS_SYSTEM_SECURITY. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Manage auditing and security log`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeSecurityPrivilege.ps1 # Configure-DcUraSeSecurityPrivilege.ps1 # Configure-DcUraSeSecurityPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesecurityprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesecurityprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSecurityPrivilege\s*=") { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSecurityPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeSecurityPrivilegeStatus.ps1 # Get-DcUraSeSecurityPrivilegeStatus.ps1 # Get-DcUraSeSecurityPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesecurityprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSecurityPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeSecurityPrivilege.ps1 # Configure-DcUraSeSecurityPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesecurityprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesecurityprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSecurityPrivilege\s*=") { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSecurityPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-108](../../07-paws/user-rights/configure-ura-sesystemenvironmentprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-116](../../08-endpoints/user-rights/configure-ura-sesystemenvironmentprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sesystemenvironmentprivilege.md The SeSystemEnvironmentPrivilege allows a process to query and modify Non-Volatile RAM (NVRAM) firmware environment variables via Win32 APIs GetFirmwareEnvironmentVariable and SetFirmwareEnvironmentVariable. NVRAM variables govern UEFI boot sequences, Secure Boot policies, boot configuration data (BCD) handoffs, and hardware configuration flags. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Modify firmware environment values`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeSystemEnvironmentPrivilege.ps1 # Configure-DcUraSeSystemEnvironmentPrivilege.ps1 # Configure-DcUraSeSystemEnvironmentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemenvironmentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemenvironmentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemEnvironmentPrivilege\s*=") { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemEnvironmentPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeSystemEnvironmentPrivilegeStatus.ps1 # Get-DcUraSeSystemEnvironmentPrivilegeStatus.ps1 # Get-DcUraSeSystemEnvironmentPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesystemenvironmentprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSystemEnvironmentPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeSystemEnvironmentPrivilege.ps1 # Configure-DcUraSeSystemEnvironmentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemenvironmentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemenvironmentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemEnvironmentPrivilege\s*=") { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemEnvironmentPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-110](../../07-paws/user-rights/configure-ura-seprofilesingleprocessprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-118](../../08-endpoints/user-rights/configure-ura-seprofilesingleprocessprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seprofilesingleprocessprivilege.md The SeProfileSingleProcessPrivilege allows a process to monitor and profile the performance and execution metrics of non-system processes using Windows performance sampling APIs. Profiling tools monitor instruction execution rates, thread context switches, memory cache behavior, and execution sampling. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Profile single process`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeProfileSingleProcessPrivilege.ps1 # Configure-DcUraSeProfileSingleProcessPrivilege.ps1 # Configure-DcUraSeProfileSingleProcessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seprofilesingleprocessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seprofilesingleprocessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeProfileSingleProcessPrivilege\s*=") { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeProfileSingleProcessPrivilege = *S-1-5-32-544") } else { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeProfileSingleProcessPrivilegeStatus.ps1 # Get-DcUraSeProfileSingleProcessPrivilegeStatus.ps1 # Get-DcUraSeProfileSingleProcessPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seprofilesingleprocessprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeProfileSingleProcessPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeProfileSingleProcessPrivilege.ps1 # Configure-DcUraSeProfileSingleProcessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seprofilesingleprocessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seprofilesingleprocessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeProfileSingleProcessPrivilege\s*=") { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeProfileSingleProcessPrivilege = *S-1-5-32-544") } else { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-111](../../07-paws/user-rights/configure-ura-serestoreprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-121](../../08-endpoints/user-rights/configure-ura-serestoreprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-serestoreprivilege.md The SeRestorePrivilege grants the caller the capability to bypass all write-access security controls (DACLs) across the entire NTFS filesystem and Windows Registry. When a process opens a file or registry key handle specifying FILE_FLAG_BACKUP_SEMANTICS in Win32 APIs, the kernel explicitly bypasses standard security descriptor DACL checks, allowing the process to write to, overwrite, or delete any file or key on the system. In addition, this privilege grants the ability to set any valid user or group SID as the owner of an object. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Restore files and directories`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeRestorePrivilege.ps1 # Configure-DcUraSeRestorePrivilege.ps1 # Configure-DcUraSeRestorePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_serestoreprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_serestoreprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRestorePrivilege\s*=") { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRestorePrivilege = *S-1-5-32-544") } else { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeRestorePrivilegeStatus.ps1 # Get-DcUraSeRestorePrivilegeStatus.ps1 # Get-DcUraSeRestorePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_serestoreprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeRestorePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeRestorePrivilege.ps1 # Configure-DcUraSeRestorePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_serestoreprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_serestoreprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRestorePrivilege\s*=") { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRestorePrivilege = *S-1-5-32-544") } else { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-seshutdownprivilege.md The SeShutdownPrivilege controls the capability of a user logged on locally at the console to cleanly shut down or restart the local operating system via the ExitWindowsEx or InitiateSystemShutdown APIs. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Shut down the system`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeShutdownPrivilege.ps1 # Configure-DcUraSeShutdownPrivilege.ps1 # Configure-DcUraSeShutdownPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seshutdownprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seshutdownprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeShutdownPrivilege\s*=") { $NewLines += "SeShutdownPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeShutdownPrivilege = *S-1-5-32-544") } else { $NewLines += "SeShutdownPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeShutdownPrivilegeStatus.ps1 # Get-DcUraSeShutdownPrivilegeStatus.ps1 # Get-DcUraSeShutdownPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seshutdownprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeShutdownPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeShutdownPrivilege.ps1 # Configure-DcUraSeShutdownPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seshutdownprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seshutdownprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeShutdownPrivilege\s*=") { $NewLines += "SeShutdownPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeShutdownPrivilege = *S-1-5-32-544") } else { $NewLines += "SeShutdownPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-sesyncagentprivilege.md The SeSyncAgentPrivilege grants the caller the authority to initiate directory synchronization operations against Active Directory domain partitions. This privilege is the underlying Windows user right associated with the directory service replication extended rights: DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes-In-Filtered-Set. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Synchronize directory service data`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeSyncAgentPrivilege.ps1 # Configure-DcUraSeSyncAgentPrivilege.ps1 # Configure-DcUraSeSyncAgentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesyncagentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesyncagentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSyncAgentPrivilege\s*=") { $NewLines += "SeSyncAgentPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSyncAgentPrivilege = ") } else { $NewLines += "SeSyncAgentPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeSyncAgentPrivilegeStatus.ps1 # Get-DcUraSeSyncAgentPrivilegeStatus.ps1 # Get-DcUraSeSyncAgentPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesyncagentprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSyncAgentPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeSyncAgentPrivilege.ps1 # Configure-DcUraSeSyncAgentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesyncagentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesyncagentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSyncAgentPrivilege\s*=") { $NewLines += "SeSyncAgentPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSyncAgentPrivilege = ") } else { $NewLines += "SeSyncAgentPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (Tier 0 Active Directory infrastructure). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-112](../../07-paws/user-rights/configure-ura-setakeownershipprivilege.md)). (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-122](../../08-endpoints/user-rights/configure-ura-setakeownershipprivilege.md)). Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. File Path: 02-domain-controllers/user-rights/configure-ura-setakeownershipprivilege.md The SeTakeOwnershipPrivilege allows a user to take ownership of any securable object in the operating system (files, directories, registry keys, Active Directory objects, printers, services) by writing the caller's SID into the object security descriptor owner field via SetNamedSecurityInfo or SetSecurityInfo. The Windows security model grants the owner of an object implicit WRITE_DAC authority. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 Domain Controller systems (e.g., Default Domain Controllers Policy). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Take ownership of files or other objects`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcUraSeTakeOwnershipPrivilege.ps1 # Configure-DcUraSeTakeOwnershipPrivilege.ps1 # Configure-DcUraSeTakeOwnershipPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setakeownershipprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setakeownershipprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTakeOwnershipPrivilege\s*=") { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTakeOwnershipPrivilege = *S-1-5-32-544") } else { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-DcUraSeTakeOwnershipPrivilegeStatus.ps1 # Get-DcUraSeTakeOwnershipPrivilegeStatus.ps1 # Get-DcUraSeTakeOwnershipPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_setakeownershipprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeTakeOwnershipPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DcUraSeTakeOwnershipPrivilege.ps1 # Configure-DcUraSeTakeOwnershipPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setakeownershipprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setakeownershipprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTakeOwnershipPrivilege\s*=") { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTakeOwnershipPrivilege = *S-1-5-32-544") } else { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-xblauthmanager.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Xbox Live Auth Manager (XblAuthManager) service directly supports this: Provides gaming authentication functions; irrelevant to server infrastructure. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\XblAuthManager Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableXblAuthManager.ps1 # Configure-DisableXblAuthManager.ps1 # Description: Disables the unnecessary Xbox Live Auth Manager (XblAuthManager) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Xbox Live Auth Manager service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "XblAuthManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-XblAuthManagerStatus.ps1 # Get-XblAuthManagerStatus.ps1 # Description: Audits the registry startup state of unnecessary Xbox Live Auth Manager (XblAuthManager) service. Write-Host "--- Auditing Xbox Live Auth Manager (XblAuthManager) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "XblAuthManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableXblAuthManager.ps1 # Description: Disables the unnecessary Xbox Live Auth Manager (XblAuthManager) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Xbox Live Auth Manager service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "XblAuthManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-xblgamesave.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Xbox Live Game Save (XblGameSave) service directly supports this: Provides gaming save functions; irrelevant to server infrastructure. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\XblGameSave Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableXblGameSave.ps1 # Configure-DisableXblGameSave.ps1 # Description: Disables the unnecessary Xbox Live Game Save (XblGameSave) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Xbox Live Game Save service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "XblGameSave" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-XblGameSaveStatus.ps1 # Get-XblGameSaveStatus.ps1 # Description: Audits the registry startup state of unnecessary Xbox Live Game Save (XblGameSave) service. Write-Host "--- Auditing Xbox Live Game Save (XblGameSave) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "XblGameSave" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableXblGameSave.ps1 # Description: Disables the unnecessary Xbox Live Game Save (XblGameSave) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Xbox Live Game Save service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "XblGameSave" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-axinstsv.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the ActiveX Installer (AxInstSV) (AxInstSV) service directly supports this: Validates ActiveX controls. Domain Controllers should never run ActiveX controls. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\AxInstSV Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableAxInstSV.ps1 # Configure-DisableAxInstSV.ps1 # Description: Disables the unnecessary ActiveX Installer (AxInstSV) (AxInstSV) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable ActiveX Installer (AxInstSV) service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "AxInstSV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-AxInstSVStatus.ps1 # Get-AxInstSVStatus.ps1 # Description: Audits the registry startup state of unnecessary ActiveX Installer (AxInstSV) (AxInstSV) service. Write-Host "--- Auditing ActiveX Installer (AxInstSV) (AxInstSV) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "AxInstSV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableAxInstSV.ps1 # Description: Disables the unnecessary ActiveX Installer (AxInstSV) (AxInstSV) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable ActiveX Installer (AxInstSV) service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "AxInstSV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-bthserv.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Bluetooth Support Service (bthserv) service directly supports this: Supports Bluetooth devices; unnecessary on server systems. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\bthserv Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disablebthserv.ps1 # Configure-Disablebthserv.ps1 # Description: Disables the unnecessary Bluetooth Support Service (bthserv) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Bluetooth Support Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "bthserv" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-bthservStatus.ps1 # Get-bthservStatus.ps1 # Description: Audits the registry startup state of unnecessary Bluetooth Support Service (bthserv) service. Write-Host "--- Auditing Bluetooth Support Service (bthserv) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "bthserv" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disablebthserv.ps1 # Description: Disables the unnecessary Bluetooth Support Service (bthserv) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Bluetooth Support Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "bthserv" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-cdpusersvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Connected Devices Platform User Service (CDPUserSvc) service directly supports this: Connected Devices Platform User Service; syncs user activity data across devices. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\CDPUserSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableCDPUserSvc.ps1 # Configure-DisableCDPUserSvc.ps1 # Description: Disables the unnecessary Connected Devices Platform User Service (CDPUserSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Connected Devices Platform User Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "CDPUserSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-CDPUserSvcStatus.ps1 # Get-CDPUserSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Connected Devices Platform User Service (CDPUserSvc) service. Write-Host "--- Auditing Connected Devices Platform User Service (CDPUserSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "CDPUserSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableCDPUserSvc.ps1 # Description: Disables the unnecessary Connected Devices Platform User Service (CDPUserSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Connected Devices Platform User Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "CDPUserSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-pimindexmaintenancesvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Contact Data (PimIndexMaintenanceSvc) service directly supports this: Manages contact data indexing; unnecessary on directory servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\PimIndexMaintenanceSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePimIndexMaintenanceSvc.ps1 # Configure-DisablePimIndexMaintenanceSvc.ps1 # Description: Disables the unnecessary Contact Data (PimIndexMaintenanceSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Contact Data service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "PimIndexMaintenanceSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-PimIndexMaintenanceSvcStatus.ps1 # Get-PimIndexMaintenanceSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Contact Data (PimIndexMaintenanceSvc) service. Write-Host "--- Auditing Contact Data (PimIndexMaintenanceSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "PimIndexMaintenanceSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePimIndexMaintenanceSvc.ps1 # Description: Disables the unnecessary Contact Data (PimIndexMaintenanceSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Contact Data service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "PimIndexMaintenanceSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-dmwappushservice.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the WAP Push Message Routing Service (dmwappushservice) service directly supports this: WAP Push Message Routing Service; used for diagnostics and telemetry. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\dmwappushservice Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disabledmwappushservice.ps1 # Configure-Disabledmwappushservice.ps1 # Description: Disables the unnecessary WAP Push Message Routing Service (dmwappushservice) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable WAP Push Message Routing Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "dmwappushservice" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-dmwappushserviceStatus.ps1 # Get-dmwappushserviceStatus.ps1 # Description: Audits the registry startup state of unnecessary WAP Push Message Routing Service (dmwappushservice) service. Write-Host "--- Auditing WAP Push Message Routing Service (dmwappushservice) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "dmwappushservice" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disabledmwappushservice.ps1 # Description: Disables the unnecessary WAP Push Message Routing Service (dmwappushservice) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable WAP Push Message Routing Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "dmwappushservice" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-mapsbroker.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Downloaded Maps Manager (MapsBroker) service directly supports this: Enables access to downloaded maps; irrelevant to server roles. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\MapsBroker Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableMapsBroker.ps1 # Configure-DisableMapsBroker.ps1 # Description: Disables the unnecessary Downloaded Maps Manager (MapsBroker) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Downloaded Maps Manager service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "MapsBroker" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-MapsBrokerStatus.ps1 # Get-MapsBrokerStatus.ps1 # Description: Audits the registry startup state of unnecessary Downloaded Maps Manager (MapsBroker) service. Write-Host "--- Auditing Downloaded Maps Manager (MapsBroker) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "MapsBroker" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableMapsBroker.ps1 # Description: Disables the unnecessary Downloaded Maps Manager (MapsBroker) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Downloaded Maps Manager service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "MapsBroker" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-lfsvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Geolocation Service (lfsvc) service directly supports this: Monitors system location; represents a privacy and security risk. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\lfsvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disablelfsvc.ps1 # Configure-Disablelfsvc.ps1 # Description: Disables the unnecessary Geolocation Service (lfsvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Geolocation Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "lfsvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-lfsvcStatus.ps1 # Get-lfsvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Geolocation Service (lfsvc) service. Write-Host "--- Auditing Geolocation Service (lfsvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "lfsvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disablelfsvc.ps1 # Description: Disables the unnecessary Geolocation Service (lfsvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Geolocation Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "lfsvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-sharedaccess.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Internet Connection Sharing (ICS) (SharedAccess) service directly supports this: Provides network address translation; represents a networking security risk. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\SharedAccess Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableSharedAccess.ps1 # Configure-DisableSharedAccess.ps1 # Description: Disables the unnecessary Internet Connection Sharing (ICS) (SharedAccess) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Internet Connection Sharing (ICS) service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SharedAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-SharedAccessStatus.ps1 # Get-SharedAccessStatus.ps1 # Description: Audits the registry startup state of unnecessary Internet Connection Sharing (ICS) (SharedAccess) service. Write-Host "--- Auditing Internet Connection Sharing (ICS) (SharedAccess) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "SharedAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableSharedAccess.ps1 # Description: Disables the unnecessary Internet Connection Sharing (ICS) (SharedAccess) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Internet Connection Sharing (ICS) service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SharedAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-lltdsvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Link-Layer Topology Discovery Mapper (lltdsvc) service directly supports this: Discovers network topology; unnecessary exposure of server network location. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\lltdsvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disablelltdsvc.ps1 # Configure-Disablelltdsvc.ps1 # Description: Disables the unnecessary Link-Layer Topology Discovery Mapper (lltdsvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Link-Layer Topology Discovery Mapper service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "lltdsvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-lltdsvcStatus.ps1 # Get-lltdsvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Link-Layer Topology Discovery Mapper (lltdsvc) service. Write-Host "--- Auditing Link-Layer Topology Discovery Mapper (lltdsvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "lltdsvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disablelltdsvc.ps1 # Description: Disables the unnecessary Link-Layer Topology Discovery Mapper (lltdsvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Link-Layer Topology Discovery Mapper service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "lltdsvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-wlidsvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Microsoft Account Sign-in Assistant (wlidsvc) service directly supports this: Enables user signing with Microsoft Accounts; unnecessary on directory servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\wlidsvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disablewlidsvc.ps1 # Configure-Disablewlidsvc.ps1 # Description: Disables the unnecessary Microsoft Account Sign-in Assistant (wlidsvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Microsoft Account Sign-in Assistant service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "wlidsvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-wlidsvcStatus.ps1 # Get-wlidsvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Microsoft Account Sign-in Assistant (wlidsvc) service. Write-Host "--- Auditing Microsoft Account Sign-in Assistant (wlidsvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "wlidsvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disablewlidsvc.ps1 # Description: Disables the unnecessary Microsoft Account Sign-in Assistant (wlidsvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Microsoft Account Sign-in Assistant service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "wlidsvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-ngcsvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Microsoft Passport (NgcSvc) service directly supports this: Part of Windows Hello for Business; not needed if Windows Hello is not deployed. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\NgcSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableNgcSvc.ps1 # Configure-DisableNgcSvc.ps1 # Description: Disables the unnecessary Microsoft Passport (NgcSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Microsoft Passport service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "NgcSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-NgcSvcStatus.ps1 # Get-NgcSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Microsoft Passport (NgcSvc) service. Write-Host "--- Auditing Microsoft Passport (NgcSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "NgcSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableNgcSvc.ps1 # Description: Disables the unnecessary Microsoft Passport (NgcSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Microsoft Passport service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "NgcSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-ngcctnrsvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Microsoft Passport Container (NgcCtnrSvc) service directly supports this: Part of Windows Hello for Business container management. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\NgcCtnrSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableNgcCtnrSvc.ps1 # Configure-DisableNgcCtnrSvc.ps1 # Description: Disables the unnecessary Microsoft Passport Container (NgcCtnrSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Microsoft Passport Container service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "NgcCtnrSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-NgcCtnrSvcStatus.ps1 # Get-NgcCtnrSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Microsoft Passport Container (NgcCtnrSvc) service. Write-Host "--- Auditing Microsoft Passport Container (NgcCtnrSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "NgcCtnrSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableNgcCtnrSvc.ps1 # Description: Disables the unnecessary Microsoft Passport Container (NgcCtnrSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Microsoft Passport Container service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "NgcCtnrSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-ncbservice.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Network Connection Broker (NcbService) service directly supports this: Broker for background network connections for modern apps. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\NcbService Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableNcbService.ps1 # Configure-DisableNcbService.ps1 # Description: Disables the unnecessary Network Connection Broker (NcbService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Network Connection Broker service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "NcbService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-NcbServiceStatus.ps1 # Get-NcbServiceStatus.ps1 # Description: Audits the registry startup state of unnecessary Network Connection Broker (NcbService) service. Write-Host "--- Auditing Network Connection Broker (NcbService) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "NcbService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableNcbService.ps1 # Description: Disables the unnecessary Network Connection Broker (NcbService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Network Connection Broker service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "NcbService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-phonesvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Phone Service (PhoneSvc) service directly supports this: Manages telephony state; irrelevant to server infrastructure. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\PhoneSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePhoneSvc.ps1 # Configure-DisablePhoneSvc.ps1 # Description: Disables the unnecessary Phone Service (PhoneSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Phone Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "PhoneSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-PhoneSvcStatus.ps1 # Get-PhoneSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Phone Service (PhoneSvc) service. Write-Host "--- Auditing Phone Service (PhoneSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "PhoneSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePhoneSvc.ps1 # Description: Disables the unnecessary Phone Service (PhoneSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Phone Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "PhoneSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-printnotify.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Printer Extensions and Notifications (PrintNotify) service directly supports this: Handles printer notification dialogs; unnecessary on servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\PrintNotify Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePrintNotify.ps1 # Configure-DisablePrintNotify.ps1 # Description: Disables the unnecessary Printer Extensions and Notifications (PrintNotify) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Printer Extensions and Notifications service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "PrintNotify" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-PrintNotifyStatus.ps1 # Get-PrintNotifyStatus.ps1 # Description: Audits the registry startup state of unnecessary Printer Extensions and Notifications (PrintNotify) service. Write-Host "--- Auditing Printer Extensions and Notifications (PrintNotify) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "PrintNotify" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePrintNotify.ps1 # Description: Disables the unnecessary Printer Extensions and Notifications (PrintNotify) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Printer Extensions and Notifications service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "PrintNotify" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-pcasvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Program Compatibility Assistant Service (PcaSvc) service directly supports this: Detects application compatibility issues; unnecessary on highly controlled DCs. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\PcaSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePcaSvc.ps1 # Configure-DisablePcaSvc.ps1 # Description: Disables the unnecessary Program Compatibility Assistant Service (PcaSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Program Compatibility Assistant Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "PcaSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-PcaSvcStatus.ps1 # Get-PcaSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Program Compatibility Assistant Service (PcaSvc) service. Write-Host "--- Auditing Program Compatibility Assistant Service (PcaSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "PcaSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePcaSvc.ps1 # Description: Disables the unnecessary Program Compatibility Assistant Service (PcaSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Program Compatibility Assistant Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "PcaSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-qwave.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Quality Windows Audio Video Experience (QWAVE) service directly supports this: Multimedia streaming quality service; irrelevant to server systems. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\QWAVE Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableQWAVE.ps1 # Configure-DisableQWAVE.ps1 # Description: Disables the unnecessary Quality Windows Audio Video Experience (QWAVE) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Quality Windows Audio Video Experience service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "QWAVE" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-QWAVEStatus.ps1 # Get-QWAVEStatus.ps1 # Description: Audits the registry startup state of unnecessary Quality Windows Audio Video Experience (QWAVE) service. Write-Host "--- Auditing Quality Windows Audio Video Experience (QWAVE) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "QWAVE" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableQWAVE.ps1 # Description: Disables the unnecessary Quality Windows Audio Video Experience (QWAVE) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Quality Windows Audio Video Experience service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "QWAVE" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-rmsvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Radio Management Service (RmSvc) service directly supports this: Controls radio transmitters (cellular, Wi-Fi); irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\RmSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableRmSvc.ps1 # Configure-DisableRmSvc.ps1 # Description: Disables the unnecessary Radio Management Service (RmSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Radio Management Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "RmSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-RmSvcStatus.ps1 # Get-RmSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Radio Management Service (RmSvc) service. Write-Host "--- Auditing Radio Management Service (RmSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "RmSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableRmSvc.ps1 # Description: Disables the unnecessary Radio Management Service (RmSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Radio Management Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "RmSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-sensordataservice.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Sensor Data Service (SensorDataService) service directly supports this: Handles data from system sensors; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\SensorDataService Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableSensorDataService.ps1 # Configure-DisableSensorDataService.ps1 # Description: Disables the unnecessary Sensor Data Service (SensorDataService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Sensor Data Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SensorDataService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-SensorDataServiceStatus.ps1 # Get-SensorDataServiceStatus.ps1 # Description: Audits the registry startup state of unnecessary Sensor Data Service (SensorDataService) service. Write-Host "--- Auditing Sensor Data Service (SensorDataService) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "SensorDataService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableSensorDataService.ps1 # Description: Disables the unnecessary Sensor Data Service (SensorDataService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Sensor Data Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SensorDataService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-sensrsvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Sensor Monitoring Service (SensrSvc) service directly supports this: Monitors system sensors; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\SensrSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableSensrSvc.ps1 # Configure-DisableSensrSvc.ps1 # Description: Disables the unnecessary Sensor Monitoring Service (SensrSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Sensor Monitoring Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SensrSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-SensrSvcStatus.ps1 # Get-SensrSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Sensor Monitoring Service (SensrSvc) service. Write-Host "--- Auditing Sensor Monitoring Service (SensrSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "SensrSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableSensrSvc.ps1 # Description: Disables the unnecessary Sensor Monitoring Service (SensrSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Sensor Monitoring Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SensrSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-sensorservice.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Sensor Service (SensorService) service directly supports this: Core sensor service; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\SensorService Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableSensorService.ps1 # Configure-DisableSensorService.ps1 # Description: Disables the unnecessary Sensor Service (SensorService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Sensor Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SensorService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-SensorServiceStatus.ps1 # Get-SensorServiceStatus.ps1 # Description: Audits the registry startup state of unnecessary Sensor Service (SensorService) service. Write-Host "--- Auditing Sensor Service (SensorService) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "SensorService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableSensorService.ps1 # Description: Disables the unnecessary Sensor Service (SensorService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Sensor Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SensorService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-shellhwdetection.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Shell Hardware Detection (ShellHWDetection) service directly supports this: Provides notifications for AutoPlay hardware events; can be disabled. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\ShellHWDetection Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableShellHWDetection.ps1 # Configure-DisableShellHWDetection.ps1 # Description: Disables the unnecessary Shell Hardware Detection (ShellHWDetection) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Shell Hardware Detection service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "ShellHWDetection" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-ShellHWDetectionStatus.ps1 # Get-ShellHWDetectionStatus.ps1 # Description: Audits the registry startup state of unnecessary Shell Hardware Detection (ShellHWDetection) service. Write-Host "--- Auditing Shell Hardware Detection (ShellHWDetection) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "ShellHWDetection" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableShellHWDetection.ps1 # Description: Disables the unnecessary Shell Hardware Detection (ShellHWDetection) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Shell Hardware Detection service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "ShellHWDetection" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-scdeviceenum.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Smart Card Device Enumeration Service (ScDeviceEnum) service directly supports this: Detects smart cards; can be disabled if smart cards are not used for authentication. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\ScDeviceEnum Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableScDeviceEnum.ps1 # Configure-DisableScDeviceEnum.ps1 # Description: Disables the unnecessary Smart Card Device Enumeration Service (ScDeviceEnum) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Smart Card Device Enumeration Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "ScDeviceEnum" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-ScDeviceEnumStatus.ps1 # Get-ScDeviceEnumStatus.ps1 # Description: Audits the registry startup state of unnecessary Smart Card Device Enumeration Service (ScDeviceEnum) service. Write-Host "--- Auditing Smart Card Device Enumeration Service (ScDeviceEnum) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "ScDeviceEnum" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableScDeviceEnum.ps1 # Description: Disables the unnecessary Smart Card Device Enumeration Service (ScDeviceEnum) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Smart Card Device Enumeration Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "ScDeviceEnum" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-ssdpsrv.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the SSDP Discovery (SSDPSRV) service directly supports this: Discovers UPnP devices; introduces broadcast name discovery vulnerabilities. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\SSDPSRV Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableSSDPSRV.ps1 # Configure-DisableSSDPSRV.ps1 # Description: Disables the unnecessary SSDP Discovery (SSDPSRV) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable SSDP Discovery service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SSDPSRV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-SSDPSRVStatus.ps1 # Get-SSDPSRVStatus.ps1 # Description: Audits the registry startup state of unnecessary SSDP Discovery (SSDPSRV) service. Write-Host "--- Auditing SSDP Discovery (SSDPSRV) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "SSDPSRV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableSSDPSRV.ps1 # Description: Disables the unnecessary SSDP Discovery (SSDPSRV) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable SSDP Discovery service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "SSDPSRV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-wiarpc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Still Image Acquisition Events (WiaRpc) service directly supports this: Still image capturing events; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\WiaRpc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableWiaRpc.ps1 # Configure-DisableWiaRpc.ps1 # Description: Disables the unnecessary Still Image Acquisition Events (WiaRpc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Still Image Acquisition Events service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "WiaRpc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-WiaRpcStatus.ps1 # Get-WiaRpcStatus.ps1 # Description: Audits the registry startup state of unnecessary Still Image Acquisition Events (WiaRpc) service. Write-Host "--- Auditing Still Image Acquisition Events (WiaRpc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "WiaRpc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableWiaRpc.ps1 # Description: Disables the unnecessary Still Image Acquisition Events (WiaRpc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Still Image Acquisition Events service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "WiaRpc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-onesyncsvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Sync Host (OneSyncSvc) service directly supports this: Synchronizes mail, contacts, calendar; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\OneSyncSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableOneSyncSvc.ps1 # Configure-DisableOneSyncSvc.ps1 # Description: Disables the unnecessary Sync Host (OneSyncSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Sync Host service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "OneSyncSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-OneSyncSvcStatus.ps1 # Get-OneSyncSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Sync Host (OneSyncSvc) service. Write-Host "--- Auditing Sync Host (OneSyncSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "OneSyncSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableOneSyncSvc.ps1 # Description: Disables the unnecessary Sync Host (OneSyncSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Sync Host service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "OneSyncSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-upnphost.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the UPnP Device Host (upnphost) service directly supports this: Allows hosting of UPnP devices; represents unnecessary network exposure. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\upnphost Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disableupnphost.ps1 # Configure-Disableupnphost.ps1 # Description: Disables the unnecessary UPnP Device Host (upnphost) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable UPnP Device Host service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "upnphost" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-upnphostStatus.ps1 # Get-upnphostStatus.ps1 # Description: Audits the registry startup state of unnecessary UPnP Device Host (upnphost) service. Write-Host "--- Auditing UPnP Device Host (upnphost) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "upnphost" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disableupnphost.ps1 # Description: Disables the unnecessary UPnP Device Host (upnphost) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable UPnP Device Host service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "upnphost" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-userdatasvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the User Data Access (UserDataSvc) service directly supports this: Manages user structured data; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\UserDataSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableUserDataSvc.ps1 # Configure-DisableUserDataSvc.ps1 # Description: Disables the unnecessary User Data Access (UserDataSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable User Data Access service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "UserDataSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-UserDataSvcStatus.ps1 # Get-UserDataSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary User Data Access (UserDataSvc) service. Write-Host "--- Auditing User Data Access (UserDataSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "UserDataSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableUserDataSvc.ps1 # Description: Disables the unnecessary User Data Access (UserDataSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable User Data Access service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "UserDataSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-unistoresvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the User Data Storage (UnistoreSvc) service directly supports this: Stores user data; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\UnistoreSvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableUnistoreSvc.ps1 # Configure-DisableUnistoreSvc.ps1 # Description: Disables the unnecessary User Data Storage (UnistoreSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable User Data Storage service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "UnistoreSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-UnistoreSvcStatus.ps1 # Get-UnistoreSvcStatus.ps1 # Description: Audits the registry startup state of unnecessary User Data Storage (UnistoreSvc) service. Write-Host "--- Auditing User Data Storage (UnistoreSvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "UnistoreSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableUnistoreSvc.ps1 # Description: Disables the unnecessary User Data Storage (UnistoreSvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable User Data Storage service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "UnistoreSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-walletservice.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the WalletService (WalletService) service directly supports this: Used by Wallet application; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\WalletService Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableWalletService.ps1 # Configure-DisableWalletService.ps1 # Description: Disables the unnecessary WalletService (WalletService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable WalletService service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "WalletService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-WalletServiceStatus.ps1 # Get-WalletServiceStatus.ps1 # Description: Audits the registry startup state of unnecessary WalletService (WalletService) service. Write-Host "--- Auditing WalletService (WalletService) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "WalletService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableWalletService.ps1 # Description: Disables the unnecessary WalletService (WalletService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable WalletService service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "WalletService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-audiosrv.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Audio (Audiosrv) service directly supports this: Manages system audio; servers do not require audio capabilities. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\Audiosrv Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableAudiosrv.ps1 # Configure-DisableAudiosrv.ps1 # Description: Disables the unnecessary Windows Audio (Audiosrv) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Audio service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "Audiosrv" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-AudiosrvStatus.ps1 # Get-AudiosrvStatus.ps1 # Description: Audits the registry startup state of unnecessary Windows Audio (Audiosrv) service. Write-Host "--- Auditing Windows Audio (Audiosrv) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "Audiosrv" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableAudiosrv.ps1 # Description: Disables the unnecessary Windows Audio (Audiosrv) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Audio service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "Audiosrv" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-audioendpointbuilder.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Audio Endpoint Builder (AudioEndpointBuilder) service directly supports this: Manages audio endpoints; servers do not require audio capabilities. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableAudioEndpointBuilder.ps1 # Configure-DisableAudioEndpointBuilder.ps1 # Description: Disables the unnecessary Windows Audio Endpoint Builder (AudioEndpointBuilder) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Audio Endpoint Builder service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "AudioEndpointBuilder" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-AudioEndpointBuilderStatus.ps1 # Get-AudioEndpointBuilderStatus.ps1 # Description: Audits the registry startup state of unnecessary Windows Audio Endpoint Builder (AudioEndpointBuilder) service. Write-Host "--- Auditing Windows Audio Endpoint Builder (AudioEndpointBuilder) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "AudioEndpointBuilder" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableAudioEndpointBuilder.ps1 # Description: Disables the unnecessary Windows Audio Endpoint Builder (AudioEndpointBuilder) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Audio Endpoint Builder service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "AudioEndpointBuilder" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-frameserver.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Camera Frame Server (FrameServer) service directly supports this: Enables access to system camera feeds; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\FrameServer Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableFrameServer.ps1 # Configure-DisableFrameServer.ps1 # Description: Disables the unnecessary Windows Camera Frame Server (FrameServer) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Camera Frame Server service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "FrameServer" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-FrameServerStatus.ps1 # Get-FrameServerStatus.ps1 # Description: Audits the registry startup state of unnecessary Windows Camera Frame Server (FrameServer) service. Write-Host "--- Auditing Windows Camera Frame Server (FrameServer) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "FrameServer" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableFrameServer.ps1 # Description: Disables the unnecessary Windows Camera Frame Server (FrameServer) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Camera Frame Server service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "FrameServer" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-stisvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Image Acquisition (WIA) (stisvc) service directly supports this: Image acquisition from scanners/cameras; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\stisvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disablestisvc.ps1 # Configure-Disablestisvc.ps1 # Description: Disables the unnecessary Windows Image Acquisition (WIA) (stisvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Image Acquisition (WIA) service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "stisvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-stisvcStatus.ps1 # Get-stisvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Windows Image Acquisition (WIA) (stisvc) service. Write-Host "--- Auditing Windows Image Acquisition (WIA) (stisvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "stisvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disablestisvc.ps1 # Description: Disables the unnecessary Windows Image Acquisition (WIA) (stisvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Image Acquisition (WIA) service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "stisvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-wisvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Insider Service (wisvc) service directly supports this: Handles Windows Insider settings; unnecessary on production servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\wisvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disablewisvc.ps1 # Configure-Disablewisvc.ps1 # Description: Disables the unnecessary Windows Insider Service (wisvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Insider Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "wisvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-wisvcStatus.ps1 # Get-wisvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Windows Insider Service (wisvc) service. Write-Host "--- Auditing Windows Insider Service (wisvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "wisvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disablewisvc.ps1 # Description: Disables the unnecessary Windows Insider Service (wisvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Insider Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "wisvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-icssvc.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Mobile Hotspot Service (icssvc) service directly supports this: Shares internet connection as hotspot; introduces wireless routing security risk. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\icssvc Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disableicssvc.ps1 # Configure-Disableicssvc.ps1 # Description: Disables the unnecessary Windows Mobile Hotspot Service (icssvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Mobile Hotspot Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "icssvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-icssvcStatus.ps1 # Get-icssvcStatus.ps1 # Description: Audits the registry startup state of unnecessary Windows Mobile Hotspot Service (icssvc) service. Write-Host "--- Auditing Windows Mobile Hotspot Service (icssvc) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "icssvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disableicssvc.ps1 # Description: Disables the unnecessary Windows Mobile Hotspot Service (icssvc) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Mobile Hotspot Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "icssvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-wpnservice.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Push Notifications System Service (WpnService) service directly supports this: System service for push notifications; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\WpnService Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableWpnService.ps1 # Configure-DisableWpnService.ps1 # Description: Disables the unnecessary Windows Push Notifications System Service (WpnService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Push Notifications System Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "WpnService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-WpnServiceStatus.ps1 # Get-WpnServiceStatus.ps1 # Description: Audits the registry startup state of unnecessary Windows Push Notifications System Service (WpnService) service. Write-Host "--- Auditing Windows Push Notifications System Service (WpnService) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "WpnService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableWpnService.ps1 # Description: Disables the unnecessary Windows Push Notifications System Service (WpnService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Push Notifications System Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "WpnService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022. File Path: 02-domain-controllers/services/disable-wpnuserservice.md Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Windows Push Notifications User Service (WpnUserService) service directly supports this: User service for push notifications; irrelevant to servers. Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\WpnUserService Value name*: Start Value type*: REG_DWORD Value data*: 4 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableWpnUserService.ps1 # Configure-DisableWpnUserService.ps1 # Description: Disables the unnecessary Windows Push Notifications User Service (WpnUserService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Push Notifications User Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "WpnUserService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the Domain Controller: Download Script: Get-WpnUserServiceStatus.ps1 # Get-WpnUserServiceStatus.ps1 # Description: Audits the registry startup state of unnecessary Windows Push Notifications User Service (WpnUserService) service. Write-Host "--- Auditing Windows Push Notifications User Service (WpnUserService) Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "WpnUserService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableWpnUserService.ps1 # Description: Disables the unnecessary Windows Push Notifications User Service (WpnUserService) service on Domain Controllers. Write-Host "Applying hardening requirement: Disable Windows Push Notifications User Service service on Domain Controllers..." -ForegroundColor Cyan $ServiceName = "WpnUserService" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers (DCs) running Windows Server. Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025. File Path: 02-domain-controllers/services/disable-webclient.md The WebClient service enables Windows-based programs to create, access, and modify Internet-based files via the Web Distributed Authoring and Versioning (WebDAV) protocol. In an Active Directory environment, the WebClient service represents a major credential coercion and relay attack surface: 1. Bypassing SMB Signing: WebDAV coercion triggers an outbound HTTP/HTTPS connection using NTLM authentication rather than SMB. Because HTTP authentication does not enforce SMB signing, an attacker can coerce a Domain Controller (e.g., via PetitPotam, DFSCoerce, or ShadowCoerce targeting a WebDAV path like \\attacker@80\share\test) and relay the coerced machine account NTLM credentials directly to LDAP/LDAPS, Active Directory Certificate Services (AD CS) Web Enrollment, or other critical directory endpoints. 2. Principle of Least Functionality: Domain Controllers perform core directory and authentication functions and must never operate as WebDAV clients to external or internal web servers. Stopping and disabling the WebClient service on Domain Controllers completely neutralizes WebDAV-based coercion and cross-protocol relay vectors. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the Domain Controllers GPO (e.g., GPO_Hardening_DC). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate WebClient, double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableWebClient.ps1 # Configure-DisableWebClient.ps1 # Description: Disables the WebClient service on the Domain Controller to eliminate WebDAV coercion and relay attacks. Write-Host "Applying hardening requirement: Disable WebClient service on Domain Controller..." -ForegroundColor Cyan $ServiceName = "WebClient" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup configuration of the WebClient service on the Domain Controller: Download Script: Get-WebClientStatus.ps1 # Get-WebClientStatus.ps1 # Description: Audits the startup configuration of the WebClient service on the Domain Controller. Write-Host "--- Auditing WebClient Service on Domain Controller ---" -ForegroundColor Cyan $ServiceName = "WebClient" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableWebClient.ps1 # Description: Disables the WebClient service on the Domain Controller to eliminate WebDAV coercion and relay attacks. Write-Host "Applying hardening requirement: Disable WebClient service on Domain Controller..." -ForegroundColor Cyan $ServiceName = "WebClient" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-audit-override.md Enforcing advanced audit policy overrides prevents legacy category settings from overriding refined subcategory policies, and disabling verbose Kerberos logging ensures that event logs are not flooded with diagnostic events. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Registry: HKLM\System\CurrentControlSet\Control\Lsa\ SCENoApplyLegacyAuditPolicy = 1 (DWord) * Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\ LogLevel = 0 (DWord) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditAuditoverride.ps1 # Configure-DcAuditAuditoverride.ps1 Write-Host "Applying Audit Policy category: audit-override..." -ForegroundColor Cyan # Set Registry Override: SCENoApplyLegacyAuditPolicy if (-not (Test-Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa")) { New-Item -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -Value 1 -Type DWord -Force Write-Host " Enforced SCENoApplyLegacyAuditPolicy = 1" -ForegroundColor Green # Set Registry Override: LogLevel if (-not (Test-Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters")) { New-Item -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "LogLevel" -Value 0 -Type DWord -Force Write-Host " Enforced LogLevel = 0" -ForegroundColor Green To audit the hardening status: Download Script: Get-DcAuditAuditoverrideStatus.ps1 # Get-DcAuditAuditoverrideStatus.ps1 $script:Vulnerable = $false # Audit Registry: SCENoApplyLegacyAuditPolicy $RegVal = Get-ItemProperty -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.SCENoApplyLegacyAuditPolicy -ne 1) { $script:Vulnerable = $true } # Audit Registry: LogLevel $RegVal = Get-ItemProperty -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "LogLevel" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.LogLevel -ne 0) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditAuditoverride.ps1 Write-Host "Applying Audit Policy category: audit-override..." -ForegroundColor Cyan # Set Registry Override: SCENoApplyLegacyAuditPolicy if (-not (Test-Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa")) { New-Item -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -Value 1 -Type DWord -Force Write-Host " Enforced SCENoApplyLegacyAuditPolicy = 1" -ForegroundColor Green # Set Registry Override: LogLevel if (-not (Test-Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters")) { New-Item -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "LogLevel" -Value 0 -Type DWord -Force Write-Host " Enforced LogLevel = 0" -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-account-logon.md Auditing account logon events captures authentication requests processed by the local system or the domain controller, which is critical for identifying Kerberoasting, NTLM relaying, and brute-force attempts. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Kerberos Authentication Service -> Success and Failure * Subcategory: Kerberos Service Ticket Operations -> Success and Failure * Subcategory: Credential Validation -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditAccountlogon.ps1 # Configure-DcAuditAccountlogon.ps1 Write-Host "Applying Audit Policy category: account-logon..." -ForegroundColor Cyan # Set Audit Subcategory: Kerberos Authentication Service $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Kerberos Authentication Service`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Kerberos Authentication Service to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Kerberos Authentication Service. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Kerberos Service Ticket Operations $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Kerberos Service Ticket Operations`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Kerberos Service Ticket Operations to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Kerberos Service Ticket Operations. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Credential Validation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Credential Validation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Credential Validation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Credential Validation. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-DcAuditAccountlogonStatus.ps1 # Get-DcAuditAccountlogonStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Kerberos Authentication Service $RawOutput = auditpol.exe /get /subcategory:"Kerberos Authentication Service" /r if ($RawOutput -notmatch ",Kerberos Authentication Service,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Kerberos Service Ticket Operations $RawOutput = auditpol.exe /get /subcategory:"Kerberos Service Ticket Operations" /r if ($RawOutput -notmatch ",Kerberos Service Ticket Operations,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Credential Validation $RawOutput = auditpol.exe /get /subcategory:"Credential Validation" /r if ($RawOutput -notmatch ",Credential Validation,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditAccountlogon.ps1 Write-Host "Applying Audit Policy category: account-logon..." -ForegroundColor Cyan # Set Audit Subcategory: Kerberos Authentication Service $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Kerberos Authentication Service`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Kerberos Authentication Service to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Kerberos Authentication Service. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Kerberos Service Ticket Operations $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Kerberos Service Ticket Operations`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Kerberos Service Ticket Operations to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Kerberos Service Ticket Operations. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Credential Validation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Credential Validation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Credential Validation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Credential Validation. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-account-management.md Auditing account management logs security principal modifications (creations, deletions, password resets, group modifications) to detect privilege escalation attempts on domain or local administrative groups. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: User Account Management -> Success and Failure * Subcategory: Security Group Management -> Success and Failure * Subcategory: Application Group Management -> Success and Failure * Subcategory: Computer Account Management -> Success and Failure * Subcategory: Distribution Group Management -> Success * Subcategory: Other Account Management Events -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditAccountmanagement.ps1 # Configure-DcAuditAccountmanagement.ps1 Write-Host "Applying Audit Policy category: account-management..." -ForegroundColor Cyan # Set Audit Subcategory: User Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"User Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory User Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory User Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security Group Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Application Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Application Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Application Group Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Application Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Computer Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Computer Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Computer Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Computer Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Distribution Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Distribution Group Management`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Distribution Group Management to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Distribution Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Account Management Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Account Management Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Account Management Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Account Management Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-DcAuditAccountmanagementStatus.ps1 # Get-DcAuditAccountmanagementStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: User Account Management $RawOutput = auditpol.exe /get /subcategory:"User Account Management" /r if ($RawOutput -notmatch ",User Account Management,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Security Group Management $RawOutput = auditpol.exe /get /subcategory:"Security Group Management" /r if ($RawOutput -notmatch ",Security Group Management,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Application Group Management $RawOutput = auditpol.exe /get /subcategory:"Application Group Management" /r if ($RawOutput -notmatch ",Application Group Management,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Computer Account Management $RawOutput = auditpol.exe /get /subcategory:"Computer Account Management" /r if ($RawOutput -notmatch ",Computer Account Management,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Distribution Group Management $RawOutput = auditpol.exe /get /subcategory:"Distribution Group Management" /r if ($RawOutput -notmatch ",Distribution Group Management,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: Other Account Management Events $RawOutput = auditpol.exe /get /subcategory:"Other Account Management Events" /r if ($RawOutput -notmatch ",Other Account Management Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditAccountmanagement.ps1 Write-Host "Applying Audit Policy category: account-management..." -ForegroundColor Cyan # Set Audit Subcategory: User Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"User Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory User Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory User Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security Group Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Application Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Application Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Application Group Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Application Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Computer Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Computer Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Computer Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Computer Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Distribution Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Distribution Group Management`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Distribution Group Management to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Distribution Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Account Management Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Account Management Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Account Management Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Account Management Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-detailed-tracking.md Detailed tracking records process creations and device arrivals to ensure EDR/SIEM visibility into executable command lines and hardware plug events. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Process Creation -> Success and Failure * Subcategory: DPAPI Activity -> Success and Failure * Subcategory: PNP Activity -> Success Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditDetailedtracking.ps1 # Configure-DcAuditDetailedtracking.ps1 Write-Host "Applying Audit Policy category: detailed-tracking..." -ForegroundColor Cyan # Set Audit Subcategory: Process Creation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Process Creation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Process Creation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Process Creation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: DPAPI Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"DPAPI Activity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory DPAPI Activity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory DPAPI Activity. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: PNP Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"PNP Activity`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory PNP Activity to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory PNP Activity. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-DcAuditDetailedtrackingStatus.ps1 # Get-DcAuditDetailedtrackingStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Process Creation $RawOutput = auditpol.exe /get /subcategory:"Process Creation" /r if ($RawOutput -notmatch ",Process Creation,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: DPAPI Activity $RawOutput = auditpol.exe /get /subcategory:"DPAPI Activity" /r if ($RawOutput -notmatch ",DPAPI Activity,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: PNP Activity $RawOutput = auditpol.exe /get /subcategory:"PNP Activity" /r if ($RawOutput -notmatch ",PNP Activity,.*,Success") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditDetailedtracking.ps1 Write-Host "Applying Audit Policy category: detailed-tracking..." -ForegroundColor Cyan # Set Audit Subcategory: Process Creation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Process Creation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Process Creation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Process Creation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: DPAPI Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"DPAPI Activity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory DPAPI Activity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory DPAPI Activity. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: PNP Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"PNP Activity`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory PNP Activity to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory PNP Activity. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-ds-access.md Auditing Directory Service changes captures creations, modifications, and deletions of Active Directory objects, providing an essential trail for monitoring structural domain modifications. Key security telemetry enabled by these subcategories includes: 1. Shadow Credentials Detection (Event ID 5136): Placing a System Access Control List (SACL) on the msDS-KeyCredentialLink attribute across user and computer objects combined with Directory Service Changes auditing generates Event ID 5136 whenever an attacker attempts to inject raw X.509 certificate credentials (pywhisker, PKINITtools) to gain Kerberos PKINIT persistence or account takeover. 2. DCSync & Replication Rights Auditing (Event ID 4662): Auditing Directory Service Access with SACLs placed on the Domain Root container generates Event ID 4662 when an attacker or unauthorized identity attempts DRSUAPI replication calls (DS-Replication-Get-Changes-All). 3. Privileged Group & ACL Tampering: Provides immediate visibility into unauthorized modifications to administrative groups (Domain Admins, Enterprise Admins, DnsAdmins) and adminSDHolder permission descriptors. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory settings matching: * Subcategory: Directory Service Changes -> Success and Failure * Subcategory: Directory Service Access -> Success and Failure Configure Active Directory SACLs on sensitive containers: To audit Shadow Credentials, open `ADSI Edit` (`adsiedit.msc`), navigate to target organizational units (e.g. `OU=Tier0,DC=corp,DC=local`), right-click -> Properties -> Security -> Advanced -> Auditing* tab. Add an audit entry for Everyone covering Write msDS-KeyCredentialLink (Type: All). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditDsaccess.ps1 # Configure-DcAuditDsaccess.ps1 Write-Host "Applying Audit Policy category: ds-access..." -ForegroundColor Cyan # Set Audit Subcategory: Directory Service Changes $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Directory Service Changes`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Directory Service Changes to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Directory Service Changes. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Directory Service Access $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Directory Service Access`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Directory Service Access to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Directory Service Access. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-DcAuditDsaccessStatus.ps1 # Get-DcAuditDsaccessStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Directory Service Changes $RawOutput = auditpol.exe /get /subcategory:"Directory Service Changes" /r if ($RawOutput -notmatch ",Directory Service Changes,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Directory Service Access $RawOutput = auditpol.exe /get /subcategory:"Directory Service Access" /r if ($RawOutput -notmatch ",Directory Service Access,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditDsaccess.ps1 Write-Host "Applying Audit Policy category: ds-access..." -ForegroundColor Cyan # Set Audit Subcategory: Directory Service Changes $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Directory Service Changes`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Directory Service Changes to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Directory Service Changes. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Directory Service Access $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Directory Service Access`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Directory Service Access to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Directory Service Access. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-logon-logoff.md Auditing logon/logoff events monitors administrative session states, special elevations, and failed logon attempts, which is critical for finding unauthorized remote access or lateral movement. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Logon -> Success and Failure * Subcategory: Logoff -> Success * Subcategory: Special Logon -> Success and Failure * Subcategory: Account Lockout -> Success and Failure * Subcategory: Other Logon/Logoff Events -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditLogonlogoff.ps1 # Configure-DcAuditLogonlogoff.ps1 Write-Host "Applying Audit Policy category: logon-logoff..." -ForegroundColor Cyan # Set Audit Subcategory: Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Logoff $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logoff`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logoff to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logoff. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Special Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Special Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Special Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Special Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Account Lockout $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Account Lockout`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Account Lockout to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Account Lockout. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Logon/Logoff Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Logon/Logoff Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Logon/Logoff Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Logon/Logoff Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-DcAuditLogonlogoffStatus.ps1 # Get-DcAuditLogonlogoffStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Logon $RawOutput = auditpol.exe /get /subcategory:"Logon" /r if ($RawOutput -notmatch ",Logon,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Logoff $RawOutput = auditpol.exe /get /subcategory:"Logoff" /r if ($RawOutput -notmatch ",Logoff,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: Special Logon $RawOutput = auditpol.exe /get /subcategory:"Special Logon" /r if ($RawOutput -notmatch ",Special Logon,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Account Lockout $RawOutput = auditpol.exe /get /subcategory:"Account Lockout" /r if ($RawOutput -notmatch ",Account Lockout,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other Logon/Logoff Events $RawOutput = auditpol.exe /get /subcategory:"Other Logon/Logoff Events" /r if ($RawOutput -notmatch ",Other Logon/Logoff Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditLogonlogoff.ps1 Write-Host "Applying Audit Policy category: logon-logoff..." -ForegroundColor Cyan # Set Audit Subcategory: Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Logoff $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logoff`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logoff to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logoff. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Special Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Special Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Special Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Special Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Account Lockout $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Account Lockout`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Account Lockout to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Account Lockout. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Logon/Logoff Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Logon/Logoff Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Logon/Logoff Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Logon/Logoff Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-object-access.md Auditing object access (files, registry keys, and shares) helps monitor unauthorized modifications to system configuration files and access to restricted shares. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Handle Manipulation -> Success and Failure * Subcategory: Registry -> Success and Failure * Subcategory: File Share -> Success and Failure * Subcategory: Detailed File Share -> Failure * Subcategory: Other Object Access Events -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditObjectaccess.ps1 # Configure-DcAuditObjectaccess.ps1 Write-Host "Applying Audit Policy category: object-access..." -ForegroundColor Cyan # Set Audit Subcategory: Handle Manipulation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Handle Manipulation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Handle Manipulation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Handle Manipulation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Registry $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Registry`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Registry to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Registry. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"File Share`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory File Share to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Detailed File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Detailed File Share`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Detailed File Share to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Detailed File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Object Access Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Object Access Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Object Access Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Object Access Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-DcAuditObjectaccessStatus.ps1 # Get-DcAuditObjectaccessStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Handle Manipulation $RawOutput = auditpol.exe /get /subcategory:"Handle Manipulation" /r if ($RawOutput -notmatch ",Handle Manipulation,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Registry $RawOutput = auditpol.exe /get /subcategory:"Registry" /r if ($RawOutput -notmatch ",Registry,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: File Share $RawOutput = auditpol.exe /get /subcategory:"File Share" /r if ($RawOutput -notmatch ",File Share,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Detailed File Share $RawOutput = auditpol.exe /get /subcategory:"Detailed File Share" /r if ($RawOutput -notmatch ",Detailed File Share,.*,Failure") { $script:Vulnerable = $true } # Audit Subcategory: Other Object Access Events $RawOutput = auditpol.exe /get /subcategory:"Other Object Access Events" /r if ($RawOutput -notmatch ",Other Object Access Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditObjectaccess.ps1 Write-Host "Applying Audit Policy category: object-access..." -ForegroundColor Cyan # Set Audit Subcategory: Handle Manipulation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Handle Manipulation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Handle Manipulation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Handle Manipulation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Registry $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Registry`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Registry to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Registry. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"File Share`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory File Share to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Detailed File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Detailed File Share`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Detailed File Share to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Detailed File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Object Access Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Object Access Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Object Access Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Object Access Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-policy-change.md Auditing policy changes tracks attempts to modify authorization policies, auditing configuration changes, or firewall rule alterations to hide adversarial tracks. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Policy Change -> Success and Failure * Subcategory: Authentication Policy Change -> Success * Subcategory: Authorization Policy Change -> Success * Subcategory: MPSSVC Rule-Level Policy Change -> Success and Failure * Subcategory: Other Policy Change Events -> Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditPolicychange.ps1 # Configure-DcAuditPolicychange.ps1 Write-Host "Applying Audit Policy category: policy-change..." -ForegroundColor Cyan # Set Audit Subcategory: Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authentication Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authentication Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authentication Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authentication Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authorization Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authorization Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authorization Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authorization Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: MPSSVC Rule-Level Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"MPSSVC Rule-Level Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory MPSSVC Rule-Level Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory MPSSVC Rule-Level Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Policy Change Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Policy Change Events`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Policy Change Events to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Policy Change Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-DcAuditPolicychangeStatus.ps1 # Get-DcAuditPolicychangeStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Policy Change $RawOutput = auditpol.exe /get /subcategory:"Policy Change" /r if ($RawOutput -notmatch ",Policy Change,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Authentication Policy Change $RawOutput = auditpol.exe /get /subcategory:"Authentication Policy Change" /r if ($RawOutput -notmatch ",Authentication Policy Change,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: Authorization Policy Change $RawOutput = auditpol.exe /get /subcategory:"Authorization Policy Change" /r if ($RawOutput -notmatch ",Authorization Policy Change,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: MPSSVC Rule-Level Policy Change $RawOutput = auditpol.exe /get /subcategory:"MPSSVC Rule-Level Policy Change" /r if ($RawOutput -notmatch ",MPSSVC Rule-Level Policy Change,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other Policy Change Events $RawOutput = auditpol.exe /get /subcategory:"Other Policy Change Events" /r if ($RawOutput -notmatch ",Other Policy Change Events,.*,Failure") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditPolicychange.ps1 Write-Host "Applying Audit Policy category: policy-change..." -ForegroundColor Cyan # Set Audit Subcategory: Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authentication Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authentication Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authentication Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authentication Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authorization Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authorization Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authorization Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authorization Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: MPSSVC Rule-Level Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"MPSSVC Rule-Level Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory MPSSVC Rule-Level Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory MPSSVC Rule-Level Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Policy Change Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Policy Change Events`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Policy Change Events to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Policy Change Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-privilege-use.md Auditing sensitive privilege use logs attempts by processes or users to exercise rights like ActAsPartOfTypeOperatingSystem or LoadDrivers, identifying potential privilege escalations. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Sensitive Privilege Use -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditPrivilegeuse.ps1 # Configure-DcAuditPrivilegeuse.ps1 Write-Host "Applying Audit Policy category: privilege-use..." -ForegroundColor Cyan # Set Audit Subcategory: Sensitive Privilege Use $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Sensitive Privilege Use`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Sensitive Privilege Use to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Sensitive Privilege Use. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-DcAuditPrivilegeuseStatus.ps1 # Get-DcAuditPrivilegeuseStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Sensitive Privilege Use $RawOutput = auditpol.exe /get /subcategory:"Sensitive Privilege Use" /r if ($RawOutput -notmatch ",Sensitive Privilege Use,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditPrivilegeuse.ps1 Write-Host "Applying Audit Policy category: privilege-use..." -ForegroundColor Cyan # Set Audit Subcategory: Sensitive Privilege Use $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Sensitive Privilege Use`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Sensitive Privilege Use to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Sensitive Privilege Use. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 02-domain-controllers/audit-policy/configure-dc-audit-system-events.md Auditing system security extensions, integrity violations, and driver arrivals monitors boot health and tampering of host security services. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: IPsec Driver -> Success and Failure * Subcategory: Other System Events -> Success and Failure * Subcategory: Security State Change -> Success and Failure * Subcategory: Security System Extension -> Success and Failure * Subcategory: System Integrity -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DcAuditSystemevents.ps1 # Configure-DcAuditSystemevents.ps1 Write-Host "Applying Audit Policy category: system-events..." -ForegroundColor Cyan # Set Audit Subcategory: IPsec Driver $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"IPsec Driver`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory IPsec Driver to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory IPsec Driver. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other System Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other System Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other System Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other System Events. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security State Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security State Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security State Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security State Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security System Extension $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security System Extension`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security System Extension to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security System Extension. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: System Integrity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"System Integrity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory System Integrity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory System Integrity. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-DcAuditSystemeventsStatus.ps1 # Get-DcAuditSystemeventsStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: IPsec Driver $RawOutput = auditpol.exe /get /subcategory:"IPsec Driver" /r if ($RawOutput -notmatch ",IPsec Driver,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other System Events $RawOutput = auditpol.exe /get /subcategory:"Other System Events" /r if ($RawOutput -notmatch ",Other System Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Security State Change $RawOutput = auditpol.exe /get /subcategory:"Security State Change" /r if ($RawOutput -notmatch ",Security State Change,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Security System Extension $RawOutput = auditpol.exe /get /subcategory:"Security System Extension" /r if ($RawOutput -notmatch ",Security System Extension,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: System Integrity $RawOutput = auditpol.exe /get /subcategory:"System Integrity" /r if ($RawOutput -notmatch ",System Integrity,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-DcAuditSystemevents.ps1 Write-Host "Applying Audit Policy category: system-events..." -ForegroundColor Cyan # Set Audit Subcategory: IPsec Driver $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"IPsec Driver`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory IPsec Driver to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory IPsec Driver. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other System Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other System Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other System Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other System Events. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security State Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security State Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security State Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security State Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security System Extension $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security System Extension`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security System Extension to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security System Extension. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: System Integrity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"System Integrity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory System Integrity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory System Integrity. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/network/configure-tcpip-keepalivetime.md The KeepAliveTime parameter controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet. If the remote system is still reachable and functioning, it acknowledges the keep-alive transmission. In Active Directory environments, Domain Controllers manage high volumes of concurrent Kerberos, LDAP, SMB, and RPC sessions with member servers and workstations. Configuring KeepAliveTime to 300,000 milliseconds (5 minutes) instead of the default 2 hours (7,200,000 ms) ensures orphaned or dead TCP connections from abruptly disconnected clients are detected and reclaimed promptly. This mitigates half-open connection accumulation and denial-of-service risks against server connection pools. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create or update the following Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Value name*: KeepAliveTime Value type*: REG_DWORD Value data*: 300000 (Decimal) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure KeepAliveTime on the Domain Controller. Download Script: Configure-TcpipKeepAliveTime.ps1 # Configure-TcpipKeepAliveTime.ps1 # Description: Configures TCP/IP KeepAliveTime parameter to 300000 ms (5 minutes) on Domain Controllers. Write-Host "Configuring TCP/IP KeepAliveTime..." -ForegroundColor Cyan $TcpipParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" if (-not (Test-Path -Path $TcpipParamsPath)) { New-Item -Path $TcpipParamsPath -Force | Out-Null } Set-ItemProperty -Path $TcpipParamsPath -Name "KeepAliveTime" -Value 300000 -Type DWord -ErrorAction Stop Write-Host "TCP/IP KeepAliveTime configured successfully (300000 ms)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-TcpipKeepAliveTimeStatus.ps1 # Get-TcpipKeepAliveTimeStatus.ps1 # Description: Audits registry configuration of TCP/IP KeepAliveTime on Domain Controllers. Write-Host "--- Auditing TCP/IP KeepAliveTime ---" -ForegroundColor Cyan $TcpipParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" $ExpectedValue = 300000 if (Test-Path -Path $TcpipParamsPath) { $Reg = Get-ItemProperty -Path $TcpipParamsPath -ErrorAction SilentlyContinue $CurrentValue = $Reg.KeepAliveTime if ($CurrentValue -eq $ExpectedValue) { Write-Host " [+] KeepAliveTime: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Green exit 0 } else { Write-Host " [!] KeepAliveTime: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Red exit 1 } } else { Write-Host " [!] TCP/IP Parameters Registry Path NOT FOUND" -ForegroundColor Red exit 1 } # Configure-TcpipKeepAliveTime.ps1 # Description: Configures TCP/IP KeepAliveTime parameter to 300000 ms (5 minutes) on Domain Controllers. Write-Host "Configuring TCP/IP KeepAliveTime..." -ForegroundColor Cyan $TcpipParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" if (-not (Test-Path -Path $TcpipParamsPath)) { New-Item -Path $TcpipParamsPath -Force | Out-Null } Set-ItemProperty -Path $TcpipParamsPath -Name "KeepAliveTime" -Value 300000 -Type DWord -ErrorAction Stop Write-Host "TCP/IP KeepAliveTime configured successfully (300000 ms)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/network/disable-tcpip-router-discovery.md The Internet Router Discovery Protocol (IRDP, RFC 1256) enables IPv4 hosts to dynamically discover local default routers by listening for ICMP Router Advertisement packets or soliciting them via ICMP Router Solicitation messages. On Active Directory Domain Controllers, dynamic router discovery presents a severe attack surface: 1. Rogue Gateway Redirection: Attackers positioned on the local network segment can forge unauthenticated ICMP Router Advertisements to advertise a higher-priority default gateway address pointing to an attacker-controlled host. 2. Man-in-the-Middle (MitM): Coercing the Domain Controller to route outbound network traffic through a rogue router allows attackers to intercept, inspect, or modify sensitive replication, Kerberos, LDAP, and DNS communication. Domain Controllers must operate exclusively with statically assigned or enterprise DHCP-reserved gateway addresses. Setting PerformRouterDiscovery to 0 explicitly disables IRDP processing. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create or update the following Registry Preference (Right-click Registry -> New -> Registry Item): Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Value name*: PerformRouterDiscovery Value type*: REG_DWORD Value data*: 0 (Decimal) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable router discovery on the Domain Controller. Download Script: Configure-DisableTcpipRouterDiscovery.ps1 # Configure-DisableTcpipRouterDiscovery.ps1 # Description: Disables IRDP (PerformRouterDiscovery) on Domain Controllers. Write-Host "Disabling TCP/IP Router Discovery..." -ForegroundColor Cyan $TcpipParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" if (-not (Test-Path -Path $TcpipParamsPath)) { New-Item -Path $TcpipParamsPath -Force | Out-Null } Set-ItemProperty -Path $TcpipParamsPath -Name "PerformRouterDiscovery" -Value 0 -Type DWord -ErrorAction Stop Write-Host "TCP/IP Router Discovery disabled successfully (PerformRouterDiscovery = 0)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-TcpipRouterDiscoveryStatus.ps1 # Get-TcpipRouterDiscoveryStatus.ps1 # Description: Audits registry configuration of PerformRouterDiscovery on Domain Controllers. Write-Host "--- Auditing TCP/IP Router Discovery Status ---" -ForegroundColor Cyan $TcpipParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" $ExpectedValue = 0 if (Test-Path -Path $TcpipParamsPath) { $Reg = Get-ItemProperty -Path $TcpipParamsPath -ErrorAction SilentlyContinue $CurrentValue = $Reg.PerformRouterDiscovery if ($CurrentValue -eq $ExpectedValue) { Write-Host " [+] PerformRouterDiscovery: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Green exit 0 } else { Write-Host " [!] PerformRouterDiscovery: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Red exit 1 } } else { Write-Host " [!] TCP/IP Parameters Registry Path NOT FOUND" -ForegroundColor Red exit 1 } # Configure-DisableTcpipRouterDiscovery.ps1 # Description: Disables IRDP (PerformRouterDiscovery) on Domain Controllers. Write-Host "Disabling TCP/IP Router Discovery..." -ForegroundColor Cyan $TcpipParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" if (-not (Test-Path -Path $TcpipParamsPath)) { New-Item -Path $TcpipParamsPath -Force | Out-Null } Set-ItemProperty -Path $TcpipParamsPath -Name "PerformRouterDiscovery" -Value 0 -Type DWord -ErrorAction Stop Write-Host "TCP/IP Router Discovery disabled successfully (PerformRouterDiscovery = 0)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/network/configure-tcpip-max-data-retransmissions.md The TcpMaxDataRetransmissions parameter determines the number of times TCP will retransmit an individual data segment (non-connect segment) before aborting the connection. The retransmission timeout is doubled with each successive retransmission on a connection, backed off exponentially. By default, Windows configures TcpMaxDataRetransmissions to 5, which causes the system to wait over 200 seconds before terminating an unresponsive connection. In an Active Directory environment: 1. Resource Exhaustion Mitigation: Restricting retransmissions to 3 causes stalled or unresponsive connections to be severed significantly faster, releasing kernel memory buffers, TCP control blocks (TCBs), and socket handles. 2. Denial-of-Service Defense: In scenarios involving connection drop attacks, network partitions, or resource starvation attempts, limiting TCP data retransmissions for both IPv4 and IPv6 prevents connection pool depletion on Domain Controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create or update the following Registry Preferences (Right-click Registry -> New -> Registry Item): IPv4 TCP Max Data Retransmissions*: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Value name*: TcpMaxDataRetransmissions Value type*: REG_DWORD Value data*: 3 (Decimal) IPv6 TCP Max Data Retransmissions*: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters Value name*: TcpMaxDataRetransmissions Value type*: REG_DWORD Value data*: 3 (Decimal) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure TcpMaxDataRetransmissions for IPv4 and IPv6 on the Domain Controller. Download Script: Configure-TcpipMaxDataRetransmissions.ps1 # Configure-TcpipMaxDataRetransmissions.ps1 # Description: Sets TcpMaxDataRetransmissions to 3 for IPv4 and IPv6 on Domain Controllers. Write-Host "Configuring TCP Max Data Retransmissions (IPv4 and IPv6)..." -ForegroundColor Cyan $TcpipParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" if (-not (Test-Path -Path $TcpipParamsPath)) { New-Item -Path $TcpipParamsPath -Force | Out-Null } Set-ItemProperty -Path $TcpipParamsPath -Name "TcpMaxDataRetransmissions" -Value 3 -Type DWord -ErrorAction Stop $Tcpip6ParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" if (-not (Test-Path -Path $Tcpip6ParamsPath)) { New-Item -Path $Tcpip6ParamsPath -Force | Out-Null } Set-ItemProperty -Path $Tcpip6ParamsPath -Name "TcpMaxDataRetransmissions" -Value 3 -Type DWord -ErrorAction Stop Write-Host "TCP Max Data Retransmissions configured to 3 for IPv4 and IPv6." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-TcpipMaxDataRetransmissionsStatus.ps1 # Get-TcpipMaxDataRetransmissionsStatus.ps1 # Description: Audits registry configuration of TcpMaxDataRetransmissions for IPv4 and IPv6 on Domain Controllers. Write-Host "--- Auditing TCP Max Data Retransmissions Status ---" -ForegroundColor Cyan $TcpipParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" $Tcpip6ParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" $IsVulnerable = $false if (Test-Path -Path $TcpipParamsPath) { $Reg4 = Get-ItemProperty -Path $TcpipParamsPath -ErrorAction SilentlyContinue $Val4 = $Reg4.TcpMaxDataRetransmissions if ($Val4 -eq 3) { Write-Host " [+] IPv4 TcpMaxDataRetransmissions: $($Val4) (Expected: 3)" -ForegroundColor Green } else { Write-Host " [!] IPv4 TcpMaxDataRetransmissions: $($Val4) (Expected: 3)" -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host " [!] IPv4 Parameters Registry Path NOT FOUND" -ForegroundColor Red $IsVulnerable = $true } if (Test-Path -Path $Tcpip6ParamsPath) { $Reg6 = Get-ItemProperty -Path $Tcpip6ParamsPath -ErrorAction SilentlyContinue $Val6 = $Reg6.TcpMaxDataRetransmissions if ($Val6 -eq 3) { Write-Host " [+] IPv6 TcpMaxDataRetransmissions: $($Val6) (Expected: 3)" -ForegroundColor Green } else { Write-Host " [!] IPv6 TcpMaxDataRetransmissions: $($Val6) (Expected: 3)" -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host " [!] IPv6 Parameters Registry Path NOT FOUND" -ForegroundColor Red $IsVulnerable = $true } if ($IsVulnerable) { exit 1 } else { exit 0 } # Configure-TcpipMaxDataRetransmissions.ps1 # Description: Sets TcpMaxDataRetransmissions to 3 for IPv4 and IPv6 on Domain Controllers. Write-Host "Configuring TCP Max Data Retransmissions (IPv4 and IPv6)..." -ForegroundColor Cyan $TcpipParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" if (-not (Test-Path -Path $TcpipParamsPath)) { New-Item -Path $TcpipParamsPath -Force | Out-Null } Set-ItemProperty -Path $TcpipParamsPath -Name "TcpMaxDataRetransmissions" -Value 3 -Type DWord -ErrorAction Stop $Tcpip6ParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" if (-not (Test-Path -Path $Tcpip6ParamsPath)) { New-Item -Path $Tcpip6ParamsPath -Force | Out-Null } Set-ItemProperty -Path $Tcpip6ParamsPath -Name "TcpMaxDataRetransmissions" -Value 3 -Type DWord -ErrorAction Stop Write-Host "TCP Max Data Retransmissions configured to 3 for IPv4 and IPv6." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/network/disable-ipv6-default-dns-servers.md By default, the Windows DNS client may fall back to well-known default IPv6 DNS addresses (such as site-local or router-advertised dynamic addresses) if statically configured DNS servers fail to respond, or when processing IPv6 router advertisements (RAs) via DHCPv6 / SLAAC. In an Active Directory environment: 1. MitM and Rogue IPv6 DNS Redirection: Attackers on the local network segment utilize tools like mitm6 to broadcast rogue IPv6 Router Advertisements and rogue DHCPv6 replies, assigning an attacker-controlled IPv6 DNS server to systems on the subnet. 2. Credential Relay & Authentication Coercion: When a Domain Controller queries DNS through a rogue IPv6 DNS server, the attacker can spoof hostnames (such as internal WPAD, CRL endpoints, or management servers) to coerce LDAP/SMB/HTTP authentication and perform NTLM relay attacks. Enabling Turn off default IPv6 DNS Servers (DisableIPv6DefaultDnsServers = 1) ensures that the DNS Client service does not fall back to default or dynamically acquired IPv6 DNS server addresses, confining DNS resolution strictly to administratively approved directory DNS servers. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\Network\DNS Client Configure the policy: Setting*: Turn off default IPv6 DNS Servers State : Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable default IPv6 DNS servers on the Domain Controller. Download Script: Configure-DisableIPv6DefaultDnsServers.ps1 # Configure-DisableIPv6DefaultDnsServers.ps1 # Description: Disables default IPv6 DNS servers in DNS Client policy on Domain Controllers. Write-Host "Disabling default IPv6 DNS servers..." -ForegroundColor Cyan $DnsClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" if (-not (Test-Path -Path $DnsClientPath)) { New-Item -Path $DnsClientPath -Force | Out-Null } Set-ItemProperty -Path $DnsClientPath -Name "DisableIPv6DefaultDnsServers" -Value 1 -Type DWord -ErrorAction Stop Write-Host "Default IPv6 DNS servers disabled successfully (DisableIPv6DefaultDnsServers = 1)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-DisableIPv6DefaultDnsServersStatus.ps1 # Get-DisableIPv6DefaultDnsServersStatus.ps1 # Description: Audits registry configuration of DisableIPv6DefaultDnsServers on Domain Controllers. Write-Host "--- Auditing DisableIPv6DefaultDnsServers Status ---" -ForegroundColor Cyan $DnsClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" $ExpectedValue = 1 if (Test-Path -Path $DnsClientPath) { $Reg = Get-ItemProperty -Path $DnsClientPath -ErrorAction SilentlyContinue $CurrentValue = $Reg.DisableIPv6DefaultDnsServers if ($CurrentValue -eq $ExpectedValue) { Write-Host " [+] DisableIPv6DefaultDnsServers: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Green exit 0 } else { Write-Host " [!] DisableIPv6DefaultDnsServers: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Red exit 1 } } else { Write-Host " [!] DNS Client Registry Path NOT FOUND" -ForegroundColor Red exit 1 } # Configure-DisableIPv6DefaultDnsServers.ps1 # Description: Disables default IPv6 DNS servers in DNS Client policy on Domain Controllers. Write-Host "Disabling default IPv6 DNS servers..." -ForegroundColor Cyan $DnsClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" if (-not (Test-Path -Path $DnsClientPath)) { New-Item -Path $DnsClientPath -Force | Out-Null } Set-ItemProperty -Path $DnsClientPath -Name "DisableIPv6DefaultDnsServers" -Value 1 -Type DWord -ErrorAction Stop Write-Host "Default IPv6 DNS servers disabled successfully (DisableIPv6DefaultDnsServers = 1)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/network/disable-lltd-mapper-io-driver.md The Link-Layer Topology Discovery (LLTD) Mapper I/O (LLTDIO) network protocol driver queries neighboring network hosts to discover physical network topology, bandwidth capabilities, and device characteristics for Windows network mapping tools. On Tier 0 Domain Controllers: 1. Attack Surface Minimization: Domain Controllers must not act as network mapping query clients or probe neighboring devices. Running network discovery protocol drivers in kernel space introduces unnecessary attack surface. 2. Reconnaissance Suppression: Prohibiting LLTDIO driver activity ensures that the Domain Controller cannot be utilized to perform unauthorized local link-layer discovery queries across adjoining subnets. Disabling the Mapper I/O driver (Turn on Mapper I/O (LLTDIO) driver -> Disabled) sets the registry flags under HKLM\SOFTWARE\Policies\Microsoft\Windows\LLTD to 0, ensuring the driver is completely disabled across domain, private, and public network profiles. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Link-Layer Topology Discovery Configure the policy: Setting*: Turn on Mapper I/O (LLTDIO) driver State : Disabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable the LLTD Mapper I/O driver on the Domain Controller. Download Script: Configure-DisableLltdMapperIoDriver.ps1 # Configure-DisableLltdMapperIoDriver.ps1 # Description: Disables the LLTD Mapper I/O (LLTDIO) driver policy on Domain Controllers. Write-Host "Disabling LLTD Mapper I/O (LLTDIO) Driver..." -ForegroundColor Cyan $LltdPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" if (-not (Test-Path -Path $LltdPath)) { New-Item -Path $LltdPath -Force | Out-Null } Set-ItemProperty -Path $LltdPath -Name "AllowLLTDIOOnDomain" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "AllowLLTDIOOnPublicNet" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "EnableLLTDIO" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "ProhibitLLTDIOOnPrivateNet" -Value 0 -Type DWord -ErrorAction Stop Write-Host "LLTD Mapper I/O Driver disabled successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-LltdMapperIoDriverStatus.ps1 # Get-LltdMapperIoDriverStatus.ps1 # Description: Audits registry configuration of LLTD Mapper I/O (LLTDIO) driver on Domain Controllers. Write-Host "--- Auditing LLTD Mapper I/O Driver Status ---" -ForegroundColor Cyan $LltdPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" $Expected = @{ "AllowLLTDIOOnDomain" = 0 "AllowLLTDIOOnPublicNet" = 0 "EnableLLTDIO" = 0 "ProhibitLLTDIOOnPrivateNet" = 0 } $IsVulnerable = $false if (Test-Path -Path $LltdPath) { $Reg = Get-ItemProperty -Path $LltdPath -ErrorAction SilentlyContinue foreach ($Key in $Expected.Keys) { $Val = $Reg.$Key $Exp = $Expected[$Key] if ($Val -eq $Exp) { Write-Host " [+] $($Key): $($Val) (Expected: $($Exp))" -ForegroundColor Green } else { Write-Host " [!] $($Key): $($Val) (Expected: $($Exp))" -ForegroundColor Red $IsVulnerable = $true } } } else { Write-Host " [!] LLTD Registry Path NOT FOUND" -ForegroundColor Red $IsVulnerable = $true } if ($IsVulnerable) { exit 1 } else { exit 0 } # Configure-DisableLltdMapperIoDriver.ps1 # Description: Disables the LLTD Mapper I/O (LLTDIO) driver policy on Domain Controllers. Write-Host "Disabling LLTD Mapper I/O (LLTDIO) Driver..." -ForegroundColor Cyan $LltdPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" if (-not (Test-Path -Path $LltdPath)) { New-Item -Path $LltdPath -Force | Out-Null } Set-ItemProperty -Path $LltdPath -Name "AllowLLTDIOOnDomain" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "AllowLLTDIOOnPublicNet" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "EnableLLTDIO" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "ProhibitLLTDIOOnPrivateNet" -Value 0 -Type DWord -ErrorAction Stop Write-Host "LLTD Mapper I/O Driver disabled successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/network/disable-lltd-responder-driver.md The Link-Layer Topology Discovery (LLTD) Responder (RSPNDR) network protocol driver listens for topology discovery requests from other computers on the local network and responds with device details, identity information, and link-layer capabilities. On Tier 0 Domain Controllers: 1. Device Fingerprinting Prevention: Enabling the Responder driver allows any workstation or rogue host on the local physical segment to discover the Domain Controller, map its MAC address, determine link characteristics, and identify its role via LLTD probe packets. 2. Network Protocol Stack Reduction: Running link-layer responders in the kernel networking stack exposes the server to packet-handling vulnerabilities and potential broadcast flooding attacks. Disabling the Responder driver (Turn on Responder (RSPNDR) driver -> Disabled) ensures that the Domain Controller never advertises itself or responds to link-layer topological queries. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Link-Layer Topology Discovery Configure the policy: Setting*: Turn on Responder (RSPNDR) driver State : Disabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable the LLTD Responder driver on the Domain Controller. Download Script: Configure-DisableLltdResponderDriver.ps1 # Configure-DisableLltdResponderDriver.ps1 # Description: Disables the LLTD Responder (RSPNDR) driver policy on Domain Controllers. Write-Host "Disabling LLTD Responder (RSPNDR) Driver..." -ForegroundColor Cyan $LltdPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" if (-not (Test-Path -Path $LltdPath)) { New-Item -Path $LltdPath -Force | Out-Null } Set-ItemProperty -Path $LltdPath -Name "AllowRspndrOnDomain" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "AllowRspndrOnPublicNet" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "EnableRspndr" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "ProhibitRspndrOnPrivateNet" -Value 0 -Type DWord -ErrorAction Stop Write-Host "LLTD Responder Driver disabled successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-LltdResponderDriverStatus.ps1 # Get-LltdResponderDriverStatus.ps1 # Description: Audits registry configuration of LLTD Responder (RSPNDR) driver on Domain Controllers. Write-Host "--- Auditing LLTD Responder Driver Status ---" -ForegroundColor Cyan $LltdPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" $Expected = @{ "AllowRspndrOnDomain" = 0 "AllowRspndrOnPublicNet" = 0 "EnableRspndr" = 0 "ProhibitRspndrOnPrivateNet" = 0 } $IsVulnerable = $false if (Test-Path -Path $LltdPath) { $Reg = Get-ItemProperty -Path $LltdPath -ErrorAction SilentlyContinue foreach ($Key in $Expected.Keys) { $Val = $Reg.$Key $Exp = $Expected[$Key] if ($Val -eq $Exp) { Write-Host " [+] $($Key): $($Val) (Expected: $($Exp))" -ForegroundColor Green } else { Write-Host " [!] $($Key): $($Val) (Expected: $($Exp))" -ForegroundColor Red $IsVulnerable = $true } } } else { Write-Host " [!] LLTD Registry Path NOT FOUND" -ForegroundColor Red $IsVulnerable = $true } if ($IsVulnerable) { exit 1 } else { exit 0 } # Configure-DisableLltdResponderDriver.ps1 # Description: Disables the LLTD Responder (RSPNDR) driver policy on Domain Controllers. Write-Host "Disabling LLTD Responder (RSPNDR) Driver..." -ForegroundColor Cyan $LltdPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LLTD" if (-not (Test-Path -Path $LltdPath)) { New-Item -Path $LltdPath -Force | Out-Null } Set-ItemProperty -Path $LltdPath -Name "AllowRspndrOnDomain" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "AllowRspndrOnPublicNet" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "EnableRspndr" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $LltdPath -Name "ProhibitRspndrOnPrivateNet" -Value 0 -Type DWord -ErrorAction Stop Write-Host "LLTD Responder Driver disabled successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/network/disable-peernet.md Microsoft Peer-to-Peer Networking Services comprise technologies such as the Peer Name Resolution Protocol (PNRP), Peer Graphing, and Grouping. These services allow distributed applications and workstations to locate each other, publish identities in peer clouds, and exchange data directly without centralized servers. On Active Directory Domain Controllers: 1. Inappropriate Technology on Tier 0: Domain Controllers are centralized identity authorities designed for hierarchical client-server communication. Peer-to-peer mechanisms are completely antithetical to Tier 0 security isolation. 2. Untracked Communication Channels: PNRP and peer networks establish autonomous, unmanaged communication channels that bypass traditional network inspection and create covert data exchange surfaces. 3. Attack Surface Reduction: Disabling Peernet services (Disabled = 1) eliminates the PNRP protocol stack and shuts down peer mesh discovery ports on Domain Controllers. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Microsoft Peer-to-Peer Networking Services Configure the policy: Setting*: Turn off Microsoft Peer-to-Peer Networking Services State : Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable Microsoft Peer-to-Peer Networking Services on the Domain Controller. Download Script: Configure-DisablePeernet.ps1 # Configure-DisablePeernet.ps1 # Description: Disables Microsoft Peer-to-Peer Networking Services policy on Domain Controllers. Write-Host "Disabling Microsoft Peer-to-Peer Networking Services..." -ForegroundColor Cyan $PeernetPath = "HKLM:\SOFTWARE\Policies\Microsoft\Peernet" if (-not (Test-Path -Path $PeernetPath)) { New-Item -Path $PeernetPath -Force | Out-Null } Set-ItemProperty -Path $PeernetPath -Name "Disabled" -Value 1 -Type DWord -ErrorAction Stop Write-Host "Microsoft Peer-to-Peer Networking Services disabled successfully (Disabled = 1)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-PeernetStatus.ps1 # Get-PeernetStatus.ps1 # Description: Audits registry configuration of Microsoft Peer-to-Peer Networking Services on Domain Controllers. Write-Host "--- Auditing Microsoft Peer-to-Peer Networking Services Status ---" -ForegroundColor Cyan $PeernetPath = "HKLM:\SOFTWARE\Policies\Microsoft\Peernet" $ExpectedValue = 1 if (Test-Path -Path $PeernetPath) { $Reg = Get-ItemProperty -Path $PeernetPath -ErrorAction SilentlyContinue $CurrentValue = $Reg.Disabled if ($CurrentValue -eq $ExpectedValue) { Write-Host " [+] Peernet Disabled: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Green exit 0 } else { Write-Host " [!] Peernet Disabled: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Red exit 1 } } else { Write-Host " [!] Peernet Registry Path NOT FOUND" -ForegroundColor Red exit 1 } # Configure-DisablePeernet.ps1 # Description: Disables Microsoft Peer-to-Peer Networking Services policy on Domain Controllers. Write-Host "Disabling Microsoft Peer-to-Peer Networking Services..." -ForegroundColor Cyan $PeernetPath = "HKLM:\SOFTWARE\Policies\Microsoft\Peernet" if (-not (Test-Path -Path $PeernetPath)) { New-Item -Path $PeernetPath -Force | Out-Null } Set-ItemProperty -Path $PeernetPath -Name "Disabled" -Value 1 -Type DWord -ErrorAction Stop Write-Host "Microsoft Peer-to-Peer Networking Services disabled successfully (Disabled = 1)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/network/disable-wcn-wireless-configuration.md Windows Connect Now (WCN) provides mechanisms for wireless network configuration using Wi-Fi Protected Setup (WPS) protocols across various discovery media, including UPnP (Universal Plug and Play), In-Band 802.11, USB flash drives (FlashConfig), and Windows Portable Devices (WPD). On Active Directory Domain Controllers: 1. Tier 0 Dedicated Wired Infrastructure: Domain Controllers must run on dedicated, physical wired server backbones within physically secured datacenter segments. Wireless configuration mechanisms have no legitimate place on these machines. 2. UPnP and Wireless Exploitation: UPnP registrars and in-band 802.11 discovery listening components can introduce local broadcast vulnerabilities, unauthenticated device registration attacks, or credential leakage over broadcast media. 3. Attack Surface Elimination: Setting Configuration of wireless settings using Windows Connect Now to Disabled ensures that all WCN registrars (UPnP, In-Band 802.11, FlashConfig, WPD) are explicitly turned off. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Windows Connect Now Configure the policy: Setting*: Configuration of wireless settings using Windows Connect Now State : Disabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable WCN wireless settings configuration registrars on the Domain Controller. Download Script: Configure-DisableWcnWirelessConfig.ps1 # Configure-DisableWcnWirelessConfig.ps1 # Description: Disables Windows Connect Now wireless settings configuration registrars on Domain Controllers. Write-Host "Disabling Windows Connect Now Wireless Settings Configuration..." -ForegroundColor Cyan $WcnRegsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" if (-not (Test-Path -Path $WcnRegsPath)) { New-Item -Path $WcnRegsPath -Force | Out-Null } Set-ItemProperty -Path $WcnRegsPath -Name "EnableRegistrars" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $WcnRegsPath -Name "DisableUPnPRegistrar" -Value 1 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $WcnRegsPath -Name "DisableInBand802DOT11Registrar" -Value 1 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $WcnRegsPath -Name "DisableFlashConfigRegistrar" -Value 1 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $WcnRegsPath -Name "DisableWPDRegistrar" -Value 1 -Type DWord -ErrorAction Stop Write-Host "Windows Connect Now Wireless Settings Configuration disabled successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-WcnWirelessConfigStatus.ps1 # Get-WcnWirelessConfigStatus.ps1 # Description: Audits registry configuration of Windows Connect Now registrars on Domain Controllers. Write-Host "--- Auditing Windows Connect Now Wireless Settings Configuration Status ---" -ForegroundColor Cyan $WcnRegsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" $Expected = @{ "EnableRegistrars" = 0 "DisableUPnPRegistrar" = 1 "DisableInBand802DOT11Registrar" = 1 "DisableFlashConfigRegistrar" = 1 "DisableWPDRegistrar" = 1 } $IsVulnerable = $false if (Test-Path -Path $WcnRegsPath) { $Reg = Get-ItemProperty -Path $WcnRegsPath -ErrorAction SilentlyContinue foreach ($Key in $Expected.Keys) { $Val = $Reg.$Key $Exp = $Expected[$Key] if ($Val -eq $Exp) { Write-Host " [+] $($Key): $($Val) (Expected: $($Exp))" -ForegroundColor Green } else { Write-Host " [!] $($Key): $($Val) (Expected: $($Exp))" -ForegroundColor Red $IsVulnerable = $true } } } else { Write-Host " [!] WCN Registrars Registry Path NOT FOUND" -ForegroundColor Red $IsVulnerable = $true } if ($IsVulnerable) { exit 1 } else { exit 0 } # Configure-DisableWcnWirelessConfig.ps1 # Description: Disables Windows Connect Now wireless settings configuration registrars on Domain Controllers. Write-Host "Disabling Windows Connect Now Wireless Settings Configuration..." -ForegroundColor Cyan $WcnRegsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars" if (-not (Test-Path -Path $WcnRegsPath)) { New-Item -Path $WcnRegsPath -Force | Out-Null } Set-ItemProperty -Path $WcnRegsPath -Name "EnableRegistrars" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $WcnRegsPath -Name "DisableUPnPRegistrar" -Value 1 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $WcnRegsPath -Name "DisableInBand802DOT11Registrar" -Value 1 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $WcnRegsPath -Name "DisableFlashConfigRegistrar" -Value 1 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $WcnRegsPath -Name "DisableWPDRegistrar" -Value 1 -Type DWord -ErrorAction Stop Write-Host "Windows Connect Now Wireless Settings Configuration disabled successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 02-domain-controllers/network/prohibit-wcn-wizards.md The Windows Connect Now (WCN) wizards guide users through configuring a wireless router or access point and saving network configuration settings to USB flash memory or broadcasting them via Wi-Fi. On Tier 0 Domain Controllers: 1. Administrative Interface Lockdown: Interactive administrative sessions on Domain Controllers must never expose consumer wireless or hardware configuration wizards that could be inadvertently or maliciously invoked. 2. Prevent Unauthorized Configuration Storage: WCN wizards allow exporting wireless network keys and connection settings to removable storage or across the network. Prohibiting access to the WCN wizards (DisableWcnUi = 1) ensures the GUI wizard interface cannot be launched. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Windows Connect Now Configure the policy: Setting*: Prohibit access of the Windows Connect Now wizards State : Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to prohibit access to WCN wizards on the Domain Controller. Download Script: Configure-ProhibitWcnWizards.ps1 # Configure-ProhibitWcnWizards.ps1 # Description: Prohibits access to Windows Connect Now wizards on Domain Controllers. Write-Host "Prohibiting access to Windows Connect Now wizards..." -ForegroundColor Cyan $WcnUiPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI" if (-not (Test-Path -Path $WcnUiPath)) { New-Item -Path $WcnUiPath -Force | Out-Null } Set-ItemProperty -Path $WcnUiPath -Name "DisableWcnUi" -Value 1 -Type DWord -ErrorAction Stop Write-Host "Windows Connect Now wizards prohibited successfully (DisableWcnUi = 1)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-ProhibitWcnWizardsStatus.ps1 # Get-ProhibitWcnWizardsStatus.ps1 # Description: Audits registry configuration of DisableWcnUi on Domain Controllers. Write-Host "--- Auditing DisableWcnUi Status ---" -ForegroundColor Cyan $WcnUiPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI" $ExpectedValue = 1 if (Test-Path -Path $WcnUiPath) { $Reg = Get-ItemProperty -Path $WcnUiPath -ErrorAction SilentlyContinue $CurrentValue = $Reg.DisableWcnUi if ($CurrentValue -eq $ExpectedValue) { Write-Host " [+] DisableWcnUi: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Green exit 0 } else { Write-Host " [!] DisableWcnUi: $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Red exit 1 } } else { Write-Host " [!] WCN UI Registry Path NOT FOUND" -ForegroundColor Red exit 1 } # Configure-ProhibitWcnWizards.ps1 # Description: Prohibits access to Windows Connect Now wizards on Domain Controllers. Write-Host "Prohibiting access to Windows Connect Now wizards..." -ForegroundColor Cyan $WcnUiPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WCN\UI" if (-not (Test-Path -Path $WcnUiPath)) { New-Item -Path $WcnUiPath -Force | Out-Null } Set-ItemProperty -Path $WcnUiPath -Name "DisableWcnUi" -Value 1 -Type DWord -ErrorAction Stop Write-Host "Windows Connect Now wizards prohibited successfully (DisableWcnUi = 1)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 03-identities-services/enforce-fgpp.md Active Directory default domain password policies apply globally to all user accounts. These global policies are often configured with lower complexity and length requirements to avoid overwhelming standard users. However, such settings are inadequate for highly privileged accounts (Tier 0 and Tier 1 administrators), which are primary targets for credential stuffing, brute-force, and offline cracking attacks. Enforcing Fine-Grained Password Policies (FGPP) via Password Settings Objects (PSOs) allows administrators to apply distinct, highly restrictive password and account lockout policies to specific users or groups. By mandating longer password lengths and stricter lockout thresholds for privileged identities, the domain's defense-in-depth posture is significantly bolstered without affecting standard users. Option A: Active Directory Administrative Center (ADAC) Configuration (Preferred) Open the Active Directory Administrative Center (dsac.exe) on a Domain Controller or management server. Switch to the Tree View, select your domain, and navigate to: System\Password Settings Container Right-click the Password Settings Container, select New, and then click Password Settings. Configure the Password Settings Object (PSO): Name*: Tier0-Admin-PSO Precedence*: 10 Enforce minimum password length*: 20 Password must meet complexity requirements*: Checked Enforce password history*: 24 Store password using reversible encryption*: Unchecked Number of failed logon attempts allowed (lockout threshold)*: 5 Reset failed logon attempts count after*: 30 minutes Account lockout duration*: 30 minutes Under Directly Applies To, click Add and select the security group containing your Tier 0 and Tier 1 administrators (e.g., Grp_Tier0_Admins). Click OK to save and apply the PSO. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script to create and apply the Fine-Grained Password Policy using PowerShell. Download Script: Set-AdminPasswordPolicy.ps1 # Set-AdminPasswordPolicy.ps1 # Description: Creates a secure Fine-Grained Password Policy for administrative accounts. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Enforce Fine-Grained Password Policies..." -ForegroundColor Cyan $AdminPSOName = "Tier0-Admin-PSO" $ExistingPSO = Get-ADFineGrainedPasswordPolicy -Filter "Name -eq '$AdminPSOName'" if (-not $ExistingPSO) { # Create the Fine-Grained Password Policy (PSO) New-ADFineGrainedPasswordPolicy -Name $AdminPSOName ` -Precedence 10 ` -ComplexityEnabled $true ` -MinPasswordLength 20 ` -PasswordHistoryCount 24 ` -ReversibleEncryptionEnabled $false ` -LockoutDuration "00:30:00" ` -LockoutObservationWindow "00:30:00" ` -LockoutThreshold 5 ` -MinPasswordAge "1.00:00:00" ` -MaxPasswordAge "60.00:00:00" Write-Host "PSO '$AdminPSOName' created successfully." -ForegroundColor Green } else { Write-Host "PSO '$AdminPSOName' already exists." -ForegroundColor Yellow } To verify the applied Fine-Grained Password Policies: Download Script: Get-AdminPasswordPolicyStatus.ps1 # Get-AdminPasswordPolicyStatus.ps1 # Description: Audits Fine-Grained Password Policies in the Active Directory domain. Import-Module ActiveDirectory Write-Host "--- Auditing Fine-Grained Password Policies ---" -ForegroundColor Cyan $psoList = Get-ADFineGrainedPasswordPolicy -Filter * if ($psoList) { foreach ($pso in $psoList) { Write-Host "[+] PSO Name: $($pso.Name)" -ForegroundColor Green Write-Host " - Precedence: $($pso.Precedence)" -ForegroundColor White Write-Host " - MinPasswordLength: $($pso.MinPasswordLength)" -ForegroundColor White Write-Host " - LockoutThreshold: $($pso.LockoutThreshold)" -ForegroundColor White Write-Host " - LockoutDuration: $($pso.LockoutDuration)" -ForegroundColor White } } else { Write-Host "[-] No Fine-Grained Password Policies found in the domain." -ForegroundColor Yellow } # Set-AdminPasswordPolicy.ps1 # Description: Creates a secure Fine-Grained Password Policy for administrative accounts. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Enforce Fine-Grained Password Policies..." -ForegroundColor Cyan $AdminPSOName = "Tier0-Admin-PSO" $ExistingPSO = Get-ADFineGrainedPasswordPolicy -Filter "Name -eq '$AdminPSOName'" if (-not $ExistingPSO) { # Create the Fine-Grained Password Policy (PSO) New-ADFineGrainedPasswordPolicy -Name $AdminPSOName ` -Precedence 10 ` -ComplexityEnabled $true ` -MinPasswordLength 20 ` -PasswordHistoryCount 24 ` -ReversibleEncryptionEnabled $false ` -LockoutDuration "00:30:00" ` -LockoutObservationWindow "00:30:00" ` -LockoutThreshold 5 ` -MinPasswordAge "1.00:00:00" ` -MaxPasswordAge "60.00:00:00" Write-Host "PSO '$AdminPSOName' created successfully." -ForegroundColor Green } else { Write-Host "PSO '$AdminPSOName' already exists." -ForegroundColor Yellow } Target Scope: Applicable Systems: Member Servers, Tier 2 Clients, Domain Controllers Operating Systems: Modern Windows LAPS: Windows Server 2019/2022/2025 (with April 11, 2023 cumulative update or later), Windows 10/11 (with April 11, 2023 cumulative update or later) Legacy Microsoft LAPS: Windows Server 2016 (and older), Windows 7/8/8.1, Windows Server 2008 R2/2012/2012 R2 File Path: 03-identities-services/enable-laps.md In standard Active Directory setups, local administrator accounts on member servers and client workstations often share the same password. If a single machine is compromised and the local administrator password hash is extracted (e.g., from LSASS memory or SAM database), attackers can leverage Pass-the-Hash (PtH) techniques to log on to other domain machines laterally. Implementing the Local Administrator Password Solution (LAPS) completely mitigates this lateral movement vector by automatically generating a unique, complex password for the specified local administrator account on each machine. These passwords are changed periodically and stored securely in a confidential attribute (msLAPS-Password or ms-Mcs-AdmPwd) on the computer's Active Directory object. Read access is restricted to authorized administrative groups. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_MemberServers). Navigate to: Computer Configuration\Administrative Templates\System\LAPS Configure the following settings: Policy*: Configure password backup directory Setting*: Enabled Options*: Set backup directory to Active Directory. Policy*: Do not allow password expiration time longer than required by policy Setting*: Enabled Policy*: Enable password encryption Setting*: Enabled Policy*: Password Settings Setting*: Enabled Options*: Set complexity to Large letters + small letters + numbers + special characters, length to 20, and age to 30 days. Policy*: Post-authentication actions Setting*: Enabled Options*: Set Grace period (hours) to 8, Actions to Reset the password and logoff the managed account. Policy*: Enable local admin password management Setting*: Enabled Link the GPO to the Organizational Units (OUs) containing member servers and client workstations. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally (for testing or standalone systems) or if the control is not manageable via standard GPO GUI interfaces. Download Script: Configure-LAPS.ps1 # Configure-LAPS.ps1 # Description: Configures Windows LAPS parameters in the registry. Write-Host "Applying hardening requirement: Enable Local Administrator Password Solution..." -ForegroundColor Cyan $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } # Enable LAPS management Set-ItemProperty -Path $RegPath -Name "EnableLAPS" -Value 1 -Type DWord # 2 = Backup to Active Directory Set-ItemProperty -Path $RegPath -Name "BackupDirectory" -Value 2 -Type DWord # 1 = Do not allow password expiration time longer than required by policy Set-ItemProperty -Path $RegPath -Name "PasswordExpirationProtectionEnabled" -Value 1 -Type DWord # 1 = Enable password encryption Set-ItemProperty -Path $RegPath -Name "ADPasswordEncryptionEnabled" -Value 1 -Type DWord # 4 = Letters + numbers + special characters Set-ItemProperty -Path $RegPath -Name "PasswordComplexity" -Value 4 -Type DWord Set-ItemProperty -Path $RegPath -Name "PasswordLength" -Value 20 -Type DWord Set-ItemProperty -Path $RegPath -Name "PasswordAgeDays" -Value 30 -Type DWord # 8 = Grace period of 8 hours Set-ItemProperty -Path $RegPath -Name "PostAuthenticationResetDelay" -Value 8 -Type DWord # 3 = Reset the password and logoff the managed account Set-ItemProperty -Path $RegPath -Name "PostAuthenticationActions" -Value 3 -Type DWord Write-Host "Windows LAPS configuration registry settings applied successfully." -ForegroundColor Green # Configure-LAPS.ps1 # Description: Configures Windows LAPS parameters in the registry. Write-Host "Applying hardening requirement: Enable Local Administrator Password Solution..." -ForegroundColor Cyan $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } # Enable LAPS management Set-ItemProperty -Path $RegPath -Name "EnableLAPS" -Value 1 -Type DWord # 2 = Backup to Active Directory Set-ItemProperty -Path $RegPath -Name "BackupDirectory" -Value 2 -Type DWord # 1 = Do not allow password expiration time longer than required by policy Set-ItemProperty -Path $RegPath -Name "PasswordExpirationProtectionEnabled" -Value 1 -Type DWord # 1 = Enable password encryption Set-ItemProperty -Path $RegPath -Name "ADPasswordEncryptionEnabled" -Value 1 -Type DWord # 4 = Letters + numbers + special characters Set-ItemProperty -Path $RegPath -Name "PasswordComplexity" -Value 4 -Type DWord Set-ItemProperty -Path $RegPath -Name "PasswordLength" -Value 20 -Type DWord Set-ItemProperty -Path $RegPath -Name "PasswordAgeDays" -Value 30 -Type DWord # 8 = Grace period of 8 hours Set-ItemProperty -Path $RegPath -Name "PostAuthenticationResetDelay" -Value 8 -Type DWord # 3 = Reset the password and logoff the managed account Set-ItemProperty -Path $RegPath -Name "PostAuthenticationActions" -Value 3 -Type DWord Write-Host "Windows LAPS configuration registry settings applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 03-identities-services/harden-service-accounts.md Traditional service accounts in Active Directory are standard user accounts with static, often long-lived passwords. Because service passwords are rarely rotated, they are prime targets for offline brute-force attacks known as Kerberoasting. An attacker with domain access can request a Kerberos service ticket (TGS) for any account with a Service Principal Name (SPN) and attempt to crack the password hash offline. Group Managed Service Accounts (gMSAs) address this risk by delegating password management to the operating system and Domain Controllers. Windows automatically generates a complex 120-character password for each gMSA and rotates it every 30 days. Additionally, gMSAs cannot be used for interactive logons, preventing administrative session hijacking or remote administrative access via service accounts. However, gMSAs introduce specific security boundaries that must be strictly enforced: 1. Password Retrieval Delegation (GMSA Password Access): The attribute msDS-GroupMSAMembership (PrincipalsAllowedToRetrieveManagedPassword) defines which security principals can query Active Directory to retrieve the clear-text gMSA password. If human user accounts or groups containing human users are added to this attribute, any compromise of those user credentials allows an attacker to fetch the clear-text password blob and convert it to an NT hash. 2. Credential Dumping from memory (LSASS ekeys): While LSASS does not cache the clear-text password of a gMSA under standard sekurlsa::logonpasswords dumps, the active Kerberos keys (NT hash, AES-128/256 keys) are stored in memory on the host computer running the service. An attacker with administrative/SYSTEM access to the host server can extract these keys using Mimikatz sekurlsa::ekeys and use them for pass-the-hash (PTH) or pass-the-ticket (PTT) attacks. 3. Tier Alignment (Tier-Matching): Because compromising the host server hosting a gMSA compromises the gMSA itself, and retrieving the gMSA password grants full control over its permissions, hosts running gMSAs must be secured to the same level (Tier) as the privileges granted to the gMSA. A Tier 0 gMSA must only run on Tier 0 systems (Domain Controllers or Tier 0 Admin Hosts), and only Tier 0 computer accounts/groups must be allowed to retrieve its password. Option A: Active Directory Management Console Configuration (Preferred) gMSAs are primarily created and managed using administrative consoles or PowerShell. Open Active Directory Users and Computers (dsa.msc). Verify the presence of the default Managed Service Accounts container. Because gMSA creation requires AD schema and principal mapping, PowerShell is the primary method used to initialize and link the account to the host server. Follow the steps in Option B. Once created, configure the target service (e.g., in Services Console services.msc): Set Log On As to This account*. * Enter the name of the gMSA with a trailing dollar sign (e.g., domain\gmsa-sqlservice$). Clear the Password fields and click OK*. * Restart the service. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use the following PowerShell script to initialize the KDS root key (if not already done) and create a gMSA. Download Script: Set-gMSAServiceAccount.ps1 # Set-gMSAServiceAccount.ps1 # Description: Generates the KDS root key and registers a new gMSA. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Implement Group Managed Service Accounts..." -ForegroundColor Cyan # 1. Initialize KDS Root Key (Required once in the forest) # In standard setups, there is a 10-hour delay for propagation. # -EffectiveImmediately is used for lab configurations. try { Add-KdsRootKey -EffectiveImmediately -ErrorAction SilentlyContinue Write-Host "[+] KDS Root Key creation initiated/verified." -ForegroundColor Green } catch { Write-Warning "Could not configure KDS Root Key. It may already exist." } # 2. Create the gMSA $gMSAName = "gmsa-sqlservice" $existingMSA = Get-ADServiceAccount -Filter "Name -eq '$gMSAName'" if (-not $existingMSA) { # Specify the name, DNS, and which principals (member servers running the service) can retrieve the password. # CRITICAL: Do NOT allow user accounts or groups containing users (like Domain Admins or Schema Admins) # to retrieve the password. Only allow the specific computer account(s) hosting the service. $targetHostComputer = "SQLServerHost$" New-ADServiceAccount -Name $gMSAName ` -DNSHostName "$gMSAName.domain.local" ` -ManagedPasswordIntervalInDays 30 ` -PrincipalsAllowedToRetrieveManagedPassword $targetHostComputer Write-Host "[+] gMSA '$gMSAName' created successfully." -ForegroundColor Green } else { Write-Host "[-] gMSA '$gMSAName' already exists." -ForegroundColor Yellow } To audit registered Managed Service Accounts: Download Script: Get-gMSAStatus.ps1 # Get-gMSAStatus.ps1 # Description: Lists all registered gMSAs and audits password retrieval delegation permissions. Import-Module ActiveDirectory Write-Host "--- Auditing Group Managed Service Accounts ---" -ForegroundColor Cyan $gMSAs = Get-ADServiceAccount -Filter * -Properties Name, DNSHostName, Enabled, PrincipalsAllowedToRetrieveManagedPassword if ($gMSAs) { foreach ($sa in $gMSAs) { $nonCompliant = $false Write-Host "[*] gMSA Account: $($sa.Name)" -ForegroundColor White Write-Host " - DNS Name: $($sa.DNSHostName)" -ForegroundColor White Write-Host " - Enabled: $($sa.Enabled)" -ForegroundColor White $principals = $sa.PrincipalsAllowedToRetrieveManagedPassword if ($null -ne $principals) { Write-Host " - Principals Allowed to Retrieve Password:" -ForegroundColor White foreach ($p in $principals) { # Get the AD Object to verify class and name $adObj = Get-ADObject -Identity $p.DistinguishedName -Properties ObjectClass, Name if ($null -ne $adObj) { $objType = $adObj.ObjectClass $name = $adObj.Name if ($objType -eq "user") { Write-Host " [-] WARNING: User account '$($name)' is explicitly allowed to retrieve password (HIGH RISK)" -ForegroundColor Red $nonCompliant = $true } elseif ($objType -eq "group") { Write-Host " [!] Group: '$($name)'" -ForegroundColor Yellow # Recursively resolve members to check for users $members = Get-ADGroupMember -Identity $p.DistinguishedName -Recursive $userMembers = $members | Where-Object { $_.objectClass -eq "user" } if ($userMembers) { $userNames = @() foreach ($user in $userMembers) { $userNames += $user.Name } $usersList = $userNames -join ", " Write-Host " [-] WARNING: Group '$($name)' contains human user accounts: $($usersList) (HIGH RISK)" -ForegroundColor Red $nonCompliant = $true } else { Write-Host " [+] Group contains only computer/service accounts." -ForegroundColor Green } } else { Write-Host " [+] Computer/Host: '$($name)'" -ForegroundColor Green } } } } else { Write-Host " [-] WARNING: No principals allowed to retrieve password (gMSA will not function)." -ForegroundColor Yellow $nonCompliant = $true } if ($nonCompliant) { Write-Host " [-] STATUS: NON-COMPLIANT (Insecure password retrieval delegation)" -ForegroundColor Red } else { Write-Host " [+] STATUS: COMPLIANT" -ForegroundColor Green } Write-Host "" } } else { Write-Host "[-] No Group Managed Service Accounts found in the Active Directory domain." -ForegroundColor Yellow } # Set-gMSAServiceAccount.ps1 # Description: Generates the KDS root key and registers a new gMSA. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Implement Group Managed Service Accounts..." -ForegroundColor Cyan # 1. Initialize KDS Root Key (Required once in the forest) # In standard setups, there is a 10-hour delay for propagation. # -EffectiveImmediately is used for lab configurations. try { Add-KdsRootKey -EffectiveImmediately -ErrorAction SilentlyContinue Write-Host "[+] KDS Root Key creation initiated/verified." -ForegroundColor Green } catch { Write-Warning "Could not configure KDS Root Key. It may already exist." } # 2. Create the gMSA $gMSAName = "gmsa-sqlservice" $existingMSA = Get-ADServiceAccount -Filter "Name -eq '$gMSAName'" if (-not $existingMSA) { # Specify the name, DNS, and which principals (member servers running the service) can retrieve the password. # CRITICAL: Do NOT allow user accounts or groups containing users (like Domain Admins or Schema Admins) # to retrieve the password. Only allow the specific computer account(s) hosting the service. $targetHostComputer = "SQLServerHost$" New-ADServiceAccount -Name $gMSAName ` -DNSHostName "$gMSAName.domain.local" ` -ManagedPasswordIntervalInDays 30 ` -PrincipalsAllowedToRetrieveManagedPassword $targetHostComputer Write-Host "[+] gMSA '$gMSAName' created successfully." -ForegroundColor Green } else { Write-Host "[-] gMSA '$gMSAName' already exists." -ForegroundColor Yellow } Target Scope: Applicable Systems: Domain Controllers, Member Servers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 03-identities-services/restrict-kerberos-delegation.md Kerberos delegation allows a service to impersonate a user to access downstream resources on behalf of that user. In Unconstrained Delegation, when a user authenticates to a service, the user's Ticket Granting Ticket (TGT) is sent to the service server and stored in LSASS memory. If an attacker compromises that service server, they can extract the cached TGTs of all users who have authenticated to it (including Domain Admins) and impersonate them across the entire domain. To prevent this critical privilege escalation path, Unconstrained Delegation must be banned entirely. Any required delegation should be restricted to Constrained Delegation or Resource-Based Constrained Delegation (RBCD), which specify exactly which target services can receive delegated credentials. Option A: Active Directory Users and Computers Console Configuration (Preferred) Open Active Directory Users and Computers (dsa.msc). Locate the computer or user account that has unconstrained delegation enabled. Right-click the object and select Properties. Go to the Delegation tab. Select Do not trust this computer for delegation to disable unconstrained delegation. Alternatively, to configure Constrained Delegation: Select Trust this computer for delegation to specified services only*. Select Use Kerberos only or Use any authentication protocol* (S4U2Self/Protocol Transition). Click Add* to specify the target services. Click Apply and then OK. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use the following PowerShell script to audit and disable unconstrained delegation on all computers and users. Download Script: Set-RestrictDelegation.ps1 # Set-RestrictDelegation.ps1 # Description: Disables unconstrained delegation on computer and user accounts. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Restrict Kerberos Delegation..." -ForegroundColor Cyan # Find all computer accounts with Unconstrained Delegation $unconstrainedComputers = Get-ADComputer -Filter {TrustedForDelegation -eq $true} foreach ($comp in $unconstrainedComputers) { Write-Host "[*] Disabling Unconstrained Delegation on Computer: $($comp.SamAccountName)" -ForegroundColor Gray Set-ADComputer -Identity $comp -TrustedForDelegation $false } # Find all user accounts with Unconstrained Delegation $unconstrainedUsers = Get-ADUser -Filter {TrustedForDelegation -eq $true} foreach ($user in $unconstrainedUsers) { Write-Host "[*] Disabling Unconstrained Delegation on User: $($user.SamAccountName)" -ForegroundColor Gray Set-ADUser -Identity $user -TrustedForDelegation $false } Write-Host "Unconstrained delegation has been disabled on all identified accounts." -ForegroundColor Green To audit delegation settings in the domain: Download Script: Get-KerberosDelegationStatus.ps1 # Get-KerberosDelegationStatus.ps1 # Description: Audits accounts with unconstrained delegation in the Active Directory domain. Import-Module ActiveDirectory Write-Host "--- Auditing Kerberos Delegation Settings ---" -ForegroundColor Cyan $unconstrainedComputers = Get-ADComputer -Filter {TrustedForDelegation -eq $true} $unconstrainedUsers = Get-ADUser -Filter {TrustedForDelegation -eq $true} $totalUnconstrained = $unconstrainedComputers.Count + $unconstrainedUsers.Count if ($totalUnconstrained -eq 0) { Write-Host "[+] Secure: No accounts found with Unconstrained Delegation." -ForegroundColor Green } else { foreach ($comp in $unconstrainedComputers) { Write-Host "[!] VULNERABLE: Computer with Unconstrained Delegation: $($comp.SamAccountName)" -ForegroundColor Red } foreach ($user in $unconstrainedUsers) { Write-Host "[!] VULNERABLE: User with Unconstrained Delegation: $($user.SamAccountName)" -ForegroundColor Red } } # Set-RestrictDelegation.ps1 # Description: Disables unconstrained delegation on computer and user accounts. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Restrict Kerberos Delegation..." -ForegroundColor Cyan # Find all computer accounts with Unconstrained Delegation $unconstrainedComputers = Get-ADComputer -Filter {TrustedForDelegation -eq $true} foreach ($comp in $unconstrainedComputers) { Write-Host "[*] Disabling Unconstrained Delegation on Computer: $($comp.SamAccountName)" -ForegroundColor Gray Set-ADComputer -Identity $comp -TrustedForDelegation $false } # Find all user accounts with Unconstrained Delegation $unconstrainedUsers = Get-ADUser -Filter {TrustedForDelegation -eq $true} foreach ($user in $unconstrainedUsers) { Write-Host "[*] Disabling Unconstrained Delegation on User: $($user.SamAccountName)" -ForegroundColor Gray Set-ADUser -Identity $user -TrustedForDelegation $false } Write-Host "Unconstrained delegation has been disabled on all identified accounts." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 File Path: 03-identities-services/configure-protected-users-group.md Standard administrative accounts are highly vulnerable to credential harvesting attacks. If a Domain Admin or other high-privilege account authenticates to a compromised workstation or member server, their credentials (passwords, Kerberos TGTs, NTLM hashes) remain cached in the Local Security Authority Subsystem Service (LSASS) memory. Attackers can extract these credentials using tools like Mimikatz to escalate privileges or move laterally. The Protected Users security group (introduced in Windows Server 2012 R2) enforces non-configurable, highly secure authentication restrictions on its members. These protections include: 1. No NTLM caching: NTLM password hashes are not cached locally, and members cannot authenticate via NTLM. 2. Short Kerberos TGT lifetimes: Ticket Granting Tickets (TGTs) are limited to 4 hours and cannot be renewed beyond that. 3. No weak encryption: Members cannot use DES or RC4 encryption for Kerberos pre-authentication. 4. No CredSSP or WDigest caching: Cleartext credentials are never cached by the local system. 5. No delegation: Kerberos delegation (constrained or unconstrained) is blocked for accounts in this group. Placing Tier 0 and Tier 1 administrative accounts into the Protected Users group significantly reduces the threat of credential harvesting. Option A: Active Directory Users and Computers Console Configuration (Preferred) Open Active Directory Users and Computers (dsa.msc). Navigate to the Users container (or where the built-in groups are located). Double-click the Protected Users security group. Click the Members tab. Click Add. Type the names of the Tier 0 and Tier 1 administrative accounts (e.g., admin-t0-user) and click OK. Click Apply and then OK. Ask the administrators to sign out and sign back in for the security group memberships to take effect. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script to add administrative accounts to the Protected Users security group using PowerShell. Download Script: Set-ProtectedUsers.ps1 # Set-ProtectedUsers.ps1 # Description: Adds privileged accounts to the Protected Users group. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Populate Protected Users Group..." -ForegroundColor Cyan $GroupName = "Protected Users" $TargetAdmins = @("admin-t0-user", "admin-t1-user") foreach ($Admin in $TargetAdmins) { $User = Get-ADUser -Filter "SamAccountName -eq '$Admin'" if ($User) { # Check if already a member $isMember = Get-ADGroupMember -Identity $GroupName | Where-Object { $_.SamAccountName -eq $Admin } if (-not $isMember) { Add-ADGroupMember -Identity $GroupName -Members $User Write-Host "[+] Added $Admin to Protected Users group." -ForegroundColor Green } else { Write-Host "[-] User $Admin is already a member of Protected Users group." -ForegroundColor Yellow } } else { Write-Warning "User '$Admin' not found in Active Directory." } } To audit the members of the Protected Users group: Download Script: Get-ProtectedUsersStatus.ps1 # Get-ProtectedUsersStatus.ps1 # Description: Lists all members of the Protected Users security group. Import-Module ActiveDirectory Write-Host "--- Auditing Protected Users Group Members ---" -ForegroundColor Cyan $GroupName = "Protected Users" $Members = Get-ADGroupMember -Identity $GroupName -ErrorAction SilentlyContinue if ($Members) { Write-Host "[+] Members of the Protected Users group:" -ForegroundColor Green foreach ($Member in $Members) { Write-Host " - $($Member.SamAccountName) (Type: $($Member.objectClass))" -ForegroundColor White } } else { Write-Host "[!] VULNERABLE: No members found in the Protected Users group. Administrative accounts may be unprotected." -ForegroundColor Red } # Set-ProtectedUsers.ps1 # Description: Adds privileged accounts to the Protected Users group. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Populate Protected Users Group..." -ForegroundColor Cyan $GroupName = "Protected Users" $TargetAdmins = @("admin-t0-user", "admin-t1-user") foreach ($Admin in $TargetAdmins) { $User = Get-ADUser -Filter "SamAccountName -eq '$Admin'" if ($User) { # Check if already a member $isMember = Get-ADGroupMember -Identity $GroupName | Where-Object { $_.SamAccountName -eq $Admin } if (-not $isMember) { Add-ADGroupMember -Identity $GroupName -Members $User Write-Host "[+] Added $Admin to Protected Users group." -ForegroundColor Green } else { Write-Host "[-] User $Admin is already a member of Protected Users group." -ForegroundColor Yellow } } else { Write-Warning "User '$Admin' not found in Active Directory." } } Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 File Path: 03-identities-services/harden-default-accounts.md Active Directory and local Windows environments initialize built-in accounts with fixed Relative Identifiers (RIDs). The default Administrator account always has RID 500, and the Guest account always has RID 501. Because these accounts are well-known, they are frequent targets for automated brute-force, password guessing, and identity enumeration attacks. In many environments, the built-in local administrator account has the same password across multiple systems, allowing attackers to move laterally if they crack one machine. Renaming these accounts increases the complexity of target identification, while disabling them prevents unauthorized logons entirely. If LAPS is active, it can rotate the password of the local administrator account even when the account is disabled, preserving safe recovery options. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the appropriate hardening GPO (e.g., GPO_Hardening_DomainControllers or GPO_Hardening_MemberServers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following settings: Policy*: Accounts: Administrator account status Setting*: Disabled Policy*: Accounts: Guest account status Setting*: Disabled Policy*: Accounts: Rename administrator account Setting*: Enter a non-obvious custom name (e.g., LocalMgmtAdmin). Policy*: Accounts: Rename guest account Setting*: Enter a non-obvious custom name (e.g., LocalMgmtGuest). Link the GPO to the appropriate Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script to disable the local Administrator and Guest accounts locally using PowerShell. Download Script: Set-HardenDefaultAccounts.ps1 # Set-HardenDefaultAccounts.ps1 # Description: Disables and renames the built-in local Administrator and Guest accounts locally. Write-Host "Applying hardening requirement: Rename and Disable Default Accounts..." -ForegroundColor Cyan # 1. Disable and rename built-in local Administrator account $adminAccount = Get-LocalUser | Where-Object { $_.SID -like "*-500" } if ($adminAccount) { if ($adminAccount.Enabled) { Disable-LocalUser -Name $adminAccount.Name Write-Host "[+] Local Administrator account ($($adminAccount.Name)) disabled." -ForegroundColor Green } else { Write-Host "[-] Local Administrator account ($($adminAccount.Name)) is already disabled." -ForegroundColor Yellow } if ($adminAccount.Name -eq "Administrator") { Rename-LocalUser -Name "Administrator" -NewName "LocalMgmtAdmin" Write-Host "[+] Local Administrator account renamed to LocalMgmtAdmin." -ForegroundColor Green } else { Write-Host "[-] Local Administrator account is already renamed ($($adminAccount.Name))." -ForegroundColor Yellow } } else { Write-Warning "Built-in local Administrator account not found." } # 2. Disable and rename built-in local Guest account $guestAccount = Get-LocalUser | Where-Object { $_.SID -like "*-501" } if ($guestAccount) { if ($guestAccount.Enabled) { Disable-LocalUser -Name $guestAccount.Name Write-Host "[+] Local Guest account ($($guestAccount.Name)) disabled." -ForegroundColor Green } else { Write-Host "[-] Local Guest account ($($guestAccount.Name)) is already disabled." -ForegroundColor Yellow } if ($guestAccount.Name -eq "Guest") { Rename-LocalUser -Name "Guest" -NewName "LocalMgmtGuest" Write-Host "[+] Local Guest account renamed to LocalMgmtGuest." -ForegroundColor Green } else { Write-Host "[-] Local Guest account is already renamed ($($guestAccount.Name))." -ForegroundColor Yellow } } else { Write-Warning "Built-in local Guest account not found." } To audit default accounts status locally: Download Script: Get-DefaultAccountsStatus.ps1 # Get-DefaultAccountsStatus.ps1 # Description: Audits the enabled status of the built-in local Administrator and Guest accounts. Write-Host "--- Auditing Default Accounts Status ---" -ForegroundColor Cyan $adminAccount = Get-LocalUser | Where-Object { $_.SID -like "*-500" } $guestAccount = Get-LocalUser | Where-Object { $_.SID -like "*-501" } if ($adminAccount) { $adminColor = if ($adminAccount.Enabled) { "Red" } else { "Green" } Write-Host " - Local Administrator ($($adminAccount.Name)): Enabled = $($adminAccount.Enabled)" -ForegroundColor $adminColor } if ($guestAccount) { $guestColor = if ($guestAccount.Enabled) { "Red" } else { "Green" } Write-Host " - Local Guest ($($guestAccount.Name)): Enabled = $($guestAccount.Enabled)" -ForegroundColor $guestColor } # Set-HardenDefaultAccounts.ps1 # Description: Disables and renames the built-in local Administrator and Guest accounts locally. Write-Host "Applying hardening requirement: Rename and Disable Default Accounts..." -ForegroundColor Cyan # 1. Disable and rename built-in local Administrator account $adminAccount = Get-LocalUser | Where-Object { $_.SID -like "*-500" } if ($adminAccount) { if ($adminAccount.Enabled) { Disable-LocalUser -Name $adminAccount.Name Write-Host "[+] Local Administrator account ($($adminAccount.Name)) disabled." -ForegroundColor Green } else { Write-Host "[-] Local Administrator account ($($adminAccount.Name)) is already disabled." -ForegroundColor Yellow } if ($adminAccount.Name -eq "Administrator") { Rename-LocalUser -Name "Administrator" -NewName "LocalMgmtAdmin" Write-Host "[+] Local Administrator account renamed to LocalMgmtAdmin." -ForegroundColor Green } else { Write-Host "[-] Local Administrator account is already renamed ($($adminAccount.Name))." -ForegroundColor Yellow } } else { Write-Warning "Built-in local Administrator account not found." } # 2. Disable and rename built-in local Guest account $guestAccount = Get-LocalUser | Where-Object { $_.SID -like "*-501" } if ($guestAccount) { if ($guestAccount.Enabled) { Disable-LocalUser -Name $guestAccount.Name Write-Host "[+] Local Guest account ($($guestAccount.Name)) disabled." -ForegroundColor Green } else { Write-Host "[-] Local Guest account ($($guestAccount.Name)) is already disabled." -ForegroundColor Yellow } if ($guestAccount.Name -eq "Guest") { Rename-LocalUser -Name "Guest" -NewName "LocalMgmtGuest" Write-Host "[+] Local Guest account renamed to LocalMgmtGuest." -ForegroundColor Green } else { Write-Host "[-] Local Guest account is already renamed ($($guestAccount.Name))." -ForegroundColor Yellow } } else { Write-Warning "Built-in local Guest account not found." } Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 File Path: 03-identities-services/restrict-service-account-logons.md Service accounts are frequent targets of brute-force and Kerberoasting attacks. If an adversary successfully cracks a service account's password offline, their immediate next step is to use those credentials to log on to domain systems to establish a footprint, dump credentials from memory, or perform administrative tasks. By enforcing User Rights Assignment policies that explicitly deny service accounts the ability to log on locally (at the physical console) or through Remote Desktop Services (RDP), the threat of an interactive domain compromise via service credentials is neutralized. Even if a service account password is compromised, the attacker cannot utilize it to gain an interactive command shell or graphical desktop session on network endpoints or servers. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the GPO linked to all domain systems (e.g., GPO_Hardening_DomainMembers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Configure the following settings: Policy*: Deny log on locally Setting : Define this policy and click Add User or Group*. Add the dedicated security group containing all service accounts (e.g., domain\Grp_ServiceAccounts or domain\Domain Users if restricting specific sub-groups). Policy*: Deny log on through Remote Desktop Services Setting : Define this policy and click Add User or Group*. Add the dedicated security group containing all service accounts. Click Apply and then OK. Force a policy update on target servers (gpupdate /force). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Since User Rights Assignment is typically controlled by GPO or local security policy database (secedit.sdb), local changes can be made using the secedit command-line utility. Download Script: Set-DenyServiceLogons.ps1 # Set-DenyServiceLogons.ps1 # Description: Configures local security database to deny interactive logons for a service account group. Write-Host "Applying hardening requirement: Restrict Interactive Logons for Service Accounts..." -ForegroundColor Cyan $SecDb = "$($env:temp)\localpolicy.sdb" $SecCfg = "$($env:temp)\localpolicy.inf" $GroupName = "Grp_ServiceAccounts" # Replace with the target security group name # Export current security policy secedit /export /cfg $SecCfg /quiet # Read configuration file $cfgContent = Get-Content -Path $SecCfg # Define logon rights lines $DenyLocalLine = "SeDenyInteractiveLogonRight = $GroupName" $DenyRdpLine = "SeDenyRemoteInteractiveLogonRight = $GroupName" # Check and update policy lines $hasDenyLocal = $false $hasDenyRdp = $false $newCfg = New-Object System.Collections.Generic.List[string] foreach ($line in $cfgContent) { if ($line -like "SeDenyInteractiveLogonRight*") { if ($line -notlike "*$GroupName*") { $line = "$($line), $GroupName" } $hasDenyLocal = $true } if ($line -like "SeDenyRemoteInteractiveLogonRight*") { if ($line -notlike "*$GroupName*") { $line = "$($line), $GroupName" } $hasDenyRdp = $true } $newCfg.Add($line) | Out-Null } if (-not $hasDenyLocal) { # Add to [Privilege Rights] section $privIndex = $newCfg.IndexOf("[Privilege Rights]") if ($privIndex -ge 0) { $newCfg.Insert($privIndex + 1, $DenyLocalLine) } } if (-not $hasDenyRdp) { $privIndex = $newCfg.IndexOf("[Privilege Rights]") if ($privIndex -ge 0) { $newCfg.Insert($privIndex + 1, $DenyRdpLine) } } # Save updated configuration $newCfg | Set-Content -Path $SecCfg # Configure local security policy secedit /configure /db $SecDb /cfg $SecCfg /areas USER_RIGHTS /quiet # Cleanup temporary files Remove-Item -Path $SecCfg -Force Remove-Item -Path $SecDb -Force Write-Host "Local security policy updated: Deny log on locally/RDP applied to group $GroupName." -ForegroundColor Green To audit local User Rights Assignment settings: Download Script: Get-DenyServiceLogonsStatus.ps1 # Get-DenyServiceLogonsStatus.ps1 # Description: Audits the Deny logon rights configurations locally. Write-Host "--- Auditing Deny Logon Rights ---" -ForegroundColor Cyan $SecCfg = "$($env:temp)\auditpolicy.inf" secedit /export /cfg $SecCfg /quiet $cfgContent = Get-Content -Path $SecCfg $denyLocal = $cfgContent | Where-Object { $_ -like "SeDenyInteractiveLogonRight*" } $denyRdp = $cfgContent | Where-Object { $_ -like "SeDenyRemoteInteractiveLogonRight*" } Write-Host "[+] Local Deny Logon Rights settings:" -ForegroundColor Green if ($denyLocal) { Write-Host " - $denyLocal" -ForegroundColor White } else { Write-Host " - SeDenyInteractiveLogonRight is not configured." -ForegroundColor Yellow } if ($denyRdp) { Write-Host " - $denyRdp" -ForegroundColor White } else { Write-Host " - SeDenyRemoteInteractiveLogonRight is not configured." -ForegroundColor Yellow } Remove-Item -Path $SecCfg -Force # Set-DenyServiceLogons.ps1 # Description: Configures local security database to deny interactive logons for a service account group. Write-Host "Applying hardening requirement: Restrict Interactive Logons for Service Accounts..." -ForegroundColor Cyan $SecDb = "$($env:temp)\localpolicy.sdb" $SecCfg = "$($env:temp)\localpolicy.inf" $GroupName = "Grp_ServiceAccounts" # Replace with the target security group name # Export current security policy secedit /export /cfg $SecCfg /quiet # Read configuration file $cfgContent = Get-Content -Path $SecCfg # Define logon rights lines $DenyLocalLine = "SeDenyInteractiveLogonRight = $GroupName" $DenyRdpLine = "SeDenyRemoteInteractiveLogonRight = $GroupName" # Check and update policy lines $hasDenyLocal = $false $hasDenyRdp = $false $newCfg = New-Object System.Collections.Generic.List[string] foreach ($line in $cfgContent) { if ($line -like "SeDenyInteractiveLogonRight*") { if ($line -notlike "*$GroupName*") { $line = "$($line), $GroupName" } $hasDenyLocal = $true } if ($line -like "SeDenyRemoteInteractiveLogonRight*") { if ($line -notlike "*$GroupName*") { $line = "$($line), $GroupName" } $hasDenyRdp = $true } $newCfg.Add($line) | Out-Null } if (-not $hasDenyLocal) { # Add to [Privilege Rights] section $privIndex = $newCfg.IndexOf("[Privilege Rights]") if ($privIndex -ge 0) { $newCfg.Insert($privIndex + 1, $DenyLocalLine) } } if (-not $hasDenyRdp) { $privIndex = $newCfg.IndexOf("[Privilege Rights]") if ($privIndex -ge 0) { $newCfg.Insert($privIndex + 1, $DenyRdpLine) } } # Save updated configuration $newCfg | Set-Content -Path $SecCfg # Configure local security policy secedit /configure /db $SecDb /cfg $SecCfg /areas USER_RIGHTS /quiet # Cleanup temporary files Remove-Item -Path $SecCfg -Force Remove-Item -Path $SecDb -Force Write-Host "Local security policy updated: Deny log on locally/RDP applied to group $GroupName." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 03-identities-services/enforce-user-aes-encryption.md In Active Directory, even when Group Policies restrict Kerberos encryption algorithms on domain members, individual user and service accounts can override these restrictions during authentication negotiation. If an account has obsolete encryption types enabled (e.g., RC4 or DES) or has the msDS-SupportedEncryptionTypes attribute set to 0 (default, which defaults to domain controllers' allowed options), the Key Distribution Center (KDC) may issue Service tickets (TGS) using the RC4 algorithm. Because RC4 utilizes weaker, legacy cryptography, tickets encrypted using RC4 can be easily extracted and cracked offline (Kerberoasting) by adversaries. Explicitly configuring the msDS-SupportedEncryptionTypes attribute to 24 (AES128 = 8 + AES256 = 16) on Active Directory accounts ensures that the KDC only negotiates AES encryption types, securing the authentication credentials against offline brute-forcing and ticket forgery. Option A: Active Directory Users and Computers Attribute Editor (Preferred) Open Active Directory Users and Computers (dsa.msc). Select View from the menu bar and check Advanced Features. Locate the target user or service account. Right-click the object and select Properties. Navigate to the Attribute Editor tab. Scroll down and double-click the msDS-SupportedEncryptionTypes attribute. Set the value to 24 (Decimal) and click OK. Go to the Account tab and verify that under Account options, This account supports Kerberos AES 128 bit encryption and This account supports Kerberos AES 256 bit encryption are checked, while RC4/DES are not forced. Click Apply and then OK. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script to enforce AES-only encryption on active user accounts in the domain. Download Script: Set-AccountAESEncryption.ps1 # Set-AccountAESEncryption.ps1 # Description: Configures the msDS-SupportedEncryptionTypes attribute to AES-only (24) on active user accounts. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Enforce AES-Only Kerberos Encryption on Accounts..." -ForegroundColor Cyan # 24 represents AES128 (8) + AES256 (16) $AESValue = 24 $TargetUsers = Get-ADUser -Filter {Enabled -eq $true} foreach ($User in $TargetUsers) { # Retrieve current attribute value $currUser = Get-ADUser -Identity $User -Properties msDS-SupportedEncryptionTypes $currVal = $currUser."msDS-SupportedEncryptionTypes" if ($currVal -ne $AESValue) { Write-Host "[*] Enforcing AES encryption on account: $($User.SamAccountName)" -ForegroundColor Gray Set-ADUser -Identity $User -Replace @{"msDS-SupportedEncryptionTypes" = $AESValue} } } Write-Host "AES encryption has been successfully enforced on active accounts." -ForegroundColor Green To audit account Kerberos encryption configuration: Download Script: Get-AccountEncryptionStatus.ps1 # Get-AccountEncryptionStatus.ps1 # Description: Identifies accounts that do not have msDS-SupportedEncryptionTypes set to 24 (AES-only). Import-Module ActiveDirectory Write-Host "--- Auditing Account Kerberos Encryption Configuration ---" -ForegroundColor Cyan $VulnerableAccounts = Get-ADUser -Filter {Enabled -eq $true} -Properties msDS-SupportedEncryptionTypes | Where-Object { $_."msDS-SupportedEncryptionTypes" -ne 24 } if ($VulnerableAccounts) { Write-Host "[!] Accounts not configured for AES-only (msDS-SupportedEncryptionTypes != 24):" -ForegroundColor Red foreach ($Acct in $VulnerableAccounts) { $Val = $Acct."msDS-SupportedEncryptionTypes" if ($null -eq $Val) { $Val = "Not Set (0)" } Write-Host " - $($Acct.SamAccountName) | Value: $Val" -ForegroundColor White } } else { Write-Host "[+] Secure: All active accounts are configured for AES-only Kerberos encryption." -ForegroundColor Green } # Set-AccountAESEncryption.ps1 # Description: Configures the msDS-SupportedEncryptionTypes attribute to AES-only (24) on active user accounts. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Enforce AES-Only Kerberos Encryption on Accounts..." -ForegroundColor Cyan # 24 represents AES128 (8) + AES256 (16) $AESValue = 24 $TargetUsers = Get-ADUser -Filter {Enabled -eq $true} foreach ($User in $TargetUsers) { # Retrieve current attribute value $currUser = Get-ADUser -Identity $User -Properties msDS-SupportedEncryptionTypes $currVal = $currUser."msDS-SupportedEncryptionTypes" if ($currVal -ne $AESValue) { Write-Host "[*] Enforcing AES encryption on account: $($User.SamAccountName)" -ForegroundColor Gray Set-ADUser -Identity $User -Replace @{"msDS-SupportedEncryptionTypes" = $AESValue} } } Write-Host "AES encryption has been successfully enforced on active accounts." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers (Active Directory User Accounts) Operating Systems: Windows Server 2016 and above File Path: 03-identities-services/enforce-kerberos-preauthentication.md Kerberos Pre-Authentication serves as the primary line of defense against AS-REP Roasting. AS-REP Roasting is a credential theft technique where attackers target accounts that do not require Kerberos pre-authentication. Without pre-authentication: 1. Unauthenticated Requesting: The Key Distribution Center (KDC) will issue a Ticket Granting Ticket (TGT) encrypted with the user's secret key (derived from their password) to any client that requests it, without requiring the client to authenticate or prove identity first. 2. Offline Password Cracking: An attacker can request a TGT for a target user, intercept the KDC's response (AS-REP payload), and take the encrypted data offline. They can then perform brute-force or dictionary attacks to crack the password hash without triggering account lockout policies or generating logon failure logs. By enforcing pre-authentication, the KDC requires the client to encrypt a timestamp using their password hash before issuing the TGT. This proves the client possesses the password, preventing attackers from retrieving the encrypted AS-REP token for offline cracking. Option A: Active Directory Users and Computers (Preferred) Log on to a Domain Controller or administrative workstation with Account Operators or Domain Admins credentials. Open Active Directory Users and Computers (dsa.msc). Locate the target user account, right-click it, and select Properties. Navigate to the Account tab. In the Account options list, scroll down and ensure that the checkbox for Do not require Kerberos preauthentication is unchecked (disabled). Click Apply and OK. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts to audit and remediate accounts in the forest. 1. Local AD Audit (Audit-KerberosPreAuth.ps1) Download Script: Audit-KerberosPreAuth.ps1 # Audit-KerberosPreAuth.ps1 # Description: Audits active user accounts to find any with pre-authentication disabled. Import-Module ActiveDirectory Write-Host "--- Auditing Kerberos Pre-Authentication Status ---" -ForegroundColor Cyan try { # Search for enabled accounts with DONOTREQ_PREAUTH (0x400000) active $VulnerableAccounts = Get-ADUser -Filter "DoesNotRequirePreAuth -eq '$true'" -Properties DoesNotRequirePreAuth, Enabled | Where-Object { $_.Enabled -eq $true } if ($VulnerableAccounts) { Write-Host "`nVULNERABLE: Found $($VulnerableAccounts.Count) enabled user account(s) with Kerberos Pre-Authentication disabled:" -ForegroundColor Red foreach ($acc in $VulnerableAccounts) { Write-Host " - User: $($acc.SamAccountName) | DN: $($acc.DistinguishedName)" -ForegroundColor White } } else { Write-Host "`nStatus: Compliant. All enabled user accounts require Kerberos Pre-Authentication." -ForegroundColor Green } } catch { Write-Host "VULNERABLE: Could not audit accounts. Error: $($_.Exception.Message)" -ForegroundColor Red } 2. Local AD Remediation (Set-KerberosPreAuth.ps1) Download Script: Set-KerberosPreAuth.ps1 # Set-KerberosPreAuth.ps1 # Description: Enforces Kerberos Pre-Authentication on all active user accounts. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Enforce Kerberos Pre-Authentication..." -ForegroundColor Cyan try { $VulnerableAccounts = Get-ADUser -Filter "DoesNotRequirePreAuth -eq '$true'" -Properties DoesNotRequirePreAuth, Enabled | Where-Object { $_.Enabled -eq $true } if ($VulnerableAccounts) { Write-Host "[+] Found $($VulnerableAccounts.Count) accounts requiring remediation." -ForegroundColor Yellow foreach ($acc in $VulnerableAccounts) { Set-ADAccountControl -Identity $acc.SamAccountName -DoesNotRequirePreAuth $false -ErrorAction Stop Write-Host " Remediated: $($acc.SamAccountName)" -ForegroundColor Green } Write-Host "[+] All target accounts successfully remediated." -ForegroundColor Green } else { Write-Host "[+] No vulnerable accounts found. Pre-Authentication is already enforced." -ForegroundColor Green } } catch { Write-Error "Failed to enforce Kerberos Pre-Authentication. Error: $($_.Exception.Message)" } # Set-KerberosPreAuth.ps1 # Description: Enforces Kerberos Pre-Authentication on all active user accounts. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Enforce Kerberos Pre-Authentication..." -ForegroundColor Cyan try { $VulnerableAccounts = Get-ADUser -Filter "DoesNotRequirePreAuth -eq '$true'" -Properties DoesNotRequirePreAuth, Enabled | Where-Object { $_.Enabled -eq $true } if ($VulnerableAccounts) { Write-Host "[+] Found $($VulnerableAccounts.Count) accounts requiring remediation." -ForegroundColor Yellow foreach ($acc in $VulnerableAccounts) { Set-ADAccountControl -Identity $acc.SamAccountName -DoesNotRequirePreAuth $false -ErrorAction Stop Write-Host " Remediated: $($acc.SamAccountName)" -ForegroundColor Green } Write-Host "[+] All target accounts successfully remediated." -ForegroundColor Green } else { Write-Host "[+] No vulnerable accounts found. Pre-Authentication is already enforced." -ForegroundColor Green } } catch { Write-Error "Failed to enforce Kerberos Pre-Authentication. Error: $($_.Exception.Message)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 and above File Path: 03-identities-services/restrict-schema-admins.md The Schema Admins group is one of the most critical security groups within an Active Directory forest. This group controls the underlying structure of the directory database, defining every class of object and every attribute that those objects can possess. A compromised Schema Admin account poses a massive risk to the forest: 1. Schema Modifications: Attackers can modify class definitions, introduce rogue attributes, or insert persistent directory-level backdoors that survive standard OS-level remediation. 2. Low Operational Frequency: Schema modifications are extremely rare, typically occurring only during major enterprise software installations (such as Exchange, SCCM) or AD functional level upgrades. To minimize the attack surface, standard administrative accounts must not have permanent membership in the Schema Admins group. Instead, membership must be granted strictly on a Just-In-Time (JIT) basis and revoked immediately after schema changes are completed. Locking the group membership to empty using a Restricted Groups GPO ensures that any unauthorized or accidental additions are automatically cleared. Option A: Group Policy Object (GPO) Configuration (Preferred) Log on to a management workstation or Domain Controller with Domain Admins credentials. Open the Group Policy Management Console (gpmc.msc). Create a new GPO named SEC_Forest_RestrictedGroups and link it to the Domain Controllers OU in the forest root domain. Right-click the GPO and select Edit to open the Group Policy Management Editor. Navigate to: Computer Configuration > Policies > Windows Settings > Security Settings > Restricted Groups Right-click Restricted Groups and select Add Group. In the Group box, type or browse for Schema Admins and click OK. In the properties dialog for Schema Admins: Leave the list under Members of this group* completely blank. Leave the list under This group is a member of* completely blank. Click Apply and OK. The group membership will be automatically checked and cleared on Domain Controllers during Group Policy refresh cycles. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts to audit and clear the group membership. 1. Local Audit (Audit-SchemaAdminsGroup.ps1) Download Script: Audit-SchemaAdminsGroup.ps1 # Audit-SchemaAdminsGroup.ps1 # Description: Audits the Schema Admins group membership. Import-Module ActiveDirectory Write-Host "--- Auditing Schema Admins Group Membership ---" -ForegroundColor Cyan try { $Group = Get-ADGroup -Identity "Schema Admins" -Properties Members -ErrorAction Stop $MembersCount = $Group.Members.Count if ($MembersCount -gt 0) { Write-Host "`nVULNERABLE: Schema Admins group is NOT empty. Found $MembersCount member(s):" -ForegroundColor Red foreach ($memberDN in $Group.Members) { $memberObj = Get-ADObject -Identity $memberDN -ErrorAction SilentlyContinue Write-Host " - Member: $($memberObj.Name) | DN: $memberDN" -ForegroundColor White } } else { Write-Host "`nStatus: Compliant. Schema Admins group is empty." -ForegroundColor Green } } catch { Write-Host "VULNERABLE: Could not query Schema Admins group. Error: $($_.Exception.Message)" -ForegroundColor Red } 2. Local Remediation (Clear-SchemaAdminsGroup.ps1) Download Script: Clear-SchemaAdminsGroup.ps1 # Clear-SchemaAdminsGroup.ps1 # Description: Removes all members from the Schema Admins group. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Clear Schema Admins group membership..." -ForegroundColor Cyan try { $Group = Get-ADGroup -Identity "Schema Admins" -Properties Members -ErrorAction Stop if ($Group.Members.Count -gt 0) { Write-Host "[+] Found $($Group.Members.Count) members in Schema Admins group." -ForegroundColor Yellow foreach ($memberDN in $Group.Members) { $memberObj = Get-ADObject -Identity $memberDN Remove-ADGroupMember -Identity "Schema Admins" -Members $memberDN -Confirm:$false -ErrorAction Stop Write-Host " Removed member: $($memberObj.Name)" -ForegroundColor Green } Write-Host "[+] Schema Admins group cleared successfully." -ForegroundColor Green } else { Write-Host "[+] Schema Admins group is already empty." -ForegroundColor Green } } catch { Write-Error "Failed to clear Schema Admins group. Error: $($_.Exception.Message)" } # Clear-SchemaAdminsGroup.ps1 # Description: Removes all members from the Schema Admins group. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Clear Schema Admins group membership..." -ForegroundColor Cyan try { $Group = Get-ADGroup -Identity "Schema Admins" -Properties Members -ErrorAction Stop if ($Group.Members.Count -gt 0) { Write-Host "[+] Found $($Group.Members.Count) members in Schema Admins group." -ForegroundColor Yellow foreach ($memberDN in $Group.Members) { $memberObj = Get-ADObject -Identity $memberDN Remove-ADGroupMember -Identity "Schema Admins" -Members $memberDN -Confirm:$false -ErrorAction Stop Write-Host " Removed member: $($memberObj.Name)" -ForegroundColor Green } Write-Host "[+] Schema Admins group cleared successfully." -ForegroundColor Green } else { Write-Host "[+] Schema Admins group is already empty." -ForegroundColor Green } } catch { Write-Error "Failed to clear Schema Admins group. Error: $($_.Exception.Message)" } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016 and above File Path: 03-identities-services/prevent-accidental-deletion-ous.md Organizational Units (OUs) act as the logical containers for structuring users, groups, and computers in Active Directory, and are the targets for linking Group Policy Objects (GPOs). Enforcing the accidental deletion protection property provides the following security and availability benefits: 1. Administrative Safeguard: Drag-and-drop mistakes or batch scripting errors can lead to the deletion of an entire OU hierarchy, causing severe outages and loss of access controls. This feature places a "Deny" Access Control Entry (ACE) for the "Everyone" group on the "Delete" and "Delete Subtree" permissions of the object. 2. Operational Continuity: While it does not prevent a malicious administrator from intentionally disabling the setting and deleting the OU, it forces a deliberate, two-step verification process before any destructive actions can be performed. Option A: Active Directory Users and Computers (Preferred) Log on to a management workstation or Domain Controller with Domain Admins or Account Operators credentials. Open Active Directory Users and Computers (dsa.msc). In the top menu, click View and ensure that Advanced Features is checked. This is required to expose the Object tab in properties. Locate the target Organizational Unit, right-click it, and select Properties. Navigate to the Object tab. Check the box for Protect object from accidental deletion. Click Apply and OK. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts to audit and configure the setting domain-wide. 1. Local Audit (Audit-OUAccidentalDeletion.ps1) Download Script: Audit-OUAccidentalDeletion.ps1 # Audit-OUAccidentalDeletion.ps1 # Description: Audits all OUs to find any without accidental deletion protection. Import-Module ActiveDirectory Write-Host "--- Auditing OU Accidental Deletion Protection ---" -ForegroundColor Cyan try { $UnprotectedOUs = Get-ADOrganizationalUnit -Filter "ProtectedFromAccidentalDeletion -eq '$false'" -ErrorAction Stop if ($UnprotectedOUs) { Write-Host "`nVULNERABLE: Found $($UnprotectedOUs.Count) Organizational Unit(s) without accidental deletion protection:" -ForegroundColor Red foreach ($ou in $UnprotectedOUs) { Write-Host " - OU: $($ou.Name) | DN: $($ou.DistinguishedName)" -ForegroundColor White } } else { Write-Host "`nStatus: Compliant. All Organizational Units are protected from accidental deletion." -ForegroundColor Green } } catch { Write-Host "VULNERABLE: Could not audit OUs. Error: $($_.Exception.Message)" -ForegroundColor Red } 2. Local Remediation (Enforce-OUAccidentalDeletion.ps1) Download Script: Enforce-OUAccidentalDeletion.ps1 # Enforce-OUAccidentalDeletion.ps1 # Description: Enables accidental deletion protection on all OUs in the domain. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Enforce OU Accidental Deletion Protection..." -ForegroundColor Cyan try { $UnprotectedOUs = Get-ADOrganizationalUnit -Filter "ProtectedFromAccidentalDeletion -eq '$false'" -ErrorAction Stop if ($UnprotectedOUs) { Write-Host "[+] Found $($UnprotectedOUs.Count) OUs requiring protection." -ForegroundColor Yellow foreach ($ou in $UnprotectedOUs) { Set-ADOrganizationalUnit -Identity $ou.DistinguishedName -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host " Protected OU: $($ou.Name)" -ForegroundColor Green } Write-Host "[+] All Organizational Units are now protected." -ForegroundColor Green } else { Write-Host "[+] No unprotected OUs found." -ForegroundColor Green } } catch { Write-Error "Failed to enable protection on OUs. Error: $($_.Exception.Message)" } # Enforce-OUAccidentalDeletion.ps1 # Description: Enables accidental deletion protection on all OUs in the domain. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Enforce OU Accidental Deletion Protection..." -ForegroundColor Cyan try { $UnprotectedOUs = Get-ADOrganizationalUnit -Filter "ProtectedFromAccidentalDeletion -eq '$false'" -ErrorAction Stop if ($UnprotectedOUs) { Write-Host "[+] Found $($UnprotectedOUs.Count) OUs requiring protection." -ForegroundColor Yellow foreach ($ou in $UnprotectedOUs) { Set-ADOrganizationalUnit -Identity $ou.DistinguishedName -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host " Protected OU: $($ou.Name)" -ForegroundColor Green } Write-Host "[+] All Organizational Units are now protected." -ForegroundColor Green } else { Write-Host "[+] No unprotected OUs found." -ForegroundColor Green } } catch { Write-Error "Failed to enable protection on OUs. Error: $($_.Exception.Message)" } Target Scope: Applicable Systems: Domain Controllers, Tier 0 Administration Workstations (PAWs), Tier 0 Administrator Accounts, Tier 0 Managed Service Accounts (gMSAs) Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025, Windows 10 Enterprise / Pro (1809+), Windows 11 Enterprise / Pro File Path: 03-identities-services/configure-authentication-silos.md Standard Active Directory access control models rely on Discretionary Access Control Lists (DACLs) and security group memberships. While DACLs determine which directory objects or network shares an administrative account can modify, they do not restrict the physical or virtual systems from which that administrator can log on. In an active enterprise network, if a Tier 0 administrator (such as a Domain Admin or Enterprise Admin) authenticates from or logs on to a compromised Tier 1 server (e.g., an application host) or a Tier 2 workstation (e.g., a standard user workstation), their authentication material is loaded into the memory of the Local Security Authority Subsystem Service (LSASS). Attackers with local administrative control over that lower-tier system can scrape LSASS memory using credential-harvesting tools (such as Mimikatz) to extract Kerberos Ticket Granting Tickets (TGTs), NTLM password hashes, or plaintext credentials, resulting in total forest compromise via lateral movement and privilege escalation (Pass-the-Hash, Pass-the-Ticket). Authentication Policies and Authentication Policy Silos (introduced in Windows Server 2012 R2) provide cryptographic containment enforced directly at the Key Distribution Center (KDC) on Domain Controllers: Cryptographic Boundary Enforcement at KDC: Unlike host-level software restrictions or traditional group memberships, Authentication Silos are evaluated by the KDC during the Kerberos ticket acquisition phase (AS-REQ and TGS-REQ). When an account assigned to an Authentication Policy Silo requests a Kerberos ticket, the KDC inspects the client host's device claims (@Device.ad:silo). If the host is not enrolled in the same silo, the KDC unconditionally rejects ticket issuance with the Kerberos status code KDC_ERR_POLICY (0x12). Because ticket issuance is denied at the domain controller level, administrative credentials are never exposed, transmitted, or cached on unauthorized workstations. Dynamic Access Control (DAC) & Compound Authentication: Authentication Silos leverage Dynamic Access Control (DAC) device claims. When accounts are enrolled in a silo, Active Directory automatically issues the @Device.ad:silo claim during Kerberos authentication. Enabled by Kerberos Flexible Authentication Secure Tunneling (FAST / RFC 6113), the KDC evaluates compound authentication, validating both the user identity and the computer identity simultaneously against conditional Security Descriptor Definition Language (SDDL) rules such as O:SYG:SYD:(XA;;CR;;;WD;(@Device.ad:silo == "T0_Silo")). Restricted Kerberos TGT Lifetimes: Authentication Policies enforce reduced Kerberos Ticket Granting Ticket (TGT) lifetimes (e.g., 120 minutes / 2 hours) specifically on high-privilege silo accounts, without impacting standard domain users whose default TGT lifetime remains 10 hours. This significantly constrains the window of opportunity for ticket reuse attacks or stolen session ticket exploitation. Defense-in-Depth Architectural Triad: Authentication Silos form an inseparable architectural defense triad with the Protected Users security group (REQ-ID-005), Kerberos Armoring (FAST) (REQ-DC-013, REQ-PAW-013, REQ-END-013), and Privileged Access Workstations (PAWs). Together, these controls prevent credential dumping, halt NTLM fallback, and enforce strict Tier 0 cryptographic isolation. Option A: Group Policy & Active Directory Administrative Center (ADAC) Configuration (Preferred) 1. Enable KDC Claims and Armoring on Domain Controllers via GPO Before configuring silos, Domain Controllers must be configured to support claims and Kerberos armoring: Open Group Policy Management (gpmc.msc). Edit the GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\System\KDC Double-click KDC support for claims, compound authentication and Kerberos armoring. Set it to Enabled. Under options, select Supported (or Always provide claims). Save the GPO and run gpupdate /force on all Domain Controllers. 2. Enable Kerberos Client Support on PAWs and Domain Controllers via GPO All Tier 0 PAWs and Domain Controllers must be configured to assert client claims: Edit the GPO linked to the Privileged Access Workstations OU and the Domain Controllers OU. Navigate to: Computer Configuration\Policies\Administrative Templates\System\Kerberos Double-click Kerberos client support for claims, compound authentication and Kerberos armoring. Set it to Enabled. Save the GPO and run gpupdate /force on target systems. 3. Enable Operational Event Logging on Domain Controllers On each Domain Controller, enable the operational log channel to capture audit events: Open an elevated command prompt on the Domain Controller. Execute: `cmd wevtutil sl Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController/Operational /e:true 4. Create the Authentication Policy in ADAC (Staging / Audit Mode) Open Active Directory Administrative Center (dsac.exe) on a Domain Controller or PAW. In the left navigation pane, switch to the Tree View, expand the domain, and select the Authentication container. Right-click Authentication Policies, select New, and click Authentication Policy: Name*: T0_AuthPol Description*: Authentication Policy for Tier 0 Isolation Under User*: Check Enforce user ticket lifetime restrictions* and enter 120 minutes. Check User Allowed To Authenticate From , click Edit , click Add a condition*, and specify: Device ad:silo Equals Value T0_Silo Under Policy setting , leave Audit policy restrictions* selected during the initial deployment phase. Under Computer*: Check Enforce computer ticket lifetime restrictions* and enter 120 minutes. Under Service*: Check Enforce service ticket lifetime restrictions* and enter 120 minutes. Click OK to save the policy. 5. Create the Authentication Policy Silo in ADAC In the Authentication container, right-click Authentication Policy Silos, select New, and click Authentication Policy Silo: Name*: T0_Silo Description*: Authentication Policy Silo for Tier 0 Containment Under Permitted Accounts , click Add* to specify: * All Tier 0 Administrator user accounts. * All Tier 0 Privileged Access Workstations (PAWs). * All writable Domain Controllers in the domain. Under Authentication Policies*: User*: Select T0_AuthPol. Computer*: Select T0_AuthPol. Service*: Select T0_AuthPol. Under Silo setting , select Audit silo policies* during initial staging. Click OK to create the silo. 6. Validate Staging Logs and Switch to Enforced Mode After running the silo in Audit Mode for 14 to 30 days, review Event Viewer on Domain Controllers under: Applications and Services Logs\Microsoft\Windows\Authentication\AuthenticationPolicyFailures-DomainController\Operational Confirm that no legitimate administrative workflows generate Event IDs 16867 or 16868. Confirm that all enrolled Tier 0 administrative users are members of the Protected Users group (CN=Protected Users,CN=Users,DC=[Domain]). Re-open Active Directory Administrative Center (dsac.exe). Open T0_AuthPol and change the policy setting to Enforce policy restrictions. Open T0_Silo and change the silo setting to Enforce the silo policies. Click OK to apply full cryptographic enforcement. Option B: PowerShell Configuration (Remediation / Non-GPO) Run the following script to configure local KDC registry settings, enable the operational event log channel, create the Tier 0 Authentication Policy with device claim restrictions, create the Silo, and enroll Domain Controllers, PAWs, and administrators. By default, the script deploys in Audit Mode to prevent accidental lockouts. Specify the -Enforce switch parameter once staging and logging validation are complete. Download Script: Set-ADAuthenticationSilo.ps1 # Set-ADAuthenticationSilo.ps1 # Description: Configures Active Directory Authentication Policies and Silos for Tier 0 isolation. # Target Engine: Windows PowerShell 5.1 [CmdletBinding()] param ( [Parameter(Mandatory = $false)] [switch]$Enforce, [Parameter(Mandatory = $false)] [string]$PolicyName = "T0_AuthPol", [Parameter(Mandatory = $false)] [string]$SiloName = "T0_Silo", [Parameter(Mandatory = $false)] [string]$UserGroupName = "Grp_Tier0_Admins", [Parameter(Mandatory = $false)] [string]$ComputerGroupName = "Grp_Tier0_PAWs", [Parameter(Mandatory = $false)] [int]$UserTGTLifetimeMins = 120 ) Import-Module ActiveDirectory -ErrorAction Stop Write-Host "Applying hardening requirement: Configure Active Directory Authentication Silos..." -ForegroundColor Cyan # 1. Validate Domain Functional Level $domain = Get-ADDomain -ErrorAction Stop if ($domain.DomainMode -lt [Microsoft.ActiveDirectory.Management.ADDomainMode]::Windows2012R2Domain) { Write-Error "Active Directory Domain Functional Level must be Windows Server 2012 R2 or higher. Current DFL: $($domain.DomainMode)" return } # 2. Configure KDC and Kerberos Client Registry Keys on Local Domain Controller $kdcRegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters" $kerbRegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" if (-not (Test-Path -Path $kdcRegPath)) { New-Item -Path $kdcRegPath -Force | Out-Null } # Enable KDC support for claims, compound authentication, and armoring (1 = Supported) Set-ItemProperty -Path $kdcRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord -Force Set-ItemProperty -Path $kdcRegPath -Name "CbacAndArmorLevel" -Value 1 -Type DWord -Force Write-Host "[+] Local KDC registry configured for claims and Kerberos armoring." -ForegroundColor Green if (-not (Test-Path -Path $kerbRegPath)) { New-Item -Path $kerbRegPath -Force | Out-Null } Set-ItemProperty -Path $kerbRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord -Force Write-Host "[+] Local Kerberos client registry configured for claims and armoring." -ForegroundColor Green # 3. Enable Operational Event Log Channel on Domain Controller try { $logChannel = "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController/Operational" wevtutil sl $logChannel /e:true 2>$null Write-Host "[+] Enabled operational log channel: $($logChannel)" -ForegroundColor Green } catch { Write-Host "[!] Could not configure operational log channel via wevtutil: $($_.Exception.Message)" -ForegroundColor Yellow } $enforceMode = $Enforce.IsPresent $modeDescription = if ($enforceMode) { "Enforced" } else { "Audit Mode (Staging)" } Write-Host "[*] Configuring Authentication Silo and Policy in mode: $($modeDescription)" -ForegroundColor Cyan # 4. Construct Device Claims SDDL Condition # Limits user authentication exclusively to devices belonging to the specified Silo $deviceConditionSddl = "O:SYG:SYD:(XA;;CR;;;WD;(@Device.ad:silo == `"$SiloName`"))" # 5. Create or Update the Authentication Policy $existPolicy = Get-ADAuthenticationPolicy -Filter "Name -eq '$PolicyName'" -ErrorAction SilentlyContinue if (-not $existPolicy) { New-ADAuthenticationPolicy -Name $PolicyName ` -Description "Authentication Policy for Tier 0 Isolation" ` -UserTGTLifetimeMins $UserTGTLifetimeMins ` -UserAllowedToAuthenticateFrom $deviceConditionSddl ` -Enforce $enforceMode ` -ProtectedFromAccidentalDeletion $true ` -ErrorAction Stop Write-Host "[+] Authentication Policy '$PolicyName' created (Enforce: $($enforceMode), TGT Lifetime: $($UserTGTLifetimeMins)m)." -ForegroundColor Green } else { Set-ADAuthenticationPolicy -Identity $PolicyName ` -UserTGTLifetimeMins $UserTGTLifetimeMins ` -UserAllowedToAuthenticateFrom $deviceConditionSddl ` -Enforce $enforceMode ` -ErrorAction Stop Write-Host "[+] Authentication Policy '$PolicyName' updated (Enforce: $($enforceMode), TGT Lifetime: $($UserTGTLifetimeMins)m)." -ForegroundColor Green } # 6. Create or Update the Authentication Policy Silo $existSilo = Get-ADAuthenticationPolicySilo -Filter "Name -eq '$SiloName'" -ErrorAction SilentlyContinue if (-not $existSilo) { New-ADAuthenticationPolicySilo -Name $SiloName ` -Description "Authentication Policy Silo for Tier 0 Containment" ` -UserAuthenticationPolicy $PolicyName ` -ComputerAuthenticationPolicy $PolicyName ` -ServiceAuthenticationPolicy $PolicyName ` -Enforce $enforceMode ` -ProtectedFromAccidentalDeletion $true ` -ErrorAction Stop Write-Host "[+] Authentication Policy Silo '$SiloName' created (Enforce: $($enforceMode))." -ForegroundColor Green } else { Set-ADAuthenticationPolicySilo -Identity $SiloName ` -UserAuthenticationPolicy $PolicyName ` -ComputerAuthenticationPolicy $PolicyName ` -ServiceAuthenticationPolicy $PolicyName ` -Enforce $enforceMode ` -ErrorAction Stop Write-Host "[+] Authentication Policy Silo '$SiloName' updated (Enforce: $($enforceMode))." -ForegroundColor Green } # 7. Grant Silo Access and Enroll Domain Controllers (Mandatory for T0 Silo) Write-Host "[*] Enrolling Domain Controllers into silo '$SiloName'..." -ForegroundColor White $domainControllers = Get-ADDomainController -Filter "IsReadOnly -eq `$false" foreach ($dc in $domainControllers) { $dcDn = $dc.ComputerObjectDN Grant-ADAuthenticationPolicySiloAccess -Identity $SiloName -Account $dcDn -ErrorAction SilentlyContinue Set-ADAccountAuthenticationPolicySilo -Identity $dcDn -AuthenticationPolicySilo $SiloName -ErrorAction SilentlyContinue Write-Host " - Enrolled DC: $($dc.HostName)" -ForegroundColor Gray } # 8. Grant Silo Access and Enroll Tier 0 Admin Users $userGroup = Get-ADGroup -Filter "Name -eq '$UserGroupName'" -ErrorAction SilentlyContinue if ($userGroup) { Write-Host "[*] Enrolling members of user group '$UserGroupName'..." -ForegroundColor White $adminUsers = Get-ADGroupMember -Identity $userGroup -Recursive | Where-Object { $_.objectClass -eq "user" } foreach ($user in $adminUsers) { Grant-ADAuthenticationPolicySiloAccess -Identity $SiloName -Account $user.distinguishedName -ErrorAction SilentlyContinue Set-ADAccountAuthenticationPolicySilo -Identity $user.distinguishedName -AuthenticationPolicySilo $SiloName -ErrorAction SilentlyContinue Write-Host " - Enrolled User: $($user.SamAccountName)" -ForegroundColor Gray } } else { Write-Host "[-] User group '$UserGroupName' not found in Active Directory. Skipping user enrollment." -ForegroundColor Yellow } # 9. Grant Silo Access and Enroll Tier 0 PAW Computers $compGroup = Get-ADGroup -Filter "Name -eq '$ComputerGroupName'" -ErrorAction SilentlyContinue if ($compGroup) { Write-Host "[*] Enrolling members of computer group '$ComputerGroupName'..." -ForegroundColor White $pawComputers = Get-ADGroupMember -Identity $compGroup -Recursive | Where-Object { $_.objectClass -eq "computer" } foreach ($comp in $pawComputers) { Grant-ADAuthenticationPolicySiloAccess -Identity $SiloName -Account $comp.distinguishedName -ErrorAction SilentlyContinue Set-ADAccountAuthenticationPolicySilo -Identity $comp.distinguishedName -AuthenticationPolicySilo $SiloName -ErrorAction SilentlyContinue Write-Host " - Enrolled Computer: $($comp.SamAccountName)" -ForegroundColor Gray } } else { Write-Host "[-] Computer group '$ComputerGroupName' not found in Active Directory. Skipping computer enrollment." -ForegroundColor Yellow } # 10. Audit Protected Users Group Membership for Silo Users Write-Host "[*] Auditing Protected Users membership for Tier 0 silo accounts..." -ForegroundColor White $protectedUsersGroup = Get-ADGroup -Identity "Protected Users" -ErrorAction SilentlyContinue if ($protectedUsersGroup) { $siloMembers = Get-ADAuthenticationPolicySilo -Identity $SiloName -Properties Members $unprotectedCount = 0 foreach ($memberDn in $siloMembers.Members) { $accountObj = Get-ADObject -Identity $memberDn -Properties objectClass, sAMAccountName -ErrorAction SilentlyContinue if ($accountObj -and $accountObj.objectClass -eq "user") { $isProtected = Get-ADGroupMember -Identity "Protected Users" -Recursive | Where-Object { $_.distinguishedName -eq $memberDn } if (-not $isProtected) { Write-Host "[!] WARNING: Silo user '$($accountObj.sAMAccountName)' is NOT in Protected Users group! Vulnerable to NTLM bypass." -ForegroundColor Yellow $unprotectedCount++ } } } if ($unprotectedCount -eq 0) { Write-Host "[+] All enrolled silo users are members of the Protected Users group." -ForegroundColor Green } } Write-Host "[+] Authentication Silo membership initialized." -ForegroundColor Green To audit Authentication Silos, KDC armoring configuration, enforcement states, and Protected Users group membership: Download Script: Get-AuthSiloAuditStatus.ps1 # Get-AuthSiloAuditStatus.ps1 # Description: Queries the active Authentication Silos, verifies KDC claims support, checks enforcement state, and audits Protected Users membership. # Target Engine: Windows PowerShell 5.1 Import-Module ActiveDirectory -ErrorAction SilentlyContinue Write-Host "--- Auditing Authentication Silos ---" -ForegroundColor Cyan $isCompliant = $true # 1. Audit KDC and Kerberos Client Registry Settings for Claims and Armoring $kdcRegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters" $kerbRegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" $kdcArmored = $false if (Test-Path -Path $kdcRegPath) { $kdcEnable = (Get-ItemProperty -Path $kdcRegPath -Name "EnableCbacAndArmor" -ErrorAction SilentlyContinue).EnableCbacAndArmor $kdcLevel = (Get-ItemProperty -Path $kdcRegPath -Name "CbacAndArmorLevel" -ErrorAction SilentlyContinue).CbacAndArmorLevel if ($kdcEnable -eq 1 -and ($kdcLevel -ge 1)) { $kdcArmored = $true Write-Host "[+] Status: Compliant. KDC support for claims and Kerberos armoring is enabled." -ForegroundColor Green } } if (-not $kdcArmored) { Write-Host "VULNERABLE: KDC support for claims, compound authentication, and Kerberos armoring is NOT enabled in registry ($kdcRegPath)." -ForegroundColor Red $isCompliant = $false } $kerbArmored = $false if (Test-Path -Path $kerbRegPath) { $kerbEnable = (Get-ItemProperty -Path $kerbRegPath -Name "EnableCbacAndArmor" -ErrorAction SilentlyContinue).EnableCbacAndArmor if ($kerbEnable -eq 1) { $kerbArmored = $true Write-Host "[+] Status: Compliant. Kerberos client support for claims and armoring is enabled." -ForegroundColor Green } } if (-not $kerbArmored) { Write-Host "VULNERABLE: Kerberos client support for claims and armoring is NOT enabled in registry ($kerbRegPath)." -ForegroundColor Red $isCompliant = $false } # 2. Audit Operational Event Log Channel try { $logChannel = "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController/Operational" $logConfig = Get-WinEvent -ListLog $logChannel -ErrorAction Stop if ($logConfig.IsEnabled) { Write-Host "[+] Status: Compliant. Operational authentication failure event log channel is enabled." -ForegroundColor Green } else { Write-Host "VULNERABLE: Operational authentication failure event log channel is disabled: $($logChannel)" -ForegroundColor Red $isCompliant = $false } } catch { Write-Host "[-] Operational log channel check skipped or unavailable on this node." -ForegroundColor Yellow } # 3. Audit Active Directory Authentication Policy Silos try { $silos = Get-ADAuthenticationPolicySilo -Filter * -Properties * -ErrorAction Stop if (-not $silos) { Write-Host "VULNERABLE: No Active Directory Authentication Policy Silos configured in this domain." -ForegroundColor Red $isCompliant = $false } else { foreach ($silo in $silos) { Write-Host "[*] Silo Name: $($silo.Name)" -ForegroundColor Cyan Write-Host " - Description: $($silo.Description)" -ForegroundColor White Write-Host " - Enforced: $($silo.Enforce)" -ForegroundColor White Write-Host " - User Policy: $($silo.UserAuthenticationPolicy)" -ForegroundColor White Write-Host " - Computer Policy: $($silo.ComputerAuthenticationPolicy)" -ForegroundColor White if (-not $silo.Enforce) { Write-Host " [!] Silo '$($silo.Name)' is in AUDIT mode (Enforce = False). Verify staging logs before enforcement." -ForegroundColor Yellow } # Verify associated User Authentication Policy if ($silo.UserAuthenticationPolicy) { $userPolicy = Get-ADAuthenticationPolicy -Identity $silo.UserAuthenticationPolicy -Properties * -ErrorAction SilentlyContinue if ($userPolicy) { Write-Host " - User TGT Lifetime: $($userPolicy.UserTGTLifetimeMins) minutes" -ForegroundColor White Write-Host " - Policy Enforced: $($userPolicy.Enforce)" -ForegroundColor White if ($userPolicy.UserTGTLifetimeMins -gt 240) { Write-Host " [!] Policy TGT lifetime exceeds 240 minutes ($($userPolicy.UserTGTLifetimeMins)m)." -ForegroundColor Yellow } } } # Check Silo Members: DCs must be enrolled in T0 Silo if ($silo.Name -like "*T0*" -or $silo.Name -like "*Tier0*") { $dcs = Get-ADDomainController -Filter "IsReadOnly -eq `$false" -ErrorAction SilentlyContinue $missingDcs = 0 foreach ($dc in $dcs) { $assignedSilo = (Get-ADAccountAuthenticationPolicySilo -Identity $dc.ComputerObjectDN -ErrorAction SilentlyContinue).AuthenticationPolicySilo if (-not $assignedSilo -or $assignedSilo -ne $silo.DistinguishedName) { $missingDcs++ } } if ($missingDcs -gt 0) { Write-Host " VULNERABLE: $($missingDcs) writable Domain Controller(s) are NOT assigned to Tier 0 Silo '$($silo.Name)'." -ForegroundColor Red $isCompliant = $false } else { Write-Host " [+] All writable Domain Controllers are assigned to Tier 0 Silo." -ForegroundColor Green } } # Check Silo Members: User accounts must be members of Protected Users group $members = $silo.Members $unprotectedUsers = 0 if ($members) { foreach ($memberDn in $members) { $memberObj = Get-ADObject -Identity $memberDn -Properties objectClass, sAMAccountName -ErrorAction SilentlyContinue if ($memberObj -and $memberObj.objectClass -eq "user") { $isProtected = Get-ADGroupMember -Identity "Protected Users" -Recursive -ErrorAction SilentlyContinue | Where-Object { $_.distinguishedName -eq $memberDn } if (-not $isProtected) { $unprotectedUsers++ Write-Host " VULNERABLE: Silo user '$($memberObj.sAMAccountName)' is NOT in Protected Users group (NTLM bypass risk)!" -ForegroundColor Red } } } } if ($unprotectedUsers -gt 0) { $isCompliant = $false } } } } catch { Write-Host "[-] Could not query Active Directory Authentication Policy Silos: $($_.Exception.Message)" -ForegroundColor Yellow } # 4. Final Compliance Verdict if ($isCompliant) { Write-Host "Audit Result: SECURE (Authentication Silos and Policies configured and compliant)" -ForegroundColor Green } else { Write-Host "Audit Result: VULNERABLE (Authentication Silos and Policies missing or non-compliant)" -ForegroundColor Red } # Set-ADAuthenticationSilo.ps1 # Description: Configures Active Directory Authentication Policies and Silos for Tier 0 isolation. # Target Engine: Windows PowerShell 5.1 [CmdletBinding()] param ( [Parameter(Mandatory = $false)] [switch]$Enforce, [Parameter(Mandatory = $false)] [string]$PolicyName = "T0_AuthPol", [Parameter(Mandatory = $false)] [string]$SiloName = "T0_Silo", [Parameter(Mandatory = $false)] [string]$UserGroupName = "Grp_Tier0_Admins", [Parameter(Mandatory = $false)] [string]$ComputerGroupName = "Grp_Tier0_PAWs", [Parameter(Mandatory = $false)] [int]$UserTGTLifetimeMins = 120 ) Import-Module ActiveDirectory -ErrorAction Stop Write-Host "Applying hardening requirement: Configure Active Directory Authentication Silos..." -ForegroundColor Cyan # 1. Validate Domain Functional Level $domain = Get-ADDomain -ErrorAction Stop if ($domain.DomainMode -lt [Microsoft.ActiveDirectory.Management.ADDomainMode]::Windows2012R2Domain) { Write-Error "Active Directory Domain Functional Level must be Windows Server 2012 R2 or higher. Current DFL: $($domain.DomainMode)" return } # 2. Configure KDC and Kerberos Client Registry Keys on Local Domain Controller $kdcRegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters" $kerbRegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" if (-not (Test-Path -Path $kdcRegPath)) { New-Item -Path $kdcRegPath -Force | Out-Null } # Enable KDC support for claims, compound authentication, and armoring (1 = Supported) Set-ItemProperty -Path $kdcRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord -Force Set-ItemProperty -Path $kdcRegPath -Name "CbacAndArmorLevel" -Value 1 -Type DWord -Force Write-Host "[+] Local KDC registry configured for claims and Kerberos armoring." -ForegroundColor Green if (-not (Test-Path -Path $kerbRegPath)) { New-Item -Path $kerbRegPath -Force | Out-Null } Set-ItemProperty -Path $kerbRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord -Force Write-Host "[+] Local Kerberos client registry configured for claims and armoring." -ForegroundColor Green # 3. Enable Operational Event Log Channel on Domain Controller try { $logChannel = "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController/Operational" wevtutil sl $logChannel /e:true 2>$null Write-Host "[+] Enabled operational log channel: $($logChannel)" -ForegroundColor Green } catch { Write-Host "[!] Could not configure operational log channel via wevtutil: $($_.Exception.Message)" -ForegroundColor Yellow } $enforceMode = $Enforce.IsPresent $modeDescription = if ($enforceMode) { "Enforced" } else { "Audit Mode (Staging)" } Write-Host "[*] Configuring Authentication Silo and Policy in mode: $($modeDescription)" -ForegroundColor Cyan # 4. Construct Device Claims SDDL Condition # Limits user authentication exclusively to devices belonging to the specified Silo $deviceConditionSddl = "O:SYG:SYD:(XA;;CR;;;WD;(@Device.ad:silo == `"$SiloName`"))" # 5. Create or Update the Authentication Policy $existPolicy = Get-ADAuthenticationPolicy -Filter "Name -eq '$PolicyName'" -ErrorAction SilentlyContinue if (-not $existPolicy) { New-ADAuthenticationPolicy -Name $PolicyName ` -Description "Authentication Policy for Tier 0 Isolation" ` -UserTGTLifetimeMins $UserTGTLifetimeMins ` -UserAllowedToAuthenticateFrom $deviceConditionSddl ` -Enforce $enforceMode ` -ProtectedFromAccidentalDeletion $true ` -ErrorAction Stop Write-Host "[+] Authentication Policy '$PolicyName' created (Enforce: $($enforceMode), TGT Lifetime: $($UserTGTLifetimeMins)m)." -ForegroundColor Green } else { Set-ADAuthenticationPolicy -Identity $PolicyName ` -UserTGTLifetimeMins $UserTGTLifetimeMins ` -UserAllowedToAuthenticateFrom $deviceConditionSddl ` -Enforce $enforceMode ` -ErrorAction Stop Write-Host "[+] Authentication Policy '$PolicyName' updated (Enforce: $($enforceMode), TGT Lifetime: $($UserTGTLifetimeMins)m)." -ForegroundColor Green } # 6. Create or Update the Authentication Policy Silo $existSilo = Get-ADAuthenticationPolicySilo -Filter "Name -eq '$SiloName'" -ErrorAction SilentlyContinue if (-not $existSilo) { New-ADAuthenticationPolicySilo -Name $SiloName ` -Description "Authentication Policy Silo for Tier 0 Containment" ` -UserAuthenticationPolicy $PolicyName ` -ComputerAuthenticationPolicy $PolicyName ` -ServiceAuthenticationPolicy $PolicyName ` -Enforce $enforceMode ` -ProtectedFromAccidentalDeletion $true ` -ErrorAction Stop Write-Host "[+] Authentication Policy Silo '$SiloName' created (Enforce: $($enforceMode))." -ForegroundColor Green } else { Set-ADAuthenticationPolicySilo -Identity $SiloName ` -UserAuthenticationPolicy $PolicyName ` -ComputerAuthenticationPolicy $PolicyName ` -ServiceAuthenticationPolicy $PolicyName ` -Enforce $enforceMode ` -ErrorAction Stop Write-Host "[+] Authentication Policy Silo '$SiloName' updated (Enforce: $($enforceMode))." -ForegroundColor Green } # 7. Grant Silo Access and Enroll Domain Controllers (Mandatory for T0 Silo) Write-Host "[*] Enrolling Domain Controllers into silo '$SiloName'..." -ForegroundColor White $domainControllers = Get-ADDomainController -Filter "IsReadOnly -eq `$false" foreach ($dc in $domainControllers) { $dcDn = $dc.ComputerObjectDN Grant-ADAuthenticationPolicySiloAccess -Identity $SiloName -Account $dcDn -ErrorAction SilentlyContinue Set-ADAccountAuthenticationPolicySilo -Identity $dcDn -AuthenticationPolicySilo $SiloName -ErrorAction SilentlyContinue Write-Host " - Enrolled DC: $($dc.HostName)" -ForegroundColor Gray } # 8. Grant Silo Access and Enroll Tier 0 Admin Users $userGroup = Get-ADGroup -Filter "Name -eq '$UserGroupName'" -ErrorAction SilentlyContinue if ($userGroup) { Write-Host "[*] Enrolling members of user group '$UserGroupName'..." -ForegroundColor White $adminUsers = Get-ADGroupMember -Identity $userGroup -Recursive | Where-Object { $_.objectClass -eq "user" } foreach ($user in $adminUsers) { Grant-ADAuthenticationPolicySiloAccess -Identity $SiloName -Account $user.distinguishedName -ErrorAction SilentlyContinue Set-ADAccountAuthenticationPolicySilo -Identity $user.distinguishedName -AuthenticationPolicySilo $SiloName -ErrorAction SilentlyContinue Write-Host " - Enrolled User: $($user.SamAccountName)" -ForegroundColor Gray } } else { Write-Host "[-] User group '$UserGroupName' not found in Active Directory. Skipping user enrollment." -ForegroundColor Yellow } # 9. Grant Silo Access and Enroll Tier 0 PAW Computers $compGroup = Get-ADGroup -Filter "Name -eq '$ComputerGroupName'" -ErrorAction SilentlyContinue if ($compGroup) { Write-Host "[*] Enrolling members of computer group '$ComputerGroupName'..." -ForegroundColor White $pawComputers = Get-ADGroupMember -Identity $compGroup -Recursive | Where-Object { $_.objectClass -eq "computer" } foreach ($comp in $pawComputers) { Grant-ADAuthenticationPolicySiloAccess -Identity $SiloName -Account $comp.distinguishedName -ErrorAction SilentlyContinue Set-ADAccountAuthenticationPolicySilo -Identity $comp.distinguishedName -AuthenticationPolicySilo $SiloName -ErrorAction SilentlyContinue Write-Host " - Enrolled Computer: $($comp.SamAccountName)" -ForegroundColor Gray } } else { Write-Host "[-] Computer group '$ComputerGroupName' not found in Active Directory. Skipping computer enrollment." -ForegroundColor Yellow } # 10. Audit Protected Users Group Membership for Silo Users Write-Host "[*] Auditing Protected Users membership for Tier 0 silo accounts..." -ForegroundColor White $protectedUsersGroup = Get-ADGroup -Identity "Protected Users" -ErrorAction SilentlyContinue if ($protectedUsersGroup) { $siloMembers = Get-ADAuthenticationPolicySilo -Identity $SiloName -Properties Members $unprotectedCount = 0 foreach ($memberDn in $siloMembers.Members) { $accountObj = Get-ADObject -Identity $memberDn -Properties objectClass, sAMAccountName -ErrorAction SilentlyContinue if ($accountObj -and $accountObj.objectClass -eq "user") { $isProtected = Get-ADGroupMember -Identity "Protected Users" -Recursive | Where-Object { $_.distinguishedName -eq $memberDn } if (-not $isProtected) { Write-Host "[!] WARNING: Silo user '$($accountObj.sAMAccountName)' is NOT in Protected Users group! Vulnerable to NTLM bypass." -ForegroundColor Yellow $unprotectedCount++ } } } if ($unprotectedCount -eq 0) { Write-Host "[+] All enrolled silo users are members of the Protected Users group." -ForegroundColor Green } } Write-Host "[+] Authentication Silo membership initialized." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Identity Management Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 03-identities-services/cleanup-admincount-orphans.md In Active Directory, when an account is added to a protected group (such as Domain Admins, Schema Admins, or Account Operators), a forest-wide background thread (the AdminSDHolder task, running on the Domain Controller holding the PDC Emulator role) automatically sets the account's adminCount attribute to 1 and disables security descriptor inheritance. This is done to ensure the account only inherits permissions defined by the secure adminSDHolder template rather than any insecure permissions on the parent Organizational Unit (OU). A common myth is that Active Directory uses the adminCount attribute to determine which accounts are protected. In reality, the AdminSDHolder background task evaluates group membership (direct or nested association with a protected group) to trigger protection, not adminCount. The adminCount=1 attribute is merely a metadata flag stamped by the task. However, if that user is later removed from the protected group: 1. adminCount Remains Active: Active Directory does not automatically reset the adminCount attribute to 0 or empty, nor does it re-enable security descriptor inheritance on the user object. Although the AdminSDHolder task stops protecting the object (it no longer overwrites its DACL), inheritance remains permanently disabled. 2. Leaves Account Insecurely Unmanaged: The user object remains orphaned, with inheritance permanently disabled. This blocks future legitimate GPO-based permission updates and can allow persistent, hidden permissions (backdoors) on the object to remain unmitigated. 3. Breaks Management Consistency: Security administrators auditing protected accounts will see false positives, as accounts appear to have administrative attributes when they do not have administrative group memberships. Auditing and resetting these orphan accounts restores proper security inheritance and cleans up directory metadata. Option A: Active Directory Administrative Center (ADAC) Manual Modification Open Active Directory Administrative Center (dsac.exe) on a Domain Controller. Navigate to your domain and locate the target orphan user account. Right-click the user account and select Properties. Click Attribute Editor (ensure Advanced features are active). Locate the adminCount attribute and click Clear or set the value to <not set>. Select the Security tab, click Advanced, and click Enable Inheritance. Click OK to save and commit changes. Option B: PowerShell Configuration (Remediation / Non-GPO) Run the following script to automatically identify all user accounts with adminCount=1 that are no longer members of any protected AD group, reset the attribute, and re-enable security inheritance. Download Script: Cleanup-AdminCountOrphans.ps1 # Cleanup-AdminCountOrphans.ps1 # Description: Resets adminCount and re-enables inheritance on user accounts that are no longer in protected groups. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Clean Up adminCount Attribute Orphans..." -ForegroundColor Cyan # Define the list of built-in protected AD groups (sAMAccountNames) $ProtectedGroups = @( "Administrators", "Domain Admins", "Enterprise Admins", "Schema Admins", "Account Operators", "Backup Operators", "Print Operators", "Server Operators", "Cert Publishers", "Group Policy Creator Owners" ) # Fetch all user objects with adminCount set to 1 Write-Host "Scanning domain for accounts with adminCount = 1..." -ForegroundColor White $Orphans = Get-ADUser -Filter "adminCount -eq 1" -Properties MemberOf, adminCount $CleanedCount = 0 foreach ($User in $Orphans) { $IsStillProtected = $false # Check if the user is currently in any of the protected groups foreach ($Group in $ProtectedGroups) { $GroupObj = Get-ADGroup -Filter "Name -eq '$Group'" -ErrorAction SilentlyContinue if ($null -ne $GroupObj) { # Check membership $IsMember = Get-ADGroupMember -Identity $GroupObj -Recursive | Where-Object { $_.distinguishedName -eq $User.distinguishedName } if ($null -ne $IsMember) { $IsStillProtected = $true break } } } # If the user is no longer in a protected group, perform cleanup if (-not $IsStillProtected) { Write-Host "[-] Found orphan account: $($User.SamAccountName)" -ForegroundColor Yellow # 1. Clear the adminCount attribute Set-ADUser -Identity $User.distinguishedName -Clear "adminCount" -ErrorAction Stop # 2. Re-enable ACL inheritance on the object $UserDN = $User.distinguishedName $AclPath = "AD:\$($UserDN)" $Acl = Get-Acl -Path $AclPath if ($Acl.AreAccessRulesProtected) { # Disable protection, copying existing rules as inherited $Acl.SetAccessRuleProtection($false, $true) Set-Acl -Path $AclPath -AclObject $Acl -ErrorAction Stop Write-Host " - Reset adminCount and enabled security inheritance." -ForegroundColor Green } else { Write-Host " - Reset adminCount (security inheritance was already enabled)." -ForegroundColor Green } $CleanedCount++ } } Write-Host "[+] Cleanup complete. Total orphan accounts remediated: $($CleanedCount)." -ForegroundColor Green To audit and list orphan accounts without making changes: Download Script: Get-AdminCountOrphansAudit.ps1 # Get-AdminCountOrphansAudit.ps1 # Description: Scans the domain and prints all orphan adminCount accounts. Import-Module ActiveDirectory Write-Host "--- Auditing adminCount Orphans ---" -ForegroundColor Cyan $ProtectedGroups = @("Administrators","Domain Admins","Enterprise Admins","Schema Admins","Account Operators","Backup Operators","Print Operators","Server Operators") $Users = Get-ADUser -Filter "adminCount -eq 1" $OrphanCount = 0 foreach ($U in $Users) { $Member = $false foreach ($Grp in $ProtectedGroups) { $GrpObj = Get-ADGroup -Filter "Name -eq '$Grp'" if ($GrpObj) { $Check = Get-ADGroupMember -Identity $GrpObj -Recursive | Where-Object { $_.distinguishedName -eq $U.distinguishedName } if ($Check) { $Member = $true break } } } if (-not $Member) { Write-Host "[!] Orphan: $($U.SamAccountName) has adminCount=1 but is not in protected groups." -ForegroundColor Yellow $OrphanCount++ } } Write-Host "[*] Total adminCount orphans detected: $($OrphanCount)." -ForegroundColor White # Cleanup-AdminCountOrphans.ps1 # Description: Resets adminCount and re-enables inheritance on user accounts that are no longer in protected groups. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Clean Up adminCount Attribute Orphans..." -ForegroundColor Cyan # Define the list of built-in protected AD groups (sAMAccountNames) $ProtectedGroups = @( "Administrators", "Domain Admins", "Enterprise Admins", "Schema Admins", "Account Operators", "Backup Operators", "Print Operators", "Server Operators", "Cert Publishers", "Group Policy Creator Owners" ) # Fetch all user objects with adminCount set to 1 Write-Host "Scanning domain for accounts with adminCount = 1..." -ForegroundColor White $Orphans = Get-ADUser -Filter "adminCount -eq 1" -Properties MemberOf, adminCount $CleanedCount = 0 foreach ($User in $Orphans) { $IsStillProtected = $false # Check if the user is currently in any of the protected groups foreach ($Group in $ProtectedGroups) { $GroupObj = Get-ADGroup -Filter "Name -eq '$Group'" -ErrorAction SilentlyContinue if ($null -ne $GroupObj) { # Check membership $IsMember = Get-ADGroupMember -Identity $GroupObj -Recursive | Where-Object { $_.distinguishedName -eq $User.distinguishedName } if ($null -ne $IsMember) { $IsStillProtected = $true break } } } # If the user is no longer in a protected group, perform cleanup if (-not $IsStillProtected) { Write-Host "[-] Found orphan account: $($User.SamAccountName)" -ForegroundColor Yellow # 1. Clear the adminCount attribute Set-ADUser -Identity $User.distinguishedName -Clear "adminCount" -ErrorAction Stop # 2. Re-enable ACL inheritance on the object $UserDN = $User.distinguishedName $AclPath = "AD:\$($UserDN)" $Acl = Get-Acl -Path $AclPath if ($Acl.AreAccessRulesProtected) { # Disable protection, copying existing rules as inherited $Acl.SetAccessRuleProtection($false, $true) Set-Acl -Path $AclPath -AclObject $Acl -ErrorAction Stop Write-Host " - Reset adminCount and enabled security inheritance." -ForegroundColor Green } else { Write-Host " - Reset adminCount (security inheritance was already enabled)." -ForegroundColor Green } $CleanedCount++ } } Write-Host "[+] Cleanup complete. Total orphan accounts remediated: $($CleanedCount)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Group Managed Service Accounts (gMSAs) Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 03-identities-services/renew-kds-keys-gmsa-secrets.md Group Managed Service Accounts (gMSAs) offer secure, automated password management (complex 120-character passwords rotated every 30 days) for services running on domain member systems. The passwords for these accounts are generated by the Key Distribution Service (KDS) running on Domain Controllers. However, the password generation algorithm relies on KDS root keys stored in the AD Configuration partition. If an attacker compromises or steals the Active Directory database (e.g., via NTDS.dit exfiltration), they obtain the active KDS root keys. Using these keys, the attacker can recalculate the passwords for any gMSA at any time, establishing an invisible, persistent backdoor to any service running under a gMSA. Therefore: 1. Interrupts Attacker Persistence: Generating a new KDS root key and forcing all gMSA accounts to rotate their passwords invalidates any previously compromised password generation seeds. 2. Harden Service Isolation: Ensures that service account security boundaries remain intact post-remediation. Option A: Active Directory PowerShell Configuration (Remediation / Non-GPO) Because KDS keys and gMSAs do not have standard GPO management interfaces, the creation of root keys and service account password rotation must be executed via PowerShell. 1. Generate a New KDS Root Key Open an elevated PowerShell console on the PDC Emulator Domain Controller and run: Download Script: New-KdsKey.ps1 # New-KdsKey.ps1 # Description: Generates a new KDS Root Key. Import-Module Kds Write-Host "Creating new KDS Root Key..." -ForegroundColor Cyan # Create new KDS key effective immediately (backdated by 10 hours to bypass replication delay) $NewKey = Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10)) -ErrorAction Stop if ($null -ne $NewKey) { Write-Host "[+] New KDS Root Key created successfully. Key ID: $NewKey" -ForegroundColor Green } 2. Force gMSA Password Rotation Once the new root key is active, force password rotation for all gMSAs: Download Script: Rotate-gMSAPasswords.ps1 # Rotate-gMSAPasswords.ps1 # Description: Forces password rotation for all gMSAs. Import-Module ActiveDirectory Write-Host "Locating all gMSAs in the domain..." -ForegroundColor Cyan $gMSAs = Get-ADServiceAccount -Filter "ObjectClass -eq 'msDS-GroupManagedServiceAccount'" if ($gMSAs) { foreach ($Acct in $gMSAs) { Write-Host "[*] Rotating password for gMSA: $($Acct.Name)..." -ForegroundColor White # Reset password (forces rotation on the next request by the host computer) Reset-ADServiceAccountPassword -Identity $Acct.DistinguishedName -ErrorAction Stop Write-Host "[+] Password rotated successfully for $($Acct.Name)." -ForegroundColor Green } } else { Write-Host "[-] No Group Managed Service Accounts found." -ForegroundColor Yellow } Option B: PowerShell Auditing Status Use this PowerShell script to audit current KDS root keys and gMSA replication status. Download Script: Get-KdsAndGmsaAudit.ps1 # Get-KdsAndGmsaAudit.ps1 # Description: Audits active KDS root keys and checks gMSA accounts. Import-Module ActiveDirectory Import-Module Kds Write-Host "--- Auditing KDS Root Keys ---" -ForegroundColor Cyan $KdsKeys = Get-KdsRootKey -ErrorAction SilentlyContinue if ($KdsKeys) { foreach ($Key in $KdsKeys) { Write-Host "[+] KDS Key ID: $($Key.KeyId)" -ForegroundColor Green Write-Host " - Created: $($Key.CreateTime)" -ForegroundColor White Write-Host " - Effective: $($Key.EffectiveTime)" -ForegroundColor White } } else { Write-Host "[-] No KDS Root Keys found in the forest." -ForegroundColor Red } Write-Host "--- Auditing gMSA Accounts ---" -ForegroundColor Cyan $Accounts = Get-ADServiceAccount -Filter * -Properties msDS-ManagedPasswordInterval, msDS-HostSecurityGroupsScope if ($Accounts) { foreach ($Acct in $Accounts) { Write-Host "[*] gMSA: $($Acct.Name)" -ForegroundColor White Write-Host " - Rotation Interval: $($Acct.'msDS-ManagedPasswordInterval') days" -ForegroundColor Gray } } else { Write-Host "[-] No service accounts found." -ForegroundColor Yellow } # New-KdsKey.ps1 # Description: Generates a new KDS Root Key. Import-Module Kds Write-Host "Creating new KDS Root Key..." -ForegroundColor Cyan # Create new KDS key effective immediately (backdated by 10 hours to bypass replication delay) $NewKey = Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10)) -ErrorAction Stop if ($null -ne $NewKey) { Write-Host "[+] New KDS Root Key created successfully. Key ID: $NewKey" -ForegroundColor Green } Target Scope: Applicable Systems: Member Servers (Certification Authorities), Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 03-identities-services/harden-adcs-pki.md Active Directory Certificate Services (ADCS) is a built-in Public Key Infrastructure (PKI) solution widely used for issuing certificates for computer and user authentication. However, misconfigured certificate templates, weak mapping policies, and unhardened CA web endpoints present severe privilege escalation vectors (collectively referred to as ESC1 through ESC17). Key vulnerabilities include: 1. ESC1 (Enrollee Supplies Subject / SAN Exploitation): If a certificate template allows the client requesting the certificate to supply the subject name (Subject Alternative Name - SAN) in the enrollment request, and that template allows client authentication, any unprivileged domain user can request a certificate in the name of a Domain Administrator or Domain Controller. Upon receiving the certificate, the attacker can authenticate as that administrator, resulting in instant forest compromise. 2. ESC4 (Template ACL Misconfiguration): If unprivileged or Tier 1 identities possess write permissions (GenericAll, GenericWrite, or WriteDacl) over a certificate template object in the Active Directory Configuration partition, an attacker can modify the template parameters to enable SAN specification and client authentication (converting it to ESC1), enroll for an administrative certificate, and then restore the original configuration. 3. ESC8 (IIS Web Enrollment NTLM Relay): The default ADCS HTTP Web Enrollment pages (/certsrv) do not enforce HTTPS and support NTLM authentication without protection. Attackers can coerce NTLM authentication from a Domain Controller (e.g., using RPC coercion or WebDAV) and relay that authentication to the CA web enrollment endpoint to request a DC certificate, taking over the domain. 4. ESC9 / ESC10 (Weak Certificate Mapping & UPN Swaps): When weak certificate mapping is permitted (or without strong object SID binding), attackers with write permissions over an account's userPrincipalName or dNSHostName can compromise targets via certificate mapping mismatches. 5. ESC1-CMC (KB5014754 Bypass via CMC `id-cmc-addExtensions`): On patched CAs where PKINIT binds certificates using the szOID_NTDS_CA_SECURITY_EXT extension, attackers may attempt to embed arbitrary object SIDs into certificate requests via CMC request extensions. Enforcing strict issuance requirements (CA administrator approval) on sensitive authentication templates and keeping CA binaries fully updated neutralizes this bypass. Hardening ADCS templates, enforcing strong certificate binding, and securing endpoints is critical to protect the Tier 0 boundary. Option A: Certificate Templates Console & Registry Configuration 1. Mitigate ESC1 (Disable Enrollee Supplies Subject) Open the Certificate Templates Console (certtmpl.msc) on the CA server or a management host. Locate the active templates used for authentication (e.g., User, Computer, or custom templates). Right-click the template and select Properties. Select the Subject Name tab. Ensure the option Build from this Active Directory information is selected. Do NOT select the option Supply in the request. If a template must allow user-supplied subjects (e.g., web server SSL templates), ensure that Client Authentication is not present in the Extended Key Usage (EKU) list, and enforce manager approval (see below). 2. Enforce Manager Approval on Sensitive Templates (Mitigates ESC1-CMC) In the template properties, select the Issuance Requirements tab. Check the box for CA administrator approval. Under Require the following for enrollment, set the authorized signatures to 1 if an enrollment agent is required. Save the template. 3. Restrict Certificate Template ACLs (Mitigate ESC4) In the Certificate Templates Console, right-click the template and select Properties. Select the Security tab. Verify that only Domain Admins, Enterprise Admins, and SYSTEM hold Full Control, Write, or Write Owner/DACL permissions. Remove any write permissions assigned to Authenticated Users, Domain Users, or delegated non-Tier 0 groups. 4. Disable or Secure HTTP Web Enrollment (Mitigate ESC8) Log on to the CA server hosting the Web Enrollment role. Open Internet Information Services (IIS) Manager (inetmgr.exe). In the left tree view, navigate to: Sites\Default Web Site\CertSrv In the middle pane, double-click Authentication. Select Windows Authentication and click Advanced Settings in the right pane. Set Extended Protection to Required (or Accept). Ensure that the Default Web Site binds exclusively to HTTPS (port 443) and redirect all HTTP traffic to HTTPS. Ideally, if Web Enrollment is not required, uninstall the "Active Directory Certificate Services Web Enrollment" role entirely via Server Manager.* 5. Enforce Strong Certificate Binding on Domain Controllers (Mitigates ESC9/ESC10) On all Domain Controllers, open the Registry Editor (regedit.exe). Navigate to: HKLM\SYSTEM\CurrentControlSet\Services\Kdc Create or set the DWORD value: Value Name*: StrongCertificateBindingEnforcement Value Data*: 2 (Full Enforcement Mode) Option B: PowerShell Configuration (Remediation / Non-GPO) Run the following script block to audit active certificate templates for vulnerable configurations (ESC1). Download Script: Get-ADCSTemplateAudit.ps1 # Get-ADCSTemplateAudit.ps1 # Description: Audits Active Directory certificate templates for SAN and authentication misconfigurations. Import-Module ActiveDirectory Write-Host "--- Auditing ADCS Certificate Templates ---" -ForegroundColor Cyan $ConfigDN = (Get-ADRootDSE).configurationNamingContext $TemplatesPath = "LDAP://CN=Certificate Templates,CN=Public Key Services,CN=Services,$($ConfigDN)" $Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$TemplatesPath) $Searcher.Filter = "(objectClass=pkipastructure)" $Templates = $Searcher.FindAll() $VulnerableCount = 0 foreach ($Result in $Templates) { $Template = $Result.GetDirectoryEntry() $TemplateName = $Template.cn.Value # Check if enrollee supplies subject name (SAN flag: 0x00010000) $NameFlags = $Template.'msPKI-Certificate-Name-Flag'.Value $SuppliesSubject = ($NameFlags -band 0x00010000) -eq 0x00010000 # Check if template is used for Client Authentication (EKU OID: 1.3.6.1.5.5.7.3.2) $EkUs = $Template.'pKIExtendedKeyUsage'.Value $AllowsClientAuth = $false foreach ($Eku in $EkUs) { if ($Eku -eq "1.3.6.1.5.5.7.3.2" -or $Eku -eq "1.3.6.1.4.1.311.20.2.2") { # Client Auth or Smartcard Logon $AllowsClientAuth = $true } } # Check if manager approval is required (Enrollment flag: 0x00000002) $EnrollFlags = $Template.'msPKI-Enrollment-Flag'.Value $RequiresApproval = ($EnrollFlags -band 0x00000002) -eq 0x00000002 if ($SuppliesSubject -and $AllowsClientAuth -and -not $RequiresApproval) { Write-Host "[!] VULNERABLE TEMPLATE DETECTED (ESC1): $TemplateName" -ForegroundColor Red Write-Host " - Allows Client Authentication" -ForegroundColor White Write-Host " - Enrollee supplies Subject/SAN" -ForegroundColor White Write-Host " - Requires NO Manager Approval" -ForegroundColor White $VulnerableCount++ } } if ($VulnerableCount -eq 0) { Write-Host "[+] No vulnerable ESC1 certificate templates found." -ForegroundColor Green } else { Write-Host "[-] Action Required: Resolve the above vulnerable templates immediately." -ForegroundColor Red } Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients. Operating Systems: Windows Server 2016 (and above), Windows 10/11 Enterprise. File Path: 03-identities-services/configure-credential-delegation.md Securing interactive logons and connection pathways is critical to preventing identity leaks, unauthorized physical user identification, and credential theft during remote administration: Logon Screen Reconnaissance: Allowing the local login screen to enumerate local and domain users exposes valid usernames to physical shoulder-surfers or unauthorized operators. Disabling local user enumeration hides username lists at logon. CredSSP Vulnerabilities (CVE-2018-0886): The Credential Security Support Provider protocol (CredSSP) had a logical remote code execution flaw. Enforcing Encryption Oracle Remediation in updated mode blocks connections from unpatched clients and servers. Delegated Credential Extraction: When users connect to remote hosts, delegating exportable credentials exposes their authentication materials in remote LSASS memory. Forcing the delegation of non-exportable credentials ensures authentication materials cannot be exported by administrative attackers on the remote system. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Disable Logon Screen Username Enumeration Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to your computer OUs (e.g., GPO_Computer_Hardening_Baseline). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Logon Double-click Enumerate local users on domain-joined computers. Set it to Disabled and click OK. 2. Configure CredSSP and Credentials Delegation Navigate to: Computer Configuration\Policies\Administrative Templates\System\Credentials Delegation Double-click Encryption Oracle Remediation. Set it to Enabled, and select Force Updated Clients in the options dropdown. Click OK. Double-click Remote host allows delegation of non-exportable credentials. Set it to Enabled and click OK. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to apply logon screen and delegation settings to the registry. Download Script: Configure-CredentialDelegationAndLogon.ps1 # Configure-CredentialDelegationAndLogon.ps1 # Description: Hardens logon screen user enumeration, CredSSP encryption oracle remediation, and remote host non-exportable credentials delegation. Write-Host "Applying logon screen and credentials delegation registry controls..." -ForegroundColor Cyan # 1. Disable Logon Screen User Enumeration $SystemPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" if (-not (Test-Path $SystemPath)) { New-Item -Path $SystemPath -Force | Out-Null } Set-ItemProperty -Path $SystemPath -Name "EnumerateLocalUsers" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] Logon screen local user enumeration disabled." -ForegroundColor Green # 2. Enforce CredSSP Encryption Oracle Remediation $CredSspPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" if (-not (Test-Path $CredSspPath)) { New-Item -Path $CredSspPath -Force | Out-Null } Set-ItemProperty -Path $CredSspPath -Name "AllowEncryptionOracle" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] CredSSP Encryption Oracle Remediation configured to Force Updated Clients." -ForegroundColor Green # 3. Remote Host Allows Delegation of Non-Exportable Credentials $DelegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation" if (-not (Test-Path $DelegPath)) { New-Item -Path $DelegPath -Force | Out-Null } Set-ItemProperty -Path $DelegPath -Name "AllowProtectedCreds" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] Delegation of non-exportable credentials enabled." -ForegroundColor Green To audit these logon screen and delegation settings: Download Script: Get-CredentialDelegationAndLogonStatus.ps1 # Get-CredentialDelegationAndLogonStatus.ps1 # Description: Audits registry configuration of user enumeration, CredSSP, and delegation settings. Write-Host "--- Auditing Credentials Delegation and Logon Settings ---" -ForegroundColor Cyan $script:Vulnerable = $false # Helper function to check registry settings function Confirm-RegValue ($Path, $Name, $Expected) { if (Test-Path $Path) { $Reg = Get-ItemProperty -Path $Path -ErrorAction SilentlyContinue $Val = $Reg.$Name if ($Val -eq $Expected) { Write-Host " [+] Path $($Path) | $($Name): $Val (Expected: $Expected)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: Path $($Path) | $($Name): $Val (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] NOT FOUND: Path $($Path) (Expected: $Name = $Expected)" -ForegroundColor Red $script:Vulnerable = $true } } # 1. User Enumeration Confirm-RegValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" "EnumerateLocalUsers" 0 # 2. CredSSP AllowEncryptionOracle Confirm-RegValue "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" "AllowEncryptionOracle" 0 # 3. Protected Credentials Delegation Confirm-RegValue "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation" "AllowProtectedCreds" 1 if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-CredentialDelegationAndLogon.ps1 # Description: Hardens logon screen user enumeration, CredSSP encryption oracle remediation, and remote host non-exportable credentials delegation. Write-Host "Applying logon screen and credentials delegation registry controls..." -ForegroundColor Cyan # 1. Disable Logon Screen User Enumeration $SystemPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" if (-not (Test-Path $SystemPath)) { New-Item -Path $SystemPath -Force | Out-Null } Set-ItemProperty -Path $SystemPath -Name "EnumerateLocalUsers" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] Logon screen local user enumeration disabled." -ForegroundColor Green # 2. Enforce CredSSP Encryption Oracle Remediation $CredSspPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" if (-not (Test-Path $CredSspPath)) { New-Item -Path $CredSspPath -Force | Out-Null } Set-ItemProperty -Path $CredSspPath -Name "AllowEncryptionOracle" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] CredSSP Encryption Oracle Remediation configured to Force Updated Clients." -ForegroundColor Green # 3. Remote Host Allows Delegation of Non-Exportable Credentials $DelegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation" if (-not (Test-Path $DelegPath)) { New-Item -Path $DelegPath -Force | Out-Null } Set-ItemProperty -Path $DelegPath -Name "AllowProtectedCreds" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] Delegation of non-exportable credentials enabled." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Domain Environment Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 File Path: 03-identities-services/disable-machine-account-quota.md By default, Active Directory sets the domain-level attribute ms-DS-MachineAccountQuota to 10 on the domain head (DC=domain,DC=com) and assigns the SeMachineAccountPrivilege ("Add workstations to domain") User Right to the Authenticated Users group. This default configuration allows any standard user, compromised domain identity, or unprivileged service account to introduce up to 10 computer objects into the directory. Active Directory governs computer creation through two distinct mechanisms: 1. The `ms-DS-MachineAccountQuota` Domain Attribute: Enforced during direct LDAP/LDAPS operations. Even if local or GPO user rights are restricted, an attacker communicating over LDAP can create computer objects as long as ms-DS-MachineAccountQuota is greater than zero. 2. The `SeMachineAccountPrivilege` User Right Assignment: Evaluated by the Security Account Manager (SAMR) and NetJoinDomain RPC interfaces when workstations join via standard Windows APIs. Allowing unprivileged users to create machine accounts introduces critical security risks across multiple Active Directory subsystems: Privilege Escalation via Resource-Based Constrained Delegation (RBCD): The SPN Prerequisite*: Exploiting Resource-Based Constrained Delegation requires an account configured with a Service Principal Name (SPN). Standard user accounts cannot register an SPN without elevated administrative permissions (the servicePrincipalName attribute write is restricted). In contrast, computer accounts automatically receive default SPNs (e.g., HOST/<computername>, RestrictedKrbHost/<computername>) upon creation, and the creating user is designated as the object's creator/owner (mS-DS-CreatorSID), retaining full DACL control. Coercion and Relaying Vector*: When an attacker coerces authentication from an unconstrained or privileged server (e.g., via PetitPotam, PrinterBug/SpoolSample, DFSCoerce, or ShadowCoerce) and relays that NTLM authentication to LDAP/LDAPS, or when an attacker has write permissions over a target computer's msDS-AllowedToActOnBehalfOfOtherIdentity attribute, they configure the victim system to trust the newly created rogue machine account. Kerberos S4U Abuse*: Using the credentials of the rogue computer account, the attacker executes Kerberos S4U2self (Service-for-User-to-Self) and S4U2proxy protocol extensions to obtain a valid Kerberos service ticket impersonating ANY domain user (including a Domain Admin or Enterprise Admin) to services (CIFS, HTTP, LDAP, WSMAN) on the target host, achieving full host or domain takeover. Active Directory Certificate Services (ADCS) Exploitation: Template Enrollment*: Many enterprise ADCS certificate templates grant enrollment permissions to Domain Computers (such as default "Machine" or "Computer" templates, or custom enrollment templates). Domain Takeover*: If vulnerable certificate templates are present in the environment—such as ESC1 (templates allowing the enrollee to specify a Subject Alternative Name / ENROLLEE_SUPPLIES_SUBJECT), ESC2/ESC3 (enrollment agent misuse), ESC6 (EDITF_ATTRIBUTESUBJECTALTNAME2 enabled on the CA), or ESC13 (certificate templates linked to issuing policies)—an attacker with a rogue computer account can enroll for a machine certificate, supply the SAN of a Domain Controller or privileged administrative account, and immediately escalate to Domain Admin. Credential Relaying*: A rogue machine account also supplies the computer identity required to participate in ESC8 attacks (relaying coerced machine NTLM authentication to ADCS HTTP Web Enrollment or CES endpoints). Local Privilege Escalation via Local Kerberos Relaying (KrbRelay / KrbRelayUp): * On domain-joined Windows endpoints and servers, attack chains such as KrbRelayUp allow local non-administrative users to elevate directly to NT AUTHORITY\SYSTEM. * The exploit leverages ms-DS-MachineAccountQuota to dynamically provision a computer account in Active Directory, configures RBCD against the local machine, triggers a local RPC connection to coerce machine Kerberos authentication, and relays the ticket locally to execute arbitrary code as SYSTEM. Active Directory Integrated DNS (ADIDNS) Poisoning & WPAD Hijacking: * By default, Active Directory-integrated DNS zones allow authenticated machine accounts to register and dynamically update host (A) and reverse (PTR) DNS records. * Attackers can leverage rogue computer accounts to poison DNS zones, hijack hostnames of anticipated servers, or register wpad (Web Proxy Auto-Discovery) records. This allows the attacker to intercept corporate web traffic, harvest NetNTLM credentials, or conduct adversary-in-the-middle (AitM) attacks. Network Access Control (NAC) & 802.1X Perimeter Bypass: * Many corporate 802.1X wired and wireless network architectures authenticate connecting devices via machine credentials (e.g., PEAP-MSCHAPv2) or machine certificates linked to domain computer accounts. * An attacker connected to an untrusted switch port, guest network, or rogue access point can create a machine account, complete 802.1X machine authentication, and gain unrestricted network placement into internal corporate workstation or server VLANs. Shadow Credentials (`msDS-KeyCredentialLink`) & Evasive Persistence: * Because the creator possesses owner permissions on the newly created machine account, an attacker can write to the msDS-KeyCredentialLink attribute to configure public-key credentials (PKINIT). The attacker can then request Kerberos TGTs at will, maintaining persistent directory access without ever modifying the machine's password or triggering password rotation alarms. * Machine accounts automatically join the Domain Computers global group, granting them persistent ambient access to read Active Directory LDAP partitions, SYSVOL and Netlogon shares, Group Policy Objects, and any internal resources open to domain members. Historical Precedent: sAMAccountName Spoofing (noPac / CVE-2021-42278 & CVE-2021-42287): * The noPac exploit demonstrated how unprivileged computer creation is weaponized: attackers created a computer account, stripped the trailing $, obtained a TGT, renamed the account to match a Domain Controller, and requested a service ticket via S4U2self to impersonate the DC. While specific CVEs are patched, setting ms-DS-MachineAccountQuota to 0 eliminates the fundamental entry point for any future exploit chain that relies on creating arbitrary machine objects. Restricting this behavior by setting ms-DS-MachineAccountQuota to 0 and removing Authenticated Users from the SeMachineAccountPrivilege ("Add workstations to domain") user right ensures that only authorized administrators and dedicated provisioning systems can introduce computer objects into the directory. Option A: Active Directory Administrative Center & GPMC (Preferred) Step 1: Set ms-DS-MachineAccountQuota to 0 Log on to a Domain Controller or administrative host with Domain Admins credentials. Open Active Directory Users and Computers (dsa.msc). Click View in the top menu and ensure Advanced Features is checked. Right-click the root domain object (e.g., domain.local) and select Properties. Navigate to the Attribute Editor tab. Scroll down to select the ms-DS-MachineAccountQuota attribute and click Edit. Change the value to 0 and click OK. Click Apply and then OK. Step 2: Restrict 'Add workstations to domain' GPO Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the Default Domain Controllers Policy or another GPO applying to all Domain Controllers. Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Locate the policy Add workstations to domain. Double-click the policy, check Define these policy settings, and ensure that only authorized administrative groups (e.g., Administrators) are added. Remove Authenticated Users. Click Apply and then OK. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts to audit and remediate these settings. 1. Local Audit (Audit-MachineAccountQuota.ps1) Download Script: Audit-MachineAccountQuota.ps1 # Audit-MachineAccountQuota.ps1 # Description: Audits the domain-wide machine account quota attribute and local Add workstations to domain user right assignment. Import-Module ActiveDirectory Write-Host "--- Auditing Machine Account Quota Settings ---" -ForegroundColor Cyan # 1. Audit domain-wide ms-DS-MachineAccountQuota try { $Domain = Get-ADDomain -ErrorAction Stop $Quota = $Domain.MachineAccountQuota if ($Quota -ne 0) { Write-Host "VULNERABLE: Domain-wide ms-DS-MachineAccountQuota is set to $($Quota) (should be 0)." -ForegroundColor Red } else { Write-Host "Status: Compliant. Domain-wide ms-DS-MachineAccountQuota is set to 0." -ForegroundColor Green } } catch { Write-Host "VULNERABLE: Could not audit ms-DS-MachineAccountQuota. Error: $($_.Exception.Message)" -ForegroundColor Red } # 2. Audit local User Rights Assignment for SeMachineAccountPrivilege try { $SecCfg = "$($env:temp)\auditpolicy.inf" secedit /export /cfg $SecCfg /quiet if (Test-Path $SecCfg) { $cfgContent = Get-Content -Path $SecCfg $privilege = $cfgContent | Where-Object { $_ -like "SeMachineAccountPrivilege*" } if ($privilege) { $parts = $privilege -split "=" if ($parts.Count -eq 2) { $value = $parts[1].Trim() if ($value -eq "*S-1-5-32-544") { Write-Host "Status: Compliant. SeMachineAccountPrivilege is restricted to Administrators." -ForegroundColor Green } elseif ($value -eq "") { Write-Host "Status: Compliant. SeMachineAccountPrivilege is empty (no one has the privilege)." -ForegroundColor Green } else { Write-Host "VULNERABLE: SeMachineAccountPrivilege is assigned to: $($value) (should be restricted to Administrators or empty)." -ForegroundColor Red } } else { Write-Host "VULNERABLE: Could not parse SeMachineAccountPrivilege line: $($privilege)" -ForegroundColor Red } } else { Write-Host "VULNERABLE: SeMachineAccountPrivilege line not defined in exported local policy (defaults to Authenticated Users)." -ForegroundColor Red } Remove-Item -Path $SecCfg -Force } else { Write-Host "VULNERABLE: Could not export local security policy database using secedit." -ForegroundColor Red } } catch { Write-Host "VULNERABLE: Could not audit SeMachineAccountPrivilege. Error: $($_.Exception.Message)" -ForegroundColor Red } 2. Local Remediation (Set-MachineAccountQuota.ps1) Download Script: Set-MachineAccountQuota.ps1 # Set-MachineAccountQuota.ps1 # Description: Sets the domain-wide machine account quota to 0 and restricts the local Add workstations to domain user right to Administrators. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Disable Machine Account Quota..." -ForegroundColor Cyan # 1. Remediate domain-wide ms-DS-MachineAccountQuota try { $Domain = Get-ADDomain -ErrorAction Stop if ($Domain.MachineAccountQuota -ne 0) { Set-ADDomain -Identity $Domain.DistinguishedName -Replace @{ "ms-DS-MachineAccountQuota" = 0 } -ErrorAction Stop Write-Host "[+] Domain-wide ms-DS-MachineAccountQuota successfully set to 0." -ForegroundColor Green } else { Write-Host "[-] Domain-wide ms-DS-MachineAccountQuota is already set to 0." -ForegroundColor Yellow } } catch { Write-Error "Failed to set ms-DS-MachineAccountQuota. Error: $($_.Exception.Message)" } # 2. Remediate local User Rights Assignment (SeMachineAccountPrivilege) try { $SecDb = "$($env:temp)\localpolicy.sdb" $SecCfg = "$($env:temp)\localpolicy.inf" # Export current security policy secedit /export /cfg $SecCfg /quiet if (Test-Path $SecCfg) { $cfgContent = Get-Content -Path $SecCfg $newCfg = New-Object System.Collections.Generic.List[string] $hasPrivilege = $false foreach ($line in $cfgContent) { if ($line -like "SeMachineAccountPrivilege*") { $line = "SeMachineAccountPrivilege = *S-1-5-32-544" $hasPrivilege = $true } $newCfg.Add($line) | Out-Null } if (-not $hasPrivilege) { # Add to [Privilege Rights] section $privIndex = $newCfg.IndexOf("[Privilege Rights]") if ($privIndex -ge 0) { $newCfg.Insert($privIndex + 1, "SeMachineAccountPrivilege = *S-1-5-32-544") } else { # Fallback: append section and value $newCfg.Add("[Privilege Rights]") | Out-Null $newCfg.Add("SeMachineAccountPrivilege = *S-1-5-32-544") | Out-Null } } # Save updated configuration $newCfg | Set-Content -Path $SecCfg # Configure local security policy secedit /configure /db $SecDb /cfg $SecCfg /areas USER_RIGHTS /quiet # Cleanup temporary files Remove-Item -Path $SecCfg -Force Remove-Item -Path $SecDb -Force Write-Host "[+] Local User Rights Assignment SeMachineAccountPrivilege successfully restricted to Administrators (*S-1-5-32-544)." -ForegroundColor Green } else { Write-Error "Failed to export local security policy for remediation." } } catch { Write-Error "Failed to configure SeMachineAccountPrivilege. Error: $($_.Exception.Message)" } # Set-MachineAccountQuota.ps1 # Description: Sets the domain-wide machine account quota to 0 and restricts the local Add workstations to domain user right to Administrators. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Disable Machine Account Quota..." -ForegroundColor Cyan # 1. Remediate domain-wide ms-DS-MachineAccountQuota try { $Domain = Get-ADDomain -ErrorAction Stop if ($Domain.MachineAccountQuota -ne 0) { Set-ADDomain -Identity $Domain.DistinguishedName -Replace @{ "ms-DS-MachineAccountQuota" = 0 } -ErrorAction Stop Write-Host "[+] Domain-wide ms-DS-MachineAccountQuota successfully set to 0." -ForegroundColor Green } else { Write-Host "[-] Domain-wide ms-DS-MachineAccountQuota is already set to 0." -ForegroundColor Yellow } } catch { Write-Error "Failed to set ms-DS-MachineAccountQuota. Error: $($_.Exception.Message)" } # 2. Remediate local User Rights Assignment (SeMachineAccountPrivilege) try { $SecDb = "$($env:temp)\localpolicy.sdb" $SecCfg = "$($env:temp)\localpolicy.inf" # Export current security policy secedit /export /cfg $SecCfg /quiet if (Test-Path $SecCfg) { $cfgContent = Get-Content -Path $SecCfg $newCfg = New-Object System.Collections.Generic.List[string] $hasPrivilege = $false foreach ($line in $cfgContent) { if ($line -like "SeMachineAccountPrivilege*") { $line = "SeMachineAccountPrivilege = *S-1-5-32-544" $hasPrivilege = $true } $newCfg.Add($line) | Out-Null } if (-not $hasPrivilege) { # Add to [Privilege Rights] section $privIndex = $newCfg.IndexOf("[Privilege Rights]") if ($privIndex -ge 0) { $newCfg.Insert($privIndex + 1, "SeMachineAccountPrivilege = *S-1-5-32-544") } else { # Fallback: append section and value $newCfg.Add("[Privilege Rights]") | Out-Null $newCfg.Add("SeMachineAccountPrivilege = *S-1-5-32-544") | Out-Null } } # Save updated configuration $newCfg | Set-Content -Path $SecCfg # Configure local security policy secedit /configure /db $SecDb /cfg $SecCfg /areas USER_RIGHTS /quiet # Cleanup temporary files Remove-Item -Path $SecCfg -Force Remove-Item -Path $SecDb -Force Write-Host "[+] Local User Rights Assignment SeMachineAccountPrivilege successfully restricted to Administrators (*S-1-5-32-544)." -ForegroundColor Green } else { Write-Error "Failed to export local security policy for remediation." } } catch { Write-Error "Failed to configure SeMachineAccountPrivilege. Error: $($_.Exception.Message)" } Target Scope: Applicable Systems: Domain Controllers, Domain Environment Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 03-identities-services/restrict-pre-windows-2000-compatible-access-group.md The "Pre-Windows 2000 Compatible Access" group (SID: S-1-5-32-554) is a legacy Active Directory security group designed to provide backward compatibility for NT4-era operating systems. By default, this group has broad read permissions to all user and group object attributes within the domain. Historically, groups like "Everyone" (S-1-1-0), "Anonymous Logon" (S-1-5-7), or "Authenticated Users" (S-1-5-11) were added to this group to maintain compatibility. The security risks include: Information Enumeration: Any authenticated user (or an unauthenticated attacker via anonymous/everyone permissions) can query the Active Directory database to enumerate user lists, group memberships, trust details, and account metadata. Reconnaissance Surface: Attackers use null-sessions or low-privileged domain accounts to profile the entire AD infrastructure, mapping target groups (like Domain Admins) and identifying service accounts for targeted attacks like Kerberoasting. Implicit Trust Abuse: Relying on legacy broad-read access bypasses modern Active Directory object-level Access Control List (ACL) restrictions. Removing insecure principals from this group and enforcing anonymous access restrictions restricts AD object access to authenticated, authorized accounts only. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Restrict Group Membership Open the Group Policy Management Console (gpmc.msc) on a management host. Create or edit a GPO linked to the Domain Controllers OU (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups Right-click Restricted Groups and select Add Group.... Type Pre-Windows 2000 Compatible Access and click OK. In the group properties dialog, under Members of this group, ensure the list is empty (or contains only authorized service accounts/CA computer accounts). Ensure Everyone, Anonymous Logon, and Authenticated Users are not listed. Click Apply and then OK. Step 2: Configure Supporting Anonymous Access Policies In the same GPO, navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Policy*: Network access: Let Everyone permissions apply to anonymous users Setting*: Disabled Policy*: Network access: Do not allow anonymous enumeration of SAM accounts and shares Setting*: Enabled Policy*: Network access: Do not allow anonymous enumeration of SAM accounts Setting*: Enabled Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts to audit and remediate these configurations. 1. Local Audit (Audit-PreWin2000Group.ps1) Download Script: Audit-PreWin2000Group.ps1 # Audit-PreWin2000Group.ps1 # Description: Audits the Pre-Windows 2000 Compatible Access group membership and local LSA registry configurations. Import-Module ActiveDirectory Write-Host "--- Auditing Pre-Windows 2000 Compatible Access Settings ---" -ForegroundColor Cyan $GroupSid = "S-1-5-32-554" $CriticalNonCompliantSids = @("S-1-1-0", "S-1-5-7") # Everyone, Anonymous Logon $RestrictedNonCompliantSids = @("S-1-5-11") # Authenticated Users (default in modern systems, high legacy impact if removed) $Vulnerable = $false $HasWarning = $false # 1. Audit Group Membership try { $Group = Get-ADGroup -Identity $GroupSid -Properties Members -ErrorAction Stop $MembersSids = New-Object System.Collections.Generic.List[string] foreach ($MemberDN in $Group.Members) { $MemberObj = Get-ADObject -Identity $MemberDN -ErrorAction SilentlyContinue if ($null -ne $MemberObj) { $MembersSids.Add($MemberObj.SID.Value) | Out-Null } } # Check for Critical SIDs (Everyone, Anonymous Logon) foreach ($Sid in $CriticalNonCompliantSids) { if ($MembersSids.Contains($Sid)) { $Vulnerable = $true $Name = "" if ($Sid -eq "S-1-1-0") { $Name = "Everyone" } elseif ($Sid -eq "S-1-5-7") { $Name = "Anonymous Logon" } Write-Host "VULNERABLE: '$($Name)' ($($Sid)) is a member of the Pre-Windows 2000 Compatible Access group." -ForegroundColor Red } } # Check for Authenticated Users (High legacy impact warning) foreach ($Sid in $RestrictedNonCompliantSids) { if ($MembersSids.Contains($Sid)) { $HasWarning = $true Write-Host "WARNING: 'Authenticated Users' ($($Sid)) is a member of the Pre-Windows 2000 Compatible Access group. (This is default in modern systems; remove with caution)." -ForegroundColor Yellow } } if (-not $Vulnerable -and -not $HasWarning) { Write-Host "Status: Compliant. Pre-Windows 2000 Compatible Access group membership is restricted." -ForegroundColor Green } elseif (-not $Vulnerable) { Write-Host "Status: Compliant (with warnings). Critical groups are removed, but legacy/default Authenticated Users remains." -ForegroundColor Green } } catch { Write-Host "VULNERABLE: Could not query Pre-Windows 2000 Compatible Access group membership. Error: $($_.Exception.Message)" -ForegroundColor Red } # 2. Audit LSA Registry Security Settings $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" $Settings = @{ "EveryoneIncludesAnonymous" = 0 "RestrictAnonymous" = 1 "RestrictAnonymousSAM" = 1 } foreach ($Key in $Settings.Keys) { try { if (Test-Path $LsaPath) { $Value = Get-ItemPropertyValue -Path $LsaPath -Name $Key -ErrorAction Stop $TargetValue = $Settings[$Key] if ($Value -ne $TargetValue) { Write-Host "VULNERABLE: LSA Registry Key '$($Key)' is set to $($Value) (should be $($TargetValue))." -ForegroundColor Red } else { Write-Host "Status: Compliant. LSA Registry Key '$($Key)' is set to $($TargetValue)." -ForegroundColor Green } } else { Write-Host "VULNERABLE: LSA registry path does not exist." -ForegroundColor Red } } catch { Write-Host "VULNERABLE: Could not audit LSA key '$($Key)'. Error: $($_.Exception.Message)" -ForegroundColor Red } } 2. Local Remediation (Set-PreWin2000Group.ps1) Download Script: Set-PreWin2000Group.ps1 # Set-PreWin2000Group.ps1 # Description: Restricts Pre-Windows 2000 Compatible Access group membership and configures LSA registry security keys. Import-Module ActiveDirectory # Configuration Switch: Set to $true if you want to remove 'Authenticated Users' (S-1-5-11). # WARNING: Removing Authenticated Users can break legacy Samba/SSSD clients, Cisco ISE, and other querying integrations. $RemoveAuthenticatedUsers = $false Write-Host "Applying hardening requirement: Restrict Pre-Windows 2000 Compatible Access..." -ForegroundColor Cyan $GroupSid = "S-1-5-32-554" $NonCompliantSids = @("S-1-1-0", "S-1-5-7") # Critical SIDs to remove (Everyone, Anonymous Logon) if ($RemoveAuthenticatedUsers) { $NonCompliantSids += "S-1-5-11" # Add Authenticated Users to the removal list } # 1. Remediate Group Membership try { $Group = Get-ADGroup -Identity $GroupSid -Properties Members -ErrorAction Stop $MembersToRemove = New-Object System.Collections.Generic.List[string] foreach ($MemberDN in $Group.Members) { $MemberObj = Get-ADObject -Identity $MemberDN -ErrorAction SilentlyContinue if ($null -ne $MemberObj) { $Sid = $MemberObj.SID.Value if ($NonCompliantSids -contains $Sid) { $MembersToRemove.Add($MemberDN) | Out-Null } } } if ($MembersToRemove.Count -gt 0) { foreach ($MemberDN in $MembersToRemove) { try { Remove-ADGroupMember -Identity $GroupSid -Members $MemberDN -Confirm:$false -ErrorAction Stop Write-Host "[+] Successfully removed '$($MemberDN)' from the group." -ForegroundColor Green } catch { Write-Host "[-] Failed to remove '$($MemberDN)'. Error: $($_.Exception.Message)" -ForegroundColor Red } } } else { Write-Host "[-] No non-compliant members found in Pre-Windows 2000 Compatible Access group." -ForegroundColor Yellow } } catch { Write-Error "Failed to remediate Pre-Windows 2000 Compatible Access group membership. Error: $($_.Exception.Message)" } # 2. Remediate LSA Registry Settings $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" $Settings = @{ "EveryoneIncludesAnonymous" = 0 "RestrictAnonymous" = 1 "RestrictAnonymousSAM" = 1 } foreach ($Key in $Settings.Keys) { try { if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } $TargetValue = $Settings[$Key] Set-ItemProperty -Path $LsaPath -Name $Key -Value $TargetValue -Type DWord -ErrorAction Stop Write-Host "[+] Registry Key '$($Key)' successfully set to $($TargetValue)." -ForegroundColor Green } catch { Write-Error "Failed to apply LSA Registry Key '$($Key)'. Error: $($_.Exception.Message)" } } # Set-PreWin2000Group.ps1 # Description: Restricts Pre-Windows 2000 Compatible Access group membership and configures LSA registry security keys. Import-Module ActiveDirectory # Configuration Switch: Set to $true if you want to remove 'Authenticated Users' (S-1-5-11). # WARNING: Removing Authenticated Users can break legacy Samba/SSSD clients, Cisco ISE, and other querying integrations. $RemoveAuthenticatedUsers = $false Write-Host "Applying hardening requirement: Restrict Pre-Windows 2000 Compatible Access..." -ForegroundColor Cyan $GroupSid = "S-1-5-32-554" $NonCompliantSids = @("S-1-1-0", "S-1-5-7") # Critical SIDs to remove (Everyone, Anonymous Logon) if ($RemoveAuthenticatedUsers) { $NonCompliantSids += "S-1-5-11" # Add Authenticated Users to the removal list } # 1. Remediate Group Membership try { $Group = Get-ADGroup -Identity $GroupSid -Properties Members -ErrorAction Stop $MembersToRemove = New-Object System.Collections.Generic.List[string] foreach ($MemberDN in $Group.Members) { $MemberObj = Get-ADObject -Identity $MemberDN -ErrorAction SilentlyContinue if ($null -ne $MemberObj) { $Sid = $MemberObj.SID.Value if ($NonCompliantSids -contains $Sid) { $MembersToRemove.Add($MemberDN) | Out-Null } } } if ($MembersToRemove.Count -gt 0) { foreach ($MemberDN in $MembersToRemove) { try { Remove-ADGroupMember -Identity $GroupSid -Members $MemberDN -Confirm:$false -ErrorAction Stop Write-Host "[+] Successfully removed '$($MemberDN)' from the group." -ForegroundColor Green } catch { Write-Host "[-] Failed to remove '$($MemberDN)'. Error: $($_.Exception.Message)" -ForegroundColor Red } } } else { Write-Host "[-] No non-compliant members found in Pre-Windows 2000 Compatible Access group." -ForegroundColor Yellow } } catch { Write-Error "Failed to remediate Pre-Windows 2000 Compatible Access group membership. Error: $($_.Exception.Message)" } # 2. Remediate LSA Registry Settings $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" $Settings = @{ "EveryoneIncludesAnonymous" = 0 "RestrictAnonymous" = 1 "RestrictAnonymousSAM" = 1 } foreach ($Key in $Settings.Keys) { try { if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } $TargetValue = $Settings[$Key] Set-ItemProperty -Path $LsaPath -Name $Key -Value $TargetValue -Type DWord -ErrorAction Stop Write-Host "[+] Registry Key '$($Key)' successfully set to $($TargetValue)." -ForegroundColor Green } catch { Write-Error "Failed to apply LSA Registry Key '$($Key)'. Error: $($_.Exception.Message)" } } Target Scope: Applicable Systems: Active Directory Domain Services (AD DS) user accounts, Domain Controllers Operating Systems: Windows Server 2016 (and above) File Path: 03-identities-services/enforce-smartcard-privileged-users.md Enforcing smart card authentication on privileged accounts significantly mitigates the risk of credential theft, lateral movement, and offline password cracking: Hash and Password Extraction Prevention: By checking "Smart card is required for interactive logon" on an Active Directory user account, AD automatically rotates the account's password to a cryptographically strong, random 120-character string that is unknown to the user. This effectively invalidates the traditional NTHash and LMHash authentication methods, preventing attackers from performing password-spraying or brute-force attacks against administrative logins. Replay and Relay Mitigation: Password-based authentication relies on credentials that can be captured, logged, or relay-attacked. Using smart cards (or physical tokens like YubiKeys) shifts authentication to Kerberos PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). This protocol relies on private keys stored in the card's secure hardware element, ensuring credentials cannot be copied or replayed. Physical Presence Factor: Combining a hardware token (something you have) and a PIN (something you know) establishes true multi-factor authentication (MFA) for administrative activities, preventing unauthorized access by remote network attackers who have compromised a password. Option A: Active Directory Administrative Tools (Preferred) To configure smart card requirement for individual privileged users or OUs: 1. Open Active Directory Users and Computers (dsa.msc) on a domain controller or administrative host. 2. Navigate to the Organizational Unit (OU) containing your administrative users. 3. Right-click the target administrator account and select Properties. 4. Click on the Account tab. 5. In the Account options window, scroll down and check the box: Smart card is required for interactive logon. 6. Click Apply and then OK. Alternatively, you can select multiple users at once, right-click, select Properties, click the Account tab, select the check box next to Smart card is required for interactive logon under Account options, and click OK to apply the policy in batch. Option B: PowerShell Script (Remediation / Automation) Use these scripts locally on a Domain Controller or a management machine with Active Directory administrative tools installed to enforce or audit the smart card requirement. Download Script: Configure-PrivilegedSmartCard.ps1 # Configure-PrivilegedSmartCard.ps1 # Description: Enforces the 'Smart card is required for interactive logon' flag on a specified user group. # Target Engine: Windows PowerShell 5.1 Write-Host "Applying smart card logon requirement to administrative accounts..." -ForegroundColor Cyan if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Error "ActiveDirectory PowerShell module is not available. Please run this script on a system with AD DS RSAT tools." exit 1 } Import-Module ActiveDirectory $GroupName = "Tier0_Administrators" $Group = Get-ADGroup -Filter "Name -eq '$GroupName'" if (-not $Group) { Write-Host "Group $GroupName not found. Defaulting to Domain Admins..." -ForegroundColor Yellow $GroupName = "Domain Admins" } $Members = Get-ADGroupMember -Identity $GroupName -Recursive | Where-Object { $_.objectClass -eq "user" } if (-not $Members) { Write-Host "No users found in group $GroupName." -ForegroundColor Yellow exit 0 } foreach ($Member in $Members) { $User = Get-ADUser -Identity $Member.distinguishedName -Properties SmartcardRequired if (-not $User.SmartcardRequired) { Write-Host "Enforcing smart card requirement for user: $($User.SamAccountName)" -ForegroundColor Cyan Set-ADUser -Identity $User.distinguishedName -SmartcardRequired $true } else { Write-Host "User $($User.SamAccountName) already requires smart card." -ForegroundColor Green } } Write-Host "Smart card requirement configuration complete." -ForegroundColor Green To audit the smart card requirement on privileged users: Download Script: Test-PrivilegedSmartCard.ps1 # Test-PrivilegedSmartCard.ps1 # Description: Audits if all members of the specified administrative group require smart card for logon. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Auditing Privileged User Smart Card Requirements ---" -ForegroundColor Cyan if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Warning "ActiveDirectory PowerShell module is not available. Please install RSAT AD DS tools." exit 0 } Import-Module ActiveDirectory $GroupName = "Tier0_Administrators" $Group = Get-ADGroup -Filter "Name -eq '$GroupName'" if (-not $Group) { Write-Host "Group $GroupName not found. Defaulting audit to Domain Admins..." -ForegroundColor Yellow $GroupName = "Domain Admins" } $Vulnerable = $false $Members = Get-ADGroupMember -Identity $GroupName -Recursive | Where-Object { $_.objectClass -eq "user" } if (-not $Members) { Write-Host "No users found in group $GroupName to audit." -ForegroundColor Yellow } else { foreach ($Member in $Members) { $User = Get-ADUser -Identity $Member.distinguishedName -Properties SmartcardRequired if (-not $User.SmartcardRequired) { Write-Host " - User: $($User.SamAccountName) | Actual: Password Allowed (Expected: Smart Card Required)" -ForegroundColor Red $Vulnerable = $true } else { Write-Host " - User: $($User.SamAccountName) | Actual: Smart Card Required (Expected: Smart Card Required)" -ForegroundColor Green } } } if ($Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-PrivilegedSmartCard.ps1 # Description: Enforces the 'Smart card is required for interactive logon' flag on a specified user group. # Target Engine: Windows PowerShell 5.1 Write-Host "Applying smart card logon requirement to administrative accounts..." -ForegroundColor Cyan if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Error "ActiveDirectory PowerShell module is not available. Please run this script on a system with AD DS RSAT tools." exit 1 } Import-Module ActiveDirectory $GroupName = "Tier0_Administrators" $Group = Get-ADGroup -Filter "Name -eq '$GroupName'" if (-not $Group) { Write-Host "Group $GroupName not found. Defaulting to Domain Admins..." -ForegroundColor Yellow $GroupName = "Domain Admins" } $Members = Get-ADGroupMember -Identity $GroupName -Recursive | Where-Object { $_.objectClass -eq "user" } if (-not $Members) { Write-Host "No users found in group $GroupName." -ForegroundColor Yellow exit 0 } foreach ($Member in $Members) { $User = Get-ADUser -Identity $Member.distinguishedName -Properties SmartcardRequired if (-not $User.SmartcardRequired) { Write-Host "Enforcing smart card requirement for user: $($User.SamAccountName)" -ForegroundColor Cyan Set-ADUser -Identity $User.distinguishedName -SmartcardRequired $true } else { Write-Host "User $($User.SamAccountName) already requires smart card." -ForegroundColor Green } } Write-Host "Smart card requirement configuration complete." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 File Path: 03-identities-services/cleanup-gpp-sysvol-passwords.md Historically, administrators utilized Group Policy Preferences (GPP) to automate account creation, service configurations, drive mappings, and local administrator password rotations. When credentials were saved within a GPP, the password was stored as an encrypted string under the cpassword attribute in XML configuration files (e.g., Groups.xml, Services.xml, ScheduledTasks.xml) inside the domain-wide SYSVOL share. Although Microsoft encrypted the password with AES-256, the static AES decryption key was published on MSDN. Because any authenticated user (or trust) has read access to the SYSVOL share, any domain user can read the preference XML files, extract the cpassword value, and decrypt it to obtain cleartext credentials. Microsoft patched this vulnerability in May 2014 via MS14-025 (KB2962486), which blocks the Group Policy Management Console (GPMC) from creating or updating policies that contain password fields. However, the patch does not delete existing GPP XML files with passwords from SYSVOL. Consequently, legacy preferences with encrypted credentials remain in the SYSVOL directory and continue to be a primary target for adversary credential harvesting. Additionally, administrators historically deployed custom login or management scripts (e.g., .vbs, .bat, .cmd, .ps1) in SYSVOL with cleartext passwords hardcoded. These must also be identified and purged. Option A: Active Directory Group Policy Management (GUI) To manually locate and clean up credential fields: 1. Open the Group Policy Management Console (gpmc.msc) on a management server. 2. Review all active GPOs that configure Preferences (specifically under Computer Configuration or User Configuration -> Preferences -> Control Panel Settings -> Local Users and Groups, Scheduled Tasks, or Services). 3. If an active policy contains an account configuration with a password, recreate the policy option without specifying credentials (use LAPS or gMSA as alternatives). 4. For any GPOs no longer in use, delete them using GPMC to clean up their folders from the SYSVOL directory. Option B: PowerShell & Remediation (Non-GPO / Script-based) Use these scripts to scan and automatically remediate GPP configuration files in the SYSVOL share. Download Script: Remove-GPPSYSVOLPasswords.ps1 # Remove-GPPSYSVOLPasswords.ps1 # Description: Removes cpassword attributes from Group Policy Preference XML files in SYSVOL and backs up original files. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Remediation: Cleaning Up GPP cpassword Credentials in SYSVOL ---" -ForegroundColor Cyan # Retrieve local SYSVOL path from registry $SysvolReg = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "Sysvol" -ErrorAction SilentlyContinue if (-not $SysvolReg) { Write-Host "[*] SYSVOL registry path not found. Checking standard share path..." -ForegroundColor Yellow $SysvolPath = "C:\Windows\SYSVOL\sysvol" } else { $SysvolPath = $SysvolReg.Sysvol } if (-not (Test-Path -Path $SysvolPath)) { Write-Host "[-] SYSVOL folder not found at path: $SysvolPath. Nothing to remediate." -ForegroundColor Red exit 0 } # 1. Scan and remediate GPP XML files $GppXmls = Get-ChildItem -Path $SysvolPath -Filter *.xml -Recurse -File -ErrorAction SilentlyContinue foreach ($file in $GppXmls) { $content = Get-Content -Path $file.FullName -Raw -ErrorAction SilentlyContinue if ($content -and $content.Contains("cpassword")) { Write-Host "[*] Found GPP file with cpassword: $($file.FullName)" -ForegroundColor Yellow # Create Backup $Timestamp = Get-Date -Format "yyyyMMddHHmmss" $BackupPath = "$($file.FullName).bak_$Timestamp" Copy-Item -Path $file.FullName -Destination $BackupPath -Force -ErrorAction SilentlyContinue Write-Host " [+] Created backup at: $BackupPath" -ForegroundColor Gray # Load XML [xml]$xml = New-Object System.Xml.XmlDocument try { $xml.Load($file.FullName) # Find all elements with cpassword attribute using XPath $Nodes = $xml.SelectNodes("//*[@cpassword]") if ($Nodes.Count -gt 0) { foreach ($Node in $Nodes) { Write-Host " [+] Stripping cpassword attribute from XML node: $($Node.Name)" -ForegroundColor White $Node.RemoveAttribute("cpassword") # If username exists, log it to help administrator identify what was affected if ($Node.Attributes["username"]) { Write-Host " [!] Note: Node was configured for username '$($Node.Attributes["username"].Value)'" -ForegroundColor Yellow } } $xml.Save($file.FullName) Write-Host " [+] Successfully stripped cpassword from: $($file.FullName)" -ForegroundColor Green } } catch { Write-Host " [-] Failed to parse or save XML: $($_.Exception.Message)" -ForegroundColor Red } } } # 2. Alert for scripts (Do not auto-remediate script files to prevent code syntax breakage) $ScriptFiles = Get-ChildItem -Path $SysvolPath -Include *.vbs, *.ps1, *.bat, *.cmd -Recurse -File -ErrorAction SilentlyContinue $CredentialPattern = '(?i)\b(password|pwd|adminpwd|syspwd|adminpassword|localadminpwd)\s*=\s*["''][^"'']+\b' foreach ($file in $ScriptFiles) { # Skip our own audit and implementation scripts if ($file.Name -like "*Get-GPPSYSVOLPasswords*" -or $file.Name -like "*Remove-GPPSYSVOLPasswords*" -or $file.Name -like "*SYSVOLHoneypot*") { continue } $content = Get-Content -Path $file.FullName -Raw -ErrorAction SilentlyContinue if ($content -and $content -match $CredentialPattern) { Write-Host "[WARNING] Script contains hardcoded credential pattern: $($file.FullName)" -ForegroundColor Red Write-Host " Manual intervention is required. Review and delete/rotate credentials in this script." -ForegroundColor Yellow } } Write-Host "[+] SYSVOL password remediation processing completed." -ForegroundColor Green To verify that no cpassword files or cleartext script credentials exist in SYSVOL: Download Script: Get-GPPSYSVOLPasswords.ps1 # Get-GPPSYSVOLPasswords.ps1 # Description: Audits the SYSVOL directory for legacy Group Policy Preference files containing cpassword values and scripts containing cleartext credentials. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Auditing SYSVOL for Group Policy Preference and Script Passwords ---" -ForegroundColor Cyan $script:Vulnerable = $false # Retrieve local SYSVOL path from registry $SysvolReg = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "Sysvol" -ErrorAction SilentlyContinue if (-not $SysvolReg) { Write-Host "[*] SYSVOL registry path not found. Checking standard share path..." -ForegroundColor Yellow $SysvolPath = "C:\Windows\SYSVOL\sysvol" } else { $SysvolPath = $SysvolReg.Sysvol } if (-not (Test-Path -Path $SysvolPath)) { Write-Host "[-] SYSVOL folder not found at path: $SysvolPath" -ForegroundColor Red exit 0 # Not a Domain Controller or SYSVOL not configured, nothing to audit } Write-Host "[*] Scanning SYSVOL directory: $SysvolPath" -ForegroundColor White # 1. Scan for XML files containing 'cpassword' $GppXmls = Get-ChildItem -Path $SysvolPath -Filter *.xml -Recurse -File -ErrorAction SilentlyContinue foreach ($file in $GppXmls) { # Read the file content safely $content = Get-Content -Path $file.FullName -Raw -ErrorAction SilentlyContinue if ($content -and $content.Contains("cpassword")) { Write-Host "[!] VULNERABLE: Group Policy Preference file contains cpassword attribute: $($file.FullName)" -ForegroundColor Red $script:Vulnerable = $true } } # 2. Scan for script files containing cleartext credentials # Scripts: .vbs, .ps1, .bat, .cmd $ScriptFiles = Get-ChildItem -Path $SysvolPath -Include *.vbs, *.ps1, *.bat, *.cmd -Recurse -File -ErrorAction SilentlyContinue # Regex pattern for credentials (e.g. password=, pwd=, adminpwd=) $CredentialPattern = '(?i)\b(password|pwd|adminpwd|syspwd|adminpassword|localadminpwd)\s*=\s*["''][^"'']+\b' foreach ($file in $ScriptFiles) { # Check if the file is our own audit or implementation scripts (skip those) if ($file.Name -like "*Get-GPPSYSVOLPasswords*" -or $file.Name -like "*Remove-GPPSYSVOLPasswords*" -or $file.Name -like "*SYSVOLHoneypot*") { continue } $content = Get-Content -Path $file.FullName -Raw -ErrorAction SilentlyContinue if ($content -and $content -match $CredentialPattern) { Write-Host "[!] VULNERABLE: Script file contains potential cleartext password: $($file.FullName)" -ForegroundColor Red $script:Vulnerable = $true } } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "[+] No Group Policy Preference passwords or cleartext scripts found in SYSVOL." -ForegroundColor Green Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Remove-GPPSYSVOLPasswords.ps1 # Description: Removes cpassword attributes from Group Policy Preference XML files in SYSVOL and backs up original files. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Remediation: Cleaning Up GPP cpassword Credentials in SYSVOL ---" -ForegroundColor Cyan # Retrieve local SYSVOL path from registry $SysvolReg = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "Sysvol" -ErrorAction SilentlyContinue if (-not $SysvolReg) { Write-Host "[*] SYSVOL registry path not found. Checking standard share path..." -ForegroundColor Yellow $SysvolPath = "C:\Windows\SYSVOL\sysvol" } else { $SysvolPath = $SysvolReg.Sysvol } if (-not (Test-Path -Path $SysvolPath)) { Write-Host "[-] SYSVOL folder not found at path: $SysvolPath. Nothing to remediate." -ForegroundColor Red exit 0 } # 1. Scan and remediate GPP XML files $GppXmls = Get-ChildItem -Path $SysvolPath -Filter *.xml -Recurse -File -ErrorAction SilentlyContinue foreach ($file in $GppXmls) { $content = Get-Content -Path $file.FullName -Raw -ErrorAction SilentlyContinue if ($content -and $content.Contains("cpassword")) { Write-Host "[*] Found GPP file with cpassword: $($file.FullName)" -ForegroundColor Yellow # Create Backup $Timestamp = Get-Date -Format "yyyyMMddHHmmss" $BackupPath = "$($file.FullName).bak_$Timestamp" Copy-Item -Path $file.FullName -Destination $BackupPath -Force -ErrorAction SilentlyContinue Write-Host " [+] Created backup at: $BackupPath" -ForegroundColor Gray # Load XML [xml]$xml = New-Object System.Xml.XmlDocument try { $xml.Load($file.FullName) # Find all elements with cpassword attribute using XPath $Nodes = $xml.SelectNodes("//*[@cpassword]") if ($Nodes.Count -gt 0) { foreach ($Node in $Nodes) { Write-Host " [+] Stripping cpassword attribute from XML node: $($Node.Name)" -ForegroundColor White $Node.RemoveAttribute("cpassword") # If username exists, log it to help administrator identify what was affected if ($Node.Attributes["username"]) { Write-Host " [!] Note: Node was configured for username '$($Node.Attributes["username"].Value)'" -ForegroundColor Yellow } } $xml.Save($file.FullName) Write-Host " [+] Successfully stripped cpassword from: $($file.FullName)" -ForegroundColor Green } } catch { Write-Host " [-] Failed to parse or save XML: $($_.Exception.Message)" -ForegroundColor Red } } } # 2. Alert for scripts (Do not auto-remediate script files to prevent code syntax breakage) $ScriptFiles = Get-ChildItem -Path $SysvolPath -Include *.vbs, *.ps1, *.bat, *.cmd -Recurse -File -ErrorAction SilentlyContinue $CredentialPattern = '(?i)\b(password|pwd|adminpwd|syspwd|adminpassword|localadminpwd)\s*=\s*["''][^"'']+\b' foreach ($file in $ScriptFiles) { # Skip our own audit and implementation scripts if ($file.Name -like "*Get-GPPSYSVOLPasswords*" -or $file.Name -like "*Remove-GPPSYSVOLPasswords*" -or $file.Name -like "*SYSVOLHoneypot*") { continue } $content = Get-Content -Path $file.FullName -Raw -ErrorAction SilentlyContinue if ($content -and $content -match $CredentialPattern) { Write-Host "[WARNING] Script contains hardcoded credential pattern: $($file.FullName)" -ForegroundColor Red Write-Host " Manual intervention is required. Review and delete/rotate credentials in this script." -ForegroundColor Yellow } } Write-Host "[+] SYSVOL password remediation processing completed." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Client Workstations. Operating Systems: Windows Server 2016 (and above), Windows 10 (and above) Enterprise/Professional. File Path: 04-network-firewall/configure-ad-port-matrix.md Active Directory services require several ports to function, including DNS, Kerberos, LDAP, SMB, and RPC. If firewalls are not configured to restrict traffic to only these essential ports, adversaries can perform internal network scanning, identify open services, exploit vulnerabilities in unhardened services, or pivot across systems. Restricting network communications to the minimum required AD Port Matrix ensures: 1. Attack Surface Reduction: Unused services are blocked from receiving network connections. 2. Reconnaissance Mitigation: Internal port scanning returns blocked states, slowing down discovery. 3. Lateral Movement Containment: Compromised endpoints cannot arbitrary query services on domain controllers or other member systems. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Enforce Default Inbound Block Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the target systems (e.g., GPO_Hardening_Firewall_Baseline). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security Right-click Windows Defender Firewall with Advanced Security and select Properties. For the Domain Profile, Private Profile, and Public Profile tabs, set: State*: On (recommended) Inbound connections*: Block (default) Outbound connections*: Allow (default) 2. Create Inbound Allow Rules for the AD Port Matrix (Domain Controllers GPO) For GPOs targeting Domain Controllers, configure the following inbound rules under Inbound Rules: | Protocol | Port | Source Subnet | Description | | :--- | :--- | :--- | :--- | | TCP / UDP | 53 | Any / Client Subnets | DNS Resolution | | UDP | 123 | Any / Client Subnets | NTP Time Sync | | TCP / UDP | 88 | Any / Client Subnets | Kerberos Authentication | | TCP / UDP | 464 | Any / Client Subnets | Kerberos Password Change | | TCP / UDP | 389 | Any / Client Subnets | LDAP Directory Queries | | TCP | 636 | Any / Client Subnets | LDAPS (Secure LDAP) | | TCP | 3268 | Any / Client Subnets | Global Catalog Query | | TCP | 3269 | Any / Client Subnets | Global Catalog SSL | | TCP | 135 | Any / Client Subnets | RPC Endpoint Mapper | | TCP | 445 | Any / Client Subnets | SMB (SYSVOL / GPO) | | TCP | 38901 | Any / Client Subnets | NTDS Static RPC Port | | TCP | 38902 | Any / Client Subnets | Netlogon Static RPC Port | | TCP | 5722 | Domain Controller Subnets | DFSR Static RPC Port | | TCP | 3389 | PAW / Jump Host Subnets | RDP (Management) | | TCP | 5985 / 5986 | PAW / Jump Host Subnets | WinRM (Management) | > [!WARNING] > **Static RPC Ports Requirement**: > The NTDS (TCP 38901), Netlogon (TCP 38902), and DFSR (TCP 5722) ports listed above require static port configurations to be active on the target Domain Controllers. If these ports are not explicitly configured to be static on the operating system, remote authentication and replication will fail. See [REQ-NET-002: Restrict RPC Dynamic Ports](restrict-rpc-dynamic-ports.md) for GPO and registry configurations to bind these services to their static endpoints. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to audit and configure the firewall profiles and inbound port rules. Remediation Script: Download Script: Set-ADPortMatrixRules.ps1 # Set-ADPortMatrixRules.ps1 # Configures local Windows Defender Firewall profiles and applies basic AD port matrix baseline rules. param( [string[]]$ManagementAddresses ) # If not passed, prompt user dynamically if ($null -eq $ManagementAddresses) { if ([Environment]::UserInteractive) { $inputVal = Read-Host "Enter remote IP addresses/subnets for remote management (comma-separated, e.g. 10.0.0.0/24,192.168.1.50) [leave empty for LocalSubnet]" if ([string]::IsNullOrWhiteSpace($inputVal)) { $ManagementAddresses = @("LocalSubnet") } else { $ManagementAddresses = $inputVal.Split(",") | ForEach-Object { $_.Trim() } } } else { $ManagementAddresses = @("LocalSubnet") } } Write-Host "Applying network firewall baseline policies..." -ForegroundColor Cyan # 1. Enable firewall and set default block inbound Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled True -DefaultInboundAction Block -DefaultOutboundAction Allow Write-Host "Firewall profiles enabled with Default Inbound Block." -ForegroundColor Green # 2. Configure AD Port Matrix inbound rules (for local system role validation) $Rules = @( @{ Name = "AD-DNS-TCP"; Port = 53; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-DNS-UDP"; Port = 53; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-Kerberos-TCP"; Port = 88; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-Kerberos-UDP"; Port = 88; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-NTP-UDP"; Port = 123; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-RPC-Mapper-TCP"; Port = 135; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-LDAP-TCP"; Port = 389; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-LDAP-UDP"; Port = 389; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-SMB-TCP"; Port = 445; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-Kpwd-TCP"; Port = 464; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-Kpwd-UDP"; Port = 464; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-LDAPS-TCP"; Port = 636; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-GC-TCP"; Port = 3268; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-GC-SSL-TCP"; Port = 3269; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-NTDS-Static-TCP"; Port = 38901; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-Netlogon-Static-TCP"; Port = 38902; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-DFSR-Static-TCP"; Port = 5722; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-RDP-TCP"; Port = 3389; Proto = "TCP"; Remote = $ManagementAddresses }, @{ Name = "AD-WinRM-HTTP-TCP"; Port = 5985; Proto = "TCP"; Remote = $ManagementAddresses }, @{ Name = "AD-WinRM-HTTPS-TCP"; Port = 5986; Proto = "TCP"; Remote = $ManagementAddresses } ) foreach ($Rule in $Rules) { $Name = $Rule.Name $Port = $Rule.Port $Proto = $Rule.Proto $Remote = $Rule.Remote $Existing = Get-NetFirewallRule -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Existing) { New-NetFirewallRule -Name $Name -DisplayName $Name ` -Direction Inbound ` -Action Allow ` -Protocol $Proto ` -LocalPort $Port ` -RemoteAddress $Remote ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "Inbound rule created: $($Name) on port $($Port) ($($Proto)) from remote address: $($Remote -join ', ')" -ForegroundColor Green } else { Set-NetFirewallRule -Name $Name -Enabled True -Action Allow -RemoteAddress $Remote | Out-Null Write-Host "Inbound rule verified: $($Name) restricted to remote address: $($Remote -join ', ')" -ForegroundColor Gray } } Write-Host "Firewall port matrix configuration completed successfully." -ForegroundColor Cyan Audit Script: Download Script: Test-ADPortMatrixRules.ps1 # Test-ADPortMatrixRules.ps1 # Audits local firewall status and checks if default inbound traffic is blocked. Write-Host "Auditing local network firewall status..." -ForegroundColor Cyan # 1. Check Windows Defender Firewall State $Profiles = Get-NetFirewallProfile $AllProfilesSecure = $true foreach ($FwProfile in $Profiles) { $Enabled = $FwProfile.Enabled $InAction = $FwProfile.DefaultInboundAction if ($Enabled -eq $true -and $InAction -eq "Block") { Write-Host "Profile: $($FwProfile.Name) | Enabled: True | InboundAction: Block" -ForegroundColor Green } else { Write-Host "Profile: $($FwProfile.Name) | Enabled: $($Enabled) | InboundAction: $($InAction) (INSECURE)" -ForegroundColor Red $AllProfilesSecure = $false } } if ($AllProfilesSecure) { Write-Host "Audit Result: Firewall state configuration is compliant." -ForegroundColor Green } else { Write-Warning "Audit Result: Firewall profiles are not fully secured!" } # Set-ADPortMatrixRules.ps1 # Configures local Windows Defender Firewall profiles and applies basic AD port matrix baseline rules. param( [string[]]$ManagementAddresses ) # If not passed, prompt user dynamically if ($null -eq $ManagementAddresses) { if ([Environment]::UserInteractive) { $inputVal = Read-Host "Enter remote IP addresses/subnets for remote management (comma-separated, e.g. 10.0.0.0/24,192.168.1.50) [leave empty for LocalSubnet]" if ([string]::IsNullOrWhiteSpace($inputVal)) { $ManagementAddresses = @("LocalSubnet") } else { $ManagementAddresses = $inputVal.Split(",") | ForEach-Object { $_.Trim() } } } else { $ManagementAddresses = @("LocalSubnet") } } Write-Host "Applying network firewall baseline policies..." -ForegroundColor Cyan # 1. Enable firewall and set default block inbound Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled True -DefaultInboundAction Block -DefaultOutboundAction Allow Write-Host "Firewall profiles enabled with Default Inbound Block." -ForegroundColor Green # 2. Configure AD Port Matrix inbound rules (for local system role validation) $Rules = @( @{ Name = "AD-DNS-TCP"; Port = 53; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-DNS-UDP"; Port = 53; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-Kerberos-TCP"; Port = 88; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-Kerberos-UDP"; Port = 88; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-NTP-UDP"; Port = 123; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-RPC-Mapper-TCP"; Port = 135; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-LDAP-TCP"; Port = 389; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-LDAP-UDP"; Port = 389; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-SMB-TCP"; Port = 445; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-Kpwd-TCP"; Port = 464; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-Kpwd-UDP"; Port = 464; Proto = "UDP"; Remote = "Any" }, @{ Name = "AD-LDAPS-TCP"; Port = 636; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-GC-TCP"; Port = 3268; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-GC-SSL-TCP"; Port = 3269; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-NTDS-Static-TCP"; Port = 38901; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-Netlogon-Static-TCP"; Port = 38902; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-DFSR-Static-TCP"; Port = 5722; Proto = "TCP"; Remote = "Any" }, @{ Name = "AD-RDP-TCP"; Port = 3389; Proto = "TCP"; Remote = $ManagementAddresses }, @{ Name = "AD-WinRM-HTTP-TCP"; Port = 5985; Proto = "TCP"; Remote = $ManagementAddresses }, @{ Name = "AD-WinRM-HTTPS-TCP"; Port = 5986; Proto = "TCP"; Remote = $ManagementAddresses } ) foreach ($Rule in $Rules) { $Name = $Rule.Name $Port = $Rule.Port $Proto = $Rule.Proto $Remote = $Rule.Remote $Existing = Get-NetFirewallRule -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Existing) { New-NetFirewallRule -Name $Name -DisplayName $Name ` -Direction Inbound ` -Action Allow ` -Protocol $Proto ` -LocalPort $Port ` -RemoteAddress $Remote ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "Inbound rule created: $($Name) on port $($Port) ($($Proto)) from remote address: $($Remote -join ', ')" -ForegroundColor Green } else { Set-NetFirewallRule -Name $Name -Enabled True -Action Allow -RemoteAddress $Remote | Out-Null Write-Host "Inbound rule verified: $($Name) restricted to remote address: $($Remote -join ', ')" -ForegroundColor Gray } } Write-Host "Firewall port matrix configuration completed successfully." -ForegroundColor Cyan Target Scope: Applicable Systems: Domain Controllers, Member Servers. Operating Systems: Windows Server 2016 (and above). File Path: 04-network-firewall/restrict-rpc-dynamic-ports.md By default, the RPC runtime utilizes a massive dynamic range of high-order ports (TCP 49152-65535) for communication, including Active Directory replication, netlogon authentication, and DFS replication. Opening this entire dynamic port range in network-based firewalls for all systems exposes an unmonitored attack surface. To mitigate this risk, key domain controller services (NTDS, Netlogon, and DFSR) must be bound to dedicated static ports (TCP 38901, 38902, and 5722 respectively). This allows network administrators to configure precise firewall rules permitting only these ports. Crucially, the system-wide dynamic RPC range must NOT be narrowed (such as restricting it globally to 50000-50100). Restricting the global dynamic range introduces severe risks: 1. Port Exhaustion: Under standard server load, limiting the global ephemeral range to a small number of ports can exhaust available sockets, resulting in network failures and domain isolation outages. 2. Replication Failure: High volumes of directory transactions can exhaust localized RPC ports. 3. No Added Security Value: Narrowing the dynamic range globally does not mitigate standard exploits, and endpoints communicate with local security authority protocols (LSAD/SAMR) over SMB named pipes (\PIPE\lsass) rather than directly via dynamic TCP sockets. Therefore, the system-wide dynamic RPC port range must remain at its default start port (49152) and number of ports (16384), and any narrowing configurations must be avoided. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Define Static Ports for NTDS and Netlogon via GPO Registry Preferences Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting Domain Controllers (e.g., GPO_Hardening_DC_RPC). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Define the following Registry Items: NTDS Static Port*: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\NTDS\Parameters Value Name*: TCP/IP Port Value Type*: REG_DWORD Value Data*: 38901 (Decimal) Netlogon Static Port*: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters Value Name*: DCTcpipPort Value Type*: REG_DWORD Value Data*: 38902 (Decimal) 2. Ensure System-Wide RPC Port Narrowing is Disabled Ensure that the registry key HKLM\SOFTWARE\Microsoft\Rpc\Internet does not exist in your GPOs, as this key enforces restrictive dynamic range overrides. If present, delete the key to allow systems to fall back to the default Windows Server dynamic range (49152-65535). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure the RPC static ports and restore default dynamic ranges. Remediation Script: Download Script: Set-RPCDynamicPorts.ps1 # Set-RPCDynamicPorts.ps1 # Description: Configures static RPC ports for NTDS, Netlogon, and DFSR, and ensures system-wide dynamic RPC ranges are at default values. Write-Host "Configuring RPC dynamic port restrictions..." -ForegroundColor Cyan $IsDC = (Get-CimInstance -ClassName Win32_ComputerSystem).Roles -contains "Primary_Domain_Controller" if ($IsDC) { Write-Host "[+] Target is a Domain Controller. Configuring static ports..." -ForegroundColor Gray # NTDS Static Port -> TCP 38901 $NtdsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" if (-not (Test-Path $NtdsPath)) { New-Item -Path $NtdsPath -Force | Out-Null } Set-ItemProperty -Path $NtdsPath -Name "TCP/IP Port" -Value 38901 -Type DWord Write-Host " NTDS Static Port set to TCP 38901." -ForegroundColor Green # Netlogon Static Port -> TCP 38902 $NetlogonPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" if (-not (Test-Path $NetlogonPath)) { New-Item -Path $NetlogonPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonPath -Name "DCTcpipPort" -Value 38902 -Type DWord Write-Host " Netlogon Static Port set to TCP 38902." -ForegroundColor Green # DFSR Static Port -> TCP 5722 (if DFSR namespace is present) try { $DfsrConfig = Get-CimInstance -Namespace "root\MicrosoftDFS" -ClassName DfsrServiceConfiguration -ErrorAction Stop if ($null -ne $DfsrConfig) { Set-CimInstance -Query "Select * from DfsrServiceConfiguration" -Namespace "root\MicrosoftDFS" -Property @{ RpcPortAssignment = 5722 } -ErrorAction Stop | Out-Null Write-Host " DFSR Static Replication Port set to TCP 5722." -ForegroundColor Green } } catch { Write-Host " DFSR WMI configuration not accessible or role not installed. Skipping." -ForegroundColor Yellow } } # Ensure system-wide dynamic RPC range is at default (start=49152, num=16384) # In accordance with Microsoft Directory Services guidelines to prevent port exhaustion. Write-Host "[+] Resetting global dynamic RPC ports to default..." -ForegroundColor Gray $ProcV4 = Start-Process netsh -ArgumentList "int ipv4 set dynamicport tcp start=49152 num=16384" -Wait -NoNewWindow -PassThru if ($ProcV4.ExitCode -eq 0) { Write-Host " IPv4 Dynamic Port Range reset to default (49152-65535)." -ForegroundColor Green } else { Write-Error " Failed to reset IPv4 dynamic port range." } $ProcV6 = Start-Process netsh -ArgumentList "int ipv6 set dynamicport tcp start=49152 num=16384" -Wait -NoNewWindow -PassThru if ($ProcV6.ExitCode -eq 0) { Write-Host " IPv6 Dynamic Port Range reset to default (49152-65535)." -ForegroundColor Green } else { Write-Error " Failed to reset IPv6 dynamic port range." } # Clean HKLM\SOFTWARE\Microsoft\Rpc\Internet range narrowing if present $RpcInternetPath = "HKLM:\SOFTWARE\Microsoft\Rpc\Internet" if (Test-Path $RpcInternetPath) { Remove-Item -Path $RpcInternetPath -Force -Recurse | Out-Null Write-Host " Removed restrictive RPC Internet registry settings to restore defaults." -ForegroundColor Green } Write-Host "RPC dynamic port configuration applied successfully." -ForegroundColor Cyan Audit Script: Download Script: Test-RPCDynamicPorts.ps1 # Test-RPCDynamicPorts.ps1 # Description: Audits dynamic RPC configurations and static ports. Write-Host "Auditing dynamic RPC configurations..." -ForegroundColor Cyan $IsDC = (Get-CimInstance -ClassName Win32_ComputerSystem).Roles -contains "Primary_Domain_Controller" $vulnerable = $false if ($IsDC) { # 1. NTDS Static Port Audit $NtdsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" $NtdsVal = Get-ItemProperty -Path $NtdsPath -Name "TCP/IP Port" -ErrorAction SilentlyContinue $NtdsPort = if ($NtdsVal) { $NtdsVal."TCP/IP Port" } else { 0 } $NtdsColor = if ($NtdsPort -eq 38901) { "Green" } else { "Red"; $vulnerable = $true } Write-Host " - NTDS Static Port: $($NtdsPort) (Expected = 38901)" -ForegroundColor $NtdsColor # 2. Netlogon Static Port Audit $NetlogonPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" $NetlogonVal = Get-ItemProperty -Path $NetlogonPath -Name "DCTcpipPort" -ErrorAction SilentlyContinue $NetlogonPort = if ($NetlogonVal) { $NetlogonVal.DCTcpipPort } else { 0 } $NetlogonColor = if ($NetlogonPort -eq 38902) { "Green" } else { "Red"; $vulnerable = $true } Write-Host " - Netlogon Static Port: $($NetlogonPort) (Expected = 38902)" -ForegroundColor $NetlogonColor # 3. DFSR Port Audit try { $DfsrConfig = Get-CimInstance -Namespace "root\MicrosoftDFS" -ClassName DfsrServiceConfiguration -ErrorAction Stop if ($null -ne $DfsrConfig) { $DfsrPort = $DfsrConfig.RpcPortAssignment $DfsrColor = if ($DfsrPort -eq 5722) { "Green" } else { "Red"; $vulnerable = $true } Write-Host " - DFSR Replication Port: $($DfsrPort) (Expected = 5722)" -ForegroundColor $DfsrColor } } catch { Write-Host " - DFSR role not active or WMI inaccessible." -ForegroundColor Gray } } # 4. Global Dynamic Port Audit (Netsh query) Write-Host "[+] Querying active TCP dynamic port settings..." -ForegroundColor Yellow $IPv4Ports = netsh int ipv4 show dynamicport tcp $IPv6Ports = netsh int ipv6 show dynamicport tcp Write-Host "--- IPv4 Dynamic Port Output ---" -ForegroundColor Gray $IPv4Ports | Out-String | Write-Host -ForegroundColor DarkGray Write-Host "--- IPv6 Dynamic Port Output ---" -ForegroundColor Gray $IPv6Ports | Out-String | Write-Host -ForegroundColor DarkGray # Verify if dynamic ranges are narrowed $RpcInternetPath = "HKLM:\SOFTWARE\Microsoft\Rpc\Internet" if (Test-Path $RpcInternetPath) { Write-Host "[!] VULNERABLE: Restrictive RPC Internet registry settings found. Narrowing dynamic ranges is not recommended." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] Restrictive RPC Internet registry settings are absent." -ForegroundColor Green } if ($vulnerable) { Write-Host "Audit result: NON-COMPLIANT" -ForegroundColor Red } else { Write-Host "Audit result: COMPLIANT" -ForegroundColor Green } # Set-RPCDynamicPorts.ps1 # Description: Configures static RPC ports for NTDS, Netlogon, and DFSR, and ensures system-wide dynamic RPC ranges are at default values. Write-Host "Configuring RPC dynamic port restrictions..." -ForegroundColor Cyan $IsDC = (Get-CimInstance -ClassName Win32_ComputerSystem).Roles -contains "Primary_Domain_Controller" if ($IsDC) { Write-Host "[+] Target is a Domain Controller. Configuring static ports..." -ForegroundColor Gray # NTDS Static Port -> TCP 38901 $NtdsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" if (-not (Test-Path $NtdsPath)) { New-Item -Path $NtdsPath -Force | Out-Null } Set-ItemProperty -Path $NtdsPath -Name "TCP/IP Port" -Value 38901 -Type DWord Write-Host " NTDS Static Port set to TCP 38901." -ForegroundColor Green # Netlogon Static Port -> TCP 38902 $NetlogonPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" if (-not (Test-Path $NetlogonPath)) { New-Item -Path $NetlogonPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonPath -Name "DCTcpipPort" -Value 38902 -Type DWord Write-Host " Netlogon Static Port set to TCP 38902." -ForegroundColor Green # DFSR Static Port -> TCP 5722 (if DFSR namespace is present) try { $DfsrConfig = Get-CimInstance -Namespace "root\MicrosoftDFS" -ClassName DfsrServiceConfiguration -ErrorAction Stop if ($null -ne $DfsrConfig) { Set-CimInstance -Query "Select * from DfsrServiceConfiguration" -Namespace "root\MicrosoftDFS" -Property @{ RpcPortAssignment = 5722 } -ErrorAction Stop | Out-Null Write-Host " DFSR Static Replication Port set to TCP 5722." -ForegroundColor Green } } catch { Write-Host " DFSR WMI configuration not accessible or role not installed. Skipping." -ForegroundColor Yellow } } # Ensure system-wide dynamic RPC range is at default (start=49152, num=16384) # In accordance with Microsoft Directory Services guidelines to prevent port exhaustion. Write-Host "[+] Resetting global dynamic RPC ports to default..." -ForegroundColor Gray $ProcV4 = Start-Process netsh -ArgumentList "int ipv4 set dynamicport tcp start=49152 num=16384" -Wait -NoNewWindow -PassThru if ($ProcV4.ExitCode -eq 0) { Write-Host " IPv4 Dynamic Port Range reset to default (49152-65535)." -ForegroundColor Green } else { Write-Error " Failed to reset IPv4 dynamic port range." } $ProcV6 = Start-Process netsh -ArgumentList "int ipv6 set dynamicport tcp start=49152 num=16384" -Wait -NoNewWindow -PassThru if ($ProcV6.ExitCode -eq 0) { Write-Host " IPv6 Dynamic Port Range reset to default (49152-65535)." -ForegroundColor Green } else { Write-Error " Failed to reset IPv6 dynamic port range." } # Clean HKLM\SOFTWARE\Microsoft\Rpc\Internet range narrowing if present $RpcInternetPath = "HKLM:\SOFTWARE\Microsoft\Rpc\Internet" if (Test-Path $RpcInternetPath) { Remove-Item -Path $RpcInternetPath -Force -Recurse | Out-Null Write-Host " Removed restrictive RPC Internet registry settings to restore defaults." -ForegroundColor Green } Write-Host "RPC dynamic port configuration applied successfully." -ForegroundColor Cyan Target Scope: Applicable Systems: Tier 2 Client Workstations, Member Servers. Operating Systems: Windows Server 2016 (and above), Windows 10 (and above) Enterprise/Professional. File Path: 04-network-firewall/configure-workstation-isolation.md Once an adversary establishes initial access on a Tier 2 client workstation or a Member Server, they will attempt to move laterally across the network to identify high-value targets, harvest credentials, and locate Tier 0 administrative pathways. Lateral movement commonly relies on standard management and remote connection protocols, including SMB (TCP 445), RPC (TCP 135 and dynamic ports), RDP (TCP 3389), and WinRM (TCP 5985/5986). In a standard enterprise design, workstations do not require inbound connections from other workstations, and member servers rarely require inbound connections from peer member servers in the same tier. Configuring local firewalls via Group Policy to explicitly block inbound SMB, RPC, RDP, and WinRM traffic originating from peer subnets (while maintaining administrative exceptions from authorized management subnets and Domain Controllers) stops host-to-host lateral propagation and containment is maintained. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Configure Peer Isolation GPO Rules Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstation_Isolation) or Member Servers OU. Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security Under Inbound Rules, create new custom rules to block peer traffic: Rule 1: Block Inbound SMB from Peers*: Action*: Block the connection Protocol : `TCP` | Local Port*: 445 Remote Address*: [Insert Local Client / Peer Subnets, e.g., 10.20.0.0/16] Profile*: Domain, Private Rule 2: Block Inbound RDP from Peers*: Action*: Block the connection Protocol : `TCP` | Local Port*: 3389 Remote Address*: [Insert Local Client / Peer Subnets] Profile*: Domain, Private Rule 3: Block Inbound WinRM from Peers*: Action*: Block the connection Protocol : `TCP` | Local Port*: 5985, 5986 Remote Address*: [Insert Local Client / Peer Subnets] Profile*: Domain, Private Rule 4: Block Inbound RPC from Peers*: Action*: Block the connection Protocol : `TCP` | Local Port*: 135, 49152-65535 Remote Address*: [Insert Local Client / Peer Subnets] Profile*: Domain, Private 2. Create Management Allow Exceptions In the same GPO, ensure there are priority inbound Allow rules configured to permit administration from dedicated administrative paths: Allow Inbound Administration : Action: Allow the connection Protocol : `TCP` | Local Port : `445, 3389, 5985, 5986` Remote Address: [Insert Administrative Subnet (PAW / Jump Hosts), e.g., 10.10.0.0/24] Profile*: Domain Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to audit and apply workstation/server isolation rules. Remediation Script: Download Script: Set-WorkstationIsolation.ps1 # Set-WorkstationIsolation.ps1 # Configures local firewall rules to block inbound SMB, RPC, and RDP from peer subnets. # Allows access only from designated Domain Controller and Admin Management subnets. # Adjust subnets for your local environment $AdminSubnet = "10.10.0.0/24" # PAW / Jump Host / DC Subnet $PeerSubnet = "10.20.0.0/16" # Local client/member peer subnet Write-Host "Applying Workstation and Server Isolation Firewall Rules..." -ForegroundColor Cyan # 1. Enable firewall profiles Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled True Write-Host "All firewall profiles enabled." -ForegroundColor Green # 2. Block Inbound SMB (TCP 445) from peer subnet New-NetFirewallRule -DisplayName "Hardening: Block Inbound SMB from Peers" ` -Direction Inbound ` -Action Block ` -Protocol TCP ` -LocalPort 445 ` -RemoteAddress $PeerSubnet ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "SMB peer blocking rule created." -ForegroundColor Green # 3. Block Inbound RDP (TCP 3389) from peer subnet New-NetFirewallRule -DisplayName "Hardening: Block Inbound RDP from Peers" ` -Direction Inbound ` -Action Block ` -Protocol TCP ` -LocalPort 3389 ` -RemoteAddress $PeerSubnet ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "RDP peer blocking rule created." -ForegroundColor Green # 4. Block Inbound WinRM (TCP 5985, 5986) from peer subnet New-NetFirewallRule -DisplayName "Hardening: Block Inbound WinRM from Peers" ` -Direction Inbound ` -Action Block ` -Protocol TCP ` -LocalPort @(5985, 5986) ` -RemoteAddress $PeerSubnet ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "WinRM peer blocking rule created." -ForegroundColor Green # 5. Block Inbound RPC (TCP 135) from peer subnet New-NetFirewallRule -DisplayName "Hardening: Block Inbound RPC Mapper from Peers" ` -Direction Inbound ` -Action Block ` -Protocol TCP ` -LocalPort 135 ` -RemoteAddress $PeerSubnet ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "RPC Endpoint Mapper peer blocking rule created." -ForegroundColor Green # 6. Allow Inbound Administration from Management Subnet (RDP, WinRM, SMB) New-NetFirewallRule -DisplayName "Hardening: Allow Admin Management Inbound" ` -Direction Inbound ` -Action Allow ` -Protocol TCP ` -LocalPort @(445, 3389, 5985, 5986) ` -RemoteAddress $AdminSubnet ` -Profile Domain ` -Enabled True | Out-Null Write-Host "Management subnet inbound allowance rule created." -ForegroundColor Green Write-Host "Workstation and Server isolation firewall rules applied successfully." -ForegroundColor Cyan Audit Script: Download Script: Test-WorkstationIsolation.ps1 # Test-WorkstationIsolation.ps1 # Audits the presence of isolation blocking rules on local firewall profiles. Write-Host "Auditing workstation and server peer isolation rules..." -ForegroundColor Cyan $PortsToVerify = @(445, 3389, 135) $FailedChecks = 0 foreach ($Port in $PortsToVerify) { # Query rules that block inbound traffic on specified ports $BlockRules = Get-NetFirewallRule -ErrorAction SilentlyContinue | Where-Object { $_.Direction -eq "Inbound" -and $_.Action -eq "Block" -and $_.Enabled -eq $true } $HasPortBlock = $false foreach ($Rule in $BlockRules) { # Check filter associated with the rule to resolve local port $Filter = Get-NetFirewallPortFilter -AssociatedNetFirewallRule $Rule -ErrorAction SilentlyContinue if ($Filter -and $Filter.LocalPort -eq [string]$Port) { $HasPortBlock = $true } } if ($HasPortBlock) { Write-Host " - Isolation block rule for Port $($Port): FOUND (Compliant)" -ForegroundColor Green } else { Write-Host " - Isolation block rule for Port $($Port): NOT FOUND (Non-Compliant)" -ForegroundColor Red $FailedChecks++ } } if ($FailedChecks -eq 0) { Write-Host "Audit Result: Peer isolation firewall rules are verified." -ForegroundColor Green } else { Write-Warning "Audit Result: Missing peer isolation rules detected!" } # Set-WorkstationIsolation.ps1 # Configures local firewall rules to block inbound SMB, RPC, and RDP from peer subnets. # Allows access only from designated Domain Controller and Admin Management subnets. # Adjust subnets for your local environment $AdminSubnet = "10.10.0.0/24" # PAW / Jump Host / DC Subnet $PeerSubnet = "10.20.0.0/16" # Local client/member peer subnet Write-Host "Applying Workstation and Server Isolation Firewall Rules..." -ForegroundColor Cyan # 1. Enable firewall profiles Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled True Write-Host "All firewall profiles enabled." -ForegroundColor Green # 2. Block Inbound SMB (TCP 445) from peer subnet New-NetFirewallRule -DisplayName "Hardening: Block Inbound SMB from Peers" ` -Direction Inbound ` -Action Block ` -Protocol TCP ` -LocalPort 445 ` -RemoteAddress $PeerSubnet ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "SMB peer blocking rule created." -ForegroundColor Green # 3. Block Inbound RDP (TCP 3389) from peer subnet New-NetFirewallRule -DisplayName "Hardening: Block Inbound RDP from Peers" ` -Direction Inbound ` -Action Block ` -Protocol TCP ` -LocalPort 3389 ` -RemoteAddress $PeerSubnet ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "RDP peer blocking rule created." -ForegroundColor Green # 4. Block Inbound WinRM (TCP 5985, 5986) from peer subnet New-NetFirewallRule -DisplayName "Hardening: Block Inbound WinRM from Peers" ` -Direction Inbound ` -Action Block ` -Protocol TCP ` -LocalPort @(5985, 5986) ` -RemoteAddress $PeerSubnet ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "WinRM peer blocking rule created." -ForegroundColor Green # 5. Block Inbound RPC (TCP 135) from peer subnet New-NetFirewallRule -DisplayName "Hardening: Block Inbound RPC Mapper from Peers" ` -Direction Inbound ` -Action Block ` -Protocol TCP ` -LocalPort 135 ` -RemoteAddress $PeerSubnet ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "RPC Endpoint Mapper peer blocking rule created." -ForegroundColor Green # 6. Allow Inbound Administration from Management Subnet (RDP, WinRM, SMB) New-NetFirewallRule -DisplayName "Hardening: Allow Admin Management Inbound" ` -Direction Inbound ` -Action Allow ` -Protocol TCP ` -LocalPort @(445, 3389, 5985, 5986) ` -RemoteAddress $AdminSubnet ` -Profile Domain ` -Enabled True | Out-Null Write-Host "Management subnet inbound allowance rule created." -ForegroundColor Green Write-Host "Workstation and Server isolation firewall rules applied successfully." -ForegroundColor Cyan Target Scope: Applicable Systems: Domain Controllers, Member Servers, PAWs, Tier 2 Client Workstations. Operating Systems: Windows Server 2016 (and above), Windows 10 (and above) Enterprise/Professional. File Path: 04-network-firewall/configure-ipsec-domain-isolation.md In environments without hardware-enforced line-encryption, an attacker who gains physical or logical access to internal network switches can perform Man-in-the-Middle (MitM) attacks (e.g., ARP spoofing, DHCP spoofing) or passive packet sniffing. Implementing IPsec Transport Mode using Connection Security Rules ensures that domain-joined hosts cryptographically authenticate each other before transmitting payloads. Benefits of IPsec isolation include: 1. Host Authentication: Ensures only trusted, domain-joined systems communicating via Kerberos V5 or certificates can exchange packets with critical servers. 2. Data Integrity & Confidentiality: Prevents packet tampering and sniffing on the wire. For DC-to-DC replication, mandating ESP encryption secures highly sensitive directory updates. 3. Mitigation of Relay Attacks: Even if credentials are intercepted, they cannot be easily replayed to services protected by IPsec isolation rules. Option A: Group Policy Object (GPO) Configuration (Preferred) To implement domain isolation successfully, two separate GPO policies must be created and linked: one targeting standard Endpoints (Member Servers and Workstations) and one targeting Domain Controllers. 1. Endpoint Domain Isolation GPO (Isolated Domain) This GPO targets all standard domain assets (Workstations, Member Servers, PAWs). Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting the target OUs (e.g., GPO_Hardening_IPsec_Isolation_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Connection Security Rules Create the general Isolation Rule: Right-click Connection Security Rules and select New Rule... Rule Type*: Isolation Requirements*: Select Request authentication for inbound and outbound connections (to allow cleartext fallback). Authentication Method*: Computer (Kerberos V5) Profile*: Domain Name*: Hardening: IPsec Domain Isolation Configure Boot Exemptions (to prevent lockouts): Create a new rule for essential infrastructure services: Rule Type*: Exemption IP Addresses*: Add the IP addresses of your DHCP servers and DNS servers (if external or required for initial boot name resolution). Name*: Hardening: IPsec Infrastructure Exemptions Note: Domain Controllers must not be added to the exemption list. If DCs are exempted, all endpoint-to-DC traffic will bypass IPsec entirely. Instead, by keeping DCs subject to the general rule with `Request outbound` requirements, clients can fall back to cleartext during boot to obtain a Kerberos ticket, and will automatically establish an encrypted IPsec SA for all subsequent DC communications once authenticated. Once the domain isolation environment is stable and all domain assets have active SAs, the GPO requirement for endpoints can be upgraded to `Require authentication for inbound connections and request authentication for outbound connections`. 2. Domain Controller IPsec GPO This GPO targets only the Domain Controllers OU. Because DCs must process bootstrap authentication from unjoined or booting machines, they cannot require IPsec for client access. Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting the Domain Controllers OU (e.g., GPO_Hardening_IPsec_DCs). Navigate to Connection Security Rules. Create the DC Client Access Rule: Rule Type*: Isolation Requirements*: Request authentication for inbound and outbound connections Authentication Method*: Computer (Kerberos V5) Profile*: Domain Name*: Hardening: IPsec DC Client Access Create the DC-to-DC Replication Encryption Rule: Rule Type*: Isolation Requirements*: Require authentication for inbound and outbound connections Authentication Method*: Computer (Kerberos V5) Protocols and Ports*: Set protocol to TCP, local port to 49152-65535 (or your restricted RPC port, e.g., 50000-50100). Action : Under advanced settings, require ESP encryption* for this connection rule. Name*: Hardening: IPsec DC-to-DC Replication Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to audit and configure Connection Security Rules. Remediation Script: Download Script: Set-IPsecDomainIsolation.ps1 # Set-IPsecDomainIsolation.ps1 # Configures local IPsec Connection Security Rules for Domain Isolation. # Detects role (DC vs Endpoint) and applies appropriate isolation policies. Write-Host "Configuring IPsec Connection Security Rules..." -ForegroundColor Cyan # 1. Determine local machine role (Domain Controller vs Endpoint/Member Server) $IsDomainController = $false try { $ComputerSystem = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop if ($ComputerSystem.DomainRole -eq 4 -or $ComputerSystem.DomainRole -eq 5) { $IsDomainController = $true } } catch { # Fallback to checking NTDS service or environment variables if CimInstance fails if (Get-Service -Name NTDS -ErrorAction SilentlyContinue) { $IsDomainController = $true } } if ($IsDomainController) { Write-Host "Local system identified as a Domain Controller." -ForegroundColor Yellow # Define Rule Names $GeneralRuleName = "Hardening: IPsec DC Client Access" $DCDCRuleName = "Hardening: IPsec DC-to-DC Replication" # A. DC General Client Access Rule: Inbound/Outbound set to Request # Allows initial cleartext bootstrap (Kerberos, DNS, LDAP) for clients, then promotes to IPsec $ExistingGeneral = Get-NetIPsecRule -DisplayName $GeneralRuleName -ErrorAction SilentlyContinue if ($null -eq $ExistingGeneral) { New-NetIPsecRule -DisplayName $GeneralRuleName ` -InboundSecurity Request ` -OutboundSecurity Request ` -Phase1AuthSet "ComputerKerberos" ` -Enabled True | Out-Null Write-Host "Created general DC IPsec rule (Request mode)." -ForegroundColor Green } else { Set-NetIPsecRule -DisplayName $GeneralRuleName ` -InboundSecurity Request ` -OutboundSecurity Request ` -Phase1AuthSet "ComputerKerberos" ` -Enabled True | Out-Null Write-Host "Updated general DC IPsec rule (Request mode)." -ForegroundColor Gray } # B. DC-to-DC Replication Rule: Require authentication and require encryption # Targets replication ports or remote DC subnets $ExistingDCDC = Get-NetIPsecRule -DisplayName $DCDCRuleName -ErrorAction SilentlyContinue # Attempt to retrieve other DCs in the domain for remote IP targeting $DCIps = @() try { if (Get-Module -ListAvailable -Name ActiveDirectory) { Import-Module ActiveDirectory -ErrorAction Stop $DCIps = Get-ADDomainController -Filter * | Where-Object { $_.IPv4Address -ne (Get-NetIPAddress -AddressFamily IPv4 | Select-Object -ExpandProperty IPAddress) } | Select-Object -ExpandProperty IPv4Address } } catch { Write-Host "Could not query AD for other DC IP addresses. Rule will apply generally to replication ports." -ForegroundColor Yellow } # Configure the rule targeting replication traffic (TCP 49152-65535 or custom RPC) # Require authentication (forces IPsec) for DC-to-DC communication $Params = @{ DisplayName = $DCDCRuleName InboundSecurity = "Require" OutboundSecurity = "Require" Phase1AuthSet = "ComputerKerberos" Protocol = "TCP" LocalPort = "49152-65535" Enabled = "True" } if ($DCIps.Count -gt 0) { $Params["RemoteAddress"] = $DCIps } if ($null -eq $ExistingDCDC) { New-NetIPsecRule @Params | Out-Null Write-Host "Created DC-to-DC replication encryption rule (Require mode)." -ForegroundColor Green } else { # RemoteAddress cannot be passed empty if we update, so omit if empty if ($null -eq $Params["RemoteAddress"]) { Set-NetIPsecRule -DisplayName $DCDCRuleName ` -InboundSecurity Require ` -OutboundSecurity Require ` -Phase1AuthSet "ComputerKerberos" ` -Protocol TCP ` -LocalPort "49152-65535" ` -Enabled True | Out-Null } else { Set-NetIPsecRule @Params | Out-Null } Write-Host "Updated DC-to-DC replication encryption rule (Require mode)." -ForegroundColor Gray } } else { Write-Host "Local system identified as an Endpoint/Member Server." -ForegroundColor Yellow $RuleName = "Hardening: IPsec Domain Isolation" $ExistingRule = Get-NetIPsecRule -DisplayName $RuleName -ErrorAction SilentlyContinue # Endpoints: Request inbound and Request outbound for safe deployment, # then promote to Require inbound and Request outbound (fallback to cleartext for DCs/Internet) if ($null -eq $ExistingRule) { New-NetIPsecRule -DisplayName $RuleName ` -InboundSecurity Request ` -OutboundSecurity Request ` -Phase1AuthSet "ComputerKerberos" ` -Enabled True | Out-Null Write-Host "Created general Endpoint IPsec rule (Request mode)." -ForegroundColor Green } else { Set-NetIPsecRule -DisplayName $RuleName ` -InboundSecurity Request ` -OutboundSecurity Request ` -Phase1AuthSet "ComputerKerberos" ` -Enabled True | Out-Null Write-Host "Updated general Endpoint IPsec rule (Request mode)." -ForegroundColor Gray } # Create Exemption Rules for DHCP and DNS to prevent boot lockouts $DHCPRuleName = "Exempt: DHCP Traffic" $DNSRuleName = "Exempt: DNS Traffic" # DHCP Rule (UDP 67, 68) $ExistingDHCP = Get-NetIPsecRule -DisplayName $DHCPRuleName -ErrorAction SilentlyContinue if ($null -eq $ExistingDHCP) { New-NetIPsecRule -DisplayName $DHCPRuleName ` -InboundSecurity None ` -OutboundSecurity None ` -Protocol UDP ` -LocalPort @("67", "68") ` -Enabled True | Out-Null Write-Host "Created DHCP exemption rule." -ForegroundColor Green } # DNS Rule (UDP/TCP 53) $ExistingDNS = Get-NetIPsecRule -DisplayName $DNSRuleName -ErrorAction SilentlyContinue if ($null -eq $ExistingDNS) { New-NetIPsecRule -DisplayName $DNSRuleName ` -InboundSecurity None ` -OutboundSecurity None ` -Protocol UDP ` -RemotePort "53" ` -Enabled True | Out-Null New-NetIPsecRule -DisplayName "$DNSRuleName (TCP)" ` -InboundSecurity None ` -OutboundSecurity None ` -Protocol TCP ` -RemotePort "53" ` -Enabled True | Out-Null Write-Host "Created DNS exemption rules." -ForegroundColor Green } } Audit Script: Download Script: Test-IPsecDomainIsolation.ps1 # Test-IPsecDomainIsolation.ps1 # Checks the state of local IPsec Connection Security Rules. # Accounts for role-specific rules (DC vs Endpoint). Write-Host "Auditing IPsec Connection Security Rules..." -ForegroundColor Cyan # 1. Determine local machine role $IsDomainController = $false try { $ComputerSystem = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop if ($ComputerSystem.DomainRole -eq 4 -or $ComputerSystem.DomainRole -eq 5) { $IsDomainController = $true } } catch { if (Get-Service -Name NTDS -ErrorAction SilentlyContinue) { $IsDomainController = $true } } $NonCompliant = $false if ($IsDomainController) { Write-Host "Auditing Domain Controller IPsec rules..." -ForegroundColor Yellow # DC should have a Client Access rule set to Request (or better) $GeneralRule = Get-NetIPsecRule -DisplayName "Hardening: IPsec DC Client Access" -ErrorAction SilentlyContinue if ($null -eq $GeneralRule -or $GeneralRule.Enabled -ne $true) { Write-Host " - General DC IPsec rule: NOT FOUND or DISABLED (Non-Compliant)" -ForegroundColor Red $NonCompliant = $true } else { $InboundSec = $GeneralRule.InboundSecurity $OutboundSec = $GeneralRule.OutboundSecurity if ($InboundSec -ne "Request" -and $InboundSec -ne "Require") { Write-Host " - General DC IPsec Inbound Security is '$InboundSec' (Non-Compliant, should be Request)" -ForegroundColor Red $NonCompliant = $true } else { Write-Host " - General DC IPsec Inbound Security: $InboundSec (Compliant)" -ForegroundColor Green } } # DC should have a DC-to-DC replication rule set to Require $DCDCRule = Get-NetIPsecRule -DisplayName "Hardening: IPsec DC-to-DC Replication" -ErrorAction SilentlyContinue if ($null -eq $DCDCRule -or $DCDCRule.Enabled -ne $true) { Write-Host " - DC-to-DC Replication rule: NOT FOUND or DISABLED (Non-Compliant)" -ForegroundColor Red $NonCompliant = $true } else { $InboundSec = $DCDCRule.InboundSecurity $OutboundSec = $DCDCRule.OutboundSecurity if ($InboundSec -ne "Require" -or $OutboundSec -ne "Require") { Write-Host " - DC-to-DC IPsec Inbound/Outbound is '$InboundSec'/'$OutboundSec' (Non-Compliant, should be Require)" -ForegroundColor Red $NonCompliant = $true } else { Write-Host " - DC-to-DC IPsec rule: Require (Compliant)" -ForegroundColor Green } } } else { Write-Host "Auditing Endpoint/Member Server IPsec rules..." -ForegroundColor Yellow # Endpoint should have a general Domain Isolation rule set to Request (transition) or Require (inbound) / Request (outbound) $GeneralRule = Get-NetIPsecRule -DisplayName "Hardening: IPsec Domain Isolation" -ErrorAction SilentlyContinue if ($null -eq $GeneralRule -or $GeneralRule.Enabled -ne $true) { Write-Host " - Endpoint Domain Isolation rule: NOT FOUND or DISABLED (Non-Compliant)" -ForegroundColor Red $NonCompliant = $true } else { $InboundSec = $GeneralRule.InboundSecurity $OutboundSec = $GeneralRule.OutboundSecurity # Request/Request or Require/Request are acceptable depending on transition phase if ($InboundSec -eq "None" -or $OutboundSec -eq "None") { Write-Host " - Endpoint Domain Isolation is set to None (Non-Compliant)" -ForegroundColor Red $NonCompliant = $true } else { Write-Host " - Endpoint Domain Isolation rule: Enabled (Inbound: $InboundSec, Outbound: $OutboundSec) (Compliant)" -ForegroundColor Green } } # DHCP and DNS exemptions should be configured if outbound is strict $DHCPRule = Get-NetIPsecRule -DisplayName "Exempt: DHCP Traffic" -ErrorAction SilentlyContinue if ($null -eq $DHCPRule) { Write-Host " - DHCP Exemption rule: NOT FOUND (Warning: highly recommended to prevent DHCP issues)" -ForegroundColor Yellow } else { Write-Host " - DHCP Exemption rule: FOUND (Compliant)" -ForegroundColor Green } $DNSRule = Get-NetIPsecRule -DisplayName "Exempt: DNS Traffic" -ErrorAction SilentlyContinue if ($null -eq $DNSRule) { Write-Host " - DNS Exemption rule: NOT FOUND (Warning: highly recommended to prevent DNS name resolution failures during boot)" -ForegroundColor Yellow } else { Write-Host " - DNS Exemption rule: FOUND (Compliant)" -ForegroundColor Green } } if ($NonCompliant) { Write-Host "IPsec Domain Isolation Audit: Non-Compliant." -ForegroundColor Red exit 1 } else { Write-Host "IPsec Domain Isolation Audit: Compliant." -ForegroundColor Green exit 0 } # Set-IPsecDomainIsolation.ps1 # Configures local IPsec Connection Security Rules for Domain Isolation. # Detects role (DC vs Endpoint) and applies appropriate isolation policies. Write-Host "Configuring IPsec Connection Security Rules..." -ForegroundColor Cyan # 1. Determine local machine role (Domain Controller vs Endpoint/Member Server) $IsDomainController = $false try { $ComputerSystem = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop if ($ComputerSystem.DomainRole -eq 4 -or $ComputerSystem.DomainRole -eq 5) { $IsDomainController = $true } } catch { # Fallback to checking NTDS service or environment variables if CimInstance fails if (Get-Service -Name NTDS -ErrorAction SilentlyContinue) { $IsDomainController = $true } } if ($IsDomainController) { Write-Host "Local system identified as a Domain Controller." -ForegroundColor Yellow # Define Rule Names $GeneralRuleName = "Hardening: IPsec DC Client Access" $DCDCRuleName = "Hardening: IPsec DC-to-DC Replication" # A. DC General Client Access Rule: Inbound/Outbound set to Request # Allows initial cleartext bootstrap (Kerberos, DNS, LDAP) for clients, then promotes to IPsec $ExistingGeneral = Get-NetIPsecRule -DisplayName $GeneralRuleName -ErrorAction SilentlyContinue if ($null -eq $ExistingGeneral) { New-NetIPsecRule -DisplayName $GeneralRuleName ` -InboundSecurity Request ` -OutboundSecurity Request ` -Phase1AuthSet "ComputerKerberos" ` -Enabled True | Out-Null Write-Host "Created general DC IPsec rule (Request mode)." -ForegroundColor Green } else { Set-NetIPsecRule -DisplayName $GeneralRuleName ` -InboundSecurity Request ` -OutboundSecurity Request ` -Phase1AuthSet "ComputerKerberos" ` -Enabled True | Out-Null Write-Host "Updated general DC IPsec rule (Request mode)." -ForegroundColor Gray } # B. DC-to-DC Replication Rule: Require authentication and require encryption # Targets replication ports or remote DC subnets $ExistingDCDC = Get-NetIPsecRule -DisplayName $DCDCRuleName -ErrorAction SilentlyContinue # Attempt to retrieve other DCs in the domain for remote IP targeting $DCIps = @() try { if (Get-Module -ListAvailable -Name ActiveDirectory) { Import-Module ActiveDirectory -ErrorAction Stop $DCIps = Get-ADDomainController -Filter * | Where-Object { $_.IPv4Address -ne (Get-NetIPAddress -AddressFamily IPv4 | Select-Object -ExpandProperty IPAddress) } | Select-Object -ExpandProperty IPv4Address } } catch { Write-Host "Could not query AD for other DC IP addresses. Rule will apply generally to replication ports." -ForegroundColor Yellow } # Configure the rule targeting replication traffic (TCP 49152-65535 or custom RPC) # Require authentication (forces IPsec) for DC-to-DC communication $Params = @{ DisplayName = $DCDCRuleName InboundSecurity = "Require" OutboundSecurity = "Require" Phase1AuthSet = "ComputerKerberos" Protocol = "TCP" LocalPort = "49152-65535" Enabled = "True" } if ($DCIps.Count -gt 0) { $Params["RemoteAddress"] = $DCIps } if ($null -eq $ExistingDCDC) { New-NetIPsecRule @Params | Out-Null Write-Host "Created DC-to-DC replication encryption rule (Require mode)." -ForegroundColor Green } else { # RemoteAddress cannot be passed empty if we update, so omit if empty if ($null -eq $Params["RemoteAddress"]) { Set-NetIPsecRule -DisplayName $DCDCRuleName ` -InboundSecurity Require ` -OutboundSecurity Require ` -Phase1AuthSet "ComputerKerberos" ` -Protocol TCP ` -LocalPort "49152-65535" ` -Enabled True | Out-Null } else { Set-NetIPsecRule @Params | Out-Null } Write-Host "Updated DC-to-DC replication encryption rule (Require mode)." -ForegroundColor Gray } } else { Write-Host "Local system identified as an Endpoint/Member Server." -ForegroundColor Yellow $RuleName = "Hardening: IPsec Domain Isolation" $ExistingRule = Get-NetIPsecRule -DisplayName $RuleName -ErrorAction SilentlyContinue # Endpoints: Request inbound and Request outbound for safe deployment, # then promote to Require inbound and Request outbound (fallback to cleartext for DCs/Internet) if ($null -eq $ExistingRule) { New-NetIPsecRule -DisplayName $RuleName ` -InboundSecurity Request ` -OutboundSecurity Request ` -Phase1AuthSet "ComputerKerberos" ` -Enabled True | Out-Null Write-Host "Created general Endpoint IPsec rule (Request mode)." -ForegroundColor Green } else { Set-NetIPsecRule -DisplayName $RuleName ` -InboundSecurity Request ` -OutboundSecurity Request ` -Phase1AuthSet "ComputerKerberos" ` -Enabled True | Out-Null Write-Host "Updated general Endpoint IPsec rule (Request mode)." -ForegroundColor Gray } # Create Exemption Rules for DHCP and DNS to prevent boot lockouts $DHCPRuleName = "Exempt: DHCP Traffic" $DNSRuleName = "Exempt: DNS Traffic" # DHCP Rule (UDP 67, 68) $ExistingDHCP = Get-NetIPsecRule -DisplayName $DHCPRuleName -ErrorAction SilentlyContinue if ($null -eq $ExistingDHCP) { New-NetIPsecRule -DisplayName $DHCPRuleName ` -InboundSecurity None ` -OutboundSecurity None ` -Protocol UDP ` -LocalPort @("67", "68") ` -Enabled True | Out-Null Write-Host "Created DHCP exemption rule." -ForegroundColor Green } # DNS Rule (UDP/TCP 53) $ExistingDNS = Get-NetIPsecRule -DisplayName $DNSRuleName -ErrorAction SilentlyContinue if ($null -eq $ExistingDNS) { New-NetIPsecRule -DisplayName $DNSRuleName ` -InboundSecurity None ` -OutboundSecurity None ` -Protocol UDP ` -RemotePort "53" ` -Enabled True | Out-Null New-NetIPsecRule -DisplayName "$DNSRuleName (TCP)" ` -InboundSecurity None ` -OutboundSecurity None ` -Protocol TCP ` -RemotePort "53" ` -Enabled True | Out-Null Write-Host "Created DNS exemption rules." -ForegroundColor Green } } Target Scope: Applicable Systems: Domain Controllers, Member Servers, PAWs, Tier 2 Client Workstations. Operating Systems: Windows Server 2016 (and above), Windows 10 (and above) Enterprise/Professional. Baseline Tiering & Sensitivity: Tier 0 Domain Controllers & PAWs: Must strictly enforce modern cryptographic algorithms (AES-256, SHA-256/384, ECDH Group 19/20) with no legacy fallbacks permitted. Tier 1 Member Servers & Tier 2 Endpoints: Standard baseline mandates AES-256 and ECDH Group 19/20. Fallback to DH Group 14 (2048-bit MODP) and AES-CBC 256 is permitted solely for systems communicating with legacy appliances or boundary hosts ([REQ-NET-004]). File Path: 04-network-firewall/harden-ipsec-cryptography.md Internet Protocol Security (IPsec) is the foundational cryptographic framework that underpins domain isolation ([REQ-NET-004]) and line-encryption across Active Directory networks. However, default IPsec settings in legacy Windows environments permit outdated cryptographic primitives, including 3DES, DES, MD5, SHA-1, and Diffie-Hellman Groups 1, 2, and 5. These algorithms are mathematically broken or provide insufficient security margins against modern adversaries. Hardening IPsec cryptographic parameters mitigates multiple specific threat vectors: Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Open the GPO Editor Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting the target systems (e.g., GPO_Hardening_IPsec_Cryptography). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - [LDAP] Right-click Windows Defender Firewall with Advanced Security - [LDAP] and select Properties. Select the IPsec Settings tab. 2. Configure Key Exchange (Main Mode) Settings Under IPsec defaults, click Customize... Under Key exchange (Main Mode), select Advanced, then click Customize... Configure the Security methods list in priority order: Proposal 1 (Preferred)*: Integrity*: SHA-256 Encryption*: AES-256 Key exchange algorithm*: Elliptic Curve Diffie-Hellman Group 19 (P-256) Proposal 2*: Integrity*: SHA-384 Encryption*: AES-256 Key exchange algorithm*: Elliptic Curve Diffie-Hellman Group 20 (P-384) Proposal 3 (Compatibility Fallback)*: Integrity*: SHA-256 Encryption*: AES-256 Key exchange algorithm*: Diffie-Hellman Group 14 (2048-bit) Remove all entries referencing DES, 3DES, MD5, SHA-1, or DH Groups 1, 2, and 5.* Under Key lifetimes: Minutes*: Set to 480 (8 hours). Sessions*: Set to 0 (unlimited within time window). Under Diffie-Hellman: Select Force Diffie-Hellman* (ensures DH recalculation upon rekeying). Click OK. 3. Configure Data Protection (Quick Mode) Settings Under Data protection (Quick Mode), select Advanced, then click Customize... Check Require encryption for all connection security rules that use these settings. Configure the Data integrity and encryption rules: Rule 1 (AEAD Preferred)*: Protocol*: ESP Encryption*: AES-GCM 256 Integrity*: None (GMAC is integrated directly into GCM mode) Rule 2 (Standard CBC)*: Protocol*: ESP Encryption*: AES-256 Integrity*: SHA-256 Remove any entries referencing DES, 3DES, MD5, or SHA-1.* Under Key lifetimes: Data amount*: Set to 100000 KB (100 MB). Time*: Set to 60 minutes. Under Perfect Forward Secrecy (PFS): Check Use Diffie-Hellman for data protection (PFS)*. Key exchange algorithm*: Select Elliptic Curve Diffie-Hellman Group 19 (or Same as Main Mode). Click OK. 4. Configure Authentication Method Defaults Under Authentication method, select Advanced, then click Customize... Configure authentication priorities: First authentication method : Select Computer (Kerberos V5)* (Standard for domain-joined hosts). Second authentication method / Fallback : Select Computer certificate*, specify the enterprise Root/Intermediate CA, and configure criteria to match machine certificates (RSA >= 3072 bits or ECDSA P-256). Ensure Pre-Shared Key (PSK) authentication is strictly prohibited in enterprise production environments.* Click OK. 5. Configure Global IPsec Exemptions and Certificate Validation Under IPsec exemptions: Exempt ICMP from IPsec*: Select No (dictates that ICMP traffic must be authenticated and encrypted along with standard traffic, closing covert channels). Click OK to close the IPsec Defaults dialog. Click Apply, then OK on the Windows Defender Firewall Properties window. # Set-IPsecCryptography.ps1 # Description: Configures hardened IPsec Main Mode, Quick Mode, and Global Firewall cryptographic parameters. # Target Engine: Windows PowerShell 5.1 [CmdletBinding()] param() Write-Host "Configuring hardened IPsec cryptographic settings..." -ForegroundColor Cyan # Phase 1: Define Main Mode cryptographic proposals # Proposals mandate AES-256 encryption, SHA-256/SHA-384 hashing, and ECDH Group 19/20 or DH14 key exchange. # Weak suites (DES, 3DES, MD5, SHA-1, DH Groups 1, 2, 5) are strictly excluded. $MMProposals = @( (New-NetIPsecMainModeCryptoProposal -Encryption AES256 -Hash SHA256 -KeyExchange DH19), (New-NetIPsecMainModeCryptoProposal -Encryption AES256 -Hash SHA384 -KeyExchange DH20), (New-NetIPsecMainModeCryptoProposal -Encryption AES256 -Hash SHA256 -KeyExchange DH14) ) # Manage Main Mode Crypto Set $MMSetName = "Hardened_MM_CryptoSet" $ExistingMM = Get-NetIPsecMainModeCryptoSet -DisplayName $MMSetName -ErrorAction SilentlyContinue if ($null -eq $ExistingMM) { New-NetIPsecMainModeCryptoSet -DisplayName $MMSetName ` -Proposal $MMProposals ` -MaxMinutes 480 ` -MaxSessions 0 ` -ForceDiffieHellman $true | Out-Null Write-Host "Created Main Mode crypto set '$($MMSetName)'." -ForegroundColor Green } else { Set-NetIPsecMainModeCryptoSet -DisplayName $MMSetName ` -Proposal $MMProposals ` -MaxMinutes 480 ` -MaxSessions 0 ` -ForceDiffieHellman $true | Out-Null Write-Host "Updated Main Mode crypto set '$($MMSetName)'." -ForegroundColor Gray } # Phase 2: Define Quick Mode cryptographic proposals # Primary: ESP AES-GCM 256 (Authenticated Encryption with Associated Data - AEAD) # Secondary: ESP AES-256 with SHA-256 integrity $QMProposals = @( (New-NetIPsecQuickModeCryptoProposal -Encapsulation ESP -Encryption AESGCM256 -ESPHash None -MaxKilobytes 100000 -MaxMinutes 60), (New-NetIPsecQuickModeCryptoProposal -Encapsulation ESP -Encryption AES256 -ESPHash SHA256 -MaxKilobytes 100000 -MaxMinutes 60) ) # Manage Quick Mode Crypto Set with Perfect Forward Secrecy (PFS) enforced $QMSetName = "Hardened_QM_CryptoSet" $ExistingQM = Get-NetIPsecQuickModeCryptoSet -DisplayName $QMSetName -ErrorAction SilentlyContinue if ($null -eq $ExistingQM) { New-NetIPsecQuickModeCryptoSet -DisplayName $QMSetName ` -Proposal $QMProposals ` -PerfectForwardSecrecyGroup DH19 | Out-Null Write-Host "Created Quick Mode crypto set '$($QMSetName)' with PFS (DH19)." -ForegroundColor Green } else { Set-NetIPsecQuickModeCryptoSet -DisplayName $QMSetName ` -Proposal $QMProposals ` -PerfectForwardSecrecyGroup DH19 | Out-Null Write-Host "Updated Quick Mode crypto set '$($QMSetName)' with PFS (DH19)." -ForegroundColor Gray } # Phase 3: Configure Global IPsec Firewall Settings # Enforces CRL revocation checking for computer certificates, bounds idle time, and restricts exemptions. try { Set-NetFirewallSetting -CertValidationLevel RequireCrlCheck ` -MaxSAIdleTimeSeconds 300 ` -Exemptions NeighborDiscovery,Dhcp ` -ErrorAction Stop | Out-Null Write-Host "Configured global firewall IPsec settings (RequireCrlCheck, IdleTime: 300s, Exemptions: ND/DHCP)." -ForegroundColor Green } catch { Write-Host "Warning: Could not update global firewall settings: $($_.Exception.Message)" -ForegroundColor Yellow } # Phase 4: Associate cryptographic sets with local Connection Security Rules and Main Mode Rules $Rules = Get-NetIPsecRule -ErrorAction SilentlyContinue if ($null -ne $Rules -and $Rules.Count -gt 0) { foreach ($Rule in $Rules) { # Only bind QuickModeCryptoSet if the rule is not an Exemption rule (InboundSecurity -ne None) if ($Rule.InboundSecurity -ne "None" -or $Rule.OutboundSecurity -ne "None") { Set-NetIPsecRule -DisplayName $Rule.DisplayName -QuickModeCryptoSet $QMSetName -ErrorAction SilentlyContinue | Out-Null Write-Host "Associated '$($QMSetName)' with rule '$($Rule.DisplayName)'." -ForegroundColor Gray } } } else { Write-Host "No active Connection Security Rules found to bind." -ForegroundColor Gray } $MMRules = Get-NetIPsecMainModeRule -ErrorAction SilentlyContinue if ($null -ne $MMRules -and $MMRules.Count -gt 0) { foreach ($MMRule in $MMRules) { Set-NetIPsecMainModeRule -DisplayName $MMRule.DisplayName -MainModeCryptoSet $MMSetName -ErrorAction SilentlyContinue | Out-Null Write-Host "Associated '$($MMSetName)' with Main Mode rule '$($MMRule.DisplayName)'." -ForegroundColor Gray } } else { Write-Host "No active Main Mode Rules found to bind." -ForegroundColor Gray } Write-Host "IPsec cryptography hardening applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, PAWs, Tier 2 Client Workstations. Operating Systems: Windows Server 2016 (and above), Windows 10 (and above). File Path: 04-network-firewall/harden-tls-configuration.md Legacy versions of SSL (2.0 and 3.0) and TLS (1.0 and 1.1) are cryptographically weak and vulnerable to various attacks (such as BEAST, POODLE, and SWEET32) that can lead to credential exposure and session hijacking. Domain services, including LDAPS and WinRM, must enforce the usage of TLS 1.2 and TLS 1.3 (where supported) to prevent protocol downgrade attacks. In addition to disabling insecure protocol versions, the TLS cipher suites and Elliptic Curves must be restricted to modern, collision-resistant options. CBC (Cipher Block Chaining) mode and RC4 ciphers are prone to padding oracle attacks. Restricting configurations to AES-GCM (Galois/Counter Mode) authenticated encryption suites combined with strong Elliptic Curve Diffie-Hellman (ECDHE) curves (such as Curve25519 and NIST P-384) guarantees confidentiality, integrity, and perfect forward secrecy (PFS). By default, legacy .NET Framework applications (targeting .NET 3.5 or earlier) and WinHTTP-based APIs do not enforce TLS 1.2 or TLS 1.3, potentially defaulting to weak protocols like SSL 3.0 or TLS 1.0. Enabling SchUseStrongCrypto and SystemDefaultTlsVersions forces .NET to use the system default secure TLS versions. Restricting DefaultSecureProtocols forces WinHTTP clients to use TLS 1.2. Disabling the strong-name bypass (AllowStrongNameBypass = 0) prevents full-trust assemblies from skipping signature validation, protecting the .NET runtime from loading tampered assemblies. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Enforce SSL Cipher Suite Order and ECC Curve Order via GPO Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting all domain assets (e.g., GPO_Hardening_TLS_Schannel). Navigate to: Computer Configuration\Administrative Templates\Network\SSL Configuration Settings Double-click the SSL Cipher Suite Order policy: Set the policy to Enabled*. In the SSL Cipher Suites* text box, enter the hardened comma-separated cipher suite string: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 Double-click the ECC Curve Order policy: Set the policy to Enabled*. In the ECC Curves* text box, enter the curves in order of preference: curve25519,nistP384,nistP256 Click OK. 2. Deploy Schannel Protocol Registry settings via GPO Preferences Since Schannel protocol versions (disabling TLS 1.0/1.1 and enabling TLS 1.2/1.3) are not exposed via default ADMX templates, configure them using Registry Preferences: 1. Within the same GPO, navigate to: Computer Configuration\Preferences\Windows Settings\Registry 2. Right-click Registry, select New -> Registry Item. 3. Create registry values under: HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols 4. Configure key pairs for each protocol (SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3) under both Client and Server subkeys: To Disable (SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1) : Value Name: Enabled | Type: REG_DWORD | Value Data: 0 Value Name: `DisabledByDefault` | Type: `REG_DWORD` | Value Data: `1` To Enable (TLS 1.2, TLS 1.3): Value Name: `Enabled` | Type: `REG_DWORD` | Value Data: `1` Value Name: DisabledByDefault | Type: REG_DWORD | Value Data: 0 Note: Systems must be rebooted for Schannel protocol and cipher settings to take effect. 3. Deploy .NET and WinHTTP Registry Settings via GPO Preferences Within the same GPO, navigate to: Computer Configuration\Preferences\Windows Settings\Registry Configure the following registry entries (as Registry Items): .NET 4.0 (32-bit & 64-bit)*: * Key: HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 | Value: SchUseStrongCrypto = 1 (REG_DWORD) * Key: HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 | Value: SystemDefaultTlsVersions = 1 (REG_DWORD) * Key: HKLM\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319 | Value: SchUseStrongCrypto = 1 (REG_DWORD) * Key: HKLM\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319 | Value: SystemDefaultTlsVersions = 1 (REG_DWORD) .NET 2.0 (32-bit & 64-bit)*: * Key: HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727 | Value: SchUseStrongCrypto = 1 (REG_DWORD) * Key: HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727 | Value: SystemDefaultTlsVersions = 1 (REG_DWORD) * Key: HKLM\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727 | Value: SchUseStrongCrypto = 1 (REG_DWORD) * Key: HKLM\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727 | Value: SystemDefaultTlsVersions = 1 (REG_DWORD) .NET Strong-Name Bypass*: * Key: HKLM\SOFTWARE\Microsoft\.NETFramework | Value: AllowStrongNameBypass = 0 (REG_DWORD) * Key: HKLM\SOFTWARE\Wow6432Node\Microsoft\.NETFramework | Value: AllowStrongNameBypass = 0 (REG_DWORD) WinHTTP (32-bit & 64-bit)*: * Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp | Value: DefaultSecureProtocols = 2048 (REG_DWORD) * Key: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp | Value: DefaultSecureProtocols = 2048 (REG_DWORD) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally on testing hosts or non-GPO-managed systems. Remediation Script: Download Script: Set-TLSConfiguration.ps1 # Set-TLSConfiguration.ps1 # Description: Hardens TLS/Schannel protocols, prioritizes modern cipher suites, and orders ECC curves. Write-Host "Configuring Schannel protocols, cipher suites, and ECC curves..." -ForegroundColor Cyan # Define Protocols to disable $ProtocolsToDisable = @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1") # Define Protocols to enable $ProtocolsToEnable = @("TLS 1.2", "TLS 1.3") # 1. Configure Protocols $SchannelRoot = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols" foreach ($Proto in $ProtocolsToDisable) { $Subkeys = @("Client", "Server") foreach ($Subkey in $Subkeys) { $Path = "$($SchannelRoot)\$($Proto)\$($Subkey)" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "Enabled" -Value 0 -Type DWord -Force | Out-Null Set-ItemProperty -Path $Path -Name "DisabledByDefault" -Value 1 -Type DWord -Force | Out-Null } } foreach ($Proto in $ProtocolsToEnable) { $Subkeys = @("Client", "Server") foreach ($Subkey in $Subkeys) { $Path = "$($SchannelRoot)\$($Proto)\$($Subkey)" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "Enabled" -Value 1 -Type DWord -Force | Out-Null Set-ItemProperty -Path $Path -Name "DisabledByDefault" -Value 0 -Type DWord -Force | Out-Null } } # 2. Configure SSL Cipher Suite Order and ECC Curve Order Policy $SSLConfigPath = "HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002" if (-not (Test-Path $SSLConfigPath)) { New-Item -Path $SSLConfigPath -Force | Out-Null } # Define cipher suites list $CipherSuites = @( "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" ) # Define ECC curves list $EccCurves = @( "curve25519", "nistP384", "nistP256" ) # Apply policy properties Set-ItemProperty -Path $SSLConfigPath -Name "Functions" -Value $CipherSuites -Type MultiString -Force | Out-Null Set-ItemProperty -Path $SSLConfigPath -Name "EccCurves" -Value $EccCurves -Type MultiString -Force | Out-Null # 3. Configure .NET strong cryptography, strong-name bypass, and WinHTTP TLS $RegistryTargets = @( @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727"; Name = "SchUseStrongCrypto"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727"; Name = "SystemDefaultTlsVersions"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"; Name = "SchUseStrongCrypto"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"; Name = "SystemDefaultTlsVersions"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319"; Name = "SchUseStrongCrypto"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319"; Name = "SystemDefaultTlsVersions"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"; Name = "SchUseStrongCrypto"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"; Name = "SystemDefaultTlsVersions"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework"; Name = "AllowStrongNameBypass"; Value = 0; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework"; Name = "AllowStrongNameBypass"; Value = 0; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"; Name = "DefaultSecureProtocols"; Value = 2048; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"; Name = "DefaultSecureProtocols"; Value = 2048; Type = "DWord" } ) foreach ($target in $RegistryTargets) { if (-not (Test-Path $target.Path)) { New-Item -Path $target.Path -Force | Out-Null } Set-ItemProperty -Path $target.Path -Name $target.Name -Value $target.Value -Type $target.Type -Force | Out-Null } Write-Host "Schannel configuration applied. A system reboot is required to apply changes." -ForegroundColor Green Audit Script: Download Script: Test-TLSConfiguration.ps1 # Test-TLSConfiguration.ps1 # Description: Audits TLS/Schannel protocol configuration, cipher suites, and ECC curves. Write-Host "Auditing TLS and Cryptographic configurations..." -ForegroundColor Cyan $NonCompliantCount = 0 $SchannelRoot = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols" # 1. Audit Protocols $ProtocolsToDisable = @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1") foreach ($Proto in $ProtocolsToDisable) { $Subkeys = @("Client", "Server") foreach ($Subkey in $Subkeys) { $Path = "$($SchannelRoot)\$($Proto)\$($Subkey)" if (Test-Path $Path) { $Enabled = Get-ItemPropertyValue -Path $Path -Name "Enabled" -ErrorAction SilentlyContinue if ($Enabled -ne 0) { Write-Host " - Protocol $($Proto) ($($Subkey)) is not disabled (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } else { Write-Host " - Protocol $($Proto) ($($Subkey)) is disabled (Compliant)." -ForegroundColor Green } } else { Write-Host " - Protocol $($Proto) ($($Subkey)) registry key does not exist (Compliant)." -ForegroundColor Green } } } # 2. Audit SSL Policy and ECC Curves $SSLConfigPath = "HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002" if (Test-Path $SSLConfigPath) { $Functions = Get-ItemPropertyValue -Path $SSLConfigPath -Name "Functions" -ErrorAction SilentlyContinue $EccCurves = Get-ItemPropertyValue -Path $SSLConfigPath -Name "EccCurves" -ErrorAction SilentlyContinue if ($null -eq $Functions -or $Functions.Length -eq 0) { Write-Host " - SSL Cipher Suite order policy is not configured (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } else { if ($Functions[0] -match "GCM") { Write-Host " - SSL Cipher Suite priority matches standards (Compliant)." -ForegroundColor Green } else { Write-Host " - SSL Cipher Suite priority does not favor secure GCM suites first (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } } if ($null -eq $EccCurves -or $EccCurves.Length -eq 0) { Write-Host " - ECC Curve priority policy is not configured (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } else { if ($EccCurves[0] -eq "curve25519" -or $EccCurves[0] -eq "nistP384") { Write-Host " - ECC Curve priority matches standards (Compliant)." -ForegroundColor Green } else { Write-Host " - ECC Curve priority does not favor curve25519/nistP384 (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } } } else { Write-Host " - Custom SSL configuration policies are not configured (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } # 3. Audit .NET and WinHTTP registry configurations $RegistryAudits = @( @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727"; Name = "SchUseStrongCrypto"; Value = 1 } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727"; Name = "SystemDefaultTlsVersions"; Value = 1 } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"; Name = "SchUseStrongCrypto"; Value = 1 } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"; Name = "SystemDefaultTlsVersions"; Value = 1 } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319"; Name = "SchUseStrongCrypto"; Value = 1 } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319"; Name = "SystemDefaultTlsVersions"; Value = 1 } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"; Name = "SchUseStrongCrypto"; Value = 1 } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"; Name = "SystemDefaultTlsVersions"; Value = 1 } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework"; Name = "AllowStrongNameBypass"; Value = 0 } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework"; Name = "AllowStrongNameBypass"; Value = 0 } @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"; Name = "DefaultSecureProtocols"; Value = 2048 } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"; Name = "DefaultSecureProtocols"; Value = 2048 } ) foreach ($target in $RegistryAudits) { if (Test-Path $target.Path) { $val = Get-ItemPropertyValue -Path $target.Path -Name $target.Name -ErrorAction SilentlyContinue if ($val -eq $target.Value) { Write-Host " - Registry Setting: $($target.Path)\$($target.Name) is Compliant." -ForegroundColor Green } else { Write-Host " - Registry Setting: $($target.Path)\$($target.Name) is Non-Compliant (Actual: '$val', Expected: '$($target.Value)')." -ForegroundColor Red $NonCompliantCount++ } } else { Write-Host " - Registry Key: $($target.Path) does not exist (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } } if ($NonCompliantCount -eq 0) { Write-Host "TLS and Cryptographic configuration: Compliant." -ForegroundColor Green } else { Write-Host "TLS and Cryptographic configuration: Non-Compliant ($($NonCompliantCount) issue(s) detected)." -ForegroundColor Red } # Set-TLSConfiguration.ps1 # Description: Hardens TLS/Schannel protocols, prioritizes modern cipher suites, and orders ECC curves. Write-Host "Configuring Schannel protocols, cipher suites, and ECC curves..." -ForegroundColor Cyan # Define Protocols to disable $ProtocolsToDisable = @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1") # Define Protocols to enable $ProtocolsToEnable = @("TLS 1.2", "TLS 1.3") # 1. Configure Protocols $SchannelRoot = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols" foreach ($Proto in $ProtocolsToDisable) { $Subkeys = @("Client", "Server") foreach ($Subkey in $Subkeys) { $Path = "$($SchannelRoot)\$($Proto)\$($Subkey)" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "Enabled" -Value 0 -Type DWord -Force | Out-Null Set-ItemProperty -Path $Path -Name "DisabledByDefault" -Value 1 -Type DWord -Force | Out-Null } } foreach ($Proto in $ProtocolsToEnable) { $Subkeys = @("Client", "Server") foreach ($Subkey in $Subkeys) { $Path = "$($SchannelRoot)\$($Proto)\$($Subkey)" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "Enabled" -Value 1 -Type DWord -Force | Out-Null Set-ItemProperty -Path $Path -Name "DisabledByDefault" -Value 0 -Type DWord -Force | Out-Null } } # 2. Configure SSL Cipher Suite Order and ECC Curve Order Policy $SSLConfigPath = "HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002" if (-not (Test-Path $SSLConfigPath)) { New-Item -Path $SSLConfigPath -Force | Out-Null } # Define cipher suites list $CipherSuites = @( "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" ) # Define ECC curves list $EccCurves = @( "curve25519", "nistP384", "nistP256" ) # Apply policy properties Set-ItemProperty -Path $SSLConfigPath -Name "Functions" -Value $CipherSuites -Type MultiString -Force | Out-Null Set-ItemProperty -Path $SSLConfigPath -Name "EccCurves" -Value $EccCurves -Type MultiString -Force | Out-Null # 3. Configure .NET strong cryptography, strong-name bypass, and WinHTTP TLS $RegistryTargets = @( @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727"; Name = "SchUseStrongCrypto"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727"; Name = "SystemDefaultTlsVersions"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"; Name = "SchUseStrongCrypto"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727"; Name = "SystemDefaultTlsVersions"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319"; Name = "SchUseStrongCrypto"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319"; Name = "SystemDefaultTlsVersions"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"; Name = "SchUseStrongCrypto"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319"; Name = "SystemDefaultTlsVersions"; Value = 1; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\.NETFramework"; Name = "AllowStrongNameBypass"; Value = 0; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework"; Name = "AllowStrongNameBypass"; Value = 0; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"; Name = "DefaultSecureProtocols"; Value = 2048; Type = "DWord" } @{ Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"; Name = "DefaultSecureProtocols"; Value = 2048; Type = "DWord" } ) foreach ($target in $RegistryTargets) { if (-not (Test-Path $target.Path)) { New-Item -Path $target.Path -Force | Out-Null } Set-ItemProperty -Path $target.Path -Name $target.Name -Value $target.Value -Type $target.Type -Force | Out-Null } Write-Host "Schannel configuration applied. A system reboot is required to apply changes." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, PAWs, Tier 2 Client Workstations. Operating Systems: Windows Server 2016 (and above), Windows 10 (and above). File Path: 04-network-firewall/enforce-smbv3-security.md Server Message Block (SMB) version 1.0 (SMBv1) is obsolete, highly insecure, and vulnerable to critical exploits (such as MS17-010 / EternalBlue, which enabled the global spread of WannaCry and NotPetya). SMBv2, while newer, lacks modern cryptographic protection and is prone to Man-in-the-Middle (MitM) interception and NTLM relaying. Enforcing SMBv3 (minimum version 3.0.0 or 3.1.1) provides significant security advantages: 1. AES-GCM Encryption: Protects data in transit from passive sniffing and tampering. Enforcing encryption is critical on Domain Controllers (specifically for Sysvol and Netlogon shares) and servers hosting sensitive business files. 2. Pre-Authentication Integrity: Prevents tampering with SMB negotiation packets (mitigating downgrade attacks). 3. SMB Signing: Adds a cryptographic signature to all packets. Mandating SMB signing (specifically Digitally sign communications (always)) protects against SMB Relay attacks, where an attacker intercepts a NTLM authentication hash on the local network and replays it to a target server to gain unauthorized access. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Configure SMB Signing Policies Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting all domain assets (e.g., GPO_Hardening_SMB_Security). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following four policies: Microsoft network client: Digitally sign communications (always)*: Enabled Microsoft network client: Digitally sign communications (if server agrees)*: Enabled Microsoft network server: Digitally sign communications (always)*: Enabled Microsoft network server: Digitally sign communications (if client agrees)*: Enabled 2. Mandate Minimum SMB Dialects On systems that support ADMX templates for SMB dialects (Windows 11 / Server 2022+): 1. Navigate to: Computer Configuration\Administrative Templates\Network\Lanman Server 2. Double-click Mandate the minimum version of SMB: Set the policy to Enabled . Set the minimum version to SMB 3.0.0 (or SMB 3.1.1 to require the latest dialect). 3. Navigate to: Computer Configuration\Administrative Templates\Network\Lanman Workstation 4. Double-click Mandate the minimum version of SMB: Set the policy to Enabled . Set the minimum version to SMB 3.0.0 (or SMB 3.1.1). 3. Disable SMBv1 Driver via GPO Preferences To ensure the SMBv1 driver is disabled on older machines, deploy a registry change: 1. Navigate to: Computer Configuration\Preferences\Windows Settings\Registry 2. Right-click Registry, select New -> Registry Item: Action : `Update` Hive: HKEY_LOCAL_MACHINE Key Path : `SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters` Value name: SMB1 Value type : `REG_DWORD` Value data: 0 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to enforce SMBv3 standards. Remediation Script: Download Script: Set-SMBSecurity.ps1 # Set-SMBSecurity.ps1 # Description: Disables SMBv1, mandates signing, sets SMBv3 as minimum dialect, and enforces encryption. Write-Host "Enforcing SMBv3 security settings..." -ForegroundColor Cyan # 1. Disable SMBv1 Protocol globally (Server side) Set-SmbServerConfiguration -EnableSMB1Protocol $false -Confirm:$false | Out-Null Write-Host "SMBv1 server protocol disabled." -ForegroundColor Green # 2. Disable SMBv1 Driver (Windows Optional Feature) $SMB1Feature = Get-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -ErrorAction SilentlyContinue if ($null -ne $SMB1Feature -and $SMB1Feature.State -eq "Enabled") { Disable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -NoRestart -WarningAction SilentlyContinue | Out-Null Write-Host "SMB1 optional feature disabled." -ForegroundColor Green } # 3. Configure SMB Signing & Encryption on Server Set-SmbServerConfiguration -RequireSecuritySignature $true -EncryptData $true -Confirm:$false | Out-Null Write-Host "SMB Server signing and encryption mandated." -ForegroundColor Green # 4. Configure SMB Signing & Encryption on Client Set-SmbClientConfiguration -RequireSecuritySignature $true -Confirm:$false | Out-Null Write-Host "SMB Client signing mandated." -ForegroundColor Green # 5. Enforce Minimum Dialects in Registry (Server and Client) $ServerParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" $ClientParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" # Write minimum dialect version 0x00000300 (SMB 3.0.0) if (-not (Test-Path $ServerParamsPath)) { New-Item -Path $ServerParamsPath -Force | Out-Null } Set-ItemProperty -Path $ServerParamsPath -Name "MinSMB2Dialect" -Value 0x00000300 -Type DWord -Force | Out-Null if (-not (Test-Path $ClientParamsPath)) { New-Item -Path $ClientParamsPath -Force | Out-Null } Set-ItemProperty -Path $ClientParamsPath -Name "MinSMB2Dialect" -Value 0x00000300 -Type DWord -Force | Out-Null # Disable legacy fallback protocols (e.g. NetBIOS over TCP/IP) if possible, but keep focus on SMBv3 Write-Host "SMBv3 minimum dialect rules configured." -ForegroundColor Green Audit Script: Download Script: Test-SMBSecurity.ps1 # Test-SMBSecurity.ps1 # Description: Audits local SMB configuration for signing, encryption, and dialects. Write-Host "Auditing SMB security configuration..." -ForegroundColor Cyan $NonCompliantCount = 0 # Retrieve configurations $ServerConfig = Get-SmbServerConfiguration $ClientConfig = Get-SmbClientConfiguration # 1. Audit SMBv1 Server status if ($ServerConfig.EnableSMB1Protocol -eq $true) { Write-Host " - SMBv1 Server protocol is enabled (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } else { Write-Host " - SMBv1 Server protocol is disabled (Compliant)." -ForegroundColor Green } # 2. Audit Signing Requirements if ($ServerConfig.RequireSecuritySignature -ne $true) { Write-Host " - SMB Server signing is not required (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } else { Write-Host " - SMB Server signing is mandated (Compliant)." -ForegroundColor Green } if ($ClientConfig.RequireSecuritySignature -ne $true) { Write-Host " - SMB Client signing is not required (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } else { Write-Host " - SMB Client signing is mandated (Compliant)." -ForegroundColor Green } # 3. Audit Encryption Requirements if ($ServerConfig.EncryptData -ne $true) { Write-Host " - SMB Server global data encryption is not enforced (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } else { Write-Host " - SMB Server global data encryption is enforced (Compliant)." -ForegroundColor Green } # 4. Audit Registry Dialects $ServerParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" $ClientParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" if (Test-Path $ServerParamsPath) { $ServerMinDialect = Get-ItemPropertyValue -Path $ServerParamsPath -Name "MinSMB2Dialect" -ErrorAction SilentlyContinue if ($null -eq $ServerMinDialect -or $ServerMinDialect -lt 0x00000300) { Write-Host " - Server minimum dialect is less than SMB 3.0 or not set (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } else { Write-Host " - Server minimum dialect is set to SMB 3.0+ (Compliant)." -ForegroundColor Green } } else { Write-Host " - LanmanServer registry path is missing (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } if (Test-Path $ClientParamsPath) { $ClientMinDialect = Get-ItemPropertyValue -Path $ClientParamsPath -Name "MinSMB2Dialect" -ErrorAction SilentlyContinue if ($null -eq $ClientMinDialect -or $ClientMinDialect -lt 0x00000300) { Write-Host " - Client minimum dialect is less than SMB 3.0 or not set (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } else { Write-Host " - Client minimum dialect is set to SMB 3.0+ (Compliant)." -ForegroundColor Green } } else { Write-Host " - LanmanWorkstation registry path is missing (Non-Compliant)." -ForegroundColor Red $NonCompliantCount++ } if ($NonCompliantCount -eq 0) { Write-Host "SMB Security configuration: Compliant." -ForegroundColor Green } else { Write-Host "SMB Security configuration: Non-Compliant ($($NonCompliantCount) issue(s) detected)." -ForegroundColor Red } # Set-SMBSecurity.ps1 # Description: Disables SMBv1, mandates signing, sets SMBv3 as minimum dialect, and enforces encryption. Write-Host "Enforcing SMBv3 security settings..." -ForegroundColor Cyan # 1. Disable SMBv1 Protocol globally (Server side) Set-SmbServerConfiguration -EnableSMB1Protocol $false -Confirm:$false | Out-Null Write-Host "SMBv1 server protocol disabled." -ForegroundColor Green # 2. Disable SMBv1 Driver (Windows Optional Feature) $SMB1Feature = Get-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -ErrorAction SilentlyContinue if ($null -ne $SMB1Feature -and $SMB1Feature.State -eq "Enabled") { Disable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -NoRestart -WarningAction SilentlyContinue | Out-Null Write-Host "SMB1 optional feature disabled." -ForegroundColor Green } # 3. Configure SMB Signing & Encryption on Server Set-SmbServerConfiguration -RequireSecuritySignature $true -EncryptData $true -Confirm:$false | Out-Null Write-Host "SMB Server signing and encryption mandated." -ForegroundColor Green # 4. Configure SMB Signing & Encryption on Client Set-SmbClientConfiguration -RequireSecuritySignature $true -Confirm:$false | Out-Null Write-Host "SMB Client signing mandated." -ForegroundColor Green # 5. Enforce Minimum Dialects in Registry (Server and Client) $ServerParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" $ClientParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" # Write minimum dialect version 0x00000300 (SMB 3.0.0) if (-not (Test-Path $ServerParamsPath)) { New-Item -Path $ServerParamsPath -Force | Out-Null } Set-ItemProperty -Path $ServerParamsPath -Name "MinSMB2Dialect" -Value 0x00000300 -Type DWord -Force | Out-Null if (-not (Test-Path $ClientParamsPath)) { New-Item -Path $ClientParamsPath -Force | Out-Null } Set-ItemProperty -Path $ClientParamsPath -Name "MinSMB2Dialect" -Value 0x00000300 -Type DWord -Force | Out-Null # Disable legacy fallback protocols (e.g. NetBIOS over TCP/IP) if possible, but keep focus on SMBv3 Write-Host "SMBv3 minimum dialect rules configured." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Client Workstations. Operating Systems: Windows Server 2016 (and above), Windows 10 (and above) Enterprise/Professional. File Path: 04-network-firewall/configure-firewall-logging.md Windows Defender Firewall with Advanced Security (WFAS) serves as the host-level stateful firewall protecting Active Directory resources from unauthorized network access. However, without correct logging and behavioral configuration, the firewall does not provide adequate defensive or diagnostic value: Visibility Gaps: By default, Windows Defender Firewall does not log dropped packets. If logging is disabled, security administrators cannot detect failed connection attempts, reconnaissance scans (port scanning), or unauthorized network communications. Log Rotational Coverage: The default firewall log size limit of 4096 KB (4 MB) is insufficient for enterprise environments. High volumes of traffic or network scanning will cause the log to roll over rapidly, destroying valuable historical entries needed for security audits and incident investigation. Deterministic Administrative Control: Allowing local administrators to create local rules or local connection security rules (IPsec) on critical Tier 0 systems, such as Domain Controllers, risks bypassing centrally defined domain firewall GPOs. Restricting rule merging ensures a uniform security baseline. Behavioral Notification Control: Disabling interactive firewall notifications prevents desktop alerts from prompting administrative users, reducing operational noise and social engineering opportunities. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Create a new GPO or edit an existing one (e.g., GPO_Hardening_Firewall_Baseline). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security Right-click Windows Defender Firewall with Advanced Security and select Properties. Under the Domain Profile tab, configure the following settings: State*: On (recommended) Inbound connections*: Block (default) Outbound connections*: Allow (default) Under Settings , click Customize...*: Display a notification*: No Allow unicast response*: Yes Apply local firewall rules*: No (Set to No for Domain Controllers GPOs; set to Yes or No for Member Servers/Workstations depending on operational requirements) Apply local connection security rules*: No (Set to No for Domain Controllers GPOs; set to Yes or No for Member Servers/Workstations depending on operational requirements) Click OK*. Under Logging , click Customize...*: Name*: %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log Size limit (KB)*: 32768 Log dropped packets*: Yes Log successful connections*: No Click OK*. Repeat the exact configuration steps (Step 5) for the Private Profile and Public Profile tabs. Click Apply and then click OK. Link the GPO to the appropriate Organizational Unit (OU) containing the target assets. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally (for testing or standalone systems) or if the control is not manageable via standard GPO GUI interfaces. Download Script: Set-FirewallLoggingAndSettings.ps1 # Set-FirewallLoggingAndSettings.ps1 # Description: Configures Windows Defender Firewall settings, log size, and log permissions for all profiles. Write-Host "Applying Windows Defender Firewall hardening settings..." -ForegroundColor Cyan # 1. Detect if the local system is a Domain Controller (ProductType = 2 is Domain Controller) $IsDomainController = $false $OSInfo = Get-CimInstance -ClassName Win32_OperatingSystem -ErrorAction SilentlyContinue if ($null -ne $OSInfo) { if ($OSInfo.ProductType -eq 2) { $IsDomainController = $true } } # 2. Configure Domain, Private, and Public profiles $Profiles = @("Domain", "Private", "Public") foreach ($FwProfile in $Profiles) { Write-Host "Configuring Profile: $($FwProfile)..." -ForegroundColor Cyan # Enable firewall and set default inbound/outbound behavior and notifications Set-NetFirewallProfile -Profile $FwProfile ` -Enabled True ` -DefaultInboundAction Block ` -DefaultOutboundAction Allow ` -NotifyOnListen False ` -AllowUnicastResponseToMulticast True | Out-Null # Configure logging: log dropped packets, disable successful logs, set size to 32MB (32768 KB) Set-NetFirewallProfile -Profile $FwProfile ` -LogBlocked True ` -LogAllowed False ` -LogMaxSizeKilobytes 32768 ` -LogFileName "%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log" | Out-Null # Disable local rule merging only on Domain Controllers to prevent bypasses if ($IsDomainController) { Set-NetFirewallProfile -Profile $FwProfile ` -AllowLocalFirewallRules False ` -AllowLocalIPsecRules False | Out-Null Write-Host "Disabled local rule merging on DC for profile: $($FwProfile)" -ForegroundColor Green } else { Set-NetFirewallProfile -Profile $FwProfile ` -AllowLocalFirewallRules True ` -AllowLocalIPsecRules True | Out-Null Write-Host "Configured profile: $($FwProfile) with local rule merging allowed" -ForegroundColor Green } } Write-Host "Firewall logging and operational settings configuration completed successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-FirewallLoggingAndSettingsStatus.ps1 # Get-FirewallLoggingAndSettingsStatus.ps1 Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction, NotifyOnListen, LogBlocked, LogAllowed, LogMaxSizeKilobytes, LogFileName, AllowLocalFirewallRules, AllowLocalIPsecRules # Set-FirewallLoggingAndSettings.ps1 # Description: Configures Windows Defender Firewall settings, log size, and log permissions for all profiles. Write-Host "Applying Windows Defender Firewall hardening settings..." -ForegroundColor Cyan # 1. Detect if the local system is a Domain Controller (ProductType = 2 is Domain Controller) $IsDomainController = $false $OSInfo = Get-CimInstance -ClassName Win32_OperatingSystem -ErrorAction SilentlyContinue if ($null -ne $OSInfo) { if ($OSInfo.ProductType -eq 2) { $IsDomainController = $true } } # 2. Configure Domain, Private, and Public profiles $Profiles = @("Domain", "Private", "Public") foreach ($FwProfile in $Profiles) { Write-Host "Configuring Profile: $($FwProfile)..." -ForegroundColor Cyan # Enable firewall and set default inbound/outbound behavior and notifications Set-NetFirewallProfile -Profile $FwProfile ` -Enabled True ` -DefaultInboundAction Block ` -DefaultOutboundAction Allow ` -NotifyOnListen False ` -AllowUnicastResponseToMulticast True | Out-Null # Configure logging: log dropped packets, disable successful logs, set size to 32MB (32768 KB) Set-NetFirewallProfile -Profile $FwProfile ` -LogBlocked True ` -LogAllowed False ` -LogMaxSizeKilobytes 32768 ` -LogFileName "%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log" | Out-Null # Disable local rule merging only on Domain Controllers to prevent bypasses if ($IsDomainController) { Set-NetFirewallProfile -Profile $FwProfile ` -AllowLocalFirewallRules False ` -AllowLocalIPsecRules False | Out-Null Write-Host "Disabled local rule merging on DC for profile: $($FwProfile)" -ForegroundColor Green } else { Set-NetFirewallProfile -Profile $FwProfile ` -AllowLocalFirewallRules True ` -AllowLocalIPsecRules True | Out-Null Write-Host "Configured profile: $($FwProfile) with local rule merging allowed" -ForegroundColor Green } } Write-Host "Firewall logging and operational settings configuration completed successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients. Operating Systems: Windows Server 2016 (and above), Windows 10/11 Enterprise. File Path: 04-network-firewall/configure-hardened-unc-paths.md Active Directory clients and servers routinely query Domain Controllers to retrieve Group Policy Objects (GPOs), startup/shutdown scripts, and user logon scripts from the SYSVOL and NETLOGON shares. By default, these connections are made over standard UNC paths and do not strictly enforce integrity validation (SMB signing) or mutual authentication. Enforcing these channel-level controls mitigates the following threat vectors: 1. GPO Spoofing and Execution Tampering: An attacker positioned on the local network using man-in-the-middle (MitM) techniques (such as ARP spoofing or DNS poisoning) can intercept GPO retrieval traffic. Without Hardened UNC Paths, the attacker can spoof the Domain Controller and inject a malicious GPO or a modified script, which then executes with local SYSTEM privileges on the client host. Enforcing integrity and mutual authentication on SYSVOL and NETLOGON blocks this spoofing vector. 2. Insecure Guest Logons: Disabling insecure guest logons stops the workstation or server from automatically authenticating to untrusted remote SMB shares using guest credentials. This prevents attackers from setting up rogue SMB servers that trick hosts into leaking NetNTLM credentials or executing untrusted files. 3. LDAP Session Hijacking: Forcing outgoing LDAP client connections to negotiate signing protects directory queries made by Member Servers or Domain Controllers (acting as clients) from interception, packet tampering, or sniffing. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Configure Hardened UNC Paths Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to all target computers (e.g., GPO_Computer_Hardening_Baseline). Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Network Provider Double-click Hardened UNC Paths. Set it to Enabled. Click Show... in the options panel, and add the following entries: Value name : `\\\NETLOGON | **Value**: RequireIntegrity=1,RequireMutualAuthentication=1` Value name : `\\\SYSVOL | **Value**: RequireIntegrity=1,RequireMutualAuthentication=1` Click OK. 2. Disable Insecure Guest Logons Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Lanman Workstation Double-click Enable insecure guest logons. Set it to Disabled and click OK. 3. Enforce LDAP Client Signing Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Double-click Network security: LDAP client signing requirements. Set it to Require signing and click OK. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to apply the hardened network provider, Lanman Workstation, and LDAP client configurations. Download Script: Set-HardenedUNCAndClientSigning.ps1 # Set-HardenedUNCAndClientSigning.ps1 # Description: Configures Hardened UNC Paths for SYSVOL/NETLOGON, disables insecure guest logons, and enforces LDAP client signing. Write-Host "Applying network provider and client channel hardening..." -ForegroundColor Cyan # 1. Hardened UNC Paths configuration $UNCPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths" if (-not (Test-Path $UNCPath)) { New-Item -Path $UNCPath -Force | Out-Null } Set-ItemProperty -Path $UNCPath -Name "\\*\NETLOGON" -Value "RequireIntegrity=1,RequireMutualAuthentication=1" -Type String -ErrorAction Stop Set-ItemProperty -Path $UNCPath -Name "\\*\SYSVOL" -Value "RequireIntegrity=1,RequireMutualAuthentication=1" -Type String -ErrorAction Stop Write-Host "[+] Hardened UNC Paths for NETLOGON and SYSVOL configured." -ForegroundColor Green # 2. Disable Insecure Guest Logons $LanmanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation" if (-not (Test-Path $LanmanPath)) { New-Item -Path $LanmanPath -Force | Out-Null } Set-ItemProperty -Path $LanmanPath -Name "AllowInsecureGuestAuth" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] Insecure guest logons disabled." -ForegroundColor Green # 3. Enforce LDAP Client Signing Requirements $LdapPath = "HKLM:\System\CurrentControlSet\Services\LDAP" if (-not (Test-Path $LdapPath)) { New-Item -Path $LdapPath -Force | Out-Null } Set-ItemProperty -Path $LdapPath -Name "ldapclientintegrity" -Value 2 -Type DWord -ErrorAction Stop Write-Host "[+] LDAP Client signing requirement set to Require signing." -ForegroundColor Green To audit the network provider, Lanman workstation, and LDAP client signing configurations: Download Script: Get-HardenedUNCAndClientSigningStatus.ps1 # Get-HardenedUNCAndClientSigningStatus.ps1 # Description: Audits the registry configuration of Hardened UNC Paths, Lanman guest authentication, and LDAP Client signing. Write-Host "--- Auditing Hardened UNC Paths and Client Signing status ---" -ForegroundColor Cyan # 1. Audit UNC Paths $UNCPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths" if (Test-Path $UNCPath) { $NetlogonVal = Get-ItemProperty -Path $UNCPath -Name "\\*\NETLOGON" -ErrorAction SilentlyContinue $SysvolVal = Get-ItemProperty -Path $UNCPath -Name "\\*\SYSVOL" -ErrorAction SilentlyContinue $NetColor = if ($NetlogonVal -and $NetlogonVal.'\\*\NETLOGON' -eq "RequireIntegrity=1,RequireMutualAuthentication=1") { "Green" } else { "Red" } $SysColor = if ($SysvolVal -and $SysvolVal.'\\*\SYSVOL' -eq "RequireIntegrity=1,RequireMutualAuthentication=1") { "Green" } else { "Red" } Write-Host " - Hardened UNC NETLOGON: $($NetlogonVal.'\\*\NETLOGON') (Expected: RequireIntegrity=1,RequireMutualAuthentication=1)" -ForegroundColor $NetColor Write-Host " - Hardened UNC SYSVOL: $($SysvolVal.'\\*\SYSVOL') (Expected: RequireIntegrity=1,RequireMutualAuthentication=1)" -ForegroundColor $SysColor } else { Write-Host " - Hardened UNC registry path: NOT FOUND" -ForegroundColor Red } # 2. Audit Guest Logons $LanmanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation" $GuestVal = Get-ItemProperty -Path $LanmanPath -Name "AllowInsecureGuestAuth" -ErrorAction SilentlyContinue $GuestSetting = if ($GuestVal) { $GuestVal.AllowInsecureGuestAuth } else { 1 } $GuestColor = if ($GuestSetting -eq 0) { "Green" } else { "Red" } Write-Host " - Allow Insecure Guest Logons: $GuestSetting (Expected: 0)" -ForegroundColor $GuestColor # 3. Audit LDAP Client Signing $LdapPath = "HKLM:\System\CurrentControlSet\Services\LDAP" $LdapVal = Get-ItemProperty -Path $LdapPath -Name "ldapclientintegrity" -ErrorAction SilentlyContinue $LdapSetting = if ($LdapVal) { $LdapVal.ldapclientintegrity } else { 0 } $LdapColor = if ($LdapSetting -eq 2) { "Green" } else { "Red" } Write-Host " - LDAP Client Integrity (Signing): $LdapSetting (Expected: 2 - Require)" -ForegroundColor $LdapColor # Set-HardenedUNCAndClientSigning.ps1 # Description: Configures Hardened UNC Paths for SYSVOL/NETLOGON, disables insecure guest logons, and enforces LDAP client signing. Write-Host "Applying network provider and client channel hardening..." -ForegroundColor Cyan # 1. Hardened UNC Paths configuration $UNCPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths" if (-not (Test-Path $UNCPath)) { New-Item -Path $UNCPath -Force | Out-Null } Set-ItemProperty -Path $UNCPath -Name "\\*\NETLOGON" -Value "RequireIntegrity=1,RequireMutualAuthentication=1" -Type String -ErrorAction Stop Set-ItemProperty -Path $UNCPath -Name "\\*\SYSVOL" -Value "RequireIntegrity=1,RequireMutualAuthentication=1" -Type String -ErrorAction Stop Write-Host "[+] Hardened UNC Paths for NETLOGON and SYSVOL configured." -ForegroundColor Green # 2. Disable Insecure Guest Logons $LanmanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation" if (-not (Test-Path $LanmanPath)) { New-Item -Path $LanmanPath -Force | Out-Null } Set-ItemProperty -Path $LanmanPath -Name "AllowInsecureGuestAuth" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] Insecure guest logons disabled." -ForegroundColor Green # 3. Enforce LDAP Client Signing Requirements $LdapPath = "HKLM:\System\CurrentControlSet\Services\LDAP" if (-not (Test-Path $LdapPath)) { New-Item -Path $LdapPath -Force | Out-Null } Set-ItemProperty -Path $LdapPath -Name "ldapclientintegrity" -Value 2 -Type DWord -ErrorAction Stop Write-Host "[+] LDAP Client signing requirement set to Require signing." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Clients. Operating Systems: Windows Server 2016 (and above), Windows 10/11 Enterprise. File Path: 04-network-firewall/harden-winrm-service.md Windows Remote Management (WinRM) and Remote Procedure Call (RPC) are standard management interfaces in Windows environments. However, by default, these interfaces allow backward-compatible configurations that pose significant security risks. Hardening these service channels blocks the following exploit vectors: 1. Plaintext Credential Harvesting: Allowing Basic authentication on WinRM clients and services allows transmission of administrative passwords in plaintext (or easily decodable formats) if secure channels are not established. Disabling Basic and Digest authentication forces the use of Kerberos or certificate-based authentication. 2. Replay and Eavesdropping: WinRM allows unencrypted traffic by default, which exposes administrative payloads and remote command execution streams to sniffing and hijacking. Forcing encryption protects the confidentiality and integrity of remote management sessions. 3. RunAs Credential Exposure: If WinRM is allowed to cache or store RunAs credentials for remote task execution, those credentials reside in the host's memory, where an administrative attacker can harvest them using memory extraction tools. 4. Anonymous RPC Enumeration: Restricting unauthenticated RPC clients prevents anonymous attackers from performing remote enumeration of active services, RPC interfaces, and registry endpoints, limiting remote reconnaissance capabilities. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Configure WinRM Client Settings Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting all computers (e.g., GPO_Computer_Hardening_Baseline). Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Client Configure the settings: Policy : `Allow Basic authentication` -> Disabled Policy : `Allow unencrypted traffic` -> Disabled Policy : `Disallow Digest authentication` -> Enabled 2. Configure WinRM Service Settings Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Service Configure the settings: Policy : `Allow Basic authentication` -> Disabled Policy : `Allow unencrypted traffic` -> Disabled Policy : `Disallow WinRM from storing RunAs credentials` -> Enabled 3. Configure Windows Remote Shell Settings Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Remote Shell Configure the settings: Policy : `Allow Remote Shell Access` -> Disabled 4. Configure RPC Client Restrictions Navigate to: Computer Configuration\Policies\Administrative Templates\System\Remote Procedure Call Double-click Restrict Unauthenticated RPC clients. Set it to Enabled. In the options dropdown, select Authenticated (corresponds to registry value 1). Click OK. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to enforce WinRM client/service and RPC restrictions in the registry. Download Script: Set-WinRMAndRpcHardening.ps1 # Set-WinRMAndRpcHardening.ps1 # Description: Hardens WinRM client/service parameters and restricts remote RPC clients. Write-Host "Applying WinRM and RPC channel hardening settings..." -ForegroundColor Cyan # 1. WinRM Client Hardening $ClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client" if (-not (Test-Path $ClientPath)) { New-Item -Path $ClientPath -Force | Out-Null } Set-ItemProperty -Path $ClientPath -Name "AllowBasic" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $ClientPath -Name "AllowUnencryptedTraffic" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $ClientPath -Name "AllowDigest" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] WinRM Client parameters hardened." -ForegroundColor Green # 2. WinRM Service Hardening $ServicePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service" if (-not (Test-Path $ServicePath)) { New-Item -Path $ServicePath -Force | Out-Null } Set-ItemProperty -Path $ServicePath -Name "AllowBasic" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $ServicePath -Name "AllowUnencryptedTraffic" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $ServicePath -Name "DisableRunAs" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] WinRM Service parameters hardened." -ForegroundColor Green # 3. Windows Remote Shell Hardening $WinRsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\WinRS" if (-not (Test-Path $WinRsPath)) { New-Item -Path $WinRsPath -Force | Out-Null } Set-ItemProperty -Path $WinRsPath -Name "AllowRemoteShellAccess" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] Windows Remote Shell access disabled." -ForegroundColor Green # 4. RPC Client Restrictions $RpcPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" if (-not (Test-Path $RpcPath)) { New-Item -Path $RpcPath -Force | Out-Null } Set-ItemProperty -Path $RpcPath -Name "RestrictRemoteClients" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] Unauthenticated RPC client restrictions enforced (RestrictRemoteClients = 1)." -ForegroundColor Green To audit the WinRM client/service and RPC client settings status: Download Script: Get-WinRMAndRpcHardeningStatus.ps1 # Get-WinRMAndRpcHardeningStatus.ps1 # Description: Audits registry configuration of WinRM client/service options and RPC client restrictions. Write-Host "--- Auditing WinRM and RPC Hardening Settings ---" -ForegroundColor Cyan # 1. Audit WinRM Client $ClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client" $ExpectedClient = @{ "AllowBasic" = 0 "AllowUnencryptedTraffic" = 0 "AllowDigest" = 0 } if (Test-Path $ClientPath) { $ClientReg = Get-ItemProperty -Path $ClientPath -ErrorAction SilentlyContinue foreach ($S in $ExpectedClient.Keys) { $Val = $ClientReg.$S $Expected = $ExpectedClient[$S] $Color = if ($Val -eq $Expected) { "Green" } else { "Red" } Write-Host " - WinRM Client $($S): $Val (Expected: $Expected)" -ForegroundColor $Color } } else { Write-Host " - WinRM Client Registry: NOT FOUND" -ForegroundColor Red } # 2. Audit WinRM Service $ServicePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service" $ExpectedService = @{ "AllowBasic" = 0 "AllowUnencryptedTraffic" = 0 "DisableRunAs" = 1 } if (Test-Path $ServicePath) { $ServiceReg = Get-ItemProperty -Path $ServicePath -ErrorAction SilentlyContinue foreach ($S in $ExpectedService.Keys) { $Val = $ServiceReg.$S $Expected = $ExpectedService[$S] $Color = if ($Val -eq $Expected) { "Green" } else { "Red" } Write-Host " - WinRM Service $($S): $Val (Expected: $Expected)" -ForegroundColor $Color } } else { Write-Host " - WinRM Service Registry: NOT FOUND" -ForegroundColor Red } # 3. Audit Windows Remote Shell $WinRsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\WinRS" if (Test-Path $WinRsPath) { $WinRsReg = Get-ItemProperty -Path $WinRsPath -ErrorAction SilentlyContinue $RsVal = $WinRsReg.AllowRemoteShellAccess $RsColor = if ($RsVal -eq 0) { "Green" } else { "Red" } Write-Host " - Windows Remote Shell AllowRemoteShellAccess: $RsVal (Expected: 0)" -ForegroundColor $RsColor } else { Write-Host " - Windows Remote Shell Registry: NOT FOUND" -ForegroundColor Red } # 4. Audit RPC Clients $RpcPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" $RpcVal = Get-ItemProperty -Path $RpcPath -Name "RestrictRemoteClients" -ErrorAction SilentlyContinue $RpcSetting = if ($RpcVal) { $RpcVal.RestrictRemoteClients } else { 0 } $RpcColor = if ($RpcSetting -eq 1) { "Green" } else { "Red" } Write-Host " - RPC RestrictRemoteClients: $RpcSetting (Expected: 1)" -ForegroundColor $RpcColor # Set-WinRMAndRpcHardening.ps1 # Description: Hardens WinRM client/service parameters and restricts remote RPC clients. Write-Host "Applying WinRM and RPC channel hardening settings..." -ForegroundColor Cyan # 1. WinRM Client Hardening $ClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client" if (-not (Test-Path $ClientPath)) { New-Item -Path $ClientPath -Force | Out-Null } Set-ItemProperty -Path $ClientPath -Name "AllowBasic" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $ClientPath -Name "AllowUnencryptedTraffic" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $ClientPath -Name "AllowDigest" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] WinRM Client parameters hardened." -ForegroundColor Green # 2. WinRM Service Hardening $ServicePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service" if (-not (Test-Path $ServicePath)) { New-Item -Path $ServicePath -Force | Out-Null } Set-ItemProperty -Path $ServicePath -Name "AllowBasic" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $ServicePath -Name "AllowUnencryptedTraffic" -Value 0 -Type DWord -ErrorAction Stop Set-ItemProperty -Path $ServicePath -Name "DisableRunAs" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] WinRM Service parameters hardened." -ForegroundColor Green # 3. Windows Remote Shell Hardening $WinRsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\WinRS" if (-not (Test-Path $WinRsPath)) { New-Item -Path $WinRsPath -Force | Out-Null } Set-ItemProperty -Path $WinRsPath -Name "AllowRemoteShellAccess" -Value 0 -Type DWord -ErrorAction Stop Write-Host "[+] Windows Remote Shell access disabled." -ForegroundColor Green # 4. RPC Client Restrictions $RpcPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" if (-not (Test-Path $RpcPath)) { New-Item -Path $RpcPath -Force | Out-Null } Set-ItemProperty -Path $RpcPath -Name "RestrictRemoteClients" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] Unauthenticated RPC client restrictions enforced (RestrictRemoteClients = 1)." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers. Operating Systems: Windows Server 2016 (and above). > [!NOTE] > Client workstations and Privileged Access Workstations (PAWs) must not expose remote WMI endpoints. Inbound remote management protocols on endpoints are blocked entirely by workstation isolation controls ([REQ-NET-003]) and Defender Attack Surface Reduction (ASR) rules ([REQ-PAW-088] and [REQ-END-092]). File Path: 04-network-firewall/configure-wmi-static-port.md Windows Management Instrumentation (WMI) is a core Windows administration framework built upon the Distributed Component Object Model (DCOM) and Remote Procedure Call (RPC) protocols. By default, WMI runs inside a shared service host process (svchost.exe -k netsvcs) and dynamically allocates ephemeral high-order TCP ports (range 49152-65535) for remote client connections. Leaving WMI in its default configuration presents four critical security risks: The Dynamic RPC Port Dilemma & Attack Surface Exposure: Because remote WMI clients dynamically negotiate communication ports via the RPC Endpoint Mapper (RPCSS on TCP port 135), network administrators who allow remote WMI must either open the entire ephemeral dynamic port range (49152-65535) on network firewalls or disable host firewalls entirely. Opening thousands of dynamic ports circumvents perimeter filtering and exposes every local service listening on high-order sockets to unauthorized network traversal. Pinning WMI to a dedicated static port (TCP 24158) allows network and host firewalls to block the broad dynamic range and enforce strict microsegmentation. Lateral Movement and Living-off-the-Land Exploitation (MITRE ATT&CK T1047): Adversaries frequently leverage WMI to orchestrate stealthy lateral movement, execute remote code, query system configuration, and deploy backdoors without triggering interactive logon events (Event ID 4624 Type 3 network logons). Widely abused post-exploitation toolkits (such as Impacket's wmiexec.py, SharpWMI, and PowerShell CIM cmdlets) abuse DCOM interfaces to spawn malicious processes under WmiPrvSE.exe (e.g., Win32_Process.Create). Restricting WMI to static port 24158 and strictly scoping firewall access to authorized PAW subnets eliminates unmonitored cross-subnet living-off-the-land attacks. Wire Eavesdropping and Session Tampering Mitigation (CVE-2021-26414): Remote DCOM communications that operate below authentication level 6 (RPC_C_AUTHN_LEVEL_PKT_PRIVACY) do not encrypt payload data. Attackers positioned on the network path could intercept sensitive administrative data returned in WMI queries (such as system configurations, installed software inventories, environment variables, or process lists) or tamper with in-flight RPC commands. Enforcing AuthenticationLevel = 6 mandates packet-level Kerberos or NTLM encryption across all WMI communications, fully satisfying Microsoft DCOM security hardening requirements (KB5004442). Process Isolation and Memory Containment: By default, the winmgmt service shares a single svchost.exe process instance with multiple other system services (such as IP Helper, Background Intelligent Transfer Service, and Windows Update). Moving WMI into a standalone host process (SERVICE_WIN32_OWN_PROCESS, Type = 16) isolates its heap, thread pools, security tokens, and memory space. If an adjacent service running in a shared host process is compromised, process isolation prevents direct in-memory manipulation, token stealing, or tampering with directory management capabilities. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Define Static WMI Port, Packet Privacy, and Service Type via GPO Registry Preferences Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting the target systems (e.g., GPO_Hardening_Firewall_Baseline). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Define the following Registry Items: WMI Static Port Assignment*: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} Value Name*: Endpoints Value Type*: REG_MULTI_SZ Value Data*: ncacn_ip_tcp,0,24158 (Enter on a single line) WMI DCOM Packet Privacy Authentication Level*: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820} Value Name*: AuthenticationLevel Value Type*: REG_DWORD Value Data*: 6 (Decimal) WMI Standalone Process Type*: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Services\winmgmt Value Name*: Type Value Type*: REG_DWORD Value Data*: 16 (Decimal) 2. Configure Windows Defender Firewall with Advanced Security In the same or linked GPO, navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - [LDAP Path]\Inbound Rules Create a new custom Inbound Rule: Rule Type*: Port Protocol and Ports*: TCP, Specific local ports: 24158 Action*: Allow the connection Profile*: Check Domain and Private (uncheck Public) Name*: AD-Hardening-WMI-StaticPort-In Description*: Permits inbound WMI traffic on dedicated static TCP port 24158 from authorized Tier 1 / PAW management subnets. Open the properties of AD-Hardening-WMI-StaticPort-In and navigate to the Scope tab: Under Remote IP address , select These IP addresses*. Add the specific IP subnets of authorized PAWs, Tier 1 management bastions, and centralized SIEM/monitoring collectors. Do not leave this set to Any IP address*. Verify or create an inbound rule for the RPC Endpoint Mapper: * Protocol: TCP, Port: 135 * Scope: Restrict remote IP addresses strictly to the same authorized management subnets. Disable generic dynamic WMI rules: Ensure the predefined rule group `Windows Management Instrumentation (WMI)` is not* enabled broadly, or set explicit block rules for dynamic high ports 49152-65535 from non-management subnets. 3. Host Maintenance Reboot Deploy the GPO to the target Organizational Unit (OU) and plan a host reboot during the next maintenance window to initialize the standalone host process cleanly. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to apply the WMI static port configuration and host firewall restrictions. Remediation Script: Download Script: Set-WMIStaticPort.ps1 # Set-WMIStaticPort.ps1 # Description: Configures WMI to run in a standalone host process on static TCP port 24158 with packet privacy and configures host firewall rules. # Target Engine: Windows PowerShell 5.1 [CmdletBinding()] param ( [Parameter(Mandatory = $false)] [string[]]$ManagementSubnets = @() ) Write-Host "Applying hardening requirement: Configure WMI Static Port and Service Hardening..." -ForegroundColor Cyan # 1. Configure the static TCP port 24158 for WMI AppID $WmiAppIdPath = "HKLM:\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" if (-not (Test-Path -Path $WmiAppIdPath)) { New-Item -Path $WmiAppIdPath -Force | Out-Null } Set-ItemProperty -Path $WmiAppIdPath -Name "Endpoints" -Value @("ncacn_ip_tcp,0,24158") -Type MultiString Write-Host "[+] Configured WMI AppID static endpoint to TCP 24158." -ForegroundColor Green # 2. Configure DCOM Authentication Level to Packet Privacy (6) Set-ItemProperty -Path $WmiAppIdPath -Name "AuthenticationLevel" -Value 6 -Type DWord Write-Host "[+] Configured WMI AppID DCOM authentication level to 6 (RPC_C_AUTHN_LEVEL_PKT_PRIVACY)." -ForegroundColor Green # 3. Configure WMI service execution type to Standalone Host (Type = 16 / SERVICE_WIN32_OWN_PROCESS) $WinmgmtSvcPath = "HKLM:\SYSTEM\CurrentControlSet\Services\winmgmt" if (-not (Test-Path -Path $WinmgmtSvcPath)) { New-Item -Path $WinmgmtSvcPath -Force | Out-Null } Set-ItemProperty -Path $WinmgmtSvcPath -Name "Type" -Value 16 -Type DWord Write-Host "[+] Configured WMI service execution type to 16 (SERVICE_WIN32_OWN_PROCESS)." -ForegroundColor Green # 4. Invoke winmgmt standalone host configuration command Write-Host "[+] Executing winmgmt.exe /standalonehost 6..." -ForegroundColor Gray $Proc = Start-Process -FilePath "winmgmt.exe" -ArgumentList "/standalonehost 6" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -eq 0) { Write-Host "[+] WMI standalone host command completed successfully." -ForegroundColor Green } else { Write-Warning "[-] WMI standalone host command exited with code $($Proc.ExitCode)." } # 5. Configure Windows Defender Firewall Inbound Rule for WMI Static Port 24158 Write-Host "[+] Configuring Windows Defender Firewall rule for static TCP port 24158..." -ForegroundColor Gray $RuleName = "AD-Hardening-WMI-StaticPort-In" $ExistingRule = Get-NetFirewallRule -Name $RuleName -ErrorAction SilentlyContinue $FirewallParams = @{ DisplayName = "Active Directory Hardening - WMI Static Port (TCP 24158)" Description = "Permits inbound DCOM/WMI traffic on dedicated static TCP port 24158 from authorized management hosts." Direction = "Inbound" Action = "Allow" Protocol = "TCP" LocalPort = "24158" Profile = "Domain,Private" Enabled = "True" } if ($ManagementSubnets.Count -gt 0) { $FirewallParams["RemoteAddress"] = $ManagementSubnets } if ($ExistingRule) { Set-NetFirewallRule -Name $RuleName @FirewallParams | Out-Null Write-Host "[+] Updated existing firewall rule: $RuleName." -ForegroundColor Green } else { New-NetFirewallRule -Name $RuleName @FirewallParams | Out-Null Write-Host "[+] Created new inbound firewall rule: $RuleName." -ForegroundColor Green } # 6. Disable unconstrained dynamic WMI inbound rules to prevent ephemeral port exposure Write-Host "[+] Disabling built-in dynamic WMI firewall rules..." -ForegroundColor Gray $DynamicWmiRules = Get-NetFirewallRule -DisplayGroup "Windows Management Instrumentation (WMI)" -ErrorAction SilentlyContinue | Where-Object { $_.Direction -eq "Inbound" -and $_.Name -like "*WMI-In*" -and $_.Name -ne $RuleName } foreach ($DynRule in $DynamicWmiRules) { Disable-NetFirewallRule -Name $DynRule.Name | Out-Null Write-Host " - Disabled dynamic WMI rule: $($DynRule.DisplayName)" -ForegroundColor Gray } Write-Host "`n[+] Hardening configuration applied successfully." -ForegroundColor Cyan Write-Host "[!] IMPORTANT: A system reboot is strongly recommended to cleanly apply WMI service isolation and restart all dependent infrastructure services." -ForegroundColor Yellow Audit Script: Download Script: Test-WMIStaticPort.ps1 # Test-WMIStaticPort.ps1 # Description: Audits WMI static port registry configuration, DCOM authentication level, service isolation, and firewall rules. # Target Engine: Windows PowerShell 5.1 Write-Host "Auditing WMI static port configuration and service hardening..." -ForegroundColor Cyan $vulnerable = $false # 1. Audit AppID Endpoints Registry Setting $WmiAppIdPath = "HKLM:\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" $AppIdProps = Get-ItemProperty -Path $WmiAppIdPath -ErrorAction SilentlyContinue if ($AppIdProps -and $AppIdProps.Endpoints) { $Endpoints = $AppIdProps.Endpoints if ($Endpoints -contains "ncacn_ip_tcp,0,24158") { Write-Host "[+] WMI static port registry endpoint is configured correctly (TCP 24158)." -ForegroundColor Green } else { Write-Host "[!] NON-COMPLIANT: WMI Endpoints registry value is: '$($Endpoints -join ', ')' (Expected: 'ncacn_ip_tcp,0,24158')" -ForegroundColor Red $vulnerable = $true } } else { Write-Host "[!] NON-COMPLIANT: WMI AppID 'Endpoints' registry value is missing or inaccessible." -ForegroundColor Red $vulnerable = $true } # 2. Audit AppID DCOM Authentication Level (Packet Privacy = 6) if ($AppIdProps -and $null -ne $AppIdProps.AuthenticationLevel) { $AuthLevel = [int]$AppIdProps.AuthenticationLevel if ($AuthLevel -ge 6) { Write-Host "[+] WMI AppID DCOM AuthenticationLevel is configured to Packet Privacy ($AuthLevel)." -ForegroundColor Green } else { Write-Host "[!] NON-COMPLIANT: WMI AppID AuthenticationLevel is: $AuthLevel (Expected: 6 [RPC_C_AUTHN_LEVEL_PKT_PRIVACY])" -ForegroundColor Red $vulnerable = $true } } else { Write-Host "[!] NON-COMPLIANT: WMI AppID 'AuthenticationLevel' value is missing (Expected: 6)." -ForegroundColor Red $vulnerable = $true } # 3. Audit WMI Service Execution Type (Standalone Host = 16) $WinmgmtPath = "HKLM:\SYSTEM\CurrentControlSet\Services\winmgmt" $TypeVal = Get-ItemProperty -Path $WinmgmtPath -Name "Type" -ErrorAction SilentlyContinue if ($TypeVal -and $null -ne $TypeVal.Type) { $Type = [int]$TypeVal.Type if ($Type -eq 16) { Write-Host "[+] WMI is configured to run as a standalone process (Type = 16 [SERVICE_WIN32_OWN_PROCESS])." -ForegroundColor Green } else { Write-Host "[!] NON-COMPLIANT: WMI service execution type is: $Type (Expected: 16 [SERVICE_WIN32_OWN_PROCESS])" -ForegroundColor Red $vulnerable = $true } } else { Write-Host "[!] NON-COMPLIANT: WMI service registry key is missing or inaccessible." -ForegroundColor Red $vulnerable = $true } # 4. Audit Host Firewall Inbound Rule for TCP 24158 $FwRules = Get-NetFirewallRule -Direction Inbound -Enabled True -ErrorAction SilentlyContinue | Where-Object { $_.Action -eq "Allow" } $WmiStaticPortAllowed = $false foreach ($Rule in $FwRules) { $PortFilter = Get-NetFirewallPortFilter -AssociatedNetFirewallRule $Rule -ErrorAction SilentlyContinue if ($PortFilter -and $PortFilter.Protocol -eq "TCP") { $LocalPorts = @($PortFilter.LocalPort) if ($LocalPorts -contains "24158") { $WmiStaticPortAllowed = $true break } } } if ($WmiStaticPortAllowed) { Write-Host "[+] Windows Defender Firewall has an active inbound allow rule for TCP port 24158." -ForegroundColor Green } else { Write-Host "[!] NON-COMPLIANT: No active inbound firewall rule permitting TCP port 24158 found." -ForegroundColor Red $vulnerable = $true } # 5. Audit Built-in Dynamic WMI Firewall Rules $DynamicWmiRules = Get-NetFirewallRule -DisplayGroup "Windows Management Instrumentation (WMI)" -Direction Inbound -Enabled True -ErrorAction SilentlyContinue | Where-Object { $_.Name -like "*WMI-In*" } if ($DynamicWmiRules) { $UnrestrictedDynamicRule = $false foreach ($DynRule in $DynamicWmiRules) { $AddressFilter = Get-NetFirewallAddressFilter -AssociatedNetFirewallRule $DynRule -ErrorAction SilentlyContinue if ($AddressFilter -and ($AddressFilter.RemoteAddress -contains "Any" -or -not $AddressFilter.RemoteAddress)) { $UnrestrictedDynamicRule = $true break } } if ($UnrestrictedDynamicRule) { Write-Host "[!] NON-COMPLIANT: Built-in dynamic WMI firewall rules are enabled and allow unconstrained dynamic RPC ports from Any address." -ForegroundColor Red $vulnerable = $true } else { Write-Host "[+] Built-in dynamic WMI firewall rules are restricted to specific subnets." -ForegroundColor Green } } else { Write-Host "[+] Built-in generic dynamic WMI inbound firewall rules are disabled." -ForegroundColor Green } # Final Verdict if ($vulnerable) { Write-Host "Audit result: NON-COMPLIANT" -ForegroundColor Red } else { Write-Host "Audit result: COMPLIANT" -ForegroundColor Green } # Set-WMIStaticPort.ps1 # Description: Configures WMI to run in a standalone host process on static TCP port 24158 with packet privacy and configures host firewall rules. # Target Engine: Windows PowerShell 5.1 [CmdletBinding()] param ( [Parameter(Mandatory = $false)] [string[]]$ManagementSubnets = @() ) Write-Host "Applying hardening requirement: Configure WMI Static Port and Service Hardening..." -ForegroundColor Cyan # 1. Configure the static TCP port 24158 for WMI AppID $WmiAppIdPath = "HKLM:\SOFTWARE\Classes\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" if (-not (Test-Path -Path $WmiAppIdPath)) { New-Item -Path $WmiAppIdPath -Force | Out-Null } Set-ItemProperty -Path $WmiAppIdPath -Name "Endpoints" -Value @("ncacn_ip_tcp,0,24158") -Type MultiString Write-Host "[+] Configured WMI AppID static endpoint to TCP 24158." -ForegroundColor Green # 2. Configure DCOM Authentication Level to Packet Privacy (6) Set-ItemProperty -Path $WmiAppIdPath -Name "AuthenticationLevel" -Value 6 -Type DWord Write-Host "[+] Configured WMI AppID DCOM authentication level to 6 (RPC_C_AUTHN_LEVEL_PKT_PRIVACY)." -ForegroundColor Green # 3. Configure WMI service execution type to Standalone Host (Type = 16 / SERVICE_WIN32_OWN_PROCESS) $WinmgmtSvcPath = "HKLM:\SYSTEM\CurrentControlSet\Services\winmgmt" if (-not (Test-Path -Path $WinmgmtSvcPath)) { New-Item -Path $WinmgmtSvcPath -Force | Out-Null } Set-ItemProperty -Path $WinmgmtSvcPath -Name "Type" -Value 16 -Type DWord Write-Host "[+] Configured WMI service execution type to 16 (SERVICE_WIN32_OWN_PROCESS)." -ForegroundColor Green # 4. Invoke winmgmt standalone host configuration command Write-Host "[+] Executing winmgmt.exe /standalonehost 6..." -ForegroundColor Gray $Proc = Start-Process -FilePath "winmgmt.exe" -ArgumentList "/standalonehost 6" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -eq 0) { Write-Host "[+] WMI standalone host command completed successfully." -ForegroundColor Green } else { Write-Warning "[-] WMI standalone host command exited with code $($Proc.ExitCode)." } # 5. Configure Windows Defender Firewall Inbound Rule for WMI Static Port 24158 Write-Host "[+] Configuring Windows Defender Firewall rule for static TCP port 24158..." -ForegroundColor Gray $RuleName = "AD-Hardening-WMI-StaticPort-In" $ExistingRule = Get-NetFirewallRule -Name $RuleName -ErrorAction SilentlyContinue $FirewallParams = @{ DisplayName = "Active Directory Hardening - WMI Static Port (TCP 24158)" Description = "Permits inbound DCOM/WMI traffic on dedicated static TCP port 24158 from authorized management hosts." Direction = "Inbound" Action = "Allow" Protocol = "TCP" LocalPort = "24158" Profile = "Domain,Private" Enabled = "True" } if ($ManagementSubnets.Count -gt 0) { $FirewallParams["RemoteAddress"] = $ManagementSubnets } if ($ExistingRule) { Set-NetFirewallRule -Name $RuleName @FirewallParams | Out-Null Write-Host "[+] Updated existing firewall rule: $RuleName." -ForegroundColor Green } else { New-NetFirewallRule -Name $RuleName @FirewallParams | Out-Null Write-Host "[+] Created new inbound firewall rule: $RuleName." -ForegroundColor Green } # 6. Disable unconstrained dynamic WMI inbound rules to prevent ephemeral port exposure Write-Host "[+] Disabling built-in dynamic WMI firewall rules..." -ForegroundColor Gray $DynamicWmiRules = Get-NetFirewallRule -DisplayGroup "Windows Management Instrumentation (WMI)" -ErrorAction SilentlyContinue | Where-Object { $_.Direction -eq "Inbound" -and $_.Name -like "*WMI-In*" -and $_.Name -ne $RuleName } foreach ($DynRule in $DynamicWmiRules) { Disable-NetFirewallRule -Name $DynRule.Name | Out-Null Write-Host " - Disabled dynamic WMI rule: $($DynRule.DisplayName)" -ForegroundColor Gray } Write-Host "`n[+] Hardening configuration applied successfully." -ForegroundColor Cyan Write-Host "[!] IMPORTANT: A system reboot is strongly recommended to cleanly apply WMI service isolation and restart all dependent infrastructure services." -ForegroundColor Yellow Target Scope: Applicable Systems: Domain Controllers, Member Servers. Operating Systems: Windows Server 2016 (and above). File Path: 04-network-firewall/configure-rpc-named-pipe-filters.md Active Directory domains heavily rely on the Server Message Block (SMB) protocol (TCP 445) for distributing group policies and replication via the SYSVOL and NETLOGON file shares. Because every joined domain member requires access to these shares, TCP port 445 cannot simply be blocked at the network perimeter or host firewall level on Domain Controllers. However, adversaries and post-exploitation frameworks (such as Impacket PsExec, SMBExec, AExec, Coercer, PetitPotam, and Mimikatz) routinely abuse this open SMB surface. Windows Remote Procedure Call (RPC) supports two primary transport protocols: 1. RPC over TCP/IP (`ncacn_ip_tcp`): Binds each service dynamically (or to configured static ports) across ephemeral TCP ports (49152-65535). 2. RPC over Named Pipes (`ncacn_np`): Multiplexes RPC requests directly through SMB named pipes over TCP port 445. Standard Layer 3 and Layer 4 firewall rules can only permit or block the entire TCP port 445. If TCP 445 is permitted, an attacker with network access can connect to sensitive SMB named pipes (such as \PIPE\svcctl or \PIPE\atsvc) to execute remote code or trigger authentication coercion without ever needing access to dynamic RPC ports. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Create the RPC Filters Definition File Create a text file named RpcNamedPipesFilters.txt containing the following Netsh commands: rpc filter # [MS-SCMR] Block Service Control Manager over SMB named pipes (\PIPE\svcctl) add rule layer=um actiontype=block filterkey=d0c7640c-9355-4e52-8335-c12835559c10 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=367ABB81-9844-35F1-AD32-98F038001003 add filter # [MS-TSCH] Block Task Scheduler Remoting over SMB named pipes (\PIPE\atsvc) add rule layer=um actiontype=block filterkey=a43b9dd2-0866-4476-89dc-2e9b200762af add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=86D35949-83C9-4044-B424-DB363231FD0C add filter # [MS-TSCH] Block Task Scheduler Legacy at.exe interface 1 (All transports) add rule layer=um actiontype=block filterkey=13518c11-e3d8-4f62-9461-eda11beb540a add condition field=if_uuid matchtype=equal data=1FF70682-0A51-30E8-076D-740BE8CEE98B add filter # [MS-TSCH] Block Task Scheduler Legacy at.exe interface 2 (All transports) add rule layer=um actiontype=block filterkey=1c079a18-e91f-4698-9868-68a121490636 add condition field=if_uuid matchtype=equal data=378E52B0-C0A9-11CF-822D-00AA0051E40F add filter # [MS-EVEN6] Block EventLog v6.0 Remoting over SMB named pipes (\PIPE\eventlog) add rule layer=um actiontype=block filterkey=dedffabf-db89-4177-be77-1954aa2c0b95 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=f6beaff7-1e19-4fbb-9f8f-b89e2018337c add filter # [MS-EVEN] Block Legacy EventLog Remoting Protocol (All transports) add rule layer=um actiontype=block filterkey=f7f68868-5f50-4cda-a18c-6a7a549652e7 add condition field=if_uuid matchtype=equal data=82273FDC-E32A-18C3-3F78-827929DC23EA add filter # [MS-DFSNM] Permit DFS Namespace Management exclusively for Domain Admins (\PIPE\netdfs) add rule layer=um actiontype=permit filterkey=43873c58-e130-4ffb-8858-d259a673a917 add condition field=if_uuid matchtype=equal data=4FC742E0-4A10-11CF-8273-00AA004AE673 add condition field=remote_user_token matchtype=equal data=D:(A;;CC;;;DA) add filter # [MS-DFSNM] Block DFS Namespace Management for all other users add rule layer=um actiontype=block filterkey=0a239867-73db-45e6-b287-d006fe3c8b18 add condition field=if_uuid matchtype=equal data=4FC742E0-4A10-11CF-8273-00AA004AE673 add filter # [MS-RPRN] Block Print System Remote Protocol over SMB named pipes (\PIPE\spoolss) add rule layer=um actiontype=block filterkey=7966512a-f2f4-4cb1-812d-d967ab83d28a add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=12345678-1234-ABCD-EF00-0123456789AB add filter # [MS-EFSR] Permit EFSRPC via lsarpc only if Kerberos-authenticated and encrypted add rule layer=um actiontype=permit filterkey=d71d00db-3eef-4935-bedf-20cf628abd9e add condition field=if_uuid matchtype=equal data=c681d488-d850-11d0-8c52-00c04fd90f7e add condition field=auth_type matchtype=equal data=16 add condition field=auth_level matchtype=equal data=6 add filter # [MS-EFSR] Block unencrypted or unauthenticated EFSRPC via lsarpc add rule layer=um actiontype=block filterkey=3a4cce27-a7fa-4248-b8b8-ef6439a2c0ff add condition field=if_uuid matchtype=equal data=c681d488-d850-11d0-8c52-00c04fd90f7e add filter # [MS-EFSR] Permit EFSRPC via efsrpc only if Kerberos-authenticated and encrypted add rule layer=um actiontype=permit filterkey=c5cf8020-c83c-4803-9241-8c7f3b10171f add condition field=if_uuid matchtype=equal data=df1941c5-fe89-4e79-bf10-463657acf44d add condition field=auth_type matchtype=equal data=16 add condition field=auth_level matchtype=equal data=6 add filter # [MS-EFSR] Block unencrypted or unauthenticated EFSRPC via efsrpc add rule layer=um actiontype=block filterkey=9ad23a91-085d-4f99-ae15-85e0ad801278 add condition field=if_uuid matchtype=equal data=df1941c5-fe89-4e79-bf10-463657acf44d add filter # [MS-DNSP] Block DNS Server Management over SMB named pipes (\PIPE\DNSSERVER) add rule layer=um actiontype=block filterkey=50754fe4-aa2d-42ff-8196-e90ea8fd2527 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=50abc2a4-574d-40b3-9d66-ee4fd5fba076 add filter # Block default Mimikatz MimiCom C2 interface (All transports) add rule layer=um actiontype=block filterkey=644291ca-9530-4066-b654-e7b838ebdc06 add condition field=if_uuid matchtype=equal data=17FC11E9-C258-4B8D-8D07-2F4125156244 add filter # [MS-FSRVP] Block File Server Remote VSS Protocol over SMB named pipes (\PIPE\FssagentRpc) add rule layer=um actiontype=block filterkey=5270da6b-67a8-4cbf-8b2c-fa5d0abcb975 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=a8e0653c-2744-4389-a61d-7373df8b2292 add filter 2. Deploy via GPO Startup Script Open the Group Policy Management Console (gpmc.msc). Edit the target Domain Controllers hardening GPO. Navigate to: Computer Configuration\Policies\Windows Settings\Scripts (Startup) Save RpcNamedPipesFilters.txt inside the GPO's Startup folder. Create a batch script named Import-RpcFilters.bat in the same directory: `cmd @echo off rem Import Windows Firewall RPC Named Pipe filters netsh.exe -f "%~dp0RpcNamedPipesFilters.txt" Add Import-RpcFilters.bat to the GPO Startup Scripts list. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to deploy or verify the RPC named pipe filters. Remediation Script: Download Script: Set-RpcNamedPipeFilters.ps1 # Set-RpcNamedPipeFilters.ps1 # Description: Generates and imports RPC filters to block remote management and coercion over SMB named pipes. Write-Host "Applying hardening requirement: Configure RPC Named Pipe Filters..." -ForegroundColor Cyan # Define the path where the filters file will be written $FilterFilePath = Join-Path $env:TEMP "RpcNamedPipesFilters.txt" # Write the netsh RPC filter commands $FilterContent = @" rpc filter # [MS-SCMR] Block Service Control Manager over SMB named pipes (\PIPE\svcctl) add rule layer=um actiontype=block filterkey=d0c7640c-9355-4e52-8335-c12835559c10 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=367ABB81-9844-35F1-AD32-98F038001003 add filter # [MS-TSCH] Block Task Scheduler Remoting over SMB named pipes (\PIPE\atsvc) add rule layer=um actiontype=block filterkey=a43b9dd2-0866-4476-89dc-2e9b200762af add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=86D35949-83C9-4044-B424-DB363231FD0C add filter # [MS-TSCH] Block Task Scheduler Legacy at.exe interface 1 (All transports) add rule layer=um actiontype=block filterkey=13518c11-e3d8-4f62-9461-eda11beb540a add condition field=if_uuid matchtype=equal data=1FF70682-0A51-30E8-076D-740BE8CEE98B add filter # [MS-TSCH] Block Task Scheduler Legacy at.exe interface 2 (All transports) add rule layer=um actiontype=block filterkey=1c079a18-e91f-4698-9868-68a121490636 add condition field=if_uuid matchtype=equal data=378E52B0-C0A9-11CF-822D-00AA0051E40F add filter # [MS-EVEN6] Block EventLog v6.0 Remoting over SMB named pipes (\PIPE\eventlog) add rule layer=um actiontype=block filterkey=dedffabf-db89-4177-be77-1954aa2c0b95 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=f6beaff7-1e19-4fbb-9f8f-b89e2018337c add filter # [MS-EVEN] Block Legacy EventLog Remoting Protocol (All transports) add rule layer=um actiontype=block filterkey=f7f68868-5f50-4cda-a18c-6a7a549652e7 add condition field=if_uuid matchtype=equal data=82273FDC-E32A-18C3-3F78-827929DC23EA add filter # [MS-DFSNM] Permit DFS Namespace Management exclusively for Domain Admins (\PIPE\netdfs) add rule layer=um actiontype=permit filterkey=43873c58-e130-4ffb-8858-d259a673a917 add condition field=if_uuid matchtype=equal data=4FC742E0-4A10-11CF-8273-00AA004AE673 add condition field=remote_user_token matchtype=equal data=D:(A;;CC;;;DA) add filter # [MS-DFSNM] Block DFS Namespace Management for all other users add rule layer=um actiontype=block filterkey=0a239867-73db-45e6-b287-d006fe3c8b18 add condition field=if_uuid matchtype=equal data=4FC742E0-4A10-11CF-8273-00AA004AE673 add filter # [MS-RPRN] Block Print System Remote Protocol over SMB named pipes (\PIPE\spoolss) add rule layer=um actiontype=block filterkey=7966512a-f2f4-4cb1-812d-d967ab83d28a add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=12345678-1234-ABCD-EF00-0123456789AB add filter # [MS-EFSR] Permit EFSRPC via lsarpc only if Kerberos-authenticated and encrypted add rule layer=um actiontype=permit filterkey=d71d00db-3eef-4935-bedf-20cf628abd9e add condition field=if_uuid matchtype=equal data=c681d488-d850-11d0-8c52-00c04fd90f7e add condition field=auth_type matchtype=equal data=16 add condition field=auth_level matchtype=equal data=6 add filter # [MS-EFSR] Block unencrypted or unauthenticated EFSRPC via lsarpc add rule layer=um actiontype=block filterkey=3a4cce27-a7fa-4248-b8b8-ef6439a2c0ff add condition field=if_uuid matchtype=equal data=c681d488-d850-11d0-8c52-00c04fd90f7e add filter # [MS-EFSR] Permit EFSRPC via efsrpc only if Kerberos-authenticated and encrypted add rule layer=um actiontype=permit filterkey=c5cf8020-c83c-4803-9241-8c7f3b10171f add condition field=if_uuid matchtype=equal data=df1941c5-fe89-4e79-bf10-463657acf44d add condition field=auth_type matchtype=equal data=16 add condition field=auth_level matchtype=equal data=6 add filter # [MS-EFSR] Block unencrypted or unauthenticated EFSRPC via efsrpc add rule layer=um actiontype=block filterkey=9ad23a91-085d-4f99-ae15-85e0ad801278 add condition field=if_uuid matchtype=equal data=df1941c5-fe89-4e79-bf10-463657acf44d add filter # [MS-DNSP] Block DNS Server Management over SMB named pipes (\PIPE\DNSSERVER) add rule layer=um actiontype=block filterkey=50754fe4-aa2d-42ff-8196-e90ea8fd2527 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=50abc2a4-574d-40b3-9d66-ee4fd5fba076 add filter # Block default Mimikatz MimiCom C2 interface (All transports) add rule layer=um actiontype=block filterkey=644291ca-9530-4066-b654-e7b838ebdc06 add condition field=if_uuid matchtype=equal data=17FC11E9-C258-4B8D-8D07-2F4125156244 add filter # [MS-FSRVP] Block File Server Remote VSS Protocol over SMB named pipes (\PIPE\FssagentRpc) add rule layer=um actiontype=block filterkey=5270da6b-67a8-4cbf-8b2c-fa5d0abcb975 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=a8e0653c-2744-4389-a61d-7373df8b2292 add filter "@ # Write filters to temp file Set-Content -Path $FilterFilePath -Value $FilterContent -Encoding Ascii Write-Host "[+] Generated RPC filters definition file at: $FilterFilePath" -ForegroundColor Gray # Import filters using netsh (requires administrative elevation) Write-Host "[+] Importing RPC filters using Netsh..." -ForegroundColor Gray $Proc = Start-Process -FilePath "netsh.exe" -ArgumentList "-f `"$FilterFilePath`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -eq 0) { Write-Host "[+] RPC filters imported successfully." -ForegroundColor Green } else { Write-Error "[-] Failed to import RPC filters. Netsh exit code: $($Proc.ExitCode)." } # Clean up temp file if (Test-Path $FilterFilePath) { Remove-Item -Path $FilterFilePath -Force | Out-Null } Audit Script: Download Script: Test-RpcNamedPipeFilters.ps1 # Test-RpcNamedPipeFilters.ps1 # Description: Audits active RPC filters configuration using Netsh queries. Write-Host "Auditing RPC filters configuration..." -ForegroundColor Cyan # Query active RPC filters $filters = netsh.exe rpc filter show filter # Define expected RPC filter rules with their metadata $expectedRules = @( @{ FilterKey = "d0c7640c-9355-4e52-8335-c12835559c10"; Name = "MS-SCMR Service Control Manager (Block ncacn_np)"; Pipe = "\PIPE\svcctl" } @{ FilterKey = "a43b9dd2-0866-4476-89dc-2e9b200762af"; Name = "MS-TSCH Task Scheduler Remoting (Block ncacn_np)"; Pipe = "\PIPE\atsvc" } @{ FilterKey = "13518c11-e3d8-4f62-9461-eda11beb540a"; Name = "MS-TSCH Task Scheduler Legacy AT 1 (Block All)"; Pipe = "\PIPE\atsvc" } @{ FilterKey = "1c079a18-e91f-4698-9868-68a121490636"; Name = "MS-TSCH Task Scheduler Legacy AT 2 (Block All)"; Pipe = "\PIPE\atsvc" } @{ FilterKey = "dedffabf-db89-4177-be77-1954aa2c0b95"; Name = "MS-EVEN6 EventLog v6.0 Remoting (Block ncacn_np)"; Pipe = "\PIPE\eventlog" } @{ FilterKey = "f7f68868-5f50-4cda-a18c-6a7a549652e7"; Name = "MS-EVEN EventLog Legacy (Block All)"; Pipe = "\PIPE\eventlog" } @{ FilterKey = "43873c58-e130-4ffb-8858-d259a673a917"; Name = "MS-DFSNM DFS Namespace Mgmt (Permit Domain Admins)"; Pipe = "\PIPE\netdfs" } @{ FilterKey = "0a239867-73db-45e6-b287-d006fe3c8b18"; Name = "MS-DFSNM DFS Namespace Mgmt (Block Others)"; Pipe = "\PIPE\netdfs" } @{ FilterKey = "7966512a-f2f4-4cb1-812d-d967ab83d28a"; Name = "MS-RPRN Print System Remote (Block ncacn_np)"; Pipe = "\PIPE\spoolss" } @{ FilterKey = "d71d00db-3eef-4935-bedf-20cf628abd9e"; Name = "MS-EFSR via lsarpc (Permit Kerberos Encrypted)"; Pipe = "\PIPE\lsarpc" } @{ FilterKey = "3a4cce27-a7fa-4248-b8b8-ef6439a2c0ff"; Name = "MS-EFSR via lsarpc (Block Others)"; Pipe = "\PIPE\lsarpc" } @{ FilterKey = "c5cf8020-c83c-4803-9241-8c7f3b10171f"; Name = "MS-EFSR via efsrpc (Permit Kerberos Encrypted)"; Pipe = "\PIPE\efsrpc" } @{ FilterKey = "9ad23a91-085d-4f99-ae15-85e0ad801278"; Name = "MS-EFSR via efsrpc (Block Others)"; Pipe = "\PIPE\efsrpc" } @{ FilterKey = "50754fe4-aa2d-42ff-8196-e90ea8fd2527"; Name = "MS-DNSP DNS Server Remote Mgmt (Block ncacn_np)"; Pipe = "\PIPE\DNSSERVER" } @{ FilterKey = "644291ca-9530-4066-b654-e7b838ebdc06"; Name = "MimiCom Mimikatz Remote C2 (Block All)"; Pipe = "Any" } @{ FilterKey = "5270da6b-67a8-4cbf-8b2c-fa5d0abcb975"; Name = "MS-FSRVP File Server Remote VSS (Block ncacn_np)"; Pipe = "\PIPE\FssagentRpc" } ) $missingFilters = @() $activeFiltersCount = 0 # Join netsh output into a single string for fast and case-insensitive matching $rawFiltersOutput = ($filters -join "`n").ToLowerInvariant() foreach ($rule in $expectedRules) { $targetKey = $rule.FilterKey.ToLowerInvariant() if ($rawFiltersOutput.Contains($targetKey)) { $activeFiltersCount++ Write-Host "[+] Active: $($rule.Name) [Key: $($rule.FilterKey)]" -ForegroundColor Green } else { $missingFilters += $rule Write-Host "[-] Missing: $($rule.Name) [Key: $($rule.FilterKey)]" -ForegroundColor Yellow } } Write-Host "`nSummary: $activeFiltersCount of $($expectedRules.Count) expected RPC filters are active." -ForegroundColor Cyan if ($missingFilters.Count -eq 0) { Write-Host "[+] All 16 RPC named pipe filters are active and enforced." -ForegroundColor Green Write-Host "Audit result: COMPLIANT" -ForegroundColor Green } else { Write-Host "[!] NON-COMPLIANT: $($missingFilters.Count) RPC named pipe filter rule(s) are missing or inactive." -ForegroundColor Red Write-Host "Audit result: NON-COMPLIANT" -ForegroundColor Red } # Set-RpcNamedPipeFilters.ps1 # Description: Generates and imports RPC filters to block remote management and coercion over SMB named pipes. Write-Host "Applying hardening requirement: Configure RPC Named Pipe Filters..." -ForegroundColor Cyan # Define the path where the filters file will be written $FilterFilePath = Join-Path $env:TEMP "RpcNamedPipesFilters.txt" # Write the netsh RPC filter commands $FilterContent = @" rpc filter # [MS-SCMR] Block Service Control Manager over SMB named pipes (\PIPE\svcctl) add rule layer=um actiontype=block filterkey=d0c7640c-9355-4e52-8335-c12835559c10 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=367ABB81-9844-35F1-AD32-98F038001003 add filter # [MS-TSCH] Block Task Scheduler Remoting over SMB named pipes (\PIPE\atsvc) add rule layer=um actiontype=block filterkey=a43b9dd2-0866-4476-89dc-2e9b200762af add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=86D35949-83C9-4044-B424-DB363231FD0C add filter # [MS-TSCH] Block Task Scheduler Legacy at.exe interface 1 (All transports) add rule layer=um actiontype=block filterkey=13518c11-e3d8-4f62-9461-eda11beb540a add condition field=if_uuid matchtype=equal data=1FF70682-0A51-30E8-076D-740BE8CEE98B add filter # [MS-TSCH] Block Task Scheduler Legacy at.exe interface 2 (All transports) add rule layer=um actiontype=block filterkey=1c079a18-e91f-4698-9868-68a121490636 add condition field=if_uuid matchtype=equal data=378E52B0-C0A9-11CF-822D-00AA0051E40F add filter # [MS-EVEN6] Block EventLog v6.0 Remoting over SMB named pipes (\PIPE\eventlog) add rule layer=um actiontype=block filterkey=dedffabf-db89-4177-be77-1954aa2c0b95 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=f6beaff7-1e19-4fbb-9f8f-b89e2018337c add filter # [MS-EVEN] Block Legacy EventLog Remoting Protocol (All transports) add rule layer=um actiontype=block filterkey=f7f68868-5f50-4cda-a18c-6a7a549652e7 add condition field=if_uuid matchtype=equal data=82273FDC-E32A-18C3-3F78-827929DC23EA add filter # [MS-DFSNM] Permit DFS Namespace Management exclusively for Domain Admins (\PIPE\netdfs) add rule layer=um actiontype=permit filterkey=43873c58-e130-4ffb-8858-d259a673a917 add condition field=if_uuid matchtype=equal data=4FC742E0-4A10-11CF-8273-00AA004AE673 add condition field=remote_user_token matchtype=equal data=D:(A;;CC;;;DA) add filter # [MS-DFSNM] Block DFS Namespace Management for all other users add rule layer=um actiontype=block filterkey=0a239867-73db-45e6-b287-d006fe3c8b18 add condition field=if_uuid matchtype=equal data=4FC742E0-4A10-11CF-8273-00AA004AE673 add filter # [MS-RPRN] Block Print System Remote Protocol over SMB named pipes (\PIPE\spoolss) add rule layer=um actiontype=block filterkey=7966512a-f2f4-4cb1-812d-d967ab83d28a add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=12345678-1234-ABCD-EF00-0123456789AB add filter # [MS-EFSR] Permit EFSRPC via lsarpc only if Kerberos-authenticated and encrypted add rule layer=um actiontype=permit filterkey=d71d00db-3eef-4935-bedf-20cf628abd9e add condition field=if_uuid matchtype=equal data=c681d488-d850-11d0-8c52-00c04fd90f7e add condition field=auth_type matchtype=equal data=16 add condition field=auth_level matchtype=equal data=6 add filter # [MS-EFSR] Block unencrypted or unauthenticated EFSRPC via lsarpc add rule layer=um actiontype=block filterkey=3a4cce27-a7fa-4248-b8b8-ef6439a2c0ff add condition field=if_uuid matchtype=equal data=c681d488-d850-11d0-8c52-00c04fd90f7e add filter # [MS-EFSR] Permit EFSRPC via efsrpc only if Kerberos-authenticated and encrypted add rule layer=um actiontype=permit filterkey=c5cf8020-c83c-4803-9241-8c7f3b10171f add condition field=if_uuid matchtype=equal data=df1941c5-fe89-4e79-bf10-463657acf44d add condition field=auth_type matchtype=equal data=16 add condition field=auth_level matchtype=equal data=6 add filter # [MS-EFSR] Block unencrypted or unauthenticated EFSRPC via efsrpc add rule layer=um actiontype=block filterkey=9ad23a91-085d-4f99-ae15-85e0ad801278 add condition field=if_uuid matchtype=equal data=df1941c5-fe89-4e79-bf10-463657acf44d add filter # [MS-DNSP] Block DNS Server Management over SMB named pipes (\PIPE\DNSSERVER) add rule layer=um actiontype=block filterkey=50754fe4-aa2d-42ff-8196-e90ea8fd2527 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=50abc2a4-574d-40b3-9d66-ee4fd5fba076 add filter # Block default Mimikatz MimiCom C2 interface (All transports) add rule layer=um actiontype=block filterkey=644291ca-9530-4066-b654-e7b838ebdc06 add condition field=if_uuid matchtype=equal data=17FC11E9-C258-4B8D-8D07-2F4125156244 add filter # [MS-FSRVP] Block File Server Remote VSS Protocol over SMB named pipes (\PIPE\FssagentRpc) add rule layer=um actiontype=block filterkey=5270da6b-67a8-4cbf-8b2c-fa5d0abcb975 add condition field=protocol matchtype=equal data=ncacn_np add condition field=if_uuid matchtype=equal data=a8e0653c-2744-4389-a61d-7373df8b2292 add filter "@ # Write filters to temp file Set-Content -Path $FilterFilePath -Value $FilterContent -Encoding Ascii Write-Host "[+] Generated RPC filters definition file at: $FilterFilePath" -ForegroundColor Gray # Import filters using netsh (requires administrative elevation) Write-Host "[+] Importing RPC filters using Netsh..." -ForegroundColor Gray $Proc = Start-Process -FilePath "netsh.exe" -ArgumentList "-f `"$FilterFilePath`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -eq 0) { Write-Host "[+] RPC filters imported successfully." -ForegroundColor Green } else { Write-Error "[-] Failed to import RPC filters. Netsh exit code: $($Proc.ExitCode)." } # Clean up temp file if (Test-Path $FilterFilePath) { Remove-Item -Path $FilterFilePath -Force | Out-Null } Target Scope: Applicable Systems: Domain Controllers. Operating Systems: Windows Server 2016 (and above). File Path: 04-network-firewall/block-intra-dc-management.md Domain Controllers (DCs) represent the Tier 0 security boundary of an Active Directory forest. In a multi-DC environment, security controls must prevent lateral movement and credential escalation between these core servers. If an adversary gains administrative control of a single Domain Controller, they will immediately attempt to pivot to other DCs. By default, standard firewall configurations allow remote management protocols (RDP, WinRM, WMI) from all Tier 0 assets—including other Domain Controllers. Enforcing intra-DC remote management blocking resolves this vector: 1. Lateral Movement Containment: Restricting management traffic between DCs (e.g. blocking RDP TCP 3389, WinRM TCP 5985/5986, WMI TCP 24158, and ADWS TCP 9389 from other DC IP addresses) prevents a compromised DC from being used to compromise other domain controllers. 2. Replication Integrity: Normal Active Directory replication and synchronization protocols (RPC replication, DNS, Kerberos, SMB) remain open and unaffected, while administrative logon and command execution protocols are blocked. 3. Zero Trust Tiering: Assumes that even Tier 0 systems must not trust other Tier 0 systems for remote command execution. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure the Domain Controllers GPO to restrict source IP addresses for remote management rules: Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting Domain Controllers (e.g., GPO_Hardening_DomainControllers_Firewall). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security Under Inbound Rules, configure rules for remote management (RDP, WinRM, WMI, ADWS) to: Allow connections originating only from Management/PAW subnets*. Ensure that Domain Controller IP addresses* are explicitly excluded from the allowed remote address list. Alternatively, create explicit inbound Block Rules* for ports 3389, 5985, 5986, 24158, and 9389 where the source IP addresses match the list of Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally on each DC to implement and audit the block rules. Remediation Script: Download Script: Set-IntraDcManagementBlocking.ps1 # Set-IntraDcManagementBlocking.ps1 # Description: Configures local Windows Firewall rules to block remote management traffic (RDP, WinRM, WMI, ADWS) originating from other Domain Controllers to prevent lateral movement. Write-Host "Applying hardening requirement: Block Management Traffic Between DCs..." -ForegroundColor Cyan # 1. Get IP addresses of all Domain Controllers in the domain $DcIPs = @() try { $Dcs = Get-ADDomainController -Filter * -ErrorAction Stop foreach ($Dc in $Dcs) { # Skip local computer if ($Dc.Name -ne $env:COMPUTERNAME) { if ($Dc.IPv4Address) { $DcIPs += $Dc.IPv4Address } if ($Dc.IPv6Address) { $DcIPs += $Dc.IPv6Address } } } } catch { Write-Host " Get-ADDomainController not available or not in AD domain. Skipping dynamic discovery." -ForegroundColor Yellow } if ($DcIPs.Count -eq 0) { Write-Host " No other Domain Controllers discovered. Blocking rule will be created but inactive." -ForegroundColor Yellow # Fallback to a dummy address to ensure rule structure is correct $DcIPs = @("255.255.255.255") } else { Write-Host " Discovered other DCs: $($DcIPs -join ', ')" -ForegroundColor Gray } # 2. Configure local block rules for DC-to-DC remote management $BlockRules = @( @{ Name = "AD-Block-IntraDC-RDP"; Port = 3389; Proto = "TCP" }, @{ Name = "AD-Block-IntraDC-WinRM-HTTP"; Port = 5985; Proto = "TCP" }, @{ Name = "AD-Block-IntraDC-WinRM-HTTPS"; Port = 5986; Proto = "TCP" }, @{ Name = "AD-Block-IntraDC-WMI"; Port = 24158; Proto = "TCP" }, @{ Name = "AD-Block-IntraDC-ADWS"; Port = 9389; Proto = "TCP" } ) foreach ($Rule in $BlockRules) { $Name = $Rule.Name $Port = $Rule.Port $Proto = $Rule.Proto $Existing = Get-NetFirewallRule -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Existing) { New-NetFirewallRule -Name $Name -DisplayName $Name ` -Direction Inbound ` -Action Block ` -Protocol $Proto ` -LocalPort $Port ` -RemoteAddress $DcIPs ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "Block rule created: $($Name) on port $($Port) ($($Proto)) from other DCs." -ForegroundColor Green } else { Set-NetFirewallRule -Name $Name -Enabled True -Action Block -RemoteAddress $DcIPs | Out-Null Write-Host "Block rule verified: $($Name) on port $($Port) ($($Proto)) from other DCs." -ForegroundColor Gray } } Write-Host "Intra-DC management blocking rules applied successfully." -ForegroundColor Cyan Audit Script: Download Script: Test-IntraDcManagementBlocking.ps1 # Test-IntraDcManagementBlocking.ps1 # Description: Audits if management traffic from other Domain Controllers is blocked. Write-Host "Auditing Intra-DC management blocking configurations..." -ForegroundColor Cyan $vulnerable = $false $BlockRules = @( "AD-Block-IntraDC-RDP", "AD-Block-IntraDC-WinRM-HTTP", "AD-Block-IntraDC-WinRM-HTTPS", "AD-Block-IntraDC-WMI", "AD-Block-IntraDC-ADWS" ) foreach ($Name in $BlockRules) { $Rule = Get-NetFirewallRule -Name $Name -ErrorAction SilentlyContinue if ($Rule) { if ($Rule.Enabled -eq $true -and $Rule.Action -eq "Block") { Write-Host "[+] Rule $($Name) is active and configured to Block." -ForegroundColor Green } else { Write-Host "[!] NON-COMPLIANT: Rule $($Name) exists but is disabled or not set to Block." -ForegroundColor Red $vulnerable = $true } } else { Write-Host "[!] NON-COMPLIANT: Block rule $($Name) is missing." -ForegroundColor Red $vulnerable = $true } } if ($vulnerable) { Write-Host "Audit result: NON-COMPLIANT" -ForegroundColor Red } else { Write-Host "Audit result: COMPLIANT" -ForegroundColor Green } # Set-IntraDcManagementBlocking.ps1 # Description: Configures local Windows Firewall rules to block remote management traffic (RDP, WinRM, WMI, ADWS) originating from other Domain Controllers to prevent lateral movement. Write-Host "Applying hardening requirement: Block Management Traffic Between DCs..." -ForegroundColor Cyan # 1. Get IP addresses of all Domain Controllers in the domain $DcIPs = @() try { $Dcs = Get-ADDomainController -Filter * -ErrorAction Stop foreach ($Dc in $Dcs) { # Skip local computer if ($Dc.Name -ne $env:COMPUTERNAME) { if ($Dc.IPv4Address) { $DcIPs += $Dc.IPv4Address } if ($Dc.IPv6Address) { $DcIPs += $Dc.IPv6Address } } } } catch { Write-Host " Get-ADDomainController not available or not in AD domain. Skipping dynamic discovery." -ForegroundColor Yellow } if ($DcIPs.Count -eq 0) { Write-Host " No other Domain Controllers discovered. Blocking rule will be created but inactive." -ForegroundColor Yellow # Fallback to a dummy address to ensure rule structure is correct $DcIPs = @("255.255.255.255") } else { Write-Host " Discovered other DCs: $($DcIPs -join ', ')" -ForegroundColor Gray } # 2. Configure local block rules for DC-to-DC remote management $BlockRules = @( @{ Name = "AD-Block-IntraDC-RDP"; Port = 3389; Proto = "TCP" }, @{ Name = "AD-Block-IntraDC-WinRM-HTTP"; Port = 5985; Proto = "TCP" }, @{ Name = "AD-Block-IntraDC-WinRM-HTTPS"; Port = 5986; Proto = "TCP" }, @{ Name = "AD-Block-IntraDC-WMI"; Port = 24158; Proto = "TCP" }, @{ Name = "AD-Block-IntraDC-ADWS"; Port = 9389; Proto = "TCP" } ) foreach ($Rule in $BlockRules) { $Name = $Rule.Name $Port = $Rule.Port $Proto = $Rule.Proto $Existing = Get-NetFirewallRule -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Existing) { New-NetFirewallRule -Name $Name -DisplayName $Name ` -Direction Inbound ` -Action Block ` -Protocol $Proto ` -LocalPort $Port ` -RemoteAddress $DcIPs ` -Profile Domain, Private ` -Enabled True | Out-Null Write-Host "Block rule created: $($Name) on port $($Port) ($($Proto)) from other DCs." -ForegroundColor Green } else { Set-NetFirewallRule -Name $Name -Enabled True -Action Block -RemoteAddress $DcIPs | Out-Null Write-Host "Block rule verified: $($Name) on port $($Port) ($($Proto)) from other DCs." -ForegroundColor Gray } } Write-Host "Intra-DC management blocking rules applied successfully." -ForegroundColor Cyan Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Client Workstations Operating Systems: Windows Server 2016 (and above), Windows 10/11 Enterprise File Path: 05-logging-monitoring/configure-advanced-audit-policies.md Standard Windows security event logging is basic and fails to capture critical event vectors, leading to visibility gaps during compromises. Enforcing refined subcategory audit policies ensures detailed Success and Failure logs for logon attempts, privilege use, process creations, and registry modifications without overloading log stores. This requirement acts as the primary logging baseline, enforcing category overrides and linking to profile-specific submodules matching each system's security tier. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the corresponding baseline GPO (e.g. GPO_Hardening_Baseline). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following setting: Policy*: Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings Setting*: Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AdvancedAuditPolicies.ps1 # Configure-AdvancedAuditPolicies.ps1 # Description: Enforces Advanced Audit Policy Overrides registry value. $RegPath = "reg:\HKLM\System\CurrentControlSet\Control\Lsa" $ValueName = "SCENoApplyLegacyAuditPolicy" Write-Host "Enforcing Advanced Security Audit Policies override settings..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value 1 -Type DWord -Force Write-Host "Advanced Audit Policy overrides enforced successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-AdvancedAuditPoliciesStatus.ps1 # Get-AdvancedAuditPoliciesStatus.ps1 # Description: Audits the Advanced Audit Policy Overrides registry value. $RegPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $ValueName = "SCENoApplyLegacyAuditPolicy" $val = Get-ItemPropertyValue -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($val -eq 1) { Write-Host "Advanced Security Audit Policy Overrides are correctly enabled." -ForegroundColor Green } else { Write-Host "Advanced Security Audit Policy Overrides are disabled!" -ForegroundColor Red } # Configure-AdvancedAuditPolicies.ps1 # Description: Enforces Advanced Audit Policy Overrides registry value. $RegPath = "reg:\HKLM\System\CurrentControlSet\Control\Lsa" $ValueName = "SCENoApplyLegacyAuditPolicy" Write-Host "Enforcing Advanced Security Audit Policies override settings..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value 1 -Type DWord -Force Write-Host "Advanced Audit Policy overrides enforced successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Client Workstations. Operating Systems: Windows Server 2016 (and above), Windows 10/11 Enterprise. File Path: 05-logging-monitoring/configure-powershell-and-command-line-auditing.md Adversaries make extensive use of built-in system tools (LOLBins) and PowerShell script execution to perform reconnaissance, privilege escalation, and lateral movement. Because PowerShell code can be dynamically obfuscated or executed directly in memory without writing to disk, traditional file-based detection mechanisms are easily bypassed. Enforcing advanced execution logging mitigates these threat vectors: 1. Command Line Auditing: Injecting command-line arguments into Security Event ID 4688 allows defenders to see parameters, file paths, and encoded arguments used during process execution. 2. Script Block Logging: Captures the full content of code blocks executed by PowerShell (Event ID 4104), logging the actual code after decryption and de-obfuscation at runtime. 3. Module Logging: Logs pipeline execution details and loaded modules (Event ID 4103) to map tool usage. 4. Hardened Transcription: Records all input commands and console outputs to local text transcripts. By restricting folder access permissions, users are blocked from reading previously typed commands (which may contain sensitive arguments, tokens, or credentials), while still allowing the system to log their actions. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Configure Process Command-Line Logging Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to target systems (e.g., GPO_Hardening_Logging_Baseline). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Audit Process Creation Configure the setting: Policy*: Include command line in process creation events Setting*: Enabled 2. Configure PowerShell Audit Settings Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows PowerShell Configure Script Block Logging: Policy*: Turn on PowerShell Script Block Logging Setting : `Enabled` (Ensure Log script block invocation start / stop events is unchecked* / disabled to prevent operational log flooding) Configure Module Logging: Policy*: Turn on PowerShell Module Logging Setting : `Enabled` -> Click Show... -> Add `` under Value. Configure PowerShell Transcription: Policy*: Turn on PowerShell Transcription Setting*: Enabled Transcript output directory*: C:\ProgramData\PowerShellTranscripts (Ensure this is a local path) Include invocation headers*: Checked Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure command line process creation, PowerShell logging registry keys, and create the hardened transcript directory with write-only NTFS permissions. Download Script: Set-PowerShellAuditing.ps1 # Set-PowerShellAuditing.ps1 # Configures command line auditing, PowerShell logging, transcription, and hardens folder ACLs. Write-Host "--- Applying PowerShell & Command Line Auditing Remediation ---" -ForegroundColor Cyan # 1. Enable Process Creation Command-Line Auditing Write-Host "[+] Configuring Command Line Process Auditing..." -ForegroundColor Gray $ProcAuditReg = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" if (-not (Test-Path $ProcAuditReg)) { New-Item -Path $ProcAuditReg -Force | Out-Null } Set-ItemProperty -Path $ProcAuditReg -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord Write-Host " Command line process auditing enabled." -ForegroundColor Green # 2. Configure PowerShell Script Block Logging Write-Host "[+] Configuring PowerShell Script Block Logging..." -ForegroundColor Gray $ScriptBlockReg = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" if (-not (Test-Path $ScriptBlockReg)) { New-Item -Path $ScriptBlockReg -Force | Out-Null } Set-ItemProperty -Path $ScriptBlockReg -Name "EnableScriptBlockLogging" -Value 1 -Type DWord Set-ItemProperty -Path $ScriptBlockReg -Name "EnableScriptBlockInvocationLogging" -Value 0 -Type DWord Write-Host " PowerShell Script Block Logging enabled and invocation start/stop logging disabled." -ForegroundColor Green # 3. Configure PowerShell Module Logging Write-Host "[+] Configuring PowerShell Module Logging..." -ForegroundColor Gray $ModuleReg = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" if (-not (Test-Path $ModuleReg)) { New-Item -Path $ModuleReg -Force | Out-Null } Set-ItemProperty -Path $ModuleReg -Name "EnableModuleLogging" -Value 1 -Type DWord $ModuleNamesReg = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames" if (-not (Test-Path $ModuleNamesReg)) { New-Item -Path $ModuleNamesReg -Force | Out-Null } Set-ItemProperty -Path $ModuleNamesReg -Name "*" -Value "*" -Type String Write-Host " PowerShell Module Logging enabled for all modules." -ForegroundColor Green # 4. Configure PowerShell Transcription Write-Host "[+] Configuring PowerShell Transcription Registry settings..." -ForegroundColor Gray $TransReg = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription" if (-not (Test-Path $TransReg)) { New-Item -Path $TransReg -Force | Out-Null } $TranscriptPath = "C:\ProgramData\PowerShellTranscripts" Set-ItemProperty -Path $TransReg -Name "EnableTranscripting" -Value 1 -Type DWord Set-ItemProperty -Path $TransReg -Name "EnableInvocationHeader" -Value 1 -Type DWord Set-ItemProperty -Path $TransReg -Name "OutputDirectory" -Value $TranscriptPath -Type String Write-Host " PowerShell Transcription registry keys configured." -ForegroundColor Green # 5. Create and Harden PowerShell Transcript Folder Write-Host "[+] Setting up hardened NTFS permissions on $($TranscriptPath)..." -ForegroundColor Gray if (-not (Test-Path $TranscriptPath)) { New-Item -Path $TranscriptPath -ItemType Directory -Force | Out-Null } # Fetch ACL and disable inheritance, copying existing rules $Acl = Get-Acl -Path $TranscriptPath $Acl.SetAccessRuleProtection($true, $true) Set-Acl -Path $TranscriptPath -AclObject $Acl # Refresh ACL and remove user/authenticated user permissions $Acl = Get-Acl -Path $TranscriptPath $Rules = $Acl.Access foreach ($Rule in $Rules) { $Identity = $Rule.IdentityReference.Value if ($Identity -like "*Users" -or $Identity -like "*Authenticated Users" -or $Identity -like "*Everyone") { $Acl.RemoveAccessRule($Rule) | Out-Null } } # Define write-only permissions for Authenticated Users # CreateFiles/AppendData allows logging, while missing ListDirectory/ReadData blocks viewing transcripts. $WriteRights = [System.Security.AccessControl.FileSystemRights]("CreateFiles, AppendData, ReadAttributes, WriteAttributes") $InheritanceFlags = [System.Security.AccessControl.InheritanceFlags]("ContainerInherit, ObjectInherit") $PropagationFlags = [System.Security.AccessControl.PropagationFlags]::None $AccessType = [System.Security.AccessControl.AccessControlType]::Allow $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\Authenticated Users", $WriteRights, $InheritanceFlags, $PropagationFlags, $AccessType) $Acl.AddAccessRule($AccessRule) Set-Acl -Path $TranscriptPath -AclObject $Acl Write-Host " Hardened NTFS permissions applied to $($TranscriptPath) successfully." -ForegroundColor Green To verify the settings have been applied: Download Script: Test-PowerShellAuditing.ps1 # Test-PowerShellAuditing.ps1 # Audits command line process creation, PowerShell logging, and transcript folder permissions. Write-Host "--- Auditing PowerShell & Command Line Auditing ---" -ForegroundColor Cyan # 1. Audit Process Command-Line Logging $ProcPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" $CmdLineVal = Get-ItemProperty -Path $ProcPath -Name "ProcessCreationIncludeCmdLine_Enabled" -ErrorAction SilentlyContinue $CmdSetting = 0 if ($CmdLineVal) { $CmdSetting = $CmdLineVal.ProcessCreationIncludeCmdLine_Enabled } $CmdColor = "Red" if ($CmdSetting -eq 1) { $CmdColor = "Green" } Write-Host " - Command Line Process Auditing: $($CmdSetting) (Required = 1)" -ForegroundColor $CmdColor # 2. Audit Script Block Logging $SBPath = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" $SBVal = Get-ItemProperty -Path $SBPath -Name "EnableScriptBlockLogging" -ErrorAction SilentlyContinue $SBSetting = 0 if ($SBVal) { $SBSetting = $SBVal.EnableScriptBlockLogging } $SBColor = "Red" if ($SBSetting -eq 1) { $SBColor = "Green" } Write-Host " - PowerShell Script Block Logging: $($SBSetting) (Required = 1)" -ForegroundColor $SBColor $SBInvVal = Get-ItemProperty -Path $SBPath -Name "EnableScriptBlockInvocationLogging" -ErrorAction SilentlyContinue $SBInvSetting = 0 if ($SBInvVal) { $SBInvSetting = $SBInvVal.EnableScriptBlockInvocationLogging } $SBInvColor = "Red" if ($SBInvSetting -eq 0) { $SBInvColor = "Green" } Write-Host " - PowerShell Script Block Invocation Logging (Start/Stop): $($SBInvSetting) (Required = 0)" -ForegroundColor $SBInvColor # 3. Audit Module Logging $ModPath = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" $ModVal = Get-ItemProperty -Path $ModPath -Name "EnableModuleLogging" -ErrorAction SilentlyContinue $ModSetting = 0 if ($ModVal) { $ModSetting = $ModVal.EnableModuleLogging } $ModColor = "Red" if ($ModSetting -eq 1) { $ModColor = "Green" } Write-Host " - PowerShell Module Logging: $($ModSetting) (Required = 1)" -ForegroundColor $ModColor # 4. Audit Transcription Setup $TransPath = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription" $TransVal = Get-ItemProperty -Path $TransPath -Name "EnableTranscripting" -ErrorAction SilentlyContinue $TransSetting = 0 if ($TransVal) { $TransSetting = $TransVal.EnableTranscripting } $TransColor = "Red" if ($TransSetting -eq 1) { $TransColor = "Green" } Write-Host " - PowerShell Transcription Enabled: $($TransSetting) (Required = 1)" -ForegroundColor $TransColor $TransDirVal = Get-ItemProperty -Path $TransPath -Name "OutputDirectory" -ErrorAction SilentlyContinue $TransDir = "" if ($TransDirVal) { $TransDir = $TransDirVal.OutputDirectory } $DirColor = if ($TransDir) { "Green" } else { "Red" } Write-Host " - PowerShell Transcription Directory: $($TransDir)" -ForegroundColor $DirColor # 5. Audit Transcript Folder Security Permissions if ($TransDir) { if (-not (Test-Path $TransDir)) { Write-Host " - Transcription directory does not exist locally." -ForegroundColor Red } else { $Acl = Get-Acl -Path $TransDir $Rules = $Acl.Access $HasUnsafeRead = $false $HasWriteOnly = $false foreach ($Rule in $Rules) { $Identity = $Rule.IdentityReference.Value $Rights = $Rule.FileSystemRights $Type = $Rule.AccessControlType if ($Type -eq "Allow" -and ($Identity -like "*Authenticated Users" -or $Identity -like "*Users" -or $Identity -like "*Everyone")) { # Look for read access $UnsafeRights = @("ReadData", "ListDirectory", "FullControl", "Modify", "Delete", "ReadAndExecute", "Read") foreach ($Right in $UnsafeRights) { if ($Rights.ToString() -match $Right) { $HasUnsafeRead = $true } } # Check for write-only parameters if ($Rights.ToString() -match "CreateFiles" -and $Rights.ToString() -match "AppendData" -and -not ($Rights.ToString() -match "ReadData")) { $HasWriteOnly = $true } } } $AclColor = "Red" if ($HasWriteOnly -and -not $HasUnsafeRead) { $AclColor = "Green" } Write-Host " - Transcript Folder Security: WriteOnly=$($HasWriteOnly), UnsafeReadAccess=$($HasUnsafeRead)" -ForegroundColor $AclColor } } # Set-PowerShellAuditing.ps1 # Configures command line auditing, PowerShell logging, transcription, and hardens folder ACLs. Write-Host "--- Applying PowerShell & Command Line Auditing Remediation ---" -ForegroundColor Cyan # 1. Enable Process Creation Command-Line Auditing Write-Host "[+] Configuring Command Line Process Auditing..." -ForegroundColor Gray $ProcAuditReg = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit" if (-not (Test-Path $ProcAuditReg)) { New-Item -Path $ProcAuditReg -Force | Out-Null } Set-ItemProperty -Path $ProcAuditReg -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord Write-Host " Command line process auditing enabled." -ForegroundColor Green # 2. Configure PowerShell Script Block Logging Write-Host "[+] Configuring PowerShell Script Block Logging..." -ForegroundColor Gray $ScriptBlockReg = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" if (-not (Test-Path $ScriptBlockReg)) { New-Item -Path $ScriptBlockReg -Force | Out-Null } Set-ItemProperty -Path $ScriptBlockReg -Name "EnableScriptBlockLogging" -Value 1 -Type DWord Set-ItemProperty -Path $ScriptBlockReg -Name "EnableScriptBlockInvocationLogging" -Value 0 -Type DWord Write-Host " PowerShell Script Block Logging enabled and invocation start/stop logging disabled." -ForegroundColor Green # 3. Configure PowerShell Module Logging Write-Host "[+] Configuring PowerShell Module Logging..." -ForegroundColor Gray $ModuleReg = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" if (-not (Test-Path $ModuleReg)) { New-Item -Path $ModuleReg -Force | Out-Null } Set-ItemProperty -Path $ModuleReg -Name "EnableModuleLogging" -Value 1 -Type DWord $ModuleNamesReg = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames" if (-not (Test-Path $ModuleNamesReg)) { New-Item -Path $ModuleNamesReg -Force | Out-Null } Set-ItemProperty -Path $ModuleNamesReg -Name "*" -Value "*" -Type String Write-Host " PowerShell Module Logging enabled for all modules." -ForegroundColor Green # 4. Configure PowerShell Transcription Write-Host "[+] Configuring PowerShell Transcription Registry settings..." -ForegroundColor Gray $TransReg = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription" if (-not (Test-Path $TransReg)) { New-Item -Path $TransReg -Force | Out-Null } $TranscriptPath = "C:\ProgramData\PowerShellTranscripts" Set-ItemProperty -Path $TransReg -Name "EnableTranscripting" -Value 1 -Type DWord Set-ItemProperty -Path $TransReg -Name "EnableInvocationHeader" -Value 1 -Type DWord Set-ItemProperty -Path $TransReg -Name "OutputDirectory" -Value $TranscriptPath -Type String Write-Host " PowerShell Transcription registry keys configured." -ForegroundColor Green # 5. Create and Harden PowerShell Transcript Folder Write-Host "[+] Setting up hardened NTFS permissions on $($TranscriptPath)..." -ForegroundColor Gray if (-not (Test-Path $TranscriptPath)) { New-Item -Path $TranscriptPath -ItemType Directory -Force | Out-Null } # Fetch ACL and disable inheritance, copying existing rules $Acl = Get-Acl -Path $TranscriptPath $Acl.SetAccessRuleProtection($true, $true) Set-Acl -Path $TranscriptPath -AclObject $Acl # Refresh ACL and remove user/authenticated user permissions $Acl = Get-Acl -Path $TranscriptPath $Rules = $Acl.Access foreach ($Rule in $Rules) { $Identity = $Rule.IdentityReference.Value if ($Identity -like "*Users" -or $Identity -like "*Authenticated Users" -or $Identity -like "*Everyone") { $Acl.RemoveAccessRule($Rule) | Out-Null } } # Define write-only permissions for Authenticated Users # CreateFiles/AppendData allows logging, while missing ListDirectory/ReadData blocks viewing transcripts. $WriteRights = [System.Security.AccessControl.FileSystemRights]("CreateFiles, AppendData, ReadAttributes, WriteAttributes") $InheritanceFlags = [System.Security.AccessControl.InheritanceFlags]("ContainerInherit, ObjectInherit") $PropagationFlags = [System.Security.AccessControl.PropagationFlags]::None $AccessType = [System.Security.AccessControl.AccessControlType]::Allow $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\Authenticated Users", $WriteRights, $InheritanceFlags, $PropagationFlags, $AccessType) $Acl.AddAccessRule($AccessRule) Set-Acl -Path $TranscriptPath -AclObject $Acl Write-Host " Hardened NTFS permissions applied to $($TranscriptPath) successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Client Workstations. Operating Systems: Windows Server 2016 (and above), Windows 10/11 Enterprise. File Path: 05-logging-monitoring/deploy-and-harden-sysmon.md Windows Security event logs lack detailed telemetry on low-level operating system actions, such as process memory reads (e.g., LSASS dumping via Mimikatz), thread injection, network connections associated with process IDs, and driver loading. Microsoft Sysmon (System Monitor) bridges this gap by writing rich system monitoring telemetry to the Microsoft-Windows-Sysmon/Operational event log channel. Because Sysmon is a critical detection source, adversaries actively target it by attempting to unload its filter driver (sysmon -u or fltmc unload SysmonDrv) or stopping/disabling the Sysmon service (sc stop Sysmon). Hardening Sysmon involves: 1. Service Recovery Configuration: Forcing the operating system to automatically restart the Sysmon service on failure or termination. 2. Telemetry Filtering: Deploying a hardened, security-focused XML configuration template that filters out noise while logging process creation (Event ID 1), remote threads (Event ID 8), LSASS memory access (Event ID 10), and suspicious file drops (Event ID 11). Option A: Installation and Service Configuration 1. Install Sysmon with Hardened XML Base Configuration Deploy Sysmon using the command line with a local XML configuration file. Save the following template as sysmon-config.xml in a secure administrative path: <Sysmon schemaversion="4.50"> <HashAlgorithms>md5,sha256,imphash</HashAlgorithms> <EventFiltering> <!-- Rule Group: Process Creation (Event ID 1) --> <RuleGroup name="Process Creation" groupRelation="or"> <ProcessCreate onmatch="exclude" /> </RuleGroup> <!-- Rule Group: Network Connections (Event ID 3) --> <RuleGroup name="Network Connection" groupRelation="or"> <NetworkConnect onmatch="include"> <DestinationPort condition="is">22</DestinationPort> <DestinationPort condition="is">3389</DestinationPort> <DestinationPort condition="is">445</DestinationPort> <DestinationPort condition="is">5985</DestinationPort> <DestinationPort condition="is">5986</DestinationPort> </NetworkConnect> </RuleGroup> <!-- Rule Group: Driver Load (Event ID 6) --> <RuleGroup name="Driver Load" groupRelation="or"> <DriverLoad onmatch="exclude" /> </RuleGroup> <!-- Rule Group: CreateRemoteThread (Event ID 8) --> <RuleGroup name="CreateRemoteThread" groupRelation="or"> <CreateRemoteThread onmatch="include"> <TargetImage condition="end with">lsass.exe</TargetImage> <TargetImage condition="end with">spoolsv.exe</TargetImage> </CreateRemoteThread> </RuleGroup> <!-- Rule Group: Process Access (Event ID 10) --> <RuleGroup name="Process Access" groupRelation="or"> <ProcessAccess onmatch="include"> <TargetImage condition="end with">lsass.exe</TargetImage> </ProcessAccess> </RuleGroup> <!-- Rule Group: File Creation (Event ID 11) --> <RuleGroup name="File Creation" groupRelation="or"> <FileCreate onmatch="include"> <TargetFilename condition="contains">\Startup\</TargetFilename> <TargetFilename condition="end with">.exe</TargetFilename> <TargetFilename condition="end with">.ps1</TargetFilename> <TargetFilename condition="end with">.bat</TargetFilename> </FileCreate> </RuleGroup> </EventFiltering> </Sysmon> Run the installer via administrative command line: cmd Sysmon64.exe -i sysmon-config.xml -accepteula 2. Enforce Service Recovery settings Configure the Windows Service Control Manager to automatically restart the Sysmon service if it is terminated: cmd sc.exe failure Sysmon actions= restart/60000/restart/60000/restart/60000 reset= 86400 (Note: Ensure there is a space after the `=` sign for both parameters). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to deploy/configure Sysmon and verify its operational state. Download Script: Set-SysmonHardening.ps1 # Set-SysmonHardening.ps1 # Configures Sysmon service recovery settings. Write-Host "--- Hardening Sysmon Service Recovery Settings ---" -ForegroundColor Cyan # 1. Ensure Sysmon Service is installed and configured $SysmonService = Get-Service -Name "Sysmon" -ErrorAction SilentlyContinue if (-not $SysmonService) { Write-Warning "Sysmon service is not currently installed. Run the Sysmon installer first." exit 1 } # 2. Configure Service Failure Recovery options via sc.exe Write-Host "[+] Configuring service failure recovery actions for Sysmon..." -ForegroundColor Gray $ScArgs = "failure Sysmon actions= restart/60000/restart/60000/restart/60000 reset= 86400" $Process = Start-Process sc.exe -ArgumentList $ScArgs -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Sysmon service recovery actions successfully set to auto-restart." -ForegroundColor Green } else { Write-Error " Failed to set service recovery settings. Exit Code: $($Process.ExitCode)" } To verify the settings have been applied: Download Script: Test-SysmonHardening.ps1 # Test-SysmonHardening.ps1 # Audits Sysmon service, driver execution, and recovery actions. Write-Host "--- Auditing Sysmon Hardening State ---" -ForegroundColor Cyan # 1. Verify Sysmon Service status $SysmonService = Get-Service -Name "Sysmon" -ErrorAction SilentlyContinue $ServiceStatus = "Stopped" if ($SysmonService) { $ServiceStatus = $SysmonService.Status } $ServiceColor = if ($ServiceStatus -eq "Running") { "Green" } else { "Red" } Write-Host " - Sysmon Service Status: $($ServiceStatus) (Required = Running)" -ForegroundColor $ServiceColor # 2. Verify Sysmon Filter Driver (SysmonDrv) $DriverRunning = $false $DriverCheck = fltmc.exe filters foreach ($Line in $DriverCheck) { if ($Line -match "SysmonDrv") { $DriverRunning = $true } } $DriverColor = if ($DriverRunning) { "Green" } else { "Red" } Write-Host " - Sysmon Kernel Driver Loaded: $($DriverRunning) (Required = True)" -ForegroundColor $DriverColor # 3. Verify Service Failure Recovery Options $FailureInfo = sc.exe qfailure Sysmon $HasReset = $false $HasRestart = $false foreach ($Line in $FailureInfo) { if ($Line -match "RESET_PERIOD\s+:\s+86400") { $HasReset = $true } if ($Line -match "FAILURE_ACTIONS\s+:\s+RESTART") { $HasRestart = $true } } $RecoveryColor = if ($HasReset -and $HasRestart) { "Green" } else { "Red" } Write-Host " - Recovery Configuration: ResetConfigured=$($HasReset), RestartActionsConfigured=$($HasRestart)" -ForegroundColor $RecoveryColor # Set-SysmonHardening.ps1 # Configures Sysmon service recovery settings. Write-Host "--- Hardening Sysmon Service Recovery Settings ---" -ForegroundColor Cyan # 1. Ensure Sysmon Service is installed and configured $SysmonService = Get-Service -Name "Sysmon" -ErrorAction SilentlyContinue if (-not $SysmonService) { Write-Warning "Sysmon service is not currently installed. Run the Sysmon installer first." exit 1 } # 2. Configure Service Failure Recovery options via sc.exe Write-Host "[+] Configuring service failure recovery actions for Sysmon..." -ForegroundColor Gray $ScArgs = "failure Sysmon actions= restart/60000/restart/60000/restart/60000 reset= 86400" $Process = Start-Process sc.exe -ArgumentList $ScArgs -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Sysmon service recovery actions successfully set to auto-restart." -ForegroundColor Green } else { Write-Error " Failed to set service recovery settings. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Client Workstations. Operating Systems: Windows Server 2016 (and above), Windows 10/11 Enterprise. File Path: 05-logging-monitoring/configure-siem-log-shipping.md In high-security, isolated environments, local log storage is vulnerable to tampering. Attackers who obtain elevated privileges will attempt to clear or modify the Security Event Logs (e.g., via wevtutil cl Security) to destroy evidence of their activities. Shipping event logs in real-time to a dedicated offline SIEM (such as an ELK Stack or Wazuh Manager) ensures that forensic logs are preserved. To prevent adversaries from intercepting, redirecting, or tampering with log telemetry, log shippers must be hardened: 1. Secure Transportation (TLS): Enforce TLS 1.2 or TLS 1.3 encryption with strict verification of the server certificate authority. This prevents man-in-the-middle attacks where an adversary redirects logs to a rogue listener. 2. Buffer and Queue Management: Limit memory and disk spool queues for the shipping agents. If the SIEM receiver goes offline during maintenance or network failure, the agents must cache logs safely without causing memory leaks, high CPU overhead, or local disk exhaustion. 3. Hardened Configuration Files: Agent configurations contain hostnames, ports, and potentially credentials or internal CA paths. Restricting access to these configuration files prevents standard users from discovering SIEM endpoints or tampering with configuration parameters. Option A: Agent Configuration 1. Secure Winlogbeat Configuration Edit winlogbeat.yml (located by default under %ProgramFiles%\Winlogbeat\winlogbeat.yml) to enforce TLS 1.2/1.3, configure local queue limits, and forward the key log channels: winlogbeat.event_logs: - name: Security - name: System - name: Microsoft-Windows-Sysmon/Operational - name: Microsoft-Windows-PowerShell/Operational # Enforce disk-assisted memory queue limits to prevent memory exhaustion queue.mem: events: 4096 flush.min_events: 2048 flush.timeout: 1s # Output to Logstash/SIEM with TLS settings output.logstash: hosts: ["local-logstash.internal.local:5044"] ssl.supported_protocols: [TLSv1.2, TLSv1.3] ssl.verification_mode: full ssl.certificate_authorities: ["C:\\ProgramData\\Winlogbeat\\certs\\ca.crt"] ssl.certificate: "C:\\ProgramData\\Winlogbeat\\certs\\client.crt" ssl.key: "C:\\ProgramData\\Winlogbeat\\certs\\client.key" 2. Secure Wazuh Agent Configuration Edit ossec.conf (located by default under %ProgramFiles(x86)%\ossec-agent\ossec.conf) to secure log verification and specify localized channels: <ossec_config> <client> <server> <address>local-wazuh.internal.local</address> <port>1514</port> <protocol>tcp</protocol> </server> <crypto_method>aes</crypto_method> <!-- Configure enrollment with validation --> <enrollment> <enabled>yes</enabled> <server_address>local-wazuh.internal.local</server_address> <port>1515</port> <ssl_cipher>HIGH</ssl_cipher> <ssl_verify_host>yes</ssl_verify_host> <ssl_cacert>C:\Program Files (x86)\ossec-agent\certs\wpk_root.pem</ssl_cacert> </enrollment> </client> <!-- Channels to Monitor --> <localfile> <location>Security</location> <log_format>eventlog</log_format> </localfile> <localfile> <location>System</location> <log_format>eventlog</log_format> </localfile> <localfile> <location>Microsoft-Windows-Sysmon/Operational</location> <log_format>eventlog</log_format> </localfile> <localfile> <location>Microsoft-Windows-PowerShell/Operational</location> <log_format>eventlog</log_format> </localfile> </ossec_config> Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to secure agent configuration files and verify SIEM shipping services status. Download Script: Set-SiemLogShipping.ps1 # Set-SiemLogShipping.ps1 # Secures Winlogbeat and Wazuh log shipping configuration file ACLs. Write-Host "--- Hardening SIEM Shipping Agent Configurations ---" -ForegroundColor Cyan $ConfigFiles = @( "C:\Program Files\Winlogbeat\winlogbeat.yml", "C:\Program Files (x86)\ossec-agent\ossec.conf" ) foreach ($File in $ConfigFiles) { if (Test-Path $File) { Write-Host "[+] Applying hardened NTFS permissions to $($File)..." -ForegroundColor Gray # Get ACL $Acl = Get-Acl -Path $File # Disable inheritance and copy existing rules $Acl.SetAccessRuleProtection($true, $true) Set-Acl -Path $File -AclObject $Acl # Refresh ACL $Acl = Get-Acl -Path $File $Rules = $Acl.Access # Remove any access rules for Users, Authenticated Users, Everyone foreach ($Rule in $Rules) { $Identity = $Rule.IdentityReference.Value if ($Identity -like "*Users" -or $Identity -like "*Authenticated Users" -or $Identity -like "*Everyone") { $Acl.RemoveAccessRule($Rule) | Out-Null } } # Explicitly ensure Administrators and SYSTEM have Full Control $FullRights = [System.Security.AccessControl.FileSystemRights]::FullControl $InheritanceFlags = [System.Security.AccessControl.InheritanceFlags]::None $PropagationFlags = [System.Security.AccessControl.PropagationFlags]::None $AccessType = [System.Security.AccessControl.AccessControlType]::Allow $AdminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators", $FullRights, $InheritanceFlags, $PropagationFlags, $AccessType) $SystemRule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM", $FullRights, $InheritanceFlags, $PropagationFlags, $AccessType) $Acl.AddAccessRule($AdminRule) $Acl.AddAccessRule($SystemRule) Set-Acl -Path $File -AclObject $Acl Write-Host " Permissions successfully secured for $($File)." -ForegroundColor Green } else { Write-Verbose " File $($File) not found, skipping." } } To verify the settings have been applied: Download Script: Test-SiemLogShipping.ps1 # Test-SiemLogShipping.ps1 # Audits SIEM shipping agents, configuration permissions, and security. Write-Host "--- Auditing SIEM Log Shipping Agents ---" -ForegroundColor Cyan # 1. Audit Agent Services $Services = @("winlogbeat", "WazuhSvc") foreach ($SvcName in $Services) { $Svc = Get-Service -Name $SvcName -ErrorAction SilentlyContinue $Status = "Not Installed" if ($Svc) { $Status = $Svc.Status } $Color = if ($Status -eq "Running") { "Green" } else { "Yellow" } Write-Host " - Agent Service '$($SvcName)': $($Status)" -ForegroundColor $Color } # 2. Audit Config File Access Permissions $ConfigFiles = @( "C:\Program Files\Winlogbeat\winlogbeat.yml", "C:\Program Files (x86)\ossec-agent\ossec.conf" ) foreach ($File in $ConfigFiles) { if (Test-Path $File) { $Acl = Get-Acl -Path $File $Rules = $Acl.Access $HasUnsafeAccess = $false foreach ($Rule in $Rules) { $Identity = $Rule.IdentityReference.Value $Type = $Rule.AccessControlType # Verify if users, authenticated users, or everyone has read/write if ($Type -eq "Allow" -and ($Identity -like "*Users" -or $Identity -like "*Authenticated Users" -or $Identity -like "*Everyone")) { $HasUnsafeAccess = $true } } $FileColor = if (-not $HasUnsafeAccess) { "Green" } else { "Red" } Write-Host " - Configuration File: $($File) | UnsafeAccessAllowed=$($HasUnsafeAccess)" -ForegroundColor $FileColor } else { Write-Host " - Configuration File: $($File) | Status: NOT FOUND" -ForegroundColor Yellow } } # Set-SiemLogShipping.ps1 # Secures Winlogbeat and Wazuh log shipping configuration file ACLs. Write-Host "--- Hardening SIEM Shipping Agent Configurations ---" -ForegroundColor Cyan $ConfigFiles = @( "C:\Program Files\Winlogbeat\winlogbeat.yml", "C:\Program Files (x86)\ossec-agent\ossec.conf" ) foreach ($File in $ConfigFiles) { if (Test-Path $File) { Write-Host "[+] Applying hardened NTFS permissions to $($File)..." -ForegroundColor Gray # Get ACL $Acl = Get-Acl -Path $File # Disable inheritance and copy existing rules $Acl.SetAccessRuleProtection($true, $true) Set-Acl -Path $File -AclObject $Acl # Refresh ACL $Acl = Get-Acl -Path $File $Rules = $Acl.Access # Remove any access rules for Users, Authenticated Users, Everyone foreach ($Rule in $Rules) { $Identity = $Rule.IdentityReference.Value if ($Identity -like "*Users" -or $Identity -like "*Authenticated Users" -or $Identity -like "*Everyone") { $Acl.RemoveAccessRule($Rule) | Out-Null } } # Explicitly ensure Administrators and SYSTEM have Full Control $FullRights = [System.Security.AccessControl.FileSystemRights]::FullControl $InheritanceFlags = [System.Security.AccessControl.InheritanceFlags]::None $PropagationFlags = [System.Security.AccessControl.PropagationFlags]::None $AccessType = [System.Security.AccessControl.AccessControlType]::Allow $AdminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators", $FullRights, $InheritanceFlags, $PropagationFlags, $AccessType) $SystemRule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM", $FullRights, $InheritanceFlags, $PropagationFlags, $AccessType) $Acl.AddAccessRule($AdminRule) $Acl.AddAccessRule($SystemRule) Set-Acl -Path $File -AclObject $Acl Write-Host " Permissions successfully secured for $($File)." -ForegroundColor Green } else { Write-Verbose " File $($File) not found, skipping." } } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 05-logging-monitoring/implement-kerberoasting-honeypot.md Kerberoasting allows an authenticated user to request a Kerberos service ticket (TGS) for any service account mapped to a Service Principal Name (SPN). Because the ticket is encrypted using the service account's password hash, the attacker can extract the encrypted ticket from memory and attempt to crack the password offline using brute-force dictionaries or GPU arrays. To mitigate and detect this vector, two strategies must be implemented: Service Account Honeypots (Decoy Accounts): By creating a fake Active Directory user account and registering a decoy SPN on it, security teams establish a high-fidelity trap. Since this decoy account is not tied to any legitimate application or service, no standard user or system has any reason to request a Kerberos ticket for it. - Set the adminCount attribute to 1 so the account appears in attacker search queries searching for high-privilege targets (e.g., Domain Admins). - Any ticket request (Event ID 4769) for the decoy SPN is a definitive indicator of a Kerberoasting attempt, providing a zero-false-positive alert with the attacker's client IP. SIEM Filtering and Correlation: Standard Event ID 4769 logging generates millions of events daily. Filtering this telemetry down to anomalous behavior is necessary to catch broad Kerberoasting scans: - Ticket Encryption Type: Focus on encryption type 0x17 (RC4-HMAC-MD5) or legacy DES (0x1, 0x2, 0x3) as modern Windows environments negotiate AES (0x11 or 0x12) by default. - Account Exclusions: Filter out usernames ending with $ (which represent computer accounts, trusts, or managed service accounts that feature automatically rotated, high-entropy passwords). - Anomalous Patterns: Trigger alerts when a single user account requests RC4 or DES tickets for multiple distinct SPNs within a short timeframe (e.g., less than 5 seconds). Option A: Active Directory Users and Computers (GUI) 1. Create the Decoy Account Log on to a Domain Controller or administrative workstation with Domain Admin privileges. Open Active Directory Users and Computers (dsa.msc). Create a new User Object (e.g., named krbtgt_honey). Set a strong, complex 120-character password. In the account options: - Ensure Account is enabled is checked. - Check Password never expires. Open the user properties and navigate to the Account tab: - Click Log On To... under Logon Workstations. - Select The following computers and enter a non-existent hostname (e.g., HONEYPOT-VOID-HOST). - Click Add and then OK. 2. Configure administrative attributes In Active Directory Users and Computers, select View -> Advanced Features to enable the Attribute Editor. Open the properties of the decoy account and navigate to the Attribute Editor tab. Locate the adminCount attribute and double-click it. Set the value to 1 and click OK. 3. Register the Decoy SPN Open an elevated command prompt on the Domain Controller. Register a unique fake SPN using the setspn tool: `cmd setspn -s MSSQLSvc/sql-backup-prod.domain.local:1433 krbtgt_honey Option B: PowerShell & Active Directory cmdlets Use this method to automatically deploy the honeypot configuration and audit its compliance status. Download Script: New-KerberoastHoneypot.ps1 # New-KerberoastHoneypot.ps1 # Description: Configures a decoy Kerberoasting Honeypot account with a fake SPN, AdminCount=1, and restricted logon capabilities. # Target Engine: Windows PowerShell 5.1 [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSAvoidUsingConvertToSecureStringWithPlainText", "")] param() Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Configure Kerberoasting Honeypot..." -ForegroundColor Cyan $HoneypotName = "krbtgt_honey" $HoneypotSPN = "MSSQLSvc/sql-backup-prod.domain.local:1433" $HoneypotDescription = "Decoy service account for backup database monitoring." # 1. Check if the honeypot user account already exists $ExistingUser = Get-ADUser -Filter "SamAccountName -eq '$HoneypotName'" if (-not $ExistingUser) { # Generate a complex 120-character password to prevent cracking $Characters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+" $RandomPassword = "" for ($i = 0; $i -lt 120; $i++) { $Index = Get-Random -Minimum 0 -Maximum $Characters.Length $RandomPassword += $Characters[$Index] } $SecurePassword = ConvertTo-SecureString $RandomPassword -AsPlainText -Force # Create the AD User. # Set LogonWorkstations to a non-existent host to prevent logon attempts. # UPN domain suffix should match the root domain. $Domain = Get-ADDomain New-ADUser -Name $HoneypotName ` -SamAccountName $HoneypotName ` -UserPrincipalName "$HoneypotName@$($Domain.DNSRoot)" ` -AccountPassword $SecurePassword ` -Enabled $true ` -Description $HoneypotDescription ` -LogonWorkstations "HONEYPOT-VOID-HOST" ` -PasswordNeverExpires $true Write-Host "[+] Decoy user account '$HoneypotName' created with logon restrictions." -ForegroundColor Green } else { Write-Host "[*] Decoy user account '$HoneypotName' already exists." -ForegroundColor Yellow } # 2. Configure target attributes: AdminCount, ServicePrincipalName $UserObj = Get-ADUser -Identity $HoneypotName -Properties servicePrincipalName, adminCount # Set AdminCount to 1 (highly attractive to scanners) if ($UserObj.adminCount -ne 1) { Set-ADUser -Identity $HoneypotName -Replace @{adminCount = 1} Write-Host "[+] Set AdminCount to 1 on '$HoneypotName'." -ForegroundColor Green } else { Write-Host "[*] AdminCount is already set to 1." -ForegroundColor Yellow } # Set Service Principal Name $SPNExists = $UserObj.servicePrincipalName | Where-Object { $_ -eq $HoneypotSPN } if (-not $SPNExists) { Set-ADUser -Identity $HoneypotName -Add @{servicePrincipalName = $HoneypotSPN} Write-Host "[+] Service Principal Name '$HoneypotSPN' registered on '$HoneypotName'." -ForegroundColor Green } else { Write-Host "[*] Service Principal Name '$HoneypotSPN' already registered." -ForegroundColor Yellow } Write-Host "Honeypot configuration applied successfully." -ForegroundColor Green To verify the honeypot configuration state: Download Script: Get-KerberoastHoneypotStatus.ps1 # Get-KerberoastHoneypotStatus.ps1 # Description: Audits the existence, SPN, AdminCount, and logon restrictions of the Kerberoasting honeypot account. # Target Engine: Windows PowerShell 5.1 Import-Module ActiveDirectory Write-Host "--- Auditing Kerberoasting Honeypot Configuration ---" -ForegroundColor Cyan $HoneypotName = "krbtgt_honey" $HoneypotSPN = "MSSQLSvc/sql-backup-prod.domain.local:1433" # 1. Retrieve the honeypot account $User = Get-ADUser -Filter "SamAccountName -eq '$HoneypotName'" -Properties servicePrincipalName, adminCount, LogonWorkstations if (-not $User) { Write-Host "[-] Decoy user account '$HoneypotName' does not exist." -ForegroundColor Red exit 1 } $IsCompliant = $true # 2. Verify SPN is registered $SPNExists = $User.servicePrincipalName | Where-Object { $_ -eq $HoneypotSPN } if ($SPNExists) { Write-Host "[+] Decoy SPN '$HoneypotSPN' is registered on '$HoneypotName'." -ForegroundColor Green } else { Write-Host "[!] Decoy SPN '$HoneypotSPN' is NOT registered on '$HoneypotName'." -ForegroundColor Red $IsCompliant = $false } # 3. Verify AdminCount is set to 1 if ($User.adminCount -eq 1) { Write-Host "[+] AdminCount is set to 1 (deceptive marker active)." -ForegroundColor Green } else { Write-Host "[!] AdminCount is NOT set to 1 on '$HoneypotName'." -ForegroundColor Red $IsCompliant = $false } # 4. Verify LogonWorkstations restriction if ($User.LogonWorkstations -like "*HONEYPOT-VOID-HOST*") { Write-Host "[+] Logon restrictions enforced (LogonWorkstations contains 'HONEYPOT-VOID-HOST')." -ForegroundColor Green } else { Write-Host "[!] Logon restrictions NOT enforced on '$HoneypotName' (LogonWorkstations: '$($User.LogonWorkstations)')." -ForegroundColor Red $IsCompliant = $false } if ($IsCompliant) { Write-Host "[+] Secure: Kerberoasting Honeypot is fully configured and active." -ForegroundColor Green exit 0 } else { Write-Host "[-] Non-Compliant: Kerberoasting Honeypot configurations are incomplete." -ForegroundColor Red exit 1 } # New-KerberoastHoneypot.ps1 # Description: Configures a decoy Kerberoasting Honeypot account with a fake SPN, AdminCount=1, and restricted logon capabilities. # Target Engine: Windows PowerShell 5.1 [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSAvoidUsingConvertToSecureStringWithPlainText", "")] param() Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Configure Kerberoasting Honeypot..." -ForegroundColor Cyan $HoneypotName = "krbtgt_honey" $HoneypotSPN = "MSSQLSvc/sql-backup-prod.domain.local:1433" $HoneypotDescription = "Decoy service account for backup database monitoring." # 1. Check if the honeypot user account already exists $ExistingUser = Get-ADUser -Filter "SamAccountName -eq '$HoneypotName'" if (-not $ExistingUser) { # Generate a complex 120-character password to prevent cracking $Characters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+" $RandomPassword = "" for ($i = 0; $i -lt 120; $i++) { $Index = Get-Random -Minimum 0 -Maximum $Characters.Length $RandomPassword += $Characters[$Index] } $SecurePassword = ConvertTo-SecureString $RandomPassword -AsPlainText -Force # Create the AD User. # Set LogonWorkstations to a non-existent host to prevent logon attempts. # UPN domain suffix should match the root domain. $Domain = Get-ADDomain New-ADUser -Name $HoneypotName ` -SamAccountName $HoneypotName ` -UserPrincipalName "$HoneypotName@$($Domain.DNSRoot)" ` -AccountPassword $SecurePassword ` -Enabled $true ` -Description $HoneypotDescription ` -LogonWorkstations "HONEYPOT-VOID-HOST" ` -PasswordNeverExpires $true Write-Host "[+] Decoy user account '$HoneypotName' created with logon restrictions." -ForegroundColor Green } else { Write-Host "[*] Decoy user account '$HoneypotName' already exists." -ForegroundColor Yellow } # 2. Configure target attributes: AdminCount, ServicePrincipalName $UserObj = Get-ADUser -Identity $HoneypotName -Properties servicePrincipalName, adminCount # Set AdminCount to 1 (highly attractive to scanners) if ($UserObj.adminCount -ne 1) { Set-ADUser -Identity $HoneypotName -Replace @{adminCount = 1} Write-Host "[+] Set AdminCount to 1 on '$HoneypotName'." -ForegroundColor Green } else { Write-Host "[*] AdminCount is already set to 1." -ForegroundColor Yellow } # Set Service Principal Name $SPNExists = $UserObj.servicePrincipalName | Where-Object { $_ -eq $HoneypotSPN } if (-not $SPNExists) { Set-ADUser -Identity $HoneypotName -Add @{servicePrincipalName = $HoneypotSPN} Write-Host "[+] Service Principal Name '$HoneypotSPN' registered on '$HoneypotName'." -ForegroundColor Green } else { Write-Host "[*] Service Principal Name '$HoneypotSPN' already registered." -ForegroundColor Yellow } Write-Host "Honeypot configuration applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 File Path: 05-logging-monitoring/implement-sysvol-honeypot.md Adversaries seeking to elevate privileges within an Active Directory domain frequently scan the SYSVOL share for files containing legacy Group Policy Preference (GPP) credentials (specifically searching for the cpassword attribute in XML files) or startup/login scripts. This discovery scanning is often automated using script search commands (e.g., findstr /S cpassword) or administrative diagnostic frameworks (such as PowerSploit or BloodHound). To detect these unauthorized discovery scans, security teams can deploy a SYSVOL Decoy XML Honeypot. This decoy consists of a mock Group Policy folder structure containing a dummy GPP Groups.xml file with fake credential properties. Because this mock policy is not linked to any active Active Directory object, no legitimate system or user account has any reason to query or read this file. By applying an explicit NTFS Deny Read rule to the Everyone group on the decoy file, any attempt by an attacker to scan or read it will immediately fail and generate a high-fidelity Access Denied event. By configuring file failure auditing on the decoy path, Windows generates Event ID 4656 or 4663 in the Domain Controller's Security Log. These events capture the attacker's account details and client IP address, providing a low-noise, high-fidelity alert. Option A: Active Directory Domain Controllers File Explorer (GUI) To manually configure the decoy file: 1. Log on to a Domain Controller with Domain Admin privileges. 2. Navigate to the local SYSVOL policies directory (typically C:\Windows\SYSVOL\sysvol\<domain.local>\Policies). 3. Create a new folder with a randomly generated GUID format (e.g., {5B7853A8-1E74-4C56-AC89-E911A34D2E5B}). 4. Inside this folder, create the directory structure: Machine\Preferences\Groups. 5. Create a new file named Groups.xml inside Groups with standard XML structure and a dummy cpassword attribute: xml <?xml version="1.0" encoding="utf-8"?> <Groups clsid="{312F64FA-EB90-4b2e-A6AE-E8C1FCDD4A2C}"> <User clsid="{15C200C5-AE9F-4a18-A372-FD51206104C1}" name="BuiltinAdminDecoy" image="0" changed="2026-07-02 20:56:00" uid="{B6396E70-2EA1-46B4-9F6D-E5D3AD3CD2BE}"> <Properties action="U" newName="LocalAdministrator" changeLogon="0" noChange="1" neverExpires="1" disabled="0" cpassword="j1Uyj/k7S8248c8j838jjSjjSj2jJ29" description="Decoy local admin account for automation services"/> </User> </Groups> 6. Configure the permissions to deny read access: - Right-click Groups.xml and select Properties. - Navigate to the Security tab and click Advanced. - Click Add. Set the Principal to Everyone. Set the Type to Deny. Check the permissions for Read & execute and Read. Click OK. 7. Configure File System Auditing on the decoy: - In the Advanced Security Settings window for Groups.xml, navigate to the Auditing tab. - Click Add. Set the Principal to Everyone. Set the Type to Fail. Check the permissions for Read & execute and Read. Click OK. - Click Apply and then OK. Option B: PowerShell & Remediation (Non-GPO / Script-based) Use these scripts to deploy and audit the SYSVOL honeypot. Download Script: New-SYSVOLHoneypot.ps1 # New-SYSVOLHoneypot.ps1 # Description: Configures a decoy Group Policy Preferences XML file in SYSVOL with Everyone:Deny read permissions and file access failure auditing. # Target Engine: Windows PowerShell 5.1 Write-Host "Applying hardening requirement: Configure SYSVOL Decoy XML Honeypot..." -ForegroundColor Cyan # 1. Retrieve local SYSVOL path $SysvolReg = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "Sysvol" -ErrorAction SilentlyContinue if (-not $SysvolReg) { Write-Host "[*] SYSVOL registry path not found. Checking standard share path..." -ForegroundColor Yellow $SysvolPath = "C:\Windows\SYSVOL\sysvol" } else { $SysvolPath = $SysvolReg.Sysvol } if (-not (Test-Path -Path $SysvolPath)) { Write-Host "[-] SYSVOL folder not found at path: $SysvolPath. Honeypot cannot be deployed." -ForegroundColor Red exit 1 } # Resolve the active Policies folder path $PoliciesPath = Get-ChildItem -Path $SysvolPath -Directory | ForEach-Object { Join-Path $_.FullName "Policies" } | Where-Object { Test-Path $_ } | Select-Object -First 1 if (-not $PoliciesPath) { Write-Host "[-] GPO Policies folder not found under SYSVOL: $SysvolPath" -ForegroundColor Red exit 1 } # 2. Check if a decoy is already registered $RegPath = "HKLM:\SOFTWARE\ADHardening\SYSVOLHoneypot" $ExistingGuid = $null $ExistingPath = $null if (Test-Path $RegPath) { $ExistingGuid = (Get-ItemProperty -Path $RegPath -Name "DecoyGuid" -ErrorAction SilentlyContinue).DecoyGuid $ExistingPath = (Get-ItemProperty -Path $RegPath -Name "DecoyPath" -ErrorAction SilentlyContinue).DecoyPath } # If it exists, verify it $DeployNew = $true if ($ExistingGuid -and $ExistingPath -and (Test-Path $ExistingPath)) { Write-Host "[*] Decoy GPO already registered in registry with GUID: $ExistingGuid" -ForegroundColor Yellow $DeployNew = $false } if ($DeployNew) { # Generate a new random GUID $Guid = [guid]::NewGuid().ToString("B").ToUpper() $DecoyGpoPath = Join-Path $PoliciesPath $Guid $DecoyGroupsPath = Join-Path $DecoyGpoPath "Machine\Preferences\Groups" $DecoyXmlPath = Join-Path $DecoyGroupsPath "Groups.xml" Write-Host "[*] Deploying new decoy GPO folder at: $DecoyGpoPath" -ForegroundColor White New-Item -ItemType Directory -Path $DecoyGroupsPath -Force | Out-Null # Create dummy XML file with decoy cpassword content $DecoyXmlContent = @' <?xml version="1.0" encoding="utf-8"?> <Groups clsid="{312F64FA-EB90-4b2e-A6AE-E8C1FCDD4A2C}"> <User clsid="{15C200C5-AE9F-4a18-A372-FD51206104C1}" name="BuiltinAdminDecoy" image="0" changed="2026-07-02 20:56:00" uid="{B6396E70-2EA1-46B4-9F6D-E5D3AD3CD2BE}"> <Properties action="U" newName="LocalAdministrator" changeLogon="0" noChange="1" neverExpires="1" disabled="0" cpassword="j1Uyj/k7S8248c8j838jjSjjSj2jJ29" description="Decoy local admin account for automation services"/> </User> </Groups> '@ Set-Content -Path $DecoyXmlPath -Value $DecoyXmlContent -Force | Out-Null Write-Host "[+] Decoy GPP Groups.xml created." -ForegroundColor Green # Save to Registry if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "DecoyGuid" -Value $Guid -Type String Set-ItemProperty -Path $RegPath -Name "DecoyPath" -Value $DecoyXmlPath -Type String Write-Host "[+] Registered Decoy Guid: $Guid in HKLM:\SOFTWARE\ADHardening\SYSVOLHoneypot" -ForegroundColor Gray } else { $DecoyXmlPath = $ExistingPath } # 3. Configure permissions: Deny Everyone Read access Write-Host "[*] Enforcing Deny Read/Execute permissions for Everyone on decoy file..." -ForegroundColor White $Acl = Get-Acl -Path $DecoyXmlPath # Check if Deny rule for Everyone already exists to avoid duplication $HasDenyRule = $false foreach ($rule in $Acl.GetAccessRules($true, $false, [System.Security.Principal.NTAccount])) { if ($rule.IdentityReference.Value -eq "Everyone" -and $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Deny) { $HasDenyRule = $true break } } if (-not $HasDenyRule) { $Identity = "Everyone" $Rights = [System.Security.AccessControl.FileSystemRights]::ReadAndExecute -bor [System.Security.AccessControl.FileSystemRights]::Read $Inheritance = [System.Security.AccessControl.InheritanceFlags]::None $Propagation = [System.Security.AccessControl.PropagationFlags]::None $Type = [System.Security.AccessControl.AccessControlType]::Deny $DenyRule = New-Object System.Security.AccessControl.FileSystemAccessRule($Identity, $Rights, $Inheritance, $Propagation, $Type) $Acl.AddAccessRule($DenyRule) Set-Acl -Path $DecoyXmlPath -AclObject $Acl Write-Host "[+] Applied Deny Everyone rule successfully." -ForegroundColor Green } else { Write-Host "[*] Deny Everyone rule is already present." -ForegroundColor Yellow } # 4. Configure Object Auditing for Failure (SACL) Write-Host "[*] Configuring Failure Audit rule for Everyone on decoy file..." -ForegroundColor White # To set SACL, we must load the ACL with audit rules $AclAudit = Get-Acl -Path $DecoyXmlPath -Audit $HasAuditRule = $false foreach ($rule in $AclAudit.GetAuditRules($true, $false, [System.Security.Principal.NTAccount])) { if ($rule.IdentityReference.Value -eq "Everyone" -and $rule.AuditFlags -eq [System.Security.AccessControl.AuditFlags]::Failure) { $HasAuditRule = $true break } } if (-not $HasAuditRule) { $AuditIdentity = "Everyone" $AuditRights = [System.Security.AccessControl.FileSystemRights]::ReadAndExecute -bor [System.Security.AccessControl.FileSystemRights]::Read $AuditInheritance = [System.Security.AccessControl.InheritanceFlags]::None $AuditPropagation = [System.Security.AccessControl.PropagationFlags]::None $AuditFlags = [System.Security.AccessControl.AuditFlags]::Failure $AuditRule = New-Object System.Security.AccessControl.FileSystemAuditRule($AuditIdentity, $AuditRights, $AuditInheritance, $AuditPropagation, $AuditFlags) $AclAudit.AddAuditRule($AuditRule) # Set the ACL with audit rules back to the file Set-Acl -Path $DecoyXmlPath -AclObject $AclAudit Write-Host "[+] Applied Failure Audit rule successfully." -ForegroundColor Green } else { Write-Host "[*] Failure Audit rule is already present." -ForegroundColor Yellow } Write-Host "SYSVOL Decoy XML Honeypot configuration completed successfully." -ForegroundColor Green To verify the honeypot configuration status: Download Script: Get-SYSVOLHoneypotStatus.ps1 # Get-SYSVOLHoneypotStatus.ps1 # Description: Checks the configuration status of the SYSVOL Decoy XML Honeypot. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Auditing SYSVOL Decoy XML Honeypot Configuration ---" -ForegroundColor Cyan $script:Vulnerable = $false $RegPath = "HKLM:\SOFTWARE\ADHardening\SYSVOLHoneypot" if (Test-Path $RegPath) { $DecoyGuid = (Get-ItemProperty -Path $RegPath -Name "DecoyGuid" -ErrorAction SilentlyContinue).DecoyGuid $DecoyPath = (Get-ItemProperty -Path $RegPath -Name "DecoyPath" -ErrorAction SilentlyContinue).DecoyPath if (-not $DecoyGuid) { Write-Host "[-] Decoy GPO GUID is missing in the registry." -ForegroundColor Red $script:Vulnerable = $true } if (-not $DecoyPath) { Write-Host "[-] Decoy file path is missing in the registry." -ForegroundColor Red $script:Vulnerable = $true } else { if (-not (Test-Path $DecoyPath)) { Write-Host "[-] Decoy XML file does not exist at registered path: $DecoyPath" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host "[+] Decoy XML file found: $DecoyPath" -ForegroundColor Green # Check Deny ACL rule $Acl = Get-Acl -Path $DecoyPath $HasDenyRule = $false foreach ($rule in $Acl.GetAccessRules($true, $false, [System.Security.Principal.NTAccount])) { if ($rule.IdentityReference.Value -eq "Everyone" -and $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Deny) { $HasDenyRule = $true break } } if ($HasDenyRule) { Write-Host " - Everyone Deny Read rule: CONFIGURED" -ForegroundColor White } else { Write-Host " - Everyone Deny Read rule: NOT CONFIGURED" -ForegroundColor Red $script:Vulnerable = $true } # Check Audit failure rule (SACL) $AclAudit = Get-Acl -Path $DecoyPath -Audit $HasAuditRule = $false foreach ($rule in $AclAudit.GetAuditRules($true, $false, [System.Security.Principal.NTAccount])) { if ($rule.IdentityReference.Value -eq "Everyone" -and $rule.AuditFlags -eq [System.Security.AccessControl.AuditFlags]::Failure) { $HasAuditRule = $true break } } if ($HasAuditRule) { Write-Host " - Everyone Failure Audit rule: CONFIGURED" -ForegroundColor White } else { Write-Host " - Everyone Failure Audit rule: NOT CONFIGURED" -ForegroundColor Red $script:Vulnerable = $true } } } } else { Write-Host "[-] Decoy registry key not found under HKLM:\SOFTWARE\ADHardening\SYSVOLHoneypot" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # New-SYSVOLHoneypot.ps1 # Description: Configures a decoy Group Policy Preferences XML file in SYSVOL with Everyone:Deny read permissions and file access failure auditing. # Target Engine: Windows PowerShell 5.1 Write-Host "Applying hardening requirement: Configure SYSVOL Decoy XML Honeypot..." -ForegroundColor Cyan # 1. Retrieve local SYSVOL path $SysvolReg = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "Sysvol" -ErrorAction SilentlyContinue if (-not $SysvolReg) { Write-Host "[*] SYSVOL registry path not found. Checking standard share path..." -ForegroundColor Yellow $SysvolPath = "C:\Windows\SYSVOL\sysvol" } else { $SysvolPath = $SysvolReg.Sysvol } if (-not (Test-Path -Path $SysvolPath)) { Write-Host "[-] SYSVOL folder not found at path: $SysvolPath. Honeypot cannot be deployed." -ForegroundColor Red exit 1 } # Resolve the active Policies folder path $PoliciesPath = Get-ChildItem -Path $SysvolPath -Directory | ForEach-Object { Join-Path $_.FullName "Policies" } | Where-Object { Test-Path $_ } | Select-Object -First 1 if (-not $PoliciesPath) { Write-Host "[-] GPO Policies folder not found under SYSVOL: $SysvolPath" -ForegroundColor Red exit 1 } # 2. Check if a decoy is already registered $RegPath = "HKLM:\SOFTWARE\ADHardening\SYSVOLHoneypot" $ExistingGuid = $null $ExistingPath = $null if (Test-Path $RegPath) { $ExistingGuid = (Get-ItemProperty -Path $RegPath -Name "DecoyGuid" -ErrorAction SilentlyContinue).DecoyGuid $ExistingPath = (Get-ItemProperty -Path $RegPath -Name "DecoyPath" -ErrorAction SilentlyContinue).DecoyPath } # If it exists, verify it $DeployNew = $true if ($ExistingGuid -and $ExistingPath -and (Test-Path $ExistingPath)) { Write-Host "[*] Decoy GPO already registered in registry with GUID: $ExistingGuid" -ForegroundColor Yellow $DeployNew = $false } if ($DeployNew) { # Generate a new random GUID $Guid = [guid]::NewGuid().ToString("B").ToUpper() $DecoyGpoPath = Join-Path $PoliciesPath $Guid $DecoyGroupsPath = Join-Path $DecoyGpoPath "Machine\Preferences\Groups" $DecoyXmlPath = Join-Path $DecoyGroupsPath "Groups.xml" Write-Host "[*] Deploying new decoy GPO folder at: $DecoyGpoPath" -ForegroundColor White New-Item -ItemType Directory -Path $DecoyGroupsPath -Force | Out-Null # Create dummy XML file with decoy cpassword content $DecoyXmlContent = @' <?xml version="1.0" encoding="utf-8"?> <Groups clsid="{312F64FA-EB90-4b2e-A6AE-E8C1FCDD4A2C}"> <User clsid="{15C200C5-AE9F-4a18-A372-FD51206104C1}" name="BuiltinAdminDecoy" image="0" changed="2026-07-02 20:56:00" uid="{B6396E70-2EA1-46B4-9F6D-E5D3AD3CD2BE}"> <Properties action="U" newName="LocalAdministrator" changeLogon="0" noChange="1" neverExpires="1" disabled="0" cpassword="j1Uyj/k7S8248c8j838jjSjjSj2jJ29" description="Decoy local admin account for automation services"/> </User> </Groups> '@ Set-Content -Path $DecoyXmlPath -Value $DecoyXmlContent -Force | Out-Null Write-Host "[+] Decoy GPP Groups.xml created." -ForegroundColor Green # Save to Registry if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "DecoyGuid" -Value $Guid -Type String Set-ItemProperty -Path $RegPath -Name "DecoyPath" -Value $DecoyXmlPath -Type String Write-Host "[+] Registered Decoy Guid: $Guid in HKLM:\SOFTWARE\ADHardening\SYSVOLHoneypot" -ForegroundColor Gray } else { $DecoyXmlPath = $ExistingPath } # 3. Configure permissions: Deny Everyone Read access Write-Host "[*] Enforcing Deny Read/Execute permissions for Everyone on decoy file..." -ForegroundColor White $Acl = Get-Acl -Path $DecoyXmlPath # Check if Deny rule for Everyone already exists to avoid duplication $HasDenyRule = $false foreach ($rule in $Acl.GetAccessRules($true, $false, [System.Security.Principal.NTAccount])) { if ($rule.IdentityReference.Value -eq "Everyone" -and $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Deny) { $HasDenyRule = $true break } } if (-not $HasDenyRule) { $Identity = "Everyone" $Rights = [System.Security.AccessControl.FileSystemRights]::ReadAndExecute -bor [System.Security.AccessControl.FileSystemRights]::Read $Inheritance = [System.Security.AccessControl.InheritanceFlags]::None $Propagation = [System.Security.AccessControl.PropagationFlags]::None $Type = [System.Security.AccessControl.AccessControlType]::Deny $DenyRule = New-Object System.Security.AccessControl.FileSystemAccessRule($Identity, $Rights, $Inheritance, $Propagation, $Type) $Acl.AddAccessRule($DenyRule) Set-Acl -Path $DecoyXmlPath -AclObject $Acl Write-Host "[+] Applied Deny Everyone rule successfully." -ForegroundColor Green } else { Write-Host "[*] Deny Everyone rule is already present." -ForegroundColor Yellow } # 4. Configure Object Auditing for Failure (SACL) Write-Host "[*] Configuring Failure Audit rule for Everyone on decoy file..." -ForegroundColor White # To set SACL, we must load the ACL with audit rules $AclAudit = Get-Acl -Path $DecoyXmlPath -Audit $HasAuditRule = $false foreach ($rule in $AclAudit.GetAuditRules($true, $false, [System.Security.Principal.NTAccount])) { if ($rule.IdentityReference.Value -eq "Everyone" -and $rule.AuditFlags -eq [System.Security.AccessControl.AuditFlags]::Failure) { $HasAuditRule = $true break } } if (-not $HasAuditRule) { $AuditIdentity = "Everyone" $AuditRights = [System.Security.AccessControl.FileSystemRights]::ReadAndExecute -bor [System.Security.AccessControl.FileSystemRights]::Read $AuditInheritance = [System.Security.AccessControl.InheritanceFlags]::None $AuditPropagation = [System.Security.AccessControl.PropagationFlags]::None $AuditFlags = [System.Security.AccessControl.AuditFlags]::Failure $AuditRule = New-Object System.Security.AccessControl.FileSystemAuditRule($AuditIdentity, $AuditRights, $AuditInheritance, $AuditPropagation, $AuditFlags) $AclAudit.AddAuditRule($AuditRule) # Set the ACL with audit rules back to the file Set-Acl -Path $DecoyXmlPath -AclObject $AclAudit Write-Host "[+] Applied Failure Audit rule successfully." -ForegroundColor Green } else { Write-Host "[*] Failure Audit rule is already present." -ForegroundColor Yellow } Write-Host "SYSVOL Decoy XML Honeypot configuration completed successfully." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers (Primary Domain Controller / PDC Emulator, replica Domain Controllers) Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 Directory Scope: Forest Root Domain, Child Domains, and Read-Only Domain Controllers (RODCs) File Path: 06-operations-maintenance/enforce-krbtgt-password-rotation.md The krbtgt account is a built-in local service account that serves as the Key Distribution Center (KDC) service account in Active Directory. The long-term secret cryptographic keys derived from the krbtgt account password are used by the KDC to sign and encrypt all Kerberos Ticket Granting Tickets (TGTs) issued within the domain, as well as to compute the Privilege Attribute Certificate (PAC) signatures that vouch for user identity, security identifiers (SIDs), and group memberships. Option A: Group Policy Object (GPO) Baseline & Staged Administrative Procedure Kerberos ticket lifetimes are governed via Group Policy Objects, while the password rotation itself is an operational database procedure executed against Active Directory objects. 1. Verify and Enforce Domain Kerberos Policy via GPO Open the Group Policy Management Console (gpmc.msc). Edit the Default Domain Policy (or a dedicated Tier 0 Domain Controller Policy linked at the domain root). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Kerberos Policy Verify and enforce standard Kerberos parameters: Enforce user logon restrictions*: Enabled Maximum lifetime for service ticket*: 600 minutes (10 hours) Maximum lifetime for user ticket*: 10 hours Maximum lifetime for user ticket renewal*: 7 days Maximum tolerance for computer clock synchronization*: 5 minutes 2. Staged Administrative Procedure for KRBTGT Rotation To execute the staged rotation using Active Directory administrative tools: Phase 1: Pre-Rotation Assessment Identify the Primary Domain Controller (PDC) Emulator for the domain: `cmd netdom query fsmo Verify that Active Directory replication is completely healthy across all Domain Controllers: `cmd repadmin /replsummary repadmin /showrepl * /csv Audit the existing krbtgt password age and kvno (using the audit script below). Phase 2: First Password Reset (Step 1) Log on to the PDC Emulator with Domain Admin or Enterprise Admin credentials. Open Active Directory Users and Computers (dsa.msc), ensure View -> Advanced Features is enabled. Navigate to the Users container, right-click krbtgt, and select Reset Password. Enter a strong, cryptographically complex random password (minimum 128 characters) and confirm it. Click OK. Trigger replication across all Domain Controllers: `cmd repadmin /syncall /AdeP Phase 3: Cooldown and Ticket Expiration Window Wait a minimum of 10 to 24 hours. Monitor Domain Controller Security Event Logs for Kerberos ticket renewal events (Event ID 4768) and verify replication convergence. Phase 4: Second Password Reset (Step 2) On the PDC Emulator, repeat the password reset procedure on the krbtgt account with a new, distinct 128-character password. Trigger replication across all Domain Controllers: `cmd repadmin /syncall /AdeP Phase 5: Post-Rotation Verification Run the audit script below to verify that all Domain Controllers report the updated PasswordLastSet and matching kvno. Option B: PowerShell Operational Automation (Remediation / Audit) Use the following enterprise-grade PowerShell scripts to programmatically manage and audit the KRBTGT password rotation lifecycle. Download Script: Reset-KrbtgtPassword.ps1 # Reset-KrbtgtPassword.ps1 # Description: Resets the KRBTGT account password on the PDC Emulator with a cryptographically secure 128-character password, enforces cooldown safety, and triggers AD replication. # Target Engine: Windows PowerShell 5.1 [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = "High")] param ( [Parameter(Mandatory = $false)] [switch]$Force, [Parameter(Mandatory = $false)] [int]$MinCooldownHours = 10, [Parameter(Mandatory = $false)] [string]$Server ) Write-Host "--- Applying Hardening Requirement: KRBTGT Password Rotation ---" -ForegroundColor Cyan # 1. Verify Active Directory module if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Error "The ActiveDirectory PowerShell module is required to execute this script." return } Import-Module ActiveDirectory -ErrorAction Stop # 2. Discover target Domain Controller (PDC Emulator) try { $domain = Get-ADDomain -ErrorAction Stop $targetServer = $Server if (-not $targetServer) { $targetServer = $domain.PDCEmulator } Write-Host "[*] Target Domain: $($domain.DNSRoot)" -ForegroundColor Gray Write-Host "[*] Authoritative PDC Emulator: $targetServer" -ForegroundColor Gray } catch { Write-Error "Failed to locate domain or PDC Emulator: $($_.Exception.Message)" return } # 3. Retrieve authoritative KRBTGT object try { $krbtgt = Get-ADUser -Identity "krbtgt" -Server $targetServer -Properties PasswordLastSet, Enabled, "msDS-KeyVersionNumber", userAccountControl -ErrorAction Stop if (-not $krbtgt) { Write-Error "KRBTGT account not found on $targetServer." return } } catch { Write-Error "Failed to retrieve KRBTGT account from $($targetServer): $($_.Exception.Message)" return } $lastSet = $krbtgt.PasswordLastSet $currentKvno = $krbtgt."msDS-KeyVersionNumber" Write-Host "[*] Current KRBTGT Password Last Set: $lastSet" -ForegroundColor Gray Write-Host "[*] Current Key Version Number (kvno): $currentKvno" -ForegroundColor Gray # 4. Enforce Cooldown Safety Check if ($null -ne $lastSet) { $elapsedHours = (New-TimeSpan -Start $lastSet -End (Get-Date)).TotalHours if ($elapsedHours -lt $MinCooldownHours -and -not $Force) { $roundedHours = [math]::Round($elapsedHours, 1) Write-Warning "SAFETY INTERLOCK ENGAGED: The KRBTGT password was last set only $roundedHours hours ago." Write-Warning "Resetting KRBTGT again before the Kerberos ticket lifetime ($MinCooldownHours hours) has elapsed" Write-Warning "will purge the previous key from history and invalidate ALL active domain TGTs," Write-Warning "causing enterprise-wide authentication failure for all users and services." Write-Warning "To override this interlock (e.g., during active incident containment), specify -Force." return } } # 5. Generate Cryptographically Secure 128-Character Password $length = 128 $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+-=[]{}|;:,.<>?" $rng = New-Object System.Security.Cryptography.RNGCryptoServiceProvider $bytes = New-Object byte[] $length $rng.GetBytes($bytes) $securePassword = New-Object System.Security.SecureString for ($i = 0; $i -lt $length; $i++) { $char = $chars[$bytes[$i] % $chars.Length] $securePassword.AppendChar($char) } $securePassword.MakeReadOnly() $rng.Dispose() # 6. Execute Password Reset via ShouldProcess $confirmTarget = "KRBTGT account on $targetServer (Domain: $($domain.DNSRoot))" if ($PSCmdlet.ShouldProcess($confirmTarget, "Reset KRBTGT account password and increment kvno")) { try { Set-ADAccountPassword -Identity $krbtgt -Server $targetServer -NewPassword $securePassword -Reset -ErrorAction Stop Write-Host "[+] KRBTGT password successfully reset on PDC Emulator ($targetServer)." -ForegroundColor Green # Re-query to verify kvno increment Start-Sleep -Seconds 2 $updatedKrbtgt = Get-ADUser -Identity "krbtgt" -Server $targetServer -Properties PasswordLastSet, "msDS-KeyVersionNumber" -ErrorAction Stop Write-Host "[+] New Password Last Set: $($updatedKrbtgt.PasswordLastSet)" -ForegroundColor Green Write-Host "[+] New Key Version Number (kvno): $($updatedKrbtgt.'msDS-KeyVersionNumber')" -ForegroundColor Green # 7. Dispatch Active Directory Replication Write-Host "[*] Triggering Active Directory replication synchronization..." -ForegroundColor Cyan $repadmin = Get-Command -Name "repadmin.exe" -ErrorAction SilentlyContinue if ($repadmin) { & repadmin.exe /syncall /AdeP | Out-Null Write-Host "[+] Active Directory replication triggered across all domain partitions." -ForegroundColor Green } else { try { Sync-ADObject -Identity $krbtgt.DistinguishedName -Server $targetServer -ErrorAction SilentlyContinue Write-Host "[+] Sync-ADObject invoked for KRBTGT account." -ForegroundColor Green } catch { Write-Warning "Could not trigger replication automatically. Ensure replication runs across all domain controllers." } } Write-Host "" Write-Host "=========================================================================" -ForegroundColor Yellow Write-Host "[IMPORTANT] Two-Step KRBTGT Password Rotation Protocol:" -ForegroundColor Yellow Write-Host " 1. This reset constitutes Step 1 of the rotation cycle." -ForegroundColor Yellow Write-Host " 2. Active Directory retains the previous key in history (index 1) so" -ForegroundColor Yellow Write-Host " existing valid Kerberos tickets continue to function until expiration." -ForegroundColor Yellow Write-Host " 3. You MUST WAIT at least $MinCooldownHours to 24 hours for all active tickets" -ForegroundColor Yellow Write-Host " to renew and for replication to converge across all domain controllers." -ForegroundColor Yellow Write-Host " 4. After the cooldown period, run this script again to perform Step 2," -ForegroundColor Yellow Write-Host " which purges the pre-rotation key and completely invalidates any" -ForegroundColor Yellow Write-Host " historical Golden, Diamond, or forged Kerberos tickets." -ForegroundColor Yellow Write-Host "=========================================================================" -ForegroundColor Yellow } catch { Write-Error "Failed to reset KRBTGT password: $($_.Exception.Message)" } } To audit the password rotation status and replication convergence of the KRBTGT account: Download Script: Get-KrbtgtRotationStatus.ps1 # Get-KrbtgtRotationStatus.ps1 # Description: Audits KRBTGT password age, kvno, replication convergence across all Domain Controllers, and RODC accounts. # Target Engine: Windows PowerShell 5.1 Import-Module ActiveDirectory -ErrorAction Stop Write-Host "--- Auditing KRBTGT Password Rotation Status ---" -ForegroundColor Cyan # 1. Discover Domain and Authoritative PDC Emulator try { $domain = Get-ADDomain -ErrorAction Stop $pdc = $domain.PDCEmulator Write-Host "[*] Domain: $($domain.DNSRoot)" -ForegroundColor Gray Write-Host "[*] Authoritative PDC Emulator: $pdc" -ForegroundColor Gray } catch { Write-Error "Failed to query domain or PDC Emulator: $($_.Exception.Message)" return } # 2. Retrieve Kerberos Policy MaxTicketAge $maxTicketAgeHours = 10 try { $kerbPolicy = Get-ADDefaultDomainPasswordPolicy -ErrorAction SilentlyContinue if ($kerbPolicy -and $kerbPolicy.MaxTicketAge) { $maxTicketAgeHours = [math]::Round($kerbPolicy.MaxTicketAge.TotalHours, 1) } } catch { $maxTicketAgeHours = 10 } Write-Host "[*] Configured Kerberos MaxTicketAge: $maxTicketAgeHours hours" -ForegroundColor Gray # 3. Query Primary KRBTGT Object on PDC $krbtgt = Get-ADUser -Identity "krbtgt" -Server $pdc -Properties PasswordLastSet, PasswordExpired, Enabled, "msDS-KeyVersionNumber", "msDS-SupportedEncryptionTypes" -ErrorAction SilentlyContinue if (-not $krbtgt) { Write-Error "KRBTGT account not found in Active Directory." return } $passwordLastSet = $krbtgt.PasswordLastSet $kvno = $krbtgt."msDS-KeyVersionNumber" $encTypes = $krbtgt."msDS-SupportedEncryptionTypes" Write-Host " - Account Name: $($krbtgt.Name)" -ForegroundColor White Write-Host " - Enabled: $($krbtgt.Enabled)" -ForegroundColor White Write-Host " - Key Version Number (kvno): $kvno" -ForegroundColor White Write-Host " - Supported Encryption Types Bitmask: $encTypes" -ForegroundColor White if ($null -ne $passwordLastSet) { $ageDays = (New-TimeSpan -Start $passwordLastSet -End (Get-Date)).Days $ageHours = (New-TimeSpan -Start $passwordLastSet -End (Get-Date)).TotalHours $stigThresholdDays = 180 $anssiThresholdDays = 90 Write-Host " - Password Last Set: $passwordLastSet ($ageDays days ago / $([math]::Round($ageHours, 1)) hours ago)" -ForegroundColor White # Check if currently inside the two-step cooldown window if ($ageHours -lt $maxTicketAgeHours) { Write-Host " - Cooldown Status: IN-PROGRESS (Step 1 executed $([math]::Round($ageHours, 1)) hours ago; wait until $maxTicketAgeHours hours have elapsed before executing Step 2)." -ForegroundColor Yellow } # Evaluate compliance thresholds if ($ageDays -gt $stigThresholdDays) { Write-Host " - Compliance Status: FAILED - KRBTGT password has not been rotated in $ageDays days (DoD STIG threshold: $stigThresholdDays days)." -ForegroundColor Red } elseif ($ageDays -gt $anssiThresholdDays) { Write-Host " - Compliance Status: WARNING - KRBTGT password age is $ageDays days (Exceeds ANSSI recommendation of $anssiThresholdDays days; compliant with STIG threshold of $stigThresholdDays days)." -ForegroundColor Yellow } else { Write-Host " - Compliance Status: PASSED - KRBTGT password age is $ageDays days (Compliant with STIG and ANSSI baselines)." -ForegroundColor Green } } else { Write-Host " - Compliance Status: FAILED - PasswordLastSet attribute is null." -ForegroundColor Red } # 4. Audit Replication Consistency Across All Reachable DCs Write-Host "`n[*] Auditing KRBTGT Replication Convergence Across Domain Controllers:" -ForegroundColor Cyan $dcs = Get-ADDomainController -Filter * -ErrorAction SilentlyContinue $dcResults = @() $replicationDiscrepancy = $false foreach ($dc in $dcs) { try { $dcKrbtgt = Get-ADUser -Identity "krbtgt" -Server $dc.HostName -Properties PasswordLastSet, "msDS-KeyVersionNumber" -ErrorAction Stop $match = ($dcKrbtgt.PasswordLastSet -eq $passwordLastSet) -and ($dcKrbtgt."msDS-KeyVersionNumber" -eq $kvno) if (-not $match) { $replicationDiscrepancy = $true } $dcResults += [PSCustomObject]@{ DomainController = $dc.HostName Reachable = $true PasswordLastSet = $dcKrbtgt.PasswordLastSet Kvno = $dcKrbtgt."msDS-KeyVersionNumber" InSync = $match } } catch { $dcResults += [PSCustomObject]@{ DomainController = $dc.HostName Reachable = $false PasswordLastSet = $null Kvno = $null InSync = $false } } } foreach ($res in $dcResults) { if ($res.Reachable -and $res.InSync) { Write-Host " [OK] $($res.DomainController): kvno=$($res.Kvno), LastSet=$($res.PasswordLastSet)" -ForegroundColor Green } elseif ($res.Reachable -and -not $res.InSync) { Write-Host " [MISMATCH] $($res.DomainController): kvno=$($res.Kvno), LastSet=$($res.PasswordLastSet) (Out of sync with PDC)" -ForegroundColor Red } else { Write-Host " [UNREACHABLE] $($res.DomainController): Unable to query" -ForegroundColor Yellow } } if ($replicationDiscrepancy) { Write-Host " [!] Warning: Replication discrepancy detected across Domain Controllers." -ForegroundColor Red } # 5. Audit Read-Only Domain Controller (RODC) KRBTGT Accounts Write-Host "`n[*] Auditing Read-Only Domain Controller (RODC) KRBTGT Accounts:" -ForegroundColor Cyan $rodcAccounts = Get-ADUser -Filter "Name -like 'krbtgt_*'" -Server $pdc -Properties PasswordLastSet, "msDS-KeyVersionNumber", Enabled -ErrorAction SilentlyContinue if ($rodcAccounts -and $rodcAccounts.Count -gt 0) { Write-Host " Found $($rodcAccounts.Count) RODC KRBTGT account(s):" -ForegroundColor Gray foreach ($rodc in $rodcAccounts) { $rodcAgeDays = "N/A" if ($rodc.PasswordLastSet) { $rodcAgeDays = (New-TimeSpan -Start $rodc.PasswordLastSet -End (Get-Date)).Days } Write-Host " - $($rodc.SamAccountName): kvno=$($rodc.'msDS-KeyVersionNumber'), LastSet=$($rodc.PasswordLastSet) ($rodcAgeDays days ago), Enabled=$($rodc.Enabled)" -ForegroundColor White } } else { Write-Host " No Read-Only Domain Controller (RODC) accounts detected in this domain." -ForegroundColor Gray } # Reset-KrbtgtPassword.ps1 # Description: Resets the KRBTGT account password on the PDC Emulator with a cryptographically secure 128-character password, enforces cooldown safety, and triggers AD replication. # Target Engine: Windows PowerShell 5.1 [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = "High")] param ( [Parameter(Mandatory = $false)] [switch]$Force, [Parameter(Mandatory = $false)] [int]$MinCooldownHours = 10, [Parameter(Mandatory = $false)] [string]$Server ) Write-Host "--- Applying Hardening Requirement: KRBTGT Password Rotation ---" -ForegroundColor Cyan # 1. Verify Active Directory module if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Error "The ActiveDirectory PowerShell module is required to execute this script." return } Import-Module ActiveDirectory -ErrorAction Stop # 2. Discover target Domain Controller (PDC Emulator) try { $domain = Get-ADDomain -ErrorAction Stop $targetServer = $Server if (-not $targetServer) { $targetServer = $domain.PDCEmulator } Write-Host "[*] Target Domain: $($domain.DNSRoot)" -ForegroundColor Gray Write-Host "[*] Authoritative PDC Emulator: $targetServer" -ForegroundColor Gray } catch { Write-Error "Failed to locate domain or PDC Emulator: $($_.Exception.Message)" return } # 3. Retrieve authoritative KRBTGT object try { $krbtgt = Get-ADUser -Identity "krbtgt" -Server $targetServer -Properties PasswordLastSet, Enabled, "msDS-KeyVersionNumber", userAccountControl -ErrorAction Stop if (-not $krbtgt) { Write-Error "KRBTGT account not found on $targetServer." return } } catch { Write-Error "Failed to retrieve KRBTGT account from $($targetServer): $($_.Exception.Message)" return } $lastSet = $krbtgt.PasswordLastSet $currentKvno = $krbtgt."msDS-KeyVersionNumber" Write-Host "[*] Current KRBTGT Password Last Set: $lastSet" -ForegroundColor Gray Write-Host "[*] Current Key Version Number (kvno): $currentKvno" -ForegroundColor Gray # 4. Enforce Cooldown Safety Check if ($null -ne $lastSet) { $elapsedHours = (New-TimeSpan -Start $lastSet -End (Get-Date)).TotalHours if ($elapsedHours -lt $MinCooldownHours -and -not $Force) { $roundedHours = [math]::Round($elapsedHours, 1) Write-Warning "SAFETY INTERLOCK ENGAGED: The KRBTGT password was last set only $roundedHours hours ago." Write-Warning "Resetting KRBTGT again before the Kerberos ticket lifetime ($MinCooldownHours hours) has elapsed" Write-Warning "will purge the previous key from history and invalidate ALL active domain TGTs," Write-Warning "causing enterprise-wide authentication failure for all users and services." Write-Warning "To override this interlock (e.g., during active incident containment), specify -Force." return } } # 5. Generate Cryptographically Secure 128-Character Password $length = 128 $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+-=[]{}|;:,.<>?" $rng = New-Object System.Security.Cryptography.RNGCryptoServiceProvider $bytes = New-Object byte[] $length $rng.GetBytes($bytes) $securePassword = New-Object System.Security.SecureString for ($i = 0; $i -lt $length; $i++) { $char = $chars[$bytes[$i] % $chars.Length] $securePassword.AppendChar($char) } $securePassword.MakeReadOnly() $rng.Dispose() # 6. Execute Password Reset via ShouldProcess $confirmTarget = "KRBTGT account on $targetServer (Domain: $($domain.DNSRoot))" if ($PSCmdlet.ShouldProcess($confirmTarget, "Reset KRBTGT account password and increment kvno")) { try { Set-ADAccountPassword -Identity $krbtgt -Server $targetServer -NewPassword $securePassword -Reset -ErrorAction Stop Write-Host "[+] KRBTGT password successfully reset on PDC Emulator ($targetServer)." -ForegroundColor Green # Re-query to verify kvno increment Start-Sleep -Seconds 2 $updatedKrbtgt = Get-ADUser -Identity "krbtgt" -Server $targetServer -Properties PasswordLastSet, "msDS-KeyVersionNumber" -ErrorAction Stop Write-Host "[+] New Password Last Set: $($updatedKrbtgt.PasswordLastSet)" -ForegroundColor Green Write-Host "[+] New Key Version Number (kvno): $($updatedKrbtgt.'msDS-KeyVersionNumber')" -ForegroundColor Green # 7. Dispatch Active Directory Replication Write-Host "[*] Triggering Active Directory replication synchronization..." -ForegroundColor Cyan $repadmin = Get-Command -Name "repadmin.exe" -ErrorAction SilentlyContinue if ($repadmin) { & repadmin.exe /syncall /AdeP | Out-Null Write-Host "[+] Active Directory replication triggered across all domain partitions." -ForegroundColor Green } else { try { Sync-ADObject -Identity $krbtgt.DistinguishedName -Server $targetServer -ErrorAction SilentlyContinue Write-Host "[+] Sync-ADObject invoked for KRBTGT account." -ForegroundColor Green } catch { Write-Warning "Could not trigger replication automatically. Ensure replication runs across all domain controllers." } } Write-Host "" Write-Host "=========================================================================" -ForegroundColor Yellow Write-Host "[IMPORTANT] Two-Step KRBTGT Password Rotation Protocol:" -ForegroundColor Yellow Write-Host " 1. This reset constitutes Step 1 of the rotation cycle." -ForegroundColor Yellow Write-Host " 2. Active Directory retains the previous key in history (index 1) so" -ForegroundColor Yellow Write-Host " existing valid Kerberos tickets continue to function until expiration." -ForegroundColor Yellow Write-Host " 3. You MUST WAIT at least $MinCooldownHours to 24 hours for all active tickets" -ForegroundColor Yellow Write-Host " to renew and for replication to converge across all domain controllers." -ForegroundColor Yellow Write-Host " 4. After the cooldown period, run this script again to perform Step 2," -ForegroundColor Yellow Write-Host " which purges the pre-rotation key and completely invalidates any" -ForegroundColor Yellow Write-Host " historical Golden, Diamond, or forged Kerberos tickets." -ForegroundColor Yellow Write-Host "=========================================================================" -ForegroundColor Yellow } catch { Write-Error "Failed to reset KRBTGT password: $($_.Exception.Message)" } } Target Scope: Applicable Systems: Domain Controllers (Forest-wide configuration affecting all domains) Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 Forest Functional Level: Windows Server 2008 R2 or higher File Path: 06-operations-maintenance/enable-recycle-bin.md The Active Directory (AD) Recycle Bin is an essential disaster recovery, availability, and incident response capability. In modern enterprise environments, directory availability is directly tied to core organizational operations. Accidental administrative errors, script bugs, malicious insider sabotage, and destructive cyberattacks (such as ransomware operations deploying wipers like HermeticWiper or deleting Tier 0 infrastructure to inhibit incident response) pose critical risks to Active Directory object integrity. Enabling and properly configuring the Active Directory Recycle Bin provides vital security and operational defenses: Option A: Active Directory Administrative Center (GUI Configuration & Recovery) 1. Enabling the Recycle Bin (Forest Root Domain Controller) Log on to a Domain Controller in the forest root domain with an account that is a member of the Enterprise Admins group. Open Active Directory Administrative Center (dsac.exe). In the left navigation pane, select the forest root domain node. In the right-hand Tasks pane, click Enable Recycle Bin.... In the confirmation warning dialog informing that this action is irreversible, click OK. A notification dialog will state that the feature will begin replicating across all Domain Controllers in the forest. Click OK. Refresh the Administrative Center interface; the "Enable Recycle Bin..." link will now be permanently grayed out. 2. Restoring Deleted Objects via ADAC Open Active Directory Administrative Center (dsac.exe). In the left navigation pane, expand the target domain node and click on the Deleted Objects container. Locate the deleted object(s) using the search bar or filter criteria. Right-click the object and select one of the following options: Restore*: Restores the object directly to its original parent Organizational Unit. Restore To...*: Allows specifying an alternative target Organizational Unit (required if the original parent OU was deleted or relocated). Option B: PowerShell & Directory Configuration (Remediation / Non-GPO) Run the following scripts to audit and activate the optional feature forest-wide, configure retention lifetimes, and verify container security. 1. Local Audit (Audit-ADRecycleBin.ps1) Download Script: Audit-ADRecycleBin.ps1 # Audit-ADRecycleBin.ps1 # Description: Audits Active Directory Recycle Bin status, lifetime configurations, and container ACL permissions. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Auditing Active Directory Recycle Bin Configuration ---" -ForegroundColor Cyan $isVulnerable = $false # 1. Verify Active Directory module availability if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Host "VULNERABLE: The ActiveDirectory PowerShell module is not available on this system." -ForegroundColor Red Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red return } Import-Module ActiveDirectory -ErrorAction SilentlyContinue try { # 2. Check Forest and Forest Functional Level $forest = Get-ADForest -ErrorAction Stop $forestMode = $forest.ForestMode Write-Host "[*] Active Directory Forest: $($forest.Name)" -ForegroundColor Gray Write-Host "[*] Forest Functional Level: $($forestMode)" -ForegroundColor Gray $validModes = @("Windows2008R2Forest", "Windows2012Forest", "Windows2012R2Forest", "Windows2016Forest", "Windows2025Forest") if ($validModes -notcontains $forestMode) { Write-Host "VULNERABLE: Forest Functional Level '$($forestMode)' does not support Active Directory Recycle Bin (requires Windows Server 2008 R2 or higher)." -ForegroundColor Red $isVulnerable = $true } # 3. Check Optional Feature Enablement $recycleFeature = Get-ADOptionalFeature -Filter "Name -eq 'Recycle Bin Feature'" -Properties EnabledScopes -ErrorAction Stop $enabledScopes = $recycleFeature.EnabledScopes if ($enabledScopes -and ($enabledScopes -contains $forest.PartitionsContainer -or $enabledScopes.Count -gt 0)) { Write-Host "[+] Recycle Bin Feature is ENABLED forest-wide." -ForegroundColor Green } else { Write-Host "VULNERABLE: Active Directory Recycle Bin Feature is NOT enabled in forest '$($forest.Name)'." -ForegroundColor Red $isVulnerable = $true } # 4. Check Deleted Object Lifetime and Tombstone Lifetime $rootDse = Get-ADRootDSE -ErrorAction Stop $configNC = $rootDse.configurationNamingContext $dsPath = "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$configNC" $dsConfig = Get-ADObject -Identity $dsPath -Properties msDS-deletedObjectLifetime, tombstoneLifetime -ErrorAction Stop $dol = $dsConfig."msDS-deletedObjectLifetime" $tombstone = $dsConfig.tombstoneLifetime if ($null -eq $tombstone -or $tombstone -eq 0) { $effectiveTombstone = 60 # Legacy Windows 2000/2003 default Write-Host "[!] tombstoneLifetime attribute is not explicitly set (defaults to 60 days in legacy forests, or 180 days in modern forests)." -ForegroundColor Yellow } else { $effectiveTombstone = $tombstone Write-Host "[*] tombstoneLifetime: $($effectiveTombstone) days" -ForegroundColor Gray } if ($null -eq $dol) { Write-Host "[*] msDS-deletedObjectLifetime: (Not Set - defaults to tombstoneLifetime of $($effectiveTombstone) days)" -ForegroundColor Gray } else { Write-Host "[*] msDS-deletedObjectLifetime: $($dol) days" -ForegroundColor Gray if ($dol -lt 60) { Write-Host "VULNERABLE: msDS-deletedObjectLifetime is configured to less than 60 days ($($dol) days). Recovery window is excessively short." -ForegroundColor Red $isVulnerable = $true } } # 5. Audit Access Permissions on CN=Deleted Objects Container $domainDN = $rootDse.defaultNamingContext $deletedObjectsDN = "CN=Deleted Objects,$domainDN" Write-Host "[*] Auditing security permissions on: $($deletedObjectsDN)" -ForegroundColor Gray try { $deletedObjACL = Get-Acl -Path "AD:\$deletedObjectsDN" -ErrorAction Stop $suspiciousIdentities = @( "NT AUTHORITY\Authenticated Users", "Everyone", "BUILTIN\Users", "ANONYMOUS LOGON" ) $flaggedAccess = $false foreach ($accessRule in $deletedObjACL.Access) { $identity = $accessRule.IdentityReference.Value foreach ($suspicious in $suspiciousIdentities) { if ($identity -like "*$suspicious*" -and $accessRule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow) { Write-Host "VULNERABLE: Non-default permissive access granted to '$($identity)' on Deleted Objects container ($($accessRule.ActiveDirectoryRights))." -ForegroundColor Red $flaggedAccess = $true $isVulnerable = $true } } } if (-not $flaggedAccess) { Write-Host "[+] Permissions on Deleted Objects container are restricted to privileged administrators." -ForegroundColor Green } } catch { Write-Host "[*] Note: Unable to query Deleted Objects container ACL directly ($($_.Exception.Message))." -ForegroundColor Yellow } } catch { Write-Host "VULNERABLE: Failed to complete Active Directory Recycle Bin audit. Error: $($_.Exception.Message)" -ForegroundColor Red $isVulnerable = $true } Write-Host "--------------------------------------------------------" -ForegroundColor Cyan if ($isVulnerable) { Write-Host "Audit Result: VULNERABLE - Active Directory Recycle Bin configuration requires remediation." -ForegroundColor Red } else { Write-Host "Audit Result: SECURE - Active Directory Recycle Bin is enabled and correctly configured." -ForegroundColor Green } 2. Local Remediation (Enable-ADRecycleBin.ps1) Download Script: Enable-ADRecycleBin.ps1 # Enable-ADRecycleBin.ps1 # Description: Validates forest prerequisites, enables Active Directory Recycle Bin forest-wide, and configures lifetimes. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Applying Hardening Requirement: Enable Active Directory Recycle Bin ---" -ForegroundColor Cyan # 1. Verify Active Directory module if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Error "The ActiveDirectory PowerShell module is required to execute this script." return } Import-Module ActiveDirectory -ErrorAction Stop try { # 2. Forest and FFL Validation $forest = Get-ADForest -ErrorAction Stop $forestMode = $forest.ForestMode Write-Host "[*] Target Forest: $($forest.Name)" -ForegroundColor Gray Write-Host "[*] Current Forest Functional Level: $($forestMode)" -ForegroundColor Gray $validModes = @("Windows2008R2Forest", "Windows2012Forest", "Windows2012R2Forest", "Windows2016Forest", "Windows2025Forest") if ($validModes -notcontains $forestMode) { Write-Error "Cannot enable Recycle Bin. Forest functional level must be Windows Server 2008 R2 or higher (Current: $($forestMode)). Raise forest functional level first." return } # 3. Check and Enable Recycle Bin Feature $recycleBinFeature = Get-ADOptionalFeature -Filter "Name -eq 'Recycle Bin Feature'" -ErrorAction Stop $enabledScopes = $recycleBinFeature.EnabledScopes if (-not $enabledScopes -or $enabledScopes.Count -eq 0) { Write-Host "[+] Enabling Active Directory Recycle Bin optional feature in forest '$($forest.Name)'..." -ForegroundColor Yellow Enable-ADOptionalFeature -Identity $recycleBinFeature -Scope ForestOrConfigurationSet -Target $forest.Name -Confirm:$false -ErrorAction Stop Write-Host "[+] Active Directory Recycle Bin enabled successfully." -ForegroundColor Green } else { Write-Host "[+] Active Directory Recycle Bin is already enabled in forest '$($forest.Name)'." -ForegroundColor Green } # 4. Configure / Verify msDS-deletedObjectLifetime $rootDse = Get-ADRootDSE -ErrorAction Stop $configNC = $rootDse.configurationNamingContext $dsPath = "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$configNC" $dsConfig = Get-ADObject -Identity $dsPath -Properties msDS-deletedObjectLifetime, tombstoneLifetime -ErrorAction Stop $tombstone = $dsConfig.tombstoneLifetime $currentDol = $dsConfig."msDS-deletedObjectLifetime" # Ensure tombstoneLifetime is at least 180 days if ($null -eq $tombstone -or $tombstone -lt 180) { Write-Host "[+] Setting tombstoneLifetime to 180 days on Directory Service configuration..." -ForegroundColor Yellow Set-ADObject -Identity $dsPath -Replace @{ tombstoneLifetime = 180 } -ErrorAction Stop Write-Host "[+] tombstoneLifetime updated to 180 days." -ForegroundColor Green } else { Write-Host "[+] tombstoneLifetime is currently configured to $($tombstone) days." -ForegroundColor Green } # Set explicit msDS-deletedObjectLifetime if missing or excessively low if ($null -eq $currentDol -or $currentDol -lt 180) { Write-Host "[+] Explicitly configuring msDS-deletedObjectLifetime to 180 days..." -ForegroundColor Yellow Set-ADObject -Identity $dsPath -Replace @{ "msDS-deletedObjectLifetime" = 180 } -ErrorAction Stop Write-Host "[+] msDS-deletedObjectLifetime configured to 180 days." -ForegroundColor Green } else { Write-Host "[+] msDS-deletedObjectLifetime is currently set to $($currentDol) days." -ForegroundColor Green } Write-Host "[+] Remediation completed successfully. Allow directory replication to synchronize across all Domain Controllers." -ForegroundColor Green } catch { Write-Error "Failed to configure Active Directory Recycle Bin. Error: $($_.Exception.Message)" } Option C: Operational Recovery Runbook (PowerShell) Use these commands during incident response or accidental deletion triage to locate and restore deleted objects. 1. Discovering Deleted Objects # List all deleted objects in the domain Get-ADObject -SearchBase "CN=Deleted Objects,$((Get-ADRootDSE).defaultNamingContext)" -IncludeDeletedObjects -Filter 'isDeleted -eq $true' -Properties sAMAccountName, whenChanged, lastKnownParent, objectClass # Find a deleted user by username Get-ADObject -Filter "sAMAccountName -eq 'jsmith' -and isDeleted -eq $true" -IncludeDeletedObjects -Properties sAMAccountName, lastKnownParent # Find all objects deleted within the last 24 hours $cutoff = (Get-Date).AddDays(-1) Get-ADObject -Filter "whenChanged -ge `$cutoff -and isDeleted -eq `$true" -IncludeDeletedObjects -Properties sAMAccountName, whenChanged, lastKnownParent 2. Restoring a Single Deleted Object # Restore a user object back to its original location (lastKnownParent) Get-ADObject -Filter "sAMAccountName -eq 'jsmith' -and isDeleted -eq $true" -IncludeDeletedObjects | Restore-ADObject # Restore an object to an alternative Organizational Unit $targetOU = "OU=Quarantine,DC=corp,DC=domain,DC=com" Get-ADObject -Filter "sAMAccountName -eq 'jsmith' -and isDeleted -eq $true" -IncludeDeletedObjects | Restore-ADObject -TargetPath $targetOU 3. Restoring Nested Organizational Units and Dependent Child Objects When an Organizational Unit containing child objects (sub-OUs, users, groups, computers) is deleted, all objects move directly into CN=Deleted Objects. Because child objects reference their parent container, the parent Organizational Unit must be restored first, followed by subordinate child objects in hierarchical order: # Step 1: Restore the parent Organizational Unit first Get-ADObject -Filter "objectClass -eq 'organizationalUnit' -and name -like 'Finance*' -and isDeleted -eq $true" -IncludeDeletedObjects | Restore-ADObject # Step 2: Restore child objects (users, groups, computers) once parent OU exists Get-ADObject -Filter "lastKnownParent -like '*Finance*' -and isDeleted -eq $true" -IncludeDeletedObjects | Restore-ADObject # Enable-ADRecycleBin.ps1 # Description: Validates forest prerequisites, enables Active Directory Recycle Bin forest-wide, and configures lifetimes. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Applying Hardening Requirement: Enable Active Directory Recycle Bin ---" -ForegroundColor Cyan # 1. Verify Active Directory module if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Error "The ActiveDirectory PowerShell module is required to execute this script." return } Import-Module ActiveDirectory -ErrorAction Stop try { # 2. Forest and FFL Validation $forest = Get-ADForest -ErrorAction Stop $forestMode = $forest.ForestMode Write-Host "[*] Target Forest: $($forest.Name)" -ForegroundColor Gray Write-Host "[*] Current Forest Functional Level: $($forestMode)" -ForegroundColor Gray $validModes = @("Windows2008R2Forest", "Windows2012Forest", "Windows2012R2Forest", "Windows2016Forest", "Windows2025Forest") if ($validModes -notcontains $forestMode) { Write-Error "Cannot enable Recycle Bin. Forest functional level must be Windows Server 2008 R2 or higher (Current: $($forestMode)). Raise forest functional level first." return } # 3. Check and Enable Recycle Bin Feature $recycleBinFeature = Get-ADOptionalFeature -Filter "Name -eq 'Recycle Bin Feature'" -ErrorAction Stop $enabledScopes = $recycleBinFeature.EnabledScopes if (-not $enabledScopes -or $enabledScopes.Count -eq 0) { Write-Host "[+] Enabling Active Directory Recycle Bin optional feature in forest '$($forest.Name)'..." -ForegroundColor Yellow Enable-ADOptionalFeature -Identity $recycleBinFeature -Scope ForestOrConfigurationSet -Target $forest.Name -Confirm:$false -ErrorAction Stop Write-Host "[+] Active Directory Recycle Bin enabled successfully." -ForegroundColor Green } else { Write-Host "[+] Active Directory Recycle Bin is already enabled in forest '$($forest.Name)'." -ForegroundColor Green } # 4. Configure / Verify msDS-deletedObjectLifetime $rootDse = Get-ADRootDSE -ErrorAction Stop $configNC = $rootDse.configurationNamingContext $dsPath = "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,$configNC" $dsConfig = Get-ADObject -Identity $dsPath -Properties msDS-deletedObjectLifetime, tombstoneLifetime -ErrorAction Stop $tombstone = $dsConfig.tombstoneLifetime $currentDol = $dsConfig."msDS-deletedObjectLifetime" # Ensure tombstoneLifetime is at least 180 days if ($null -eq $tombstone -or $tombstone -lt 180) { Write-Host "[+] Setting tombstoneLifetime to 180 days on Directory Service configuration..." -ForegroundColor Yellow Set-ADObject -Identity $dsPath -Replace @{ tombstoneLifetime = 180 } -ErrorAction Stop Write-Host "[+] tombstoneLifetime updated to 180 days." -ForegroundColor Green } else { Write-Host "[+] tombstoneLifetime is currently configured to $($tombstone) days." -ForegroundColor Green } # Set explicit msDS-deletedObjectLifetime if missing or excessively low if ($null -eq $currentDol -or $currentDol -lt 180) { Write-Host "[+] Explicitly configuring msDS-deletedObjectLifetime to 180 days..." -ForegroundColor Yellow Set-ADObject -Identity $dsPath -Replace @{ "msDS-deletedObjectLifetime" = 180 } -ErrorAction Stop Write-Host "[+] msDS-deletedObjectLifetime configured to 180 days." -ForegroundColor Green } else { Write-Host "[+] msDS-deletedObjectLifetime is currently set to $($currentDol) days." -ForegroundColor Green } Write-Host "[+] Remediation completed successfully. Allow directory replication to synchronize across all Domain Controllers." -ForegroundColor Green } catch { Write-Error "Failed to configure Active Directory Recycle Bin. Error: $($_.Exception.Message)" } Target Scope: Applicable Systems: Domain Controllers (SYSVOL Share) Operating Systems: Windows Server 2016 and above File Path: 06-operations-maintenance/maintain-gpo-templates.md Group Policy Objects (GPOs) rely on XML-based Administrative Template files (.admx) and language-specific resource files (.adml) to display registry-based policy settings within administrative tools. By default, the Group Policy Management Editor loads templates from the local computer's %SystemRoot%\PolicyDefinitions folder. In an enterprise AD environment, this behavior introduces several security and operational risks: 1. Configuration Drift: If different Domain Controllers or management workstations have different template versions installed, editing GPOs can result in missing configurations, corrupted settings, or inadvertent reversion of newer security settings. 2. Missing Security Controls: As operating systems evolve, new security controls (such as disabling legacy name resolution or enforcing LSA protection) are introduced in newer templates. Without updated templates, administrators cannot manage these settings via the GPMC GUI. Establishing the Central Store in the SYSVOL share ensures that all administrators edit GPOs using a single, authoritative set of administrative templates. Option A: Manual Central Store Establishment (Preferred) Log on to a Domain Controller with Schema Admins or Domain Admins credentials. Open File Explorer and navigate to the local SYSVOL Policies folder: C:\Windows\SYSVOL\sysvol\<Domain_FQDN>\Policies (or use the UNC path: \\localhost\SYSVOL\<Domain_FQDN>\Policies). Create a new folder named PolicyDefinitions. Create language-specific subdirectories inside it based on your environment (e.g. en-US). Copy the contents of the local administrative template directory C:\Windows\PolicyDefinitions (all .admx files) into the newly created PolicyDefinitions folder in SYSVOL. Copy the local .adml files from C:\Windows\PolicyDefinitions\en-US into the en-US subfolder in SYSVOL. To update templates in an offline, air-gapped environment, manually transfer the latest Administrative Templates (downloaded as .msi packages from Microsoft) to the domain controller, extract them, and copy the new .admx and .adml files into the SYSVOL Central Store, replacing older versions. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts to audit and initialize the Central Store folder structure. 1. Local Audit (Audit-GPOCentralStore.ps1) Download Script: Audit-GPOCentralStore.ps1 # Audit-GPOCentralStore.ps1 # Description: Audits the existence of the GPO Central Store in SYSVOL. Import-Module ActiveDirectory Write-Host "--- Auditing Group Policy Central Store ---" -ForegroundColor Cyan try { $Domain = Get-ADDomain -ErrorAction Stop $CentralStorePath = "\\$($Domain.DNSRoot)\SYSVOL\$($Domain.DNSRoot)\Policies\PolicyDefinitions" if (Test-Path -Path $CentralStorePath) { Write-Host "`nStatus: Compliant. Group Policy Central Store is established at:" -ForegroundColor Green Write-Host " $CentralStorePath" -ForegroundColor White $AdmxFiles = Get-ChildItem -Path $CentralStorePath -Filter *.admx Write-Host " Found $($AdmxFiles.Count) ADMX templates in the store." -ForegroundColor Green } else { Write-Host "`nVULNERABLE: Group Policy Central Store does NOT exist. Expected location:" -ForegroundColor Red Write-Host " $CentralStorePath" -ForegroundColor Red } } catch { Write-Host "VULNERABLE: Could not query Active Directory for SYSVOL path. Error: $($_.Exception.Message)" -ForegroundColor Red } 2. Local Remediation (Create-GPOCentralStore.ps1) Download Script: Create-GPOCentralStore.ps1 # Create-GPOCentralStore.ps1 # Description: Initializes the Central Store directory structure in SYSVOL. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Initialize GPO Central Store..." -ForegroundColor Cyan try { $Domain = Get-ADDomain -ErrorAction Stop $CentralStorePath = "\\$($Domain.DNSRoot)\SYSVOL\$($Domain.DNSRoot)\Policies\PolicyDefinitions" if (-not (Test-Path -Path $CentralStorePath)) { New-Item -ItemType Directory -Path $CentralStorePath -Force -ErrorAction Stop | Out-Null # Create standard language folder New-Item -ItemType Directory -Path (Join-Path $CentralStorePath "en-US") -Force -ErrorAction Stop | Out-Null Write-Host "[+] Group Policy Central Store initialized successfully." -ForegroundColor Green Write-Host " Path: $CentralStorePath" -ForegroundColor White Write-Host " Please copy the latest .admx and .adml files to this directory." -ForegroundColor Yellow } else { Write-Host "[+] Central Store is already initialized at: $CentralStorePath" -ForegroundColor Green } } catch { Write-Error "Failed to initialize GPO Central Store. Error: $($_.Exception.Message)" } # Create-GPOCentralStore.ps1 # Description: Initializes the Central Store directory structure in SYSVOL. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Initialize GPO Central Store..." -ForegroundColor Cyan try { $Domain = Get-ADDomain -ErrorAction Stop $CentralStorePath = "\\$($Domain.DNSRoot)\SYSVOL\$($Domain.DNSRoot)\Policies\PolicyDefinitions" if (-not (Test-Path -Path $CentralStorePath)) { New-Item -ItemType Directory -Path $CentralStorePath -Force -ErrorAction Stop | Out-Null # Create standard language folder New-Item -ItemType Directory -Path (Join-Path $CentralStorePath "en-US") -Force -ErrorAction Stop | Out-Null Write-Host "[+] Group Policy Central Store initialized successfully." -ForegroundColor Green Write-Host " Path: $CentralStorePath" -ForegroundColor White Write-Host " Please copy the latest .admx and .adml files to this directory." -ForegroundColor Yellow } else { Write-Host "[+] Central Store is already initialized at: $CentralStorePath" -ForegroundColor Green } } catch { Write-Error "Failed to initialize GPO Central Store. Error: $($_.Exception.Message)" } Target Scope: Applicable Systems: Domain Members (Clients and Servers) Operating Systems: Windows 10/11, Windows Server 2016 and above File Path: 06-operations-maintenance/use-third-party-templates.md Group Policy Objects (GPOs) natively manage core Windows operating system components but lack administrative control definitions for third-party Commercial Off-The-Shelf (COTS) software (such as Google Chrome, Microsoft Edge, Adobe Acrobat Reader) and advanced security guide extensions. Implementing third-party and custom GPO templates provides the following benefits: 1. Centralized Configuration: Administrators can enforce security configurations across all enterprise workstations and member servers (e.g. disabling insecure browser protocols, locking PDF execution properties) directly from the Group Policy Management Console. 2. Reduced Attack Surface: Custom templates (such as Security-ADMX GitHub Repository or the Microsoft Security Guide template) expose hidden or advanced registry configurations, allowing administrators to restrict features like WDigest authentication or LSA credential caching that are not exposed in standard out-of-the-box Windows templates. 3. Consistency: Linking COTS hardening GPOs ensures that third-party applications remain compliant with corporate security baselines, preventing local user overrides. Option A: Manual Central Store Importing (Preferred) Log on to a management workstation or Domain Controller with Domain Admins credentials. Download the official Administrative Templates from the software manufacturer's website (e.g. Microsoft Edge Enterprise templates, Google Chrome templates). Extract the downloaded files to locate the .admx files and matching .adml language-specific resource files (typically in en-US subfolders). Navigate to the Central Store on a Domain Controller: \\<Domain_FQDN>\SYSVOL\<Domain_FQDN>\Policies\PolicyDefinitions Copy the .admx files into the root of the PolicyDefinitions directory. Copy the .adml files into the language subfolder matching the language (e.g. PolicyDefinitions\en-US). Open the Group Policy Management Console (gpmc.msc) and edit a target hardening GPO. The new settings will appear under Computer Configuration > Policies > Administrative Templates > [Software Name]. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts to audit and import custom templates. 1. Local Audit (Audit-ThirdPartyTemplates.ps1) Download Script: Audit-ThirdPartyTemplates.ps1 # Audit-ThirdPartyTemplates.ps1 # Description: Checks the GPO Central Store for common third-party templates. Import-Module ActiveDirectory Write-Host "--- Auditing Third-Party GPO Templates ---" -ForegroundColor Cyan try { $Domain = Get-ADDomain -ErrorAction Stop $CentralStorePath = "\\$($Domain.DNSRoot)\SYSVOL\$($Domain.DNSRoot)\Policies\PolicyDefinitions" if (Test-Path -Path $CentralStorePath) { $Templates = @{ "Microsoft Edge" = "msedge.admx" "Google Chrome" = "chrome.admx" "Adobe Acrobat" = "Acrobat.admx" "MS Security Guide" = "SecGuide.admx" } Write-Host "`nChecking for common templates in Central Store:" -ForegroundColor Yellow foreach ($key in $Templates.Keys) { $file = $Templates[$key] $fullPath = Join-Path $CentralStorePath $file if (Test-Path -Path $fullPath) { Write-Host " - [FOUND] $key ($file)" -ForegroundColor Green } else { Write-Host " - [MISSING] $key ($file)" -ForegroundColor Yellow } } } else { Write-Host "VULNERABLE: Group Policy Central Store does not exist. Cannot audit templates." -ForegroundColor Red } } catch { Write-Host "VULNERABLE: Could not query Active Directory. Error: $($_.Exception.Message)" -ForegroundColor Red } 2. Local Remediation (Import-ThirdPartyTemplate.ps1) Download Script: Import-ThirdPartyTemplate.ps1 # Import-ThirdPartyTemplate.ps1 # Description: Copies a specified ADMX and ADML template to the Central Store. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Copy GPO Templates to Central Store..." -ForegroundColor Cyan # Define local source paths for templates (to be populated by administrator) $SourceAdmx = "C:\SourceTemplates\msedge.admx" $SourceAdml = "C:\SourceTemplates\en-US\msedge.adml" try { $Domain = Get-ADDomain -ErrorAction Stop $CentralStorePath = "\\$($Domain.DNSRoot)\SYSVOL\$($Domain.DNSRoot)\Policies\PolicyDefinitions" if (-not (Test-Path -Path $CentralStorePath)) { Write-Error "GPO Central Store is not initialized. Please establish the Central Store first." exit 1 } if ((Test-Path -Path $SourceAdmx) -and (Test-Path -Path $SourceAdml)) { # Copy ADMX file Copy-Item -Path $SourceAdmx -Destination $CentralStorePath -Force -ErrorAction Stop Write-Host "[+] Copied ADMX: $(Split-Path $SourceAdmx -Leaf) to Central Store." -ForegroundColor Green # Copy ADML file to matching subfolder $LangDir = Join-Path $CentralStorePath "en-US" if (-not (Test-Path -Path $LangDir)) { New-Item -ItemType Directory -Path $LangDir -Force -ErrorAction Stop | Out-Null } Copy-Item -Path $SourceAdml -Destination $LangDir -Force -ErrorAction Stop Write-Host "[+] Copied ADML: $(Split-Path $SourceAdml -Leaf) to Central Store en-US subfolder." -ForegroundColor Green } else { Write-Warning "Source template files not found at specified paths. Please ensure templates are downloaded locally." } } catch { Write-Error "Failed to copy template files. Error: $($_.Exception.Message)" } # Import-ThirdPartyTemplate.ps1 # Description: Copies a specified ADMX and ADML template to the Central Store. Import-Module ActiveDirectory Write-Host "Applying hardening requirement: Copy GPO Templates to Central Store..." -ForegroundColor Cyan # Define local source paths for templates (to be populated by administrator) $SourceAdmx = "C:\SourceTemplates\msedge.admx" $SourceAdml = "C:\SourceTemplates\en-US\msedge.adml" try { $Domain = Get-ADDomain -ErrorAction Stop $CentralStorePath = "\\$($Domain.DNSRoot)\SYSVOL\$($Domain.DNSRoot)\Policies\PolicyDefinitions" if (-not (Test-Path -Path $CentralStorePath)) { Write-Error "GPO Central Store is not initialized. Please establish the Central Store first." exit 1 } if ((Test-Path -Path $SourceAdmx) -and (Test-Path -Path $SourceAdml)) { # Copy ADMX file Copy-Item -Path $SourceAdmx -Destination $CentralStorePath -Force -ErrorAction Stop Write-Host "[+] Copied ADMX: $(Split-Path $SourceAdmx -Leaf) to Central Store." -ForegroundColor Green # Copy ADML file to matching subfolder $LangDir = Join-Path $CentralStorePath "en-US" if (-not (Test-Path -Path $LangDir)) { New-Item -ItemType Directory -Path $LangDir -Force -ErrorAction Stop | Out-Null } Copy-Item -Path $SourceAdml -Destination $LangDir -Force -ErrorAction Stop Write-Host "[+] Copied ADML: $(Split-Path $SourceAdml -Leaf) to Central Store en-US subfolder." -ForegroundColor Green } else { Write-Warning "Source template files not found at specified paths. Please ensure templates are downloaded locally." } } catch { Write-Error "Failed to copy template files. Error: $($_.Exception.Message)" } Target Scope: Applicable Systems: Domain Controllers, Tier 0 Administration Workstations (PAWs) Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10/11 Enterprise File Path: 06-operations-maintenance/configure-dedicated-tier0-wsus.md The Windows Server Update Services (WSUS) role allows administrators to centralize the approval and distribution of security updates and patches. However, update services execute code with system privileges. If a shared, mutualized WSUS server (managed by Tier 1 or Tier 2 administrators) is used to patch Tier 0 Domain Controllers: 1. Lateral Movement Target: A compromise of the shared WSUS server or its database allows an attacker to inject malicious metadata, forcing Domain Controllers to execute arbitrary code or load compromised updates. 2. Bypasses Administration Isolation: Standard network administrators could inadvertently or maliciously deploy payloads to Tier 0 servers. 3. HTTP Traffic Manipulation: If WSUS communication is configured over cleartext HTTP (the default port 8530), attackers inside the network can perform man-in-the-middle attacks to inject custom update packages. To mitigate these threats, Tier 0 Domain Controllers and PAWs must pull updates from a dedicated WSUS server located inside the Tier 0 security boundary, configured exclusively with SSL/TLS encryption. Option A: Group Policy Object (GPO) Configuration 1. Enforce HTTPS for WSUS in GPO Open Group Policy Management (gpmc.msc). Create or edit a GPO targeting Tier 0 systems (e.g., GPO_Hardening_DomainControllers). Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update Double-click the Specify intranet Microsoft update service location policy. Set it to Enabled. Set the intranet update service and status server properties to point to the dedicated, secure Tier 0 WSUS server: Set the intranet update service for detecting updates*: https://wsust0.corp.local:8531 Set the intranet statistics server*: https://wsust0.corp.local:8531 Set the alternate download server*: https://wsust0.corp.local:8531 Click OK and link the GPO to the Domain Controllers and PAW OUs. 2. Configure SSL on the WSUS Server On the dedicated Tier 0 WSUS server: 1. Open IIS Manager (inetmgr.exe). 2. Bind an SSL certificate (issued by a trusted PKI) to port 8531 on the WSUS Administration Web Site. 3. In the middle pane, double-click SSL Settings on the virtual directories (SimpleAuthWebService, DSSAuthWebService, ClientWebService, APIRemoting30). 4. Check Require SSL and click Apply. 5. Execute the WSUS configuration command to activate SSL bindings: C:\Program Files\Update Services\Tools\wsusutil.exe configuressl wsust0.corp.local Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script block to apply the dedicated WSUS target server configuration locally via registry parameters. Download Script: Set-LocalWsusServer.ps1 # Set-LocalWsusServer.ps1 # Description: Configures the local client registry to utilize the dedicated Tier 0 WSUS over HTTPS. Write-Host "Applying hardening requirement: Configure Dedicated WSUS for Tier 0..." -ForegroundColor Cyan $WsusRegPath = "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate" $WsusServerUrl = "https://wsust0.corp.local:8531" if (-not (Test-Path $WsusRegPath)) { New-Item -Path $WsusRegPath -Force | Out-Null } # 1. Configure target WSUS server values Set-ItemProperty -Path $WsusRegPath -Name "WUServer" -Value $WsusServerUrl -Type String -ErrorAction Stop Set-ItemProperty -Path $WsusRegPath -Name "WUStatusServer" -Value $WsusServerUrl -Type String -ErrorAction Stop # 2. Force Windows Update configuration to use local settings $UpdateAuPath = "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" if (-not (Test-Path $UpdateAuPath)) { New-Item -Path $UpdateAuPath -Force | Out-Null } Set-ItemProperty -Path $UpdateAuPath -Name "UseWUServer" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] Local system configured to use secure WSUS server: $WsusServerUrl" -ForegroundColor Green To verify active WSUS configurations: Download Script: Get-WsusConfigStatus.ps1 # Get-WsusConfigStatus.ps1 # Description: Audits local WSUS configuration settings. $WsusRegPath = "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate" Write-Host "Checking Windows Update registry parameters..." -ForegroundColor Cyan if (Test-Path $WsusRegPath) { $WusVal = Get-ItemProperty -Path $WsusRegPath -Name "WUServer" -ErrorAction SilentlyContinue if ($null -ne $WusVal) { $WusServer = $WusVal.WUServer # Check if using HTTPS if ($WusServer -like "https://*") { Write-Host "[+] WUServer: $WusServer (Secure HTTPS Connection)." -ForegroundColor Green } else { Write-Host "[-] WUServer: $WusServer (Insecure HTTP Connection - Action Required)." -ForegroundColor Red } } else { Write-Host "[-] WUServer is not configured." -ForegroundColor Yellow } } else { Write-Host "[-] Windows Update policies are not defined." -ForegroundColor Yellow } # Set-LocalWsusServer.ps1 # Description: Configures the local client registry to utilize the dedicated Tier 0 WSUS over HTTPS. Write-Host "Applying hardening requirement: Configure Dedicated WSUS for Tier 0..." -ForegroundColor Cyan $WsusRegPath = "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate" $WsusServerUrl = "https://wsust0.corp.local:8531" if (-not (Test-Path $WsusRegPath)) { New-Item -Path $WsusRegPath -Force | Out-Null } # 1. Configure target WSUS server values Set-ItemProperty -Path $WsusRegPath -Name "WUServer" -Value $WsusServerUrl -Type String -ErrorAction Stop Set-ItemProperty -Path $WsusRegPath -Name "WUStatusServer" -Value $WsusServerUrl -Type String -ErrorAction Stop # 2. Force Windows Update configuration to use local settings $UpdateAuPath = "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" if (-not (Test-Path $UpdateAuPath)) { New-Item -Path $UpdateAuPath -Force | Out-Null } Set-ItemProperty -Path $UpdateAuPath -Name "UseWUServer" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] Local system configured to use secure WSUS server: $WsusServerUrl" -ForegroundColor Green Target Scope: Applicable Systems: Active Directory Domain Controllers (Domain-wide structural policy) Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025 Domain Functional Level: Windows Server 2003 or higher File Path: 06-operations-maintenance/redirect-default-containers.md In default Active Directory deployments, newly provisioned user and computer accounts are automatically instantiated within two legacy default containers located at the root of the domain: Default Users Container : `CN=Users,DC=domain,DC=com` Default Computers Container: CN=Computers,DC=domain,DC=com From an enterprise security and systems architecture perspective, placing active operational assets in these default locations creates severe defensive gaps, policy blind spots, and lateral movement vulnerabilities. Option A: Active Directory Administrative Center & Native CLI Tools (Preferred) Execute the following procedure on a Domain Controller using an account with Domain Admins or Enterprise Admins privileges. 1. Create and Protect Staging Organizational Units Open Active Directory Administrative Center (dsac.exe) or Active Directory Users and Computers (dsa.msc). Ensure View -> Advanced Features is enabled in dsa.msc. Create two dedicated staging Organizational Units at the appropriate administrative level (e.g., at the domain root or under a dedicated Staging hierarchy): * OU=Staging-Computers,DC=domain,DC=com * OU=Staging-Users,DC=domain,DC=com For both OUs, verify that accidental deletion protection is active: Right-click the OU, select Properties , navigate to the Object* tab. Verify that Protect object from accidental deletion is checked. Click OK*. 2. Link Baseline Quarantine Group Policy Objects Open the Group Policy Management Console (gpmc.msc). Create and link a dedicated quarantine baseline GPO to OU=Staging-Computers: * Enforce Windows LAPS with randomized high-entropy passwords. * Enable Windows Firewall for all profiles with default inbound block rules, permitting only essential management traffic from authorized deployment servers and DCs. * Enable Windows Defender Antivirus real-time protection and Credential Guard. Link appropriate baseline policies to OU=Staging-Users (e.g., enforce Kerberos pre-authentication, smart card enforcement, or account disablement pending onboarding validation). 3. Execute Container Redirection Open an elevated Command Prompt (cmd.exe) on a Domain Controller. Redirect the default computer container to the new staging OU: `cmd redircmp.exe "OU=Staging-Computers,DC=domain,DC=com" (Replace `DC=domain,DC=com` with the actual Distinguished Name of the domain). Verify command output: `text Redirection was successful. Redirect the default user container to the new staging OU: `cmd redirusr.exe "OU=Staging-Users,DC=domain,DC=com" (Replace `DC=domain,DC=com` with the actual Distinguished Name of the domain). Verify command output: `text Redirection was successful. 4. Delegate Computer Joining Permissions on Staging-Computers OU If authorized provisioning accounts or automated imaging systems (SCCM/MECM, MDT, WDS) need to join computers: 1. In dsa.msc, right-click OU=Staging-Computers and select Delegate Control.... 2. Add the designated provisioning service account or security group (e.g., SVC_ComputerJoiner_gMSA or GG_Workstation_Provisioning). 3. Select Create a custom task to delegate -> Next. 4. Select Only the following objects in the folder -> check Computer objects -> check Create selected objects in this folder. 5. Click Next, grant Read and Write permissions for computer properties, and finish the wizard. Option B: PowerShell Automated Administration (Audit & Remediation) The following PowerShell scripts run natively on Windows PowerShell 5.1 on Domain Controllers with the Active Directory RSAT module installed. 1. Local Audit (Audit-DefaultContainers.ps1) This script audits the redirection state of both user and computer containers, validates accidental deletion protection, verifies GPO linkages, and flags any unmanaged residual accounts remaining in legacy containers. Download Script: Audit-DefaultContainers.ps1 # Audit-DefaultContainers.ps1 # Description: Audits Active Directory default user and computer container redirection, # verifies accidental deletion protection, checks GPO linkage, and inventories residual accounts. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Auditing Active Directory Default Containers Redirection ---" -ForegroundColor Cyan # 1. Verify Active Directory module availability if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Host "VULNERABLE: The ActiveDirectory PowerShell module is not installed or available on this system." -ForegroundColor Red exit 1 } Import-Module ActiveDirectory $isVulnerable = $false try { $domain = Get-ADDomain -ErrorAction Stop $domainDN = $domain.DistinguishedName $defaultComputersDN = "CN=Computers,$($domainDN)" $defaultUsersDN = "CN=Users,$($domainDN)" Write-Host "[i] Domain Distinguished Name: $($domainDN)" -ForegroundColor Gray Write-Host "[i] Domain Functional Level : $($domain.DomainMode)" -ForegroundColor Gray Write-Host "" # ------------------------------------------------------------- # 2. Check Computers Container Redirection # ------------------------------------------------------------- Write-Host "Checking Computers Container Configuration..." -ForegroundColor Yellow $currentCompContainer = $domain.ComputersContainer Write-Host "[i] Current Computers Container: $($currentCompContainer)" -ForegroundColor Gray if ($currentCompContainer -eq $defaultComputersDN) { Write-Host "VULNERABLE: Default Computers container is NOT redirected. Newly joined computers land in unmanaged 'CN=Computers'." -ForegroundColor Red $isVulnerable = $true } else { # Verify the redirected container is an OU $compTarget = Get-ADObject -Identity $currentCompContainer -Properties ProtectedFromAccidentalDeletion, gPLink -ErrorAction SilentlyContinue if ($null -eq $compTarget) { Write-Host "VULNERABLE: The redirected Computers target container does not exist: $($currentCompContainer)" -ForegroundColor Red $isVulnerable = $true } elseif ($compTarget.ObjectClass -ne "organizationalUnit") { Write-Host "VULNERABLE: Computers container is redirected to object class '$($compTarget.ObjectClass)', NOT an Organizational Unit. GPOs cannot be linked directly." -ForegroundColor Red $isVulnerable = $true } else { Write-Host "[+] Computers container is redirected to an Organizational Unit." -ForegroundColor Green # Check accidental deletion protection if ($compTarget.ProtectedFromAccidentalDeletion) { Write-Host "[+] Computers OU has Accidental Deletion Protection ENABLED." -ForegroundColor Green } else { Write-Host "VULNERABLE: Computers OU '$($compTarget.Name)' has Accidental Deletion Protection DISABLED." -ForegroundColor Red $isVulnerable = $true } # Check GPO linkage if ([string]::IsNullOrEmpty($compTarget.gPLink)) { Write-Host "WARNING: Computers target OU has NO Group Policy Objects linked. Newly joined machines will not receive hardening baselines." -ForegroundColor Yellow } else { Write-Host "[+] Computers target OU has active Group Policy Object(s) linked." -ForegroundColor Green } } } Write-Host "" # ------------------------------------------------------------- # 3. Check Users Container Redirection # ------------------------------------------------------------- Write-Host "Checking Users Container Configuration..." -ForegroundColor Yellow $currentUserContainer = $domain.UsersContainer Write-Host "[i] Current Users Container: $($currentUserContainer)" -ForegroundColor Gray if ($currentUserContainer -eq $defaultUsersDN) { Write-Host "VULNERABLE: Default Users container is NOT redirected. Newly created users land in unmanaged 'CN=Users'." -ForegroundColor Red $isVulnerable = $true } else { # Verify the redirected container is an OU $userTarget = Get-ADObject -Identity $currentUserContainer -Properties ProtectedFromAccidentalDeletion, gPLink -ErrorAction SilentlyContinue if ($null -eq $userTarget) { Write-Host "VULNERABLE: The redirected Users target container does not exist: $($currentUserContainer)" -ForegroundColor Red $isVulnerable = $true } elseif ($userTarget.ObjectClass -ne "organizationalUnit") { Write-Host "VULNERABLE: Users container is redirected to object class '$($userTarget.ObjectClass)', NOT an Organizational Unit. GPOs cannot be linked directly." -ForegroundColor Red $isVulnerable = $true } else { Write-Host "[+] Users container is redirected to an Organizational Unit." -ForegroundColor Green # Check accidental deletion protection if ($userTarget.ProtectedFromAccidentalDeletion) { Write-Host "[+] Users OU has Accidental Deletion Protection ENABLED." -ForegroundColor Green } else { Write-Host "VULNERABLE: Users OU '$($userTarget.Name)' has Accidental Deletion Protection DISABLED." -ForegroundColor Red $isVulnerable = $true } # Check GPO linkage if ([string]::IsNullOrEmpty($userTarget.gPLink)) { Write-Host "WARNING: Users target OU has NO Group Policy Objects linked. Newly provisioned users will not receive hardening baselines." -ForegroundColor Yellow } else { Write-Host "[+] Users target OU has active Group Policy Object(s) linked." -ForegroundColor Green } } } Write-Host "" # ------------------------------------------------------------- # 4. Inventory Residual Accounts in Legacy Containers # ------------------------------------------------------------- Write-Host "Inventorying Residual Non-Built-in Objects in Default Containers..." -ForegroundColor Yellow # Residual computers in CN=Computers $strayComputers = Get-ADComputer -SearchBase $defaultComputersDN -SearchScope OneLevel -Filter * -ErrorAction SilentlyContinue if ($strayComputers) { $count = ($strayComputers | Measure-Object).Count Write-Host "WARNING: Found $($count) computer object(s) remaining in legacy default 'CN=Computers'. These should be migrated to appropriate tier OUs." -ForegroundColor Yellow foreach ($comp in $strayComputers | Select-Object -First 5) { Write-Host " - $($comp.Name) (Enabled: $($comp.Enabled))" -ForegroundColor Gray } if ($count -gt 5) { Write-Host " - ... and $($count - 5) more computer(s)." -ForegroundColor Gray } } else { Write-Host "[+] Legacy default 'CN=Computers' container has no residual computer objects." -ForegroundColor Green } # Residual non-system users in CN=Users $builtinSids = @( "$($domain.DomainSID)-500", # Administrator "$($domain.DomainSID)-501", # Guest "$($domain.DomainSID)-502" # krbtgt ) $strayUsers = Get-ADUser -SearchBase $defaultUsersDN -SearchScope OneLevel -Filter * -ErrorAction SilentlyContinue | Where-Object { $builtinSids -notcontains $_.SID.Value -and $_.SamAccountName -ne "SUPPORT_388945a0" } if ($strayUsers) { $userCount = ($strayUsers | Measure-Object).Count Write-Host "WARNING: Found $($userCount) non-built-in user account(s) remaining in legacy default 'CN=Users'. These should be evaluated and migrated to tier OUs." -ForegroundColor Yellow foreach ($usr in $strayUsers | Select-Object -First 5) { Write-Host " - $($usr.SamAccountName) (Enabled: $($usr.Enabled))" -ForegroundColor Gray } if ($userCount -gt 5) { Write-Host " - ... and $($userCount - 5) more user(s)." -ForegroundColor Gray } } else { Write-Host "[+] Legacy default 'CN=Users' container contains only default built-in security principals." -ForegroundColor Green } Write-Host "" # ------------------------------------------------------------- # 5. Final Compliance Assessment # ------------------------------------------------------------- if ($isVulnerable) { Write-Host "STATUS: NON-COMPLIANT - Default container redirection is not fully configured or protected." -ForegroundColor Red exit 1 } else { Write-Host "STATUS: COMPLIANT - Default Users and Computers containers are properly redirected to deletion-protected Organizational Units." -ForegroundColor Green exit 0 } } catch { Write-Host "VULNERABLE: Failed to query Active Directory domain configuration. Error: $($_.Exception.Message)" -ForegroundColor Red exit 1 } 2. Local Remediation (Set-DefaultContainersRedirection.ps1) This script creates the target staging Organizational Units, enables accidental deletion protection, executes redircmp.exe and redirusr.exe, and verifies the updated well-known objects in Active Directory. Download Script: Set-DefaultContainersRedirection.ps1 # Set-DefaultContainersRedirection.ps1 # Description: Creates staging OUs, configures accidental deletion protection, # and redirects default user and computer containers using redircmp and redirusr. # Target Engine: Windows PowerShell 5.1 [CmdletBinding(SupportsShouldProcess = $true)] param ( [Parameter(Mandatory = $false)] [string]$TargetComputersOUName = "Staging-Computers", [Parameter(Mandatory = $false)] [string]$TargetUsersOUName = "Staging-Users", [Parameter(Mandatory = $false)] [string]$ParentOUPath ) Write-Host "--- Applying Hardening: Redirect Default Users and Computers Containers ---" -ForegroundColor Cyan # 1. Verify Active Directory module availability if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Error "The ActiveDirectory PowerShell module is required to execute this script." exit 1 } Import-Module ActiveDirectory try { $domain = Get-ADDomain -ErrorAction Stop $domainDN = $domain.DistinguishedName # Determine base path if ([string]::IsNullOrEmpty($ParentOUPath)) { $basePath = $domainDN } else { $basePath = $ParentOUPath } $targetComputersDN = "OU=$($TargetComputersOUName),$($basePath)" $targetUsersDN = "OU=$($TargetUsersOUName),$($basePath)" Write-Host "[i] Target Computers OU DN: $($targetComputersDN)" -ForegroundColor Gray Write-Host "[i] Target Users OU DN : $($targetUsersDN)" -ForegroundColor Gray Write-Host "" # ------------------------------------------------------------- # 2. Provision and Protect Computers Staging OU # ------------------------------------------------------------- $existingCompOU = Get-ADOrganizationalUnit -Filter "DistinguishedName -eq '$($targetComputersDN)'" -ErrorAction SilentlyContinue if ($null -eq $existingCompOU) { if ($PSCmdlet.ShouldProcess($targetComputersDN, "Create Organizational Unit and enable Accidental Deletion Protection")) { Write-Host "[+] Creating target Computers OU: $($targetComputersDN)" -ForegroundColor Yellow New-ADOrganizationalUnit -Name $TargetComputersOUName -Path $basePath -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host "[+] Target Computers OU created and protected successfully." -ForegroundColor Green } } else { Write-Host "[+] Target Computers OU already exists. Ensuring accidental deletion protection is enabled..." -ForegroundColor Yellow if ($PSCmdlet.ShouldProcess($targetComputersDN, "Set ProtectedFromAccidentalDeletion = $true")) { Set-ADOrganizationalUnit -Identity $targetComputersDN -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host "[+] Accidental deletion protection verified on Computers OU." -ForegroundColor Green } } # ------------------------------------------------------------- # 3. Provision and Protect Users Staging OU # ------------------------------------------------------------- $existingUserOU = Get-ADOrganizationalUnit -Filter "DistinguishedName -eq '$($targetUsersDN)'" -ErrorAction SilentlyContinue if ($null -eq $existingUserOU) { if ($PSCmdlet.ShouldProcess($targetUsersDN, "Create Organizational Unit and enable Accidental Deletion Protection")) { Write-Host "[+] Creating target Users OU: $($targetUsersDN)" -ForegroundColor Yellow New-ADOrganizationalUnit -Name $TargetUsersOUName -Path $basePath -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host "[+] Target Users OU created and protected successfully." -ForegroundColor Green } } else { Write-Host "[+] Target Users OU already exists. Ensuring accidental deletion protection is enabled..." -ForegroundColor Yellow if ($PSCmdlet.ShouldProcess($targetUsersDN, "Set ProtectedFromAccidentalDeletion = $true")) { Set-ADOrganizationalUnit -Identity $targetUsersDN -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host "[+] Accidental deletion protection verified on Users OU." -ForegroundColor Green } } Write-Host "" # ------------------------------------------------------------- # 4. Redirect Computers Container via redircmp.exe # ------------------------------------------------------------- if ($domain.ComputersContainer -ne $targetComputersDN) { if ($PSCmdlet.ShouldProcess($domainDN, "Redirect Computers Container to $($targetComputersDN)")) { Write-Host "[+] Redirecting default Computers container to: $($targetComputersDN)..." -ForegroundColor Yellow $outputComp = & redircmp.exe $targetComputersDN 2>&1 if ($LASTEXITCODE -eq 0) { Write-Host "[+] redircmp output: $($outputComp)" -ForegroundColor Green } else { throw "redircmp.exe failed with exit code $($LASTEXITCODE). Output: $($outputComp)" } } } else { Write-Host "[+] Computers container is already redirected to target OU: $($targetComputersDN)" -ForegroundColor Green } # ------------------------------------------------------------- # 5. Redirect Users Container via redirusr.exe # ------------------------------------------------------------- if ($domain.UsersContainer -ne $targetUsersDN) { if ($PSCmdlet.ShouldProcess($domainDN, "Redirect Users Container to $($targetUsersDN)")) { Write-Host "[+] Redirecting default Users container to: $($targetUsersDN)..." -ForegroundColor Yellow $outputUser = & redirusr.exe $targetUsersDN 2>&1 if ($LASTEXITCODE -eq 0) { Write-Host "[+] redirusr output: $($outputUser)" -ForegroundColor Green } else { throw "redirusr.exe failed with exit code $($LASTEXITCODE). Output: $($outputUser)" } } } else { Write-Host "[+] Users container is already redirected to target OU: $($targetUsersDN)" -ForegroundColor Green } Write-Host "" # ------------------------------------------------------------- # 6. Post-Remediation Verification # ------------------------------------------------------------- $refreshedDomain = Get-ADDomain -ErrorAction Stop Write-Host "Post-Remediation Verification:" -ForegroundColor Cyan Write-Host " - Domain ComputersContainer: $($refreshedDomain.ComputersContainer)" -ForegroundColor Gray Write-Host " - Domain UsersContainer : $($refreshedDomain.UsersContainer)" -ForegroundColor Gray if ($refreshedDomain.ComputersContainer -eq $targetComputersDN -and $refreshedDomain.UsersContainer -eq $targetUsersDN) { Write-Host "`n[+] Default containers redirection completed successfully." -ForegroundColor Green } else { Write-Warning "Directory attributes have not yet reflected the redirection. Allow time for domain-wide replication." } Write-Host "" Write-Host "[IMPORTANT NEXT STEPS]:" -ForegroundColor Yellow Write-Host "1. Link a quarantine/staging Group Policy Object (GPO) to '$($targetComputersDN)' (enforcing LAPS, Firewall, Credential Guard)." -ForegroundColor Gray Write-Host "2. Delegate 'Create Computer Objects' on '$($targetComputersDN)' to authorized provisioning service accounts." -ForegroundColor Gray Write-Host "3. Inventory and migrate any non-built-in residual accounts from 'CN=Computers' and 'CN=Users' to appropriate production OUs." -ForegroundColor Gray } catch { Write-Error "Remediation failed. Error: $($_.Exception.Message)" exit 1 } # Set-DefaultContainersRedirection.ps1 # Description: Creates staging OUs, configures accidental deletion protection, # and redirects default user and computer containers using redircmp and redirusr. # Target Engine: Windows PowerShell 5.1 [CmdletBinding(SupportsShouldProcess = $true)] param ( [Parameter(Mandatory = $false)] [string]$TargetComputersOUName = "Staging-Computers", [Parameter(Mandatory = $false)] [string]$TargetUsersOUName = "Staging-Users", [Parameter(Mandatory = $false)] [string]$ParentOUPath ) Write-Host "--- Applying Hardening: Redirect Default Users and Computers Containers ---" -ForegroundColor Cyan # 1. Verify Active Directory module availability if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) { Write-Error "The ActiveDirectory PowerShell module is required to execute this script." exit 1 } Import-Module ActiveDirectory try { $domain = Get-ADDomain -ErrorAction Stop $domainDN = $domain.DistinguishedName # Determine base path if ([string]::IsNullOrEmpty($ParentOUPath)) { $basePath = $domainDN } else { $basePath = $ParentOUPath } $targetComputersDN = "OU=$($TargetComputersOUName),$($basePath)" $targetUsersDN = "OU=$($TargetUsersOUName),$($basePath)" Write-Host "[i] Target Computers OU DN: $($targetComputersDN)" -ForegroundColor Gray Write-Host "[i] Target Users OU DN : $($targetUsersDN)" -ForegroundColor Gray Write-Host "" # ------------------------------------------------------------- # 2. Provision and Protect Computers Staging OU # ------------------------------------------------------------- $existingCompOU = Get-ADOrganizationalUnit -Filter "DistinguishedName -eq '$($targetComputersDN)'" -ErrorAction SilentlyContinue if ($null -eq $existingCompOU) { if ($PSCmdlet.ShouldProcess($targetComputersDN, "Create Organizational Unit and enable Accidental Deletion Protection")) { Write-Host "[+] Creating target Computers OU: $($targetComputersDN)" -ForegroundColor Yellow New-ADOrganizationalUnit -Name $TargetComputersOUName -Path $basePath -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host "[+] Target Computers OU created and protected successfully." -ForegroundColor Green } } else { Write-Host "[+] Target Computers OU already exists. Ensuring accidental deletion protection is enabled..." -ForegroundColor Yellow if ($PSCmdlet.ShouldProcess($targetComputersDN, "Set ProtectedFromAccidentalDeletion = $true")) { Set-ADOrganizationalUnit -Identity $targetComputersDN -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host "[+] Accidental deletion protection verified on Computers OU." -ForegroundColor Green } } # ------------------------------------------------------------- # 3. Provision and Protect Users Staging OU # ------------------------------------------------------------- $existingUserOU = Get-ADOrganizationalUnit -Filter "DistinguishedName -eq '$($targetUsersDN)'" -ErrorAction SilentlyContinue if ($null -eq $existingUserOU) { if ($PSCmdlet.ShouldProcess($targetUsersDN, "Create Organizational Unit and enable Accidental Deletion Protection")) { Write-Host "[+] Creating target Users OU: $($targetUsersDN)" -ForegroundColor Yellow New-ADOrganizationalUnit -Name $TargetUsersOUName -Path $basePath -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host "[+] Target Users OU created and protected successfully." -ForegroundColor Green } } else { Write-Host "[+] Target Users OU already exists. Ensuring accidental deletion protection is enabled..." -ForegroundColor Yellow if ($PSCmdlet.ShouldProcess($targetUsersDN, "Set ProtectedFromAccidentalDeletion = $true")) { Set-ADOrganizationalUnit -Identity $targetUsersDN -ProtectedFromAccidentalDeletion $true -ErrorAction Stop Write-Host "[+] Accidental deletion protection verified on Users OU." -ForegroundColor Green } } Write-Host "" # ------------------------------------------------------------- # 4. Redirect Computers Container via redircmp.exe # ------------------------------------------------------------- if ($domain.ComputersContainer -ne $targetComputersDN) { if ($PSCmdlet.ShouldProcess($domainDN, "Redirect Computers Container to $($targetComputersDN)")) { Write-Host "[+] Redirecting default Computers container to: $($targetComputersDN)..." -ForegroundColor Yellow $outputComp = & redircmp.exe $targetComputersDN 2>&1 if ($LASTEXITCODE -eq 0) { Write-Host "[+] redircmp output: $($outputComp)" -ForegroundColor Green } else { throw "redircmp.exe failed with exit code $($LASTEXITCODE). Output: $($outputComp)" } } } else { Write-Host "[+] Computers container is already redirected to target OU: $($targetComputersDN)" -ForegroundColor Green } # ------------------------------------------------------------- # 5. Redirect Users Container via redirusr.exe # ------------------------------------------------------------- if ($domain.UsersContainer -ne $targetUsersDN) { if ($PSCmdlet.ShouldProcess($domainDN, "Redirect Users Container to $($targetUsersDN)")) { Write-Host "[+] Redirecting default Users container to: $($targetUsersDN)..." -ForegroundColor Yellow $outputUser = & redirusr.exe $targetUsersDN 2>&1 if ($LASTEXITCODE -eq 0) { Write-Host "[+] redirusr output: $($outputUser)" -ForegroundColor Green } else { throw "redirusr.exe failed with exit code $($LASTEXITCODE). Output: $($outputUser)" } } } else { Write-Host "[+] Users container is already redirected to target OU: $($targetUsersDN)" -ForegroundColor Green } Write-Host "" # ------------------------------------------------------------- # 6. Post-Remediation Verification # ------------------------------------------------------------- $refreshedDomain = Get-ADDomain -ErrorAction Stop Write-Host "Post-Remediation Verification:" -ForegroundColor Cyan Write-Host " - Domain ComputersContainer: $($refreshedDomain.ComputersContainer)" -ForegroundColor Gray Write-Host " - Domain UsersContainer : $($refreshedDomain.UsersContainer)" -ForegroundColor Gray if ($refreshedDomain.ComputersContainer -eq $targetComputersDN -and $refreshedDomain.UsersContainer -eq $targetUsersDN) { Write-Host "`n[+] Default containers redirection completed successfully." -ForegroundColor Green } else { Write-Warning "Directory attributes have not yet reflected the redirection. Allow time for domain-wide replication." } Write-Host "" Write-Host "[IMPORTANT NEXT STEPS]:" -ForegroundColor Yellow Write-Host "1. Link a quarantine/staging Group Policy Object (GPO) to '$($targetComputersDN)' (enforcing LAPS, Firewall, Credential Guard)." -ForegroundColor Gray Write-Host "2. Delegate 'Create Computer Objects' on '$($targetComputersDN)' to authorized provisioning service accounts." -ForegroundColor Gray Write-Host "3. Inventory and migrate any non-built-in residual accounts from 'CN=Computers' and 'CN=Users' to appropriate production OUs." -ForegroundColor Gray } catch { Write-Error "Remediation failed. Error: $($_.Exception.Message)" exit 1 } Target Scope: Applicable Systems: Active Directory Domain Services (Logical Structure), Management Stations, Domain Controllers Operating Systems: Windows Server 2016+, Windows 10 Enterprise, Windows 11 Enterprise File Path: 06-operations-maintenance/mandate-naming-conventions.md Active Directory environments, particularly those with administrative tiering, require strict logical organization to maintain security boundaries and prevent operational errors. The lack of standard naming conventions leads to several security and operational risks: 1. Administrative Confusions and Misconfigurations: Without clear identifiers, administrators might link a highly restrictive Tier 0 GPO to a Tier 2 Client Workstations OU, causing system outages or security bypasses. 2. Audit and Monitoring Gaps: Security monitoring tools and SIEM parsers rely on predictable account and resource patterns (such as a0- for Tier 0 admin actions) to flag abnormal logons or lateral movement attempts. 3. Privilege Escalation: Predictable naming conventions for standard accounts, combined with clear tier prefixes for administrative accounts, prevent users from mistakenly allocating administrative permissions to non-admin accounts. 4. Configuration Drift: Group Policy Objects without descriptions or identifiers become "orphaned" or modified by different teams without clear change tracking, leading to undocumented changes that weaken the security posture. Enforcing structured GPO, OU, and Account naming conventions, combined with a mandatory description template for GPOs, establishes self-documenting metadata that can be programmatically audited to ensure long-term directory integrity. Option A: Manual Logical Configuration (GUI) 1. Organizational Unit (OU) Hierarchy Design Establish a clear, tiered OU hierarchy in Active Directory Users and Computers (dsa.msc). All custom OUs must follow the format: <Tier>-<ObjectType>-<Function> Tier : `T0` (Tier 0), `T1` (Tier 1), `T2` (Tier 2), or `Global` (common infrastructure/domain-wide settings). ObjectType: Computers, Users, Groups, or ServiceAccounts. Function*: Descriptive PascalCase text indicating the target scope. Examples of compliant OUs: `T0-Computers-DomainControllers` (for DCs) T1-Computers-ApplicationServers (for Tier 1 member servers) `T2-Computers-Workstations` (for Tier 2 client computers) T0-Users-Admins (for Tier 0 administrative users) * T1-Users-ServiceAccounts (for Tier 1 application/service accounts) 2. Group Policy Object (GPO) Naming Scheme Create GPOs in the Group Policy Management Console (gpmc.msc) using the following naming structure: GPO_<Scope>_<Class>_<Name> Scope : `T0` (Tier 0), `T1` (Tier 1), `T2` (Tier 2), or `Global` (domain-wide). Class: Hardening (security settings), Config (operational settings), Restricted (restricted logons/groups), or Software (installations). Name*: Descriptive PascalCase text indicating policy focus. Examples of compliant GPOs: `GPO_T0_Hardening_DomainControllers` GPO_T2_Config_WorkstationIsolation * GPO_Global_Hardening_DefaultDomain 3. GPO Description Metadata Template Every GPO must have its Description field populated in gpmc.msc properties using the following structured template. This template uses a YAML-compatible layout to support programmatic validation: --- RequirementID: [ID of corresponding hardening control, e.g., REQ-OPS-007] Owner: [Administrative team/role responsible, e.g., Domain Admins] CreatedBy: [Account name of creator, e.g., a0-sysadmin] CreatedDate: [YYYY-MM-DD] LastModifiedBy: [Account name of editor, e.g., a0-sysadmin] LastModifiedDate: [YYYY-MM-DD] Purpose: [A clear, concise summary of the settings applied and their intent] ApprovalRef: [Change management ticket or authorization reference, e.g., CR-84920] Tier: [T0 / T1 / T2 / Global] --- 4. Active Directory Account Naming Scheme Configure and provision accounts using standardized prefixes: Tier 0 Administrative Accounts : Prefix `a0-` (e.g., `a0-florian`). Tier 1 Administrative Accounts: Prefix a1- (e.g., a1-florian). Tier 2 Administrative Accounts : Prefix `a2-` (e.g., `a2-florian`). Tier 0 Service Accounts / gMSAs: Prefix s0- / g0- (e.g., s0-backup, g0-adbackup$). Tier 1 Service Accounts / gMSAs : Prefix `s1-` / `g1-` (e.g., `s1-sql`, `g1-sqlservice$`). Tier 2 Service Accounts / gMSAs: Prefix s2- / g2- (e.g., s2-print, g2-printservice$). Emergency (Break-Glass) Accounts*: Prefix bg- (e.g., bg-admin1). Option B: PowerShell & Administrative Scripting (Remediation / Auditing) 1. Configuring GPO Description Metadata Use the following remediation script to programmatically write or update the structured metadata template to a specified GPO's description field. Download Script: Configure-GPODescription.ps1 # Configure-GPODescription.ps1 # Description: Configures structured metadata in a GPO's description field. param ( [Parameter(Mandatory = $true)] [string]$GPOName, [Parameter(Mandatory = $true)] [string]$RequirementID, [Parameter(Mandatory = $true)] [string]$Owner, [Parameter(Mandatory = $true)] [string]$CreatedBy, [Parameter(Mandatory = $true)] [string]$ApprovalRef, [Parameter(Mandatory = $true)] [ValidateSet("T0", "T1", "T2", "Global")] [string]$Tier, [Parameter(Mandatory = $true)] [string]$Purpose ) Import-Module GroupPolicy -ErrorAction SilentlyContinue Write-Host "--- Configuring Structured GPO Description Metadata ---" -ForegroundColor Cyan # Verify if GPO exists $gpo = Get-GPO -Name $GPOName -ErrorAction SilentlyContinue if (-not $gpo) { Write-Error "Group Policy Object '$GPOName' was not found in the domain." exit 1 } $CurrentDate = Get-Date -Format "yyyy-MM-dd" # Build YAML-style metadata string $DescriptionText = @" --- RequirementID: $RequirementID Owner: $Owner CreatedBy: $CreatedBy CreatedDate: $CurrentDate LastModifiedBy: $CreatedBy LastModifiedDate: $CurrentDate Purpose: $Purpose ApprovalRef: $ApprovalRef Tier: $Tier --- "@ try { # Set the GPO description Set-GPO -Name $GPOName -Description $DescriptionText -ErrorAction Stop Write-Host "[+] Successfully configured description metadata for GPO: $GPOName" -ForegroundColor Green exit 0 } catch { Write-Error "Failed to update description for GPO '$GPOName'. Error: $($_.Exception.Message)" exit 1 } To verify directory alignment and find non-compliant OUs, GPOs, and Accounts: Download Script: Audit-NamingConventions.ps1 # Audit-NamingConventions.ps1 # Description: Audits GPOs, OUs, and User Accounts for compliance with standard naming conventions and metadata description templates. Import-Module ActiveDirectory -ErrorAction SilentlyContinue Import-Module GroupPolicy -ErrorAction SilentlyContinue Write-Host "--- Auditing Active Directory Naming Conventions & Metadata ---" -ForegroundColor Cyan $Compliant = $true # Define Regex Patterns $gpoNameRegex = "^GPO_(T[0-2]|Global)_(Hardening|Config|Restricted|Software)_[A-Za-z0-9]+$" $ouNameRegex = "^(T[0-2]-(Computers|Users|Groups|ServiceAccounts|Servers|Endpoints|Admins)-[A-Za-z0-9-]+|Domain Controllers|System|Builtin|ForeignSecurityPrincipals|LostAndFound|NTDS Quotas|Program Data)$" # 1. Audit GPO Names and Description Fields Write-Host "`n[+] Checking Group Policy Objects..." -ForegroundColor Yellow try { $gpos = Get-GPO -All -ErrorAction Stop foreach ($gpo in $gpos) { $gpoName = $gpo.DisplayName # Check Name format if ($gpoName -notmatch $gpoNameRegex) { Write-Host " [-] NON-COMPLIANT GPO NAME: '$gpoName' (does not match expected structure)" -ForegroundColor Red $Compliant = $false } else { Write-Host " [+] GPO Name OK: '$gpoName'" -ForegroundColor Green } # Check Description metadata $desc = $gpo.Description if ([string]::IsNullOrEmpty($desc)) { Write-Host " [-] NON-COMPLIANT GPO DESCRIPTION: '$gpoName' (Description field is empty)" -ForegroundColor Red $Compliant = $false } else { # Verify YAML structure has key metadata fields $hasReqId = $desc -match "RequirementID:" $hasOwner = $desc -match "Owner:" $hasTier = $desc -match "Tier:" $hasPurpose = $desc -match "Purpose:" if ($hasReqId -and $hasOwner -and $hasTier -and $hasPurpose) { Write-Host " [+] GPO Description Template OK: '$gpoName'" -ForegroundColor Green } else { Write-Host " [-] NON-COMPLIANT GPO DESCRIPTION FORMAT: '$gpoName' (Structured fields are missing or malformed)" -ForegroundColor Red $Compliant = $false } } } } catch { Write-Warning "Could not retrieve GPOs from domain. Ensure GPMC RSAT tools are installed and domain is reachable." } # 2. Audit Organizational Units Write-Host "`n[+] Checking Organizational Units (OUs)..." -ForegroundColor Yellow try { $ous = Get-ADOrganizationalUnit -Filter * -ErrorAction Stop foreach ($ou in $ous) { $ouName = $ou.Name if ($ouName -notmatch $ouNameRegex) { Write-Host " [-] NON-COMPLIANT OU NAME: '$ouName' (DistinguishedName: $($ou.DistinguishedName))" -ForegroundColor Red $Compliant = $false } else { Write-Host " [+] OU Name OK: '$ouName'" -ForegroundColor Green } } } catch { Write-Warning "Could not retrieve OUs from Active Directory. Ensure AD RSAT tools are installed." } # 3. Audit Account Naming Conventions (Tiered / Service / Emergency) Write-Host "`n[+] Checking Account Naming Conventions..." -ForegroundColor Yellow try { # Check Administrative Group memberships to see if administrative accounts are properly prefixed $privilegedGroups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators") foreach ($group in $privilegedGroups) { $members = Get-ADGroupMember -Identity $group -ErrorAction SilentlyContinue foreach ($member in $members) { if ($member.objectClass -eq "user") { $sam = $member.SamAccountName # Tier 0 admins must have 'a0-' or 'bg-' or be standard default Administrator if ($sam -ne "Administrator" -and $sam -notlike "a0-*" -and $sam -notlike "bg-*") { Write-Host " [-] NON-COMPLIANT TIER 0 ACCOUNT NAME: '$sam' (Member of privileged group: $group, lacks 'a0-' or 'bg-' prefix)" -ForegroundColor Red $Compliant = $false } else { Write-Host " [+] Admin Account Prefix OK: '$sam' ($group)" -ForegroundColor Green } } } } # Audit Service Accounts and gMSAs $serviceAccounts = Get-ADServiceAccount -Filter * -ErrorAction SilentlyContinue foreach ($sa in $serviceAccounts) { $sam = $sa.SamAccountName if ($sam -notlike "g0-*" -and $sam -notlike "g1-*" -and $sam -notlike "g2-*") { Write-Host " [-] NON-COMPLIANT gMSA NAME: '$sam' (lacks 'g0-', 'g1-', or 'g2-' prefix)" -ForegroundColor Red $Compliant = $false } else { Write-Host " [+] gMSA Prefix OK: '$sam'" -ForegroundColor Green } } } catch { Write-Warning "Could not query account or group memberships. Ensure AD RSAT tools are installed and domain is reachable." } # 4. Final Compliance Verdict if ($Compliant) { Write-Host "`nStatus: Compliant. GPOs, OUs, and Accounts conform to standard conventions." -ForegroundColor Green exit 0 } else { Write-Host "`nStatus: Non-Compliant. Naming conventions drift detected." -ForegroundColor Red exit 1 } # Configure-GPODescription.ps1 # Description: Configures structured metadata in a GPO's description field. param ( [Parameter(Mandatory = $true)] [string]$GPOName, [Parameter(Mandatory = $true)] [string]$RequirementID, [Parameter(Mandatory = $true)] [string]$Owner, [Parameter(Mandatory = $true)] [string]$CreatedBy, [Parameter(Mandatory = $true)] [string]$ApprovalRef, [Parameter(Mandatory = $true)] [ValidateSet("T0", "T1", "T2", "Global")] [string]$Tier, [Parameter(Mandatory = $true)] [string]$Purpose ) Import-Module GroupPolicy -ErrorAction SilentlyContinue Write-Host "--- Configuring Structured GPO Description Metadata ---" -ForegroundColor Cyan # Verify if GPO exists $gpo = Get-GPO -Name $GPOName -ErrorAction SilentlyContinue if (-not $gpo) { Write-Error "Group Policy Object '$GPOName' was not found in the domain." exit 1 } $CurrentDate = Get-Date -Format "yyyy-MM-dd" # Build YAML-style metadata string $DescriptionText = @" --- RequirementID: $RequirementID Owner: $Owner CreatedBy: $CreatedBy CreatedDate: $CurrentDate LastModifiedBy: $CreatedBy LastModifiedDate: $CurrentDate Purpose: $Purpose ApprovalRef: $ApprovalRef Tier: $Tier --- "@ try { # Set the GPO description Set-GPO -Name $GPOName -Description $DescriptionText -ErrorAction Stop Write-Host "[+] Successfully configured description metadata for GPO: $GPOName" -ForegroundColor Green exit 0 } catch { Write-Error "Failed to update description for GPO '$GPOName'. Error: $($_.Exception.Message)" exit 1 } Target Scope: Applicable Systems: Domain Controllers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 06-operations-maintenance/configure-system-state-backups.md Disaster Recovery is a core pillar of Active Directory security. If Domain Controllers are corrupted or compromised, administrators must recover from trusted, clean states. The System State contains the Active Directory database (ntds.dit), the SYSVOL share, registry settings, certificates, and DNS records. To ensure resilience: 1. Daily Frequency: Create System State Backups daily on at least two Domain Controllers to minimize data loss. 2. Storage Isolation (Offline/Immutable): Backups must be stored on separate physical or virtual storage. In high-security systems, enforce write-once-read-many (WORM) storage or store backups in an offline, physically secured media rotation to prevent modifications by compromised accounts. 3. Regular Validation: Run recovery exercises quarterly in an isolated network sandbox to verify that restored DCs are functional and free of replication loops. Option A: Graphical User Interface (GUI) Configuration Log in to the Domain Controller and open Server Manager. Click Manage -> Add Roles and Features. Advance to the Features step, check Windows Server Backup, and complete the installation. Open the administrative tool Windows Server Backup (wbadmin.msc). In the Actions pane, click Backup Schedule.... In the Backup Schedule Wizard, click Next on the Getting Started page. Select Custom configuration and click Next. Click Add Items, check System State, and click OK. Specify the time and frequency (once a day, during off-peak hours) and click Next. Choose the destination type (dedicated backup disk, volume, or shared network folder) and complete the wizard. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script block to install the Windows Server Backup feature, configure a System State backup policy, and execute an immediate System State backup to a designated disk volume. Download Script: Set-ADSystemStateBackup.ps1 # Set-ADSystemStateBackup.ps1 # Installs Windows Server Backup and executes a System State backup. Write-Host "--- Initializing System State Backup ---" -ForegroundColor Cyan # 1. Install Windows Server Backup feature if missing $feature = Get-WindowsFeature -Name Windows-Server-Backup if ($feature.Installed -eq $false) { Write-Host "[+] Installing Windows Server Backup feature..." -ForegroundColor Gray Install-WindowsFeature -Name Windows-Server-Backup -IncludeAllSubFeature | Out-Null Write-Host " Feature installed successfully." -ForegroundColor Green } else { Write-Host "[+] Windows Server Backup feature is already installed." -ForegroundColor Green } # Import WSB module Import-Module WindowsServerBackup # 2. Define Backup Volume Target $BackupVolumePath = "E:\" # Replace with your designated offline backup storage disk if (-not (Test-Path $BackupVolumePath)) { Write-Error "Backup target volume '$BackupVolumePath' does not exist. Please specify a valid volume." exit 1 } # 3. Create Backup Policy Write-Host "[+] Configuring System State Backup Policy..." -ForegroundColor Gray $policy = New-WBPolicy Add-WBSystemState -Policy $policy | Out-Null $backupTarget = New-WBBackupTarget -VolumePath $BackupVolumePath Add-WBBackupTarget -Policy $policy -Target $backupTarget | Out-Null Write-Host " Backup Policy created (Target: $BackupVolumePath, Subject: SystemState)." -ForegroundColor Green # 4. Execute Backup Job Write-Host "[+] Starting System State Backup. This process can take several minutes..." -ForegroundColor Yellow $backupJob = Start-WBBackup -Policy $policy -Async # Monitor backup job status while ($backupJob.State -eq "Running" -or $backupJob.State -eq "Verifying") { Write-Host " - Backup Progress: $($backupJob.PercentComplete)% complete..." -ForegroundColor Gray Start-Sleep -Seconds 10 # Refresh backup job status $backupJob = Get-WBJob } # Final output $finalJob = Get-WBJob -Previous 1 if ($finalJob.JobState -eq "Completed") { Write-Host "`nSystem State Backup Completed successfully!" -ForegroundColor Green } else { Write-Error "`nBackup failed with status: $($finalJob.JobState). Error: $($finalJob.ErrorDescription)" } To verify active backup configurations: Download Script: Audit-ADBackupStatus.ps1 # Audit-ADBackupStatus.ps1 # Audits the status of local system state backups. Import-Module WindowsServerBackup -ErrorAction SilentlyContinue Write-Host "--- Auditing System State Backup Status ---" -ForegroundColor Cyan # Check if Windows Server Backup feature is installed $feature = Get-WindowsFeature -Name Windows-Server-Backup -ErrorAction SilentlyContinue if ($feature -and $feature.Installed -eq $false) { Write-Warning "Windows Server Backup feature is NOT installed on this machine." exit 1 } # Retrieve history of local backups try { $backups = Get-WBBackupSet -ErrorAction Stop Write-Host "`n[+] Found $($backups.Count) recorded backup sets." -ForegroundColor Yellow # Sort and output the most recent backups $sortedBackups = $backups | Sort-Object -Property BackupTime -Descending foreach ($bk in $sortedBackups | Select-Object -First 5) { $containsSystemState = $bk.CatalogFlags -match "SystemState" $statusColor = if ($containsSystemState) { "Green" } else { "Yellow" } Write-Host " - Backup Time: $($bk.BackupTime) | Location: $($bk.VolumePath) | Contains SystemState: $containsSystemState" -ForegroundColor $statusColor } } catch { Write-Host "[-] No backup records found on the system. System state backups may not be configured." -ForegroundColor Red } # Audit Backup Target Access Control List $policy = Get-WBPolicy -ErrorAction SilentlyContinue if ($policy) { $targets = Get-WBBackupTarget -Policy $policy -ErrorAction SilentlyContinue foreach ($target in $targets) { $path = $null if ($target.VolumePath) { $path = $target.VolumePath } elseif ($target.NetworkPath) { $path = $target.NetworkPath } if ($path) { Write-Host "`n[*] Auditing backup target permissions: $path" -ForegroundColor Gray if (Test-Path $path) { $acl = Get-Acl -Path $path -ErrorAction SilentlyContinue if ($acl) { $unauthorized = $false foreach ($access in $acl.Access) { $identity = $access.IdentityReference.Value $rights = $access.FileSystemRights $type = $access.AccessControlType if ($type -eq "Allow") { if ($identity -notmatch "SYSTEM|Administrators|Domain Admins|Enterprise Admins|Creator Owner|NT AUTHORITY\\SYSTEM|BUILTIN\\Administrators") { if ($rights -match "Read|Write|Modify|FullControl") { Write-Host " [!] WARNING: Unauthorized identity '$identity' has '$rights' access to backup target." -ForegroundColor Red $unauthorized = $true } } } } if (-not $unauthorized) { Write-Host " [+] Target directory ACL is securely restricted." -ForegroundColor Green } } else { Write-Warning " Could not retrieve ACL for backup target." } } else { Write-Host " [-] Backup target path is currently offline or unreachable." -ForegroundColor Yellow } } } } # Set-ADSystemStateBackup.ps1 # Installs Windows Server Backup and executes a System State backup. Write-Host "--- Initializing System State Backup ---" -ForegroundColor Cyan # 1. Install Windows Server Backup feature if missing $feature = Get-WindowsFeature -Name Windows-Server-Backup if ($feature.Installed -eq $false) { Write-Host "[+] Installing Windows Server Backup feature..." -ForegroundColor Gray Install-WindowsFeature -Name Windows-Server-Backup -IncludeAllSubFeature | Out-Null Write-Host " Feature installed successfully." -ForegroundColor Green } else { Write-Host "[+] Windows Server Backup feature is already installed." -ForegroundColor Green } # Import WSB module Import-Module WindowsServerBackup # 2. Define Backup Volume Target $BackupVolumePath = "E:\" # Replace with your designated offline backup storage disk if (-not (Test-Path $BackupVolumePath)) { Write-Error "Backup target volume '$BackupVolumePath' does not exist. Please specify a valid volume." exit 1 } # 3. Create Backup Policy Write-Host "[+] Configuring System State Backup Policy..." -ForegroundColor Gray $policy = New-WBPolicy Add-WBSystemState -Policy $policy | Out-Null $backupTarget = New-WBBackupTarget -VolumePath $BackupVolumePath Add-WBBackupTarget -Policy $policy -Target $backupTarget | Out-Null Write-Host " Backup Policy created (Target: $BackupVolumePath, Subject: SystemState)." -ForegroundColor Green # 4. Execute Backup Job Write-Host "[+] Starting System State Backup. This process can take several minutes..." -ForegroundColor Yellow $backupJob = Start-WBBackup -Policy $policy -Async # Monitor backup job status while ($backupJob.State -eq "Running" -or $backupJob.State -eq "Verifying") { Write-Host " - Backup Progress: $($backupJob.PercentComplete)% complete..." -ForegroundColor Gray Start-Sleep -Seconds 10 # Refresh backup job status $backupJob = Get-WBJob } # Final output $finalJob = Get-WBJob -Previous 1 if ($finalJob.JobState -eq "Completed") { Write-Host "`nSystem State Backup Completed successfully!" -ForegroundColor Green } else { Write-Error "`nBackup failed with status: $($finalJob.JobState). Error: $($finalJob.ErrorDescription)" } Target Scope: Applicable Systems: Dedicated WSUS Update Servers (Tier 0 & Tier 1/2) Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 06-operations-maintenance/implement-offline-patch-management.md Keeping Domain Controllers, member servers, and clients patched is critical to resolve OS and RPC vulnerabilities. In isolated, air-gapped networks, direct connection to Microsoft Update servers is impossible, requiring all patches to be imported offline. Establishing an offline WSUS sync protocol: 1. Prevents Network exposure: Domain Controllers and administrative hosts do not require access to external network zones. 2. Maintains Integrity: Allows checking update metadata and approvals in a controlled sandbox environment before propagating them to production. 3. Automates Distribution: Uses standard WSUS client policies to distribute approved updates locally with minimal network overhead. WSUS Categories & Classifications Configuration Before performing the import/export process, both the online (source) and offline (destination) WSUS servers must be configured with identical Products and Classifications. If the destination server does not have the corresponding categories enabled, the imported update metadata for those categories will be ignored. 1. Graphical User Interface (GUI) Configuration On both the online and offline WSUS administration consoles: 1. Open the Windows Server Update Services console (wsus.msc). 2. Expand the server name and click on Options -> Products and Classifications. 3. In the Products tab, ensure the exact operating systems present in the environment are selected: Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows 10 Windows 11 4. In the Classifications tab, ensure the following classifications are selected: Critical Updates Security Updates Definition Updates (mandatory if distributing Windows Defender signatures) Update Rollups (standard cumulative updates) 5. Click Apply and then click OK*. 2. PowerShell Configuration Run the following PowerShell commands as Administrator on both WSUS servers to align Categories and Classifications programmatically: # Import WSUS module Import-Module UpdateServices Write-Host "--- Aligning WSUS Categories & Classifications ---" -ForegroundColor Cyan # Define targets $TargetClassifications = @("Critical Updates", "Security Updates", "Definition Updates", "Update Rollups") $TargetProducts = @("Windows Server 2016", "Windows Server 2019", "Windows Server 2022", "Windows 10", "Windows 11") # Enable Classifications Write-Host "[+] Configuring WSUS Classifications..." -ForegroundColor Gray Get-WsusClassification | Where-Object { $TargetClassifications -contains $_.Classification.Title } | Set-WsusClassification # Enable Products Write-Host "[+] Configuring WSUS Products..." -ForegroundColor Gray Get-WsusProduct | Where-Object { $TargetProducts -contains $_.Product.Title } | Set-WsusProduct Write-Host "[+] WSUS categories and classifications updated successfully." -ForegroundColor Green Option A: Command-line Execution (wsusutil) 1. On the Internet-Connected WSUS Server Wait for standard synchronization to complete, or force a sync. Open a Command Prompt as Administrator. Export the WSUS metadata file: `cmd wsusutil.exe export C:\export\metadata.xml.gz C:\export\export.log Copy the metadata file (metadata.xml.gz) and the entire WSUSContent directory (containing the update binaries) onto an encrypted and scanned storage medium. 2. On the Air-Gapped WSUS Server Connect the transfer storage medium and copy the files to a local staging directory (e.g., C:\import). Open a Command Prompt as Administrator. Import the update metadata: `cmd wsusutil.exe import C:\import\metadata.xml.gz C:\import\import.log Copy the update binary files from the storage medium into the WSUS content directory of the air-gapped server. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use the following PowerShell script to programmatically import WSUS metadata from a specified location using the native WSUS utility. Download Script: Invoke-OfflineWsusImport.ps1 # Invoke-OfflineWsusImport.ps1 # Description: Imports WSUS update metadata from an offline backup file. param ( [Parameter(Mandatory = $true)] [string]$MetadataPath, [Parameter(Mandatory = $true)] [string]$LogPath ) Write-Host "--- Performing Offline WSUS Import ---" -ForegroundColor Cyan if (-not (Test-Path $MetadataPath)) { Write-Error "Metadata file not found at: $MetadataPath" exit 1 } # Run wsusutil import $WsusUtil = "C:\Program Files\Update Services\Tools\wsusutil.exe" if (-not (Test-Path $WsusUtil)) { Write-Error "wsusutil.exe not found at default location." exit 1 } Write-Host "[+] Running wsusutil import..." -ForegroundColor Yellow $Process = Start-Process -FilePath $WsusUtil -ArgumentList "import `"$MetadataPath`" `"$LogPath`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host "[+] Offline WSUS Import completed successfully." -ForegroundColor Green } else { Write-Error "wsusutil import failed with exit code $($Process.ExitCode)." exit 1 } To verify synchronization state of the local WSUS server: Download Script: Get-OfflineWsusSyncStatus.ps1 # Get-OfflineWsusSyncStatus.ps1 # Description: Checks the synchronization history of the local WSUS server. Import-Module UpdateServices -ErrorAction SilentlyContinue Write-Host "--- Auditing WSUS Offline Synchronization Status ---" -ForegroundColor Cyan try { # Connect to the local WSUS server $wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer() $history = $wsus.GetSubscription().GetSynchronizationHistory() if ($history.Count -gt 0) { $lastSync = $history[0] Write-Host "[+] Last WSUS Sync Time: $($lastSync.EndTime)" -ForegroundColor Green Write-Host "[+] Last WSUS Sync Result: $($lastSync.Result)" -ForegroundColor Green if ($lastSync.Result -eq "Succeeded") { exit 0 } else { Write-Warning "Last WSUS Sync did not succeed." exit 1 } } else { Write-Host "[-] No WSUS synchronization history found." -ForegroundColor Red exit 1 } } catch { Write-Host "[-] Failed to retrieve WSUS synchronization history. Ensure the WSUS role is installed and services are running." -ForegroundColor Red exit 1 } # Invoke-OfflineWsusImport.ps1 # Description: Imports WSUS update metadata from an offline backup file. param ( [Parameter(Mandatory = $true)] [string]$MetadataPath, [Parameter(Mandatory = $true)] [string]$LogPath ) Write-Host "--- Performing Offline WSUS Import ---" -ForegroundColor Cyan if (-not (Test-Path $MetadataPath)) { Write-Error "Metadata file not found at: $MetadataPath" exit 1 } # Run wsusutil import $WsusUtil = "C:\Program Files\Update Services\Tools\wsusutil.exe" if (-not (Test-Path $WsusUtil)) { Write-Error "wsusutil.exe not found at default location." exit 1 } Write-Host "[+] Running wsusutil import..." -ForegroundColor Yellow $Process = Start-Process -FilePath $WsusUtil -ArgumentList "import `"$MetadataPath`" `"$LogPath`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host "[+] Offline WSUS Import completed successfully." -ForegroundColor Green } else { Write-Error "wsusutil import failed with exit code $($Process.ExitCode)." exit 1 } Target Scope: Applicable Systems: Active Directory Domain Services, Management Workstations Operating Systems: Windows Server 2016+, Windows 10/11 Enterprise File Path: 06-operations-maintenance/establish-continuous-security-assessments.md Active Directory configurations naturally drift over time as a result of administrative changes, new trust relationships, and changing group policies. Administrators must actively search for misconfigurations, weak permissions, and signs of compromise. In isolated, air-gapped networks, online security analysis services cannot be reached. Therefore: 1. Periodic Scans: Execute security audits locally using offline-compatible tools (such as PingCastle, BloodHound/SharpHound, Locksmith, or ORADAD). 2. Directory Health Monitoring: Run PingCastle monthly to generate local XML/HTML reports indicating domain vulnerabilities and tracking AD configuration health. 3. Lateral Movement Auditing: Execute SharpHound quarterly to construct lateral movement path graphs, enabling defenders to identify complex trust relationships or delegation chains leading to Tier 0 compromise. 4. Active Directory Certificate Services Auditing: Run Locksmith monthly to identify misconfigured certificate templates, insecure enrollment settings, and potential AD CS privilege escalation paths. 5. Data Isolation: Transfer the diagnostic reports, CSV exports, and export ZIPs out of production to secure, offline assessment platforms to limit exposure of sensitive configuration data. Option A: Manual Diagnostic Tool Execution 1. Running PingCastle Audits Place PingCastle.exe in a secure local diagnostic directory (e.g., C:\Diagnostics). Open a Command Prompt as Administrator on a domain-joined workstation. Run the following command to generate the HTML report and XML output: `cmd PingCastle.exe --server target.domain.local --level level_Default --xml --no_update Collect the generated files from the directory and transfer them to a secure analysis terminal. 2. Running BloodHound/SharpHound Collectors Place the SharpHound.exe collector binary in the diagnostic directory. Open a Command Prompt as Administrator on a domain-joined workstation. Run the collector using standard active directory enumeration methods: `cmd SharpHound.exe --CollectionMethods All --Domain target.domain.local --ZipFileName AD_BloodHound_Export.zip Copy the resulting zip file to the offline BloodHound graph database dashboard to query and audit lateral movement paths. 3. Running Locksmith Audits (AD CS) Download the Invoke-Locksmith.ps1 script from the official repository and place it in the diagnostic directory (e.g., C:\Diagnostics). Open PowerShell as Administrator on a domain-joined workstation. Run the script using the CSV export mode (Mode 2) to audit AD CS and save findings: `powershell Set-Location -Path C:\Diagnostics .\Invoke-Locksmith.ps1 -Mode 2 Copy the generated ADCSIssues.CSV report to a secure analysis terminal for offline review. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use the following PowerShell script to automate the execution of PingCastle, SharpHound, and Locksmith collectors inside a specified diagnostic workspace. Download Script: Start-OfflineAssessments.ps1 # Start-OfflineAssessments.ps1 # Description: Triggers PingCastle, SharpHound, and Locksmith security audit scans. param ( [string]$DiagnosticsPath = "C:\Diagnostics", [string]$DomainName = "target.domain.local" ) Write-Host "--- Starting AD Hardening Offline Assessment Scans ---" -ForegroundColor Cyan if (-not (Test-Path $DiagnosticsPath)) { New-Item -Path $DiagnosticsPath -ItemType Directory -Force | Out-Null } $PingCastlePath = Join-Path $DiagnosticsPath "PingCastle.exe" $SharpHoundPath = Join-Path $DiagnosticsPath "SharpHound.exe" $LocksmithPath = Join-Path $DiagnosticsPath "Invoke-Locksmith.ps1" # 1. Execute PingCastle if (Test-Path $PingCastlePath) { Write-Host "[+] Executing PingCastle..." -ForegroundColor Yellow $params = @( "--server", $DomainName, "--level", "level_Default", "--xml", "--no_update", "--output", $DiagnosticsPath ) Start-Process -FilePath $PingCastlePath -ArgumentList $params -Wait -NoNewWindow Write-Host "[+] PingCastle scan complete." -ForegroundColor Green } else { Write-Error "PingCastle.exe not found at $PingCastlePath. Please place the binary to execute." } # 2. Execute SharpHound if (Test-Path $SharpHoundPath) { Write-Host "[+] Executing SharpHound..." -ForegroundColor Yellow $zipName = "AD_BloodHound_Export_" + (Get-Date -Format "yyyyMMdd") + ".zip" $zipPath = Join-Path $DiagnosticsPath $zipName $params = @( "--CollectionMethods", "All", "--Domain", $DomainName, "--ZipFileName", $zipPath ) Start-Process -FilePath $SharpHoundPath -ArgumentList $params -Wait -NoNewWindow Write-Host "[+] SharpHound collection complete. Saved to: $zipPath" -ForegroundColor Green } else { Write-Error "SharpHound.exe not found at $SharpHoundPath. Please place the binary to execute." } # 3. Execute Locksmith if (Test-Path $LocksmithPath) { Write-Host "[+] Executing Locksmith..." -ForegroundColor Yellow $originalLocation = Get-Location Set-Location -Path $DiagnosticsPath try { & $LocksmithPath -Mode 2 Write-Host ("[+] Locksmith scan complete. Saved to: " + (Join-Path $DiagnosticsPath "ADCSIssues.CSV")) -ForegroundColor Green } catch { Write-Error "Failed to execute Locksmith: $($_.Exception.Message)" } finally { Set-Location -Path $originalLocation } } else { Write-Error "Invoke-Locksmith.ps1 not found at $LocksmithPath. Please place the script to execute." } To verify that diagnostic tools and recent reports exist on the auditing system: Download Script: Get-OfflineAssessmentStatus.ps1 # Get-OfflineAssessmentStatus.ps1 # Description: Audits the presence of PingCastle, SharpHound, and Locksmith tools and the age of recent reports. Write-Host "--- Auditing Active Directory Security Assessment Tools ---" -ForegroundColor Cyan $DiagnosticsPath = "C:\Diagnostics" # Common diagnostics path $PingCastlePath = Join-Path $DiagnosticsPath "PingCastle.exe" $SharpHoundPath = Join-Path $DiagnosticsPath "SharpHound.exe" $LocksmithPath = Join-Path $DiagnosticsPath "Invoke-Locksmith.ps1" $ReportAgeDays = 30 $Compliant = $true # 1. Check PingCastle if (Test-Path $PingCastlePath) { Write-Host "[+] PingCastle executable found: $PingCastlePath" -ForegroundColor Green # Check if reports have been generated in the last 30 days $reports = Get-ChildItem -Path $DiagnosticsPath -Filter "*pingcastle*.xml" -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge (Get-Date).AddDays(-$ReportAgeDays) } if ($reports) { Write-Host " [+] Found $($reports.Count) recent PingCastle report(s) (within last $ReportAgeDays days)." -ForegroundColor Green } else { Write-Warning " [-] No recent PingCastle report found (older than $ReportAgeDays days)." $Compliant = $false } } else { Write-Warning "[-] PingCastle executable NOT found at: $PingCastlePath" $Compliant = $false } # 2. Check SharpHound if (Test-Path $SharpHoundPath) { Write-Host "[+] SharpHound executable found: $SharpHoundPath" -ForegroundColor Green # Check if data exports exist $exports = Get-ChildItem -Path $DiagnosticsPath -Filter "*BloodHound*.zip" -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge (Get-Date).AddDays(-$ReportAgeDays) } if ($exports) { Write-Host " [+] Found $($exports.Count) recent SharpHound export(s) (within last $ReportAgeDays days)." -ForegroundColor Green } else { Write-Warning " [-] No recent SharpHound export found (older than $ReportAgeDays days)." $Compliant = $false } } else { Write-Warning "[-] SharpHound executable NOT found at: $SharpHoundPath" $Compliant = $false } # 3. Check Locksmith if (Test-Path $LocksmithPath) { Write-Host "[+] Locksmith script found: $LocksmithPath" -ForegroundColor Green # Check if Locksmith CSV output exists and was generated in the last 30 days $locksmithReport = Get-ChildItem -Path $DiagnosticsPath -Filter "ADCSIssues.CSV" -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge (Get-Date).AddDays(-$ReportAgeDays) } if ($locksmithReport) { Write-Host " [+] Found recent Locksmith report (within last $ReportAgeDays days)." -ForegroundColor Green } else { Write-Warning " [-] No recent Locksmith report (ADCSIssues.CSV) found (older than $ReportAgeDays days)." $Compliant = $false } } else { Write-Warning "[-] Locksmith script (Invoke-Locksmith.ps1) NOT found at: $LocksmithPath" $Compliant = $false } if ($Compliant) { Write-Host "`nStatus: Compliant. Diagnostics tools and recent reports are present." -ForegroundColor Green exit 0 } else { Write-Host "`nStatus: Non-Compliant. Action required." -ForegroundColor Red exit 1 } # Start-OfflineAssessments.ps1 # Description: Triggers PingCastle, SharpHound, and Locksmith security audit scans. param ( [string]$DiagnosticsPath = "C:\Diagnostics", [string]$DomainName = "target.domain.local" ) Write-Host "--- Starting AD Hardening Offline Assessment Scans ---" -ForegroundColor Cyan if (-not (Test-Path $DiagnosticsPath)) { New-Item -Path $DiagnosticsPath -ItemType Directory -Force | Out-Null } $PingCastlePath = Join-Path $DiagnosticsPath "PingCastle.exe" $SharpHoundPath = Join-Path $DiagnosticsPath "SharpHound.exe" $LocksmithPath = Join-Path $DiagnosticsPath "Invoke-Locksmith.ps1" # 1. Execute PingCastle if (Test-Path $PingCastlePath) { Write-Host "[+] Executing PingCastle..." -ForegroundColor Yellow $params = @( "--server", $DomainName, "--level", "level_Default", "--xml", "--no_update", "--output", $DiagnosticsPath ) Start-Process -FilePath $PingCastlePath -ArgumentList $params -Wait -NoNewWindow Write-Host "[+] PingCastle scan complete." -ForegroundColor Green } else { Write-Error "PingCastle.exe not found at $PingCastlePath. Please place the binary to execute." } # 2. Execute SharpHound if (Test-Path $SharpHoundPath) { Write-Host "[+] Executing SharpHound..." -ForegroundColor Yellow $zipName = "AD_BloodHound_Export_" + (Get-Date -Format "yyyyMMdd") + ".zip" $zipPath = Join-Path $DiagnosticsPath $zipName $params = @( "--CollectionMethods", "All", "--Domain", $DomainName, "--ZipFileName", $zipPath ) Start-Process -FilePath $SharpHoundPath -ArgumentList $params -Wait -NoNewWindow Write-Host "[+] SharpHound collection complete. Saved to: $zipPath" -ForegroundColor Green } else { Write-Error "SharpHound.exe not found at $SharpHoundPath. Please place the binary to execute." } # 3. Execute Locksmith if (Test-Path $LocksmithPath) { Write-Host "[+] Executing Locksmith..." -ForegroundColor Yellow $originalLocation = Get-Location Set-Location -Path $DiagnosticsPath try { & $LocksmithPath -Mode 2 Write-Host ("[+] Locksmith scan complete. Saved to: " + (Join-Path $DiagnosticsPath "ADCSIssues.CSV")) -ForegroundColor Green } catch { Write-Error "Failed to execute Locksmith: $($_.Exception.Message)" } finally { Set-Location -Path $originalLocation } } else { Write-Error "Invoke-Locksmith.ps1 not found at $LocksmithPath. Please place the script to execute." } Target Scope: Applicable Systems: Domain Controllers, Member Servers, Tier 2 Client Workstations Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, Windows 11 Enterprise File Path: 06-operations-maintenance/enable-detailed-bsod-parameters.md During critical system failures (such as a kernel panic or Blue Screen of Death - BSOD), Windows by default displays a simplified error screen intended for general consumers, hiding the actual bugcheck code and parameters. Enabling detailed stop error parameters is crucial because: 1. Offline Diagnostics: In air-gapped, isolated environments, administrators cannot easily query online resources, transmit automated memory dumps, or contact cloud support. 2. Immediate Visibility: Having the exact stop code (e.g., 0x0000000A) and the four parameters visible on the screen or virtual console allows operators to diagnose driver, memory, or hardware issues immediately. 3. Improves Mean Time to Recovery (MTTR): Speeds up troubleshooting during disaster recovery or critical server restore processes. Option A: Group Policy Object (GPO) Configuration Because this parameter resides in the system registry and is not exposed as a default administrative template, it must be deployed via Group Policy Preferences (GPP): Open the Group Policy Management Console (gpmc.msc) on a management station. Create a new GPO targeting all domain computers (e.g., GPO_Global_Config_SystemHardening) or edit an existing policy. Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click the Registry node and select New -> Registry Item. Configure the following properties: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\CrashControl Value Name*: DisplayParameters Value Type*: REG_DWORD Value Data*: 1 Click OK. Link the GPO to the top-level OU structure containing computers, servers, and Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script block to enable detailed stop error parameters locally in the registry. Download Script: Set-CrashControl.ps1 # Set-CrashControl.ps1 # Description: Enables detailed BSOD parameters in the registry. Write-Host "--- Configuring Detailed BSOD Parameters ---" -ForegroundColor Cyan $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisplayParameters" -Value 1 -Type DWord -Force | Out-Null Write-Host "[+] Detailed BSOD stop parameters configured successfully." -ForegroundColor Green To verify that detailed stop parameters are enabled: Download Script: Audit-CrashControl.ps1 # Audit-CrashControl.ps1 # Description: Audits whether detailed BSOD parameters are enabled in the registry. Write-Host "--- Auditing Detailed BSOD Parameters ---" -ForegroundColor Cyan $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" if (Test-Path $Path) { $Val = Get-ItemProperty -Path $Path -Name "DisplayParameters" -ErrorAction SilentlyContinue if ($Val -and $Val.DisplayParameters -eq 1) { Write-Host "[+] Detailed BSOD stop parameters are ENABLED (Compliant)." -ForegroundColor Green } else { Write-Host "[-] Detailed BSOD stop parameters are DISABLED (Non-Compliant)." -ForegroundColor Red exit 1 } } else { Write-Host "[-] Registry path HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl not found." -ForegroundColor Red exit 1 } # Set-CrashControl.ps1 # Description: Enables detailed BSOD parameters in the registry. Write-Host "--- Configuring Detailed BSOD Parameters ---" -ForegroundColor Cyan $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisplayParameters" -Value 1 -Type DWord -Force | Out-Null Write-Host "[+] Detailed BSOD stop parameters configured successfully." -ForegroundColor Green Target Scope: Applicable Systems: Active Directory User and Computer Accounts (Tiers 0, 1, and 2). Operating Systems: Active Directory Domain Services (All supported functional levels). File Path: 06-operations-maintenance/decommission-inactive-accounts.md Inactive computer and user accounts remain in the directory due to gaps in the employee offboarding or machine decommissioning processes. These stale accounts represent a significant security risk: 1. Backdoor Persistence: Attackers targeting a domain can take control of inactive accounts (especially stale administrative accounts or service accounts with never-expiring passwords) to establish persistent, quiet access that is rarely monitored. 2. Resource-Based Delegation Exploits: Stale computer accounts can be targeted by attackers to construct resource-based constrained delegation (RBCD) attacks, allowing them to impersonate high-privilege services and eventually compromise the domain. 3. Password Aging bypass: Standard computers automatically change their passwords every 30 days. If a machine is powered off or disconnected, its password age increases. If computer passwords are not rotated, or if a stale computer account remains enabled, it increases the risk of offline password dumping and hash-relay. Automatically disabling and isolating user accounts after 180 days of inactivity, and computer accounts after 90 days of inactivity, minimizes the active attack surface of the directory. Option A: Scheduled Maintenance Task Setup Place the decommissioning script (Decommission-InactiveAccounts.ps1) in a secure administrative directory on a domain management host (e.g., C:\ADMaintenance\Scripts\). Open Task Scheduler (taskschd.msc) on the management host. Create a new task with the following properties: Account*: Run as a dedicated service account or NT AUTHORITY\SYSTEM (with delegated rights to modify user and computer accounts in target OUs). Trigger*: Weekly (e.g., every Sunday at 02:00 AM). Action*: Start a program: Program/script*: powershell.exe Arguments*: -NoProfile -ExecutionPolicy Bypass -File "C:\ADMaintenance\Scripts\Decommission-InactiveAccounts.ps1" -LogPath "C:\ADMaintenance\Logs\" Enable logging and monitor execution logs to verify that accounts are correctly identified, disabled, and moved to the Stale OU. Option B: PowerShell & Active Directory Configuration (Remediation / Non-GPO) To automate the identification, disabling, and isolation of inactive accounts: Download Script: Decommission-InactiveAccounts.ps1 # Decommission-InactiveAccounts.ps1 # Description: Disables and moves inactive user (180 days) and computer (90 days) accounts to a stale OU. Import-Module ActiveDirectory # Define thresholds $UserInactivityDays = 180 $ComputerInactivityDays = 90 $UserCutoffDate = (Get-Date).AddDays(-$UserInactivityDays) $ComputerCutoffDate = (Get-Date).AddDays(-$ComputerInactivityDays) # Target OU for stale objects (adjust to your environment) $StaleOU = "OU=StaleObjects,DC=domain,DC=local" $Exclusions = @("Domain Controllers") # Exclude OUs containing DCs if (-not (Get-ADOrganizationalUnit -Identity $StaleOU -ErrorAction SilentlyContinue)) { Write-Host "[-] Stale OU '$StaleOU' does not exist. Creating it." -ForegroundColor Yellow New-ADOrganizationalUnit -Name "StaleObjects" -Path (Get-ADDomain).DistinguishedName -Verbose } Write-Host "Scanning for inactive user accounts (no logon in last $UserInactivityDays days)..." -ForegroundColor Cyan $StaleUsers = Get-ADUser -Filter {Enabled -eq $true -and LastLogonDate -lt $UserCutoffDate -and Name -ne "Administrator" -and Name -ne "Guest"} -Properties LastLogonDate foreach ($user in $StaleUsers) { # Verify the user is not in excluded paths $isExcluded = $false foreach ($ex in $Exclusions) { if ($user.DistinguishedName -like "*$ex*") { $isExcluded = $true } } if ($isExcluded) { continue } Write-Host "Disabling and moving inactive user: $($user.SamAccountName) (Last Logon: $($user.LastLogonDate))" -ForegroundColor Yellow Set-ADUser -Identity $user -Enabled $false -Description "Disabled by AD Decommissioning Script - Inactive for $UserInactivityDays days" Move-ADObject -Identity $user -TargetPath $StaleOU } Write-Host "`nScanning for inactive computer accounts (no logon in last $ComputerInactivityDays days)..." -ForegroundColor Cyan $StaleComputers = Get-ADComputer -Filter {Enabled -eq $true -and LastLogonDate -lt $ComputerCutoffDate} -Properties LastLogonDate foreach ($comp in $StaleComputers) { $isExcluded = $false foreach ($ex in $Exclusions) { if ($comp.DistinguishedName -like "*$ex*") { $isExcluded = $true } } if ($isExcluded) { continue } Write-Host "Disabling and moving inactive computer: $($comp.Name) (Last Logon: $($comp.LastLogonDate))" -ForegroundColor Yellow Set-ADComputer -Identity $comp -Enabled $false -Description "Disabled by AD Decommissioning Script - Inactive for $ComputerInactivityDays days" Move-ADObject -Identity $comp -TargetPath $StaleOU } Write-Host "`nDecommissioning process completed." -ForegroundColor Green To audit the domain for stale user/computer accounts: Download Script: Get-InactiveAccountsStatus.ps1 # Get-InactiveAccountsStatus.ps1 # Audits the directory for enabled but inactive user (180 days) and computer (90 days) accounts. Import-Module ActiveDirectory $UserInactivityDays = 180 $ComputerInactivityDays = 90 $UserCutoffDate = (Get-Date).AddDays(-$UserInactivityDays) $ComputerCutoffDate = (Get-Date).AddDays(-$ComputerInactivityDays) $StaleUsers = Get-ADUser -Filter {Enabled -eq $true -and LastLogonDate -lt $UserCutoffDate -and Name -ne "Administrator" -and Name -ne "Guest"} -Properties LastLogonDate $StaleComputers = Get-ADComputer -Filter {Enabled -eq $true -and LastLogonDate -lt $ComputerCutoffDate} -Properties LastLogonDate $Exclusions = @("Domain Controllers") $nonCompliantCount = 0 foreach ($user in $StaleUsers) { $isExcluded = $false foreach ($ex in $Exclusions) { if ($user.DistinguishedName -like "*$ex*") { $isExcluded = $true } } if ($isExcluded) { continue } Write-Host "[!] NON-COMPLIANT: User account '$($user.SamAccountName)' is enabled but inactive since $($user.LastLogonDate)" -ForegroundColor Red $nonCompliantCount++ } foreach ($comp in $StaleComputers) { $isExcluded = $false foreach ($ex in $Exclusions) { if ($comp.DistinguishedName -like "*$ex*") { $isExcluded = $true } } if ($isExcluded) { continue } Write-Host "[!] NON-COMPLIANT: Computer account '$($comp.Name)' is enabled but inactive since $($comp.LastLogonDate)" -ForegroundColor Red $nonCompliantCount++ } if ($nonCompliantCount -eq 0) { Write-Host "[+] COMPLIANT: No stale enabled user or computer accounts detected." -ForegroundColor Green exit 0 } else { Write-Host "[!] NON-COMPLIANT: Detected $nonCompliantCount stale enabled accounts that need to be decommissioned." -ForegroundColor Red exit 1 } # Decommission-InactiveAccounts.ps1 # Description: Disables and moves inactive user (180 days) and computer (90 days) accounts to a stale OU. Import-Module ActiveDirectory # Define thresholds $UserInactivityDays = 180 $ComputerInactivityDays = 90 $UserCutoffDate = (Get-Date).AddDays(-$UserInactivityDays) $ComputerCutoffDate = (Get-Date).AddDays(-$ComputerInactivityDays) # Target OU for stale objects (adjust to your environment) $StaleOU = "OU=StaleObjects,DC=domain,DC=local" $Exclusions = @("Domain Controllers") # Exclude OUs containing DCs if (-not (Get-ADOrganizationalUnit -Identity $StaleOU -ErrorAction SilentlyContinue)) { Write-Host "[-] Stale OU '$StaleOU' does not exist. Creating it." -ForegroundColor Yellow New-ADOrganizationalUnit -Name "StaleObjects" -Path (Get-ADDomain).DistinguishedName -Verbose } Write-Host "Scanning for inactive user accounts (no logon in last $UserInactivityDays days)..." -ForegroundColor Cyan $StaleUsers = Get-ADUser -Filter {Enabled -eq $true -and LastLogonDate -lt $UserCutoffDate -and Name -ne "Administrator" -and Name -ne "Guest"} -Properties LastLogonDate foreach ($user in $StaleUsers) { # Verify the user is not in excluded paths $isExcluded = $false foreach ($ex in $Exclusions) { if ($user.DistinguishedName -like "*$ex*") { $isExcluded = $true } } if ($isExcluded) { continue } Write-Host "Disabling and moving inactive user: $($user.SamAccountName) (Last Logon: $($user.LastLogonDate))" -ForegroundColor Yellow Set-ADUser -Identity $user -Enabled $false -Description "Disabled by AD Decommissioning Script - Inactive for $UserInactivityDays days" Move-ADObject -Identity $user -TargetPath $StaleOU } Write-Host "`nScanning for inactive computer accounts (no logon in last $ComputerInactivityDays days)..." -ForegroundColor Cyan $StaleComputers = Get-ADComputer -Filter {Enabled -eq $true -and LastLogonDate -lt $ComputerCutoffDate} -Properties LastLogonDate foreach ($comp in $StaleComputers) { $isExcluded = $false foreach ($ex in $Exclusions) { if ($comp.DistinguishedName -like "*$ex*") { $isExcluded = $true } } if ($isExcluded) { continue } Write-Host "Disabling and moving inactive computer: $($comp.Name) (Last Logon: $($comp.LastLogonDate))" -ForegroundColor Yellow Set-ADComputer -Identity $comp -Enabled $false -Description "Disabled by AD Decommissioning Script - Inactive for $ComputerInactivityDays days" Move-ADObject -Identity $comp -TargetPath $StaleOU } Write-Host "`nDecommissioning process completed." -ForegroundColor Green Target Scope: Applicable Systems: Domain Controllers, Member Servers Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022 File Path: 06-operations-maintenance/cleanup-staged-ifm-files.md The Install From Media (IFM) feature allows administrators to promote a new Domain Controller using an offline backup dataset rather than copying the entire Active Directory database over the network. To generate this dataset, administrators run the ntdsutil tool (e.g., ntdsutil "ac i ntds" "ifm" "create full c:\Staging" q q). This process generates a staging folder containing: 1. The Active Directory database file (ntds.dit). 2. Copies of the SYSTEM and SECURITY registry hives (which contain the boot key needed to decrypt the database file). If these staged IFM folders are left behind on member servers, administrative shares, or staging volumes, any user or attacker who compromises that machine can copy the files and extract all Active Directory password hashes offline. Securing active directory requires ensuring that temporary IFM datasets are deleted immediately after the new Domain Controller is promoted. Option A: Manual Search and Deletion (GUI) To manually locate and clean up staged IFM folders: 1. Log on to the staging Member Server or Domain Controller with administrative privileges. 2. Open File Explorer and search all local disk volumes (e.g., C:\, D:\) for files named ntds.dit. 3. Verify the location of each found file: Domain Controllers : The authorized directory is the Active Directory database path (typically `C:\Windows\NTDS\ntds.dit` as specified in the registry value `DSA Database file` under `HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters`). Member Servers: There are no authorized directories. Any instance of ntds.dit is unauthorized. 4. If an unauthorized ntds.dit file is located: Select the folder containing the `ntds.dit` file (which usually also contains a `registry` sub-folder). Delete the folder and clear it from the Recycle Bin. Option B: PowerShell & Remediation (Non-GPO / Script-based) Use these scripts to audit and automatically delete staged IFM datasets. Download Script: Remove-StagedIFM.ps1 # Remove-StagedIFM.ps1 # Description: Searches for unauthorized copies of ntds.dit and deletes them. # Target Engine: Windows PowerShell 5.1 Write-Host "Applying hardening requirement: Clean Up Staged IFM Data..." -ForegroundColor Cyan # 1. Resolve standard active directory database path (only applicable to DCs) $StandardDir = $null $StandardAdPath = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Name "DSA Database file" -ErrorAction SilentlyContinue)."DSA Database file" if ($StandardAdPath) { $StandardDir = [System.IO.Path]::GetDirectoryName($StandardAdPath) } # 2. Recursive search function excluding standard heavy system directories function Search-UnauthorizedDIT ($SearchPath) { if (-not (Test-Path $SearchPath)) { return @() } $Found = @() $Items = Get-ChildItem -Path $SearchPath -ErrorAction SilentlyContinue foreach ($Item in $Items) { if ($Item.Attributes -match "Directory") { # Skip system/program directories to optimize speed if ($Item.Name -match "^(Windows|Program Files|Program Files \(x86\)|\$Recycle\.Bin|System Volume Information|AppData)$") { continue } $Found += Search-UnauthorizedDIT $Item.FullName } elseif ($Item.Name -ieq "ntds.dit") { # Skip authorized DC database folder if ($null -ne $StandardDir -and $Item.DirectoryName -eq $StandardDir) { continue } $Found += $Item.FullName } } return $Found } # 3. Scan all local drives $Drives = Get-PSDrive -PSProvider FileSystem $VulnerableFiles = @() foreach ($Drive in $Drives) { $Root = $Drive.Root Write-Host "[*] Scanning drive $Root for unauthorized ntds.dit files..." -ForegroundColor Gray $VulnerableFiles += Search-UnauthorizedDIT $Root } # 4. Delete unauthorized directories if ($VulnerableFiles.Count -gt 0) { Write-Host "[-] Found $($VulnerableFiles.Count) unauthorized ntds.dit file(s)." -ForegroundColor Yellow foreach ($File in $VulnerableFiles) { $FolderToDelete = [System.IO.Path]::GetDirectoryName($File) Write-Host "[-] Deleting staging directory: $FolderToDelete" -ForegroundColor Yellow try { Remove-Item -Path $FolderToDelete -Recurse -Force -ErrorAction Stop Write-Host "[+] Directory $FolderToDelete successfully deleted." -ForegroundColor Green } catch { Write-Error "Failed to delete directory: $FolderToDelete. Error: $($_.Exception.Message)" } } } else { Write-Host "[+] No unauthorized staged ntds.dit files found on local drives." -ForegroundColor Green } To audit the system for staged IFM directories: Download Script: Get-StagedIFMStatus.ps1 # Get-StagedIFMStatus.ps1 # Description: Audits local drives for unauthorized staged ntds.dit databases. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Auditing Staged IFM Data ---" -ForegroundColor Cyan # 1. Resolve standard active directory database path (only applicable to DCs) $StandardDir = $null $StandardAdPath = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Name "DSA Database file" -ErrorAction SilentlyContinue)."DSA Database file" if ($StandardAdPath) { $StandardDir = [System.IO.Path]::GetDirectoryName($StandardAdPath) } # 2. Recursive search function function Search-UnauthorizedDIT ($SearchPath) { if (-not (Test-Path $SearchPath)) { return @() } $Found = @() $Items = Get-ChildItem -Path $SearchPath -ErrorAction SilentlyContinue foreach ($Item in $Items) { if ($Item.Attributes -match "Directory") { # Skip system/program directories to optimize speed if ($Item.Name -match "^(Windows|Program Files|Program Files \(x86\)|\$Recycle\.Bin|System Volume Information|AppData)$") { continue } $Found += Search-UnauthorizedDIT $Item.FullName } elseif ($Item.Name -ieq "ntds.dit") { # Skip authorized DC database folder if ($null -ne $StandardDir -and $Item.DirectoryName -eq $StandardDir) { continue } $Found += $Item.FullName } } return $Found } # 3. Scan local drives $Drives = Get-PSDrive -PSProvider FileSystem $VulnerableFiles = @() foreach ($Drive in $Drives) { $Root = $Drive.Root $VulnerableFiles += Search-UnauthorizedDIT $Root } # 4. Evaluate status if ($VulnerableFiles.Count -gt 0) { foreach ($File in $VulnerableFiles) { Write-Host "[!] VULNERABLE: Unauthorized ntds.dit database found at: $File" -ForegroundColor Red } exit 1 } else { Write-Host "[+] Secure: No unauthorized staged ntds.dit database files found." -ForegroundColor Green exit 0 } # Remove-StagedIFM.ps1 # Description: Searches for unauthorized copies of ntds.dit and deletes them. # Target Engine: Windows PowerShell 5.1 Write-Host "Applying hardening requirement: Clean Up Staged IFM Data..." -ForegroundColor Cyan # 1. Resolve standard active directory database path (only applicable to DCs) $StandardDir = $null $StandardAdPath = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Name "DSA Database file" -ErrorAction SilentlyContinue)."DSA Database file" if ($StandardAdPath) { $StandardDir = [System.IO.Path]::GetDirectoryName($StandardAdPath) } # 2. Recursive search function excluding standard heavy system directories function Search-UnauthorizedDIT ($SearchPath) { if (-not (Test-Path $SearchPath)) { return @() } $Found = @() $Items = Get-ChildItem -Path $SearchPath -ErrorAction SilentlyContinue foreach ($Item in $Items) { if ($Item.Attributes -match "Directory") { # Skip system/program directories to optimize speed if ($Item.Name -match "^(Windows|Program Files|Program Files \(x86\)|\$Recycle\.Bin|System Volume Information|AppData)$") { continue } $Found += Search-UnauthorizedDIT $Item.FullName } elseif ($Item.Name -ieq "ntds.dit") { # Skip authorized DC database folder if ($null -ne $StandardDir -and $Item.DirectoryName -eq $StandardDir) { continue } $Found += $Item.FullName } } return $Found } # 3. Scan all local drives $Drives = Get-PSDrive -PSProvider FileSystem $VulnerableFiles = @() foreach ($Drive in $Drives) { $Root = $Drive.Root Write-Host "[*] Scanning drive $Root for unauthorized ntds.dit files..." -ForegroundColor Gray $VulnerableFiles += Search-UnauthorizedDIT $Root } # 4. Delete unauthorized directories if ($VulnerableFiles.Count -gt 0) { Write-Host "[-] Found $($VulnerableFiles.Count) unauthorized ntds.dit file(s)." -ForegroundColor Yellow foreach ($File in $VulnerableFiles) { $FolderToDelete = [System.IO.Path]::GetDirectoryName($File) Write-Host "[-] Deleting staging directory: $FolderToDelete" -ForegroundColor Yellow try { Remove-Item -Path $FolderToDelete -Recurse -Force -ErrorAction Stop Write-Host "[+] Directory $FolderToDelete successfully deleted." -ForegroundColor Green } catch { Write-Error "Failed to delete directory: $FolderToDelete. Error: $($_.Exception.Message)" } } } else { Write-Host "[+] No unauthorized staged ntds.dit files found on local drives." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/configure-applocker-policies.md Privileged Access Workstations (PAWs) host highly sensitive Tier 0 credentials. If administrative workstations are allowed to execute arbitrary binaries, scripts, or installation packages, they become highly susceptible to malware infections, remote access trojans, and credential harvesting tools (like Mimikatz). Enforcing strict execution controls via AppLocker ensures that: 1. Execution Control: Only signed operating system files, approved software binaries, and scripts are allowed to execute. 2. Standard User Restrictions: Any standard users or unauthorized accounts cannot run executable files or installers from writeable directories (like %TEMP% or %USERPROFILE%). 3. Defends Against AppLocker Bypasses: Abusing trusted, signed Microsoft binaries (such as msbuild.exe, installutil.exe, regasm.exe, regsvcs.exe, mshta.exe, regsvr32.exe, rundll32.exe) allows attackers to execute arbitrary code bypassing default AppLocker rules. This control blocks these "Living off the Land" binaries (LOLBins) and prevents execution from user-writeable paths under %WINDIR% (such as Tasks, Temp, tracing, spool\drivers\color, etc.). 4. Defense-in-Depth: Even if an administrator is tricked into downloading a malicious file, AppLocker blocks the execution of the binary, preventing the compromise of the endpoint. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Create or edit the GPO linked to the PAWs Organizational Unit (OU) (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Application Control Policies\AppLocker Configure AppLocker Enforcement: Right-click AppLocker and select Properties*. On the Enforcement tab, check Configured* under: Executable rules -> Select Enforce rules Windows Installer rules -> Select Enforce rules Script rules -> Select Enforce rules Packaged app rules -> Select Enforce rules Right-click Executable Rules and select Create Default Rules (this permits Windows files and program files). Delete the default rule allowing "Everyone" to run files in all locations, and replace it with a rule allowing only authorized administrative groups (e.g., Tier0-Admins) to run binaries outside the default system locations. Per ANSSI R2 recommendation, do not create standalone Deny rules. Instead, configure the following path Exceptions on the default Allow rule for the Windows folder: Right-click the rule `(Default Rule) All files located in the Windows folder` and select Properties*. On the Exceptions* tab, add path exceptions for writeable directories under %WINDIR%: `%WINDIR%\Tasks\ `%WINDIR%\Temp\ `%WINDIR%\tracing\ `%WINDIR%\System32\spool\drivers\color\ `%WINDIR%\System32\Tasks\Microsoft\Windows\SyncCenter\ `%WINDIR%\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ On the same Exceptions* tab, add path exceptions for the following bypass binaries (LOLBins): `\msbuild.exe` `\installutil.exe` `\mshta.exe` `\regasm.exe` `\regsvcs.exe` `\regsvr32.exe` `\rundll32.exe` `\bginfo.exe` `\cdb.exe` `\cmstp.exe` `\control.exe` `\csi.exe` `\dfsvc.exe` `\dnx.exe` `\fsi.exe` `\ie4unit.exe` `\ieexec.exe` `\infdefaultinstall.exe` `\mavinject.exe` `\msdeploy.exe` `\msdt.exe` `\msxsl.exe` `\odbcconf.exe` `\presentationhost.exe` `\rcsi.exe` `\rsi.exe` `\runscripthelper.exe` `\te.exe` `\tracker.exe` `\xwizard.exe` Repeat the process for Script Rules by creating default rules and adding exceptions to the %WINDIR%\* Allow rule for script execution from user-writeable paths (such as %WINDIR%\Temp\* and %WINDIR%\Tasks\*). Disable NTVDM (16-bit application support) to prevent AppLocker bypasses via 16-bit binaries: * Navigate to: Computer Configuration\Administrative Templates\System\16-bit Application Compatibility Configure Prevent access to 16-bit applications to Enabled*. Link the GPO to the PAWs Organizational Unit (OU). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the Application Identity service (AppIDSvc) and import the robust AppLocker policy locally. Download Script: Configure-PawAppLockerService.ps1 # Configure-PawAppLockerService.ps1 # Description: Configures the Application Identity service (AppIDSvc) to start automatically and imports a robust AppLocker XML policy. Write-Host "Applying AppLocker Identity service hardening..." -ForegroundColor Cyan # 1. Enable Application Identity service (AppIDSvc) $AppLockerService = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue if ($AppLockerService) { Set-Service -Name AppIDSvc -StartupType Automatic Start-Service -Name AppIDSvc -ErrorAction SilentlyContinue Write-Host "[+] Application Identity Service (AppIDSvc) set to Automatic and started." -ForegroundColor Green } else { Write-Warning "[-] Application Identity Service not found on this machine." } # 2. Configure local AppLocker policy XML content $AppLockerXml = @" <AppLockerPolicy Version="1"> <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e1e-453f-b3a5-bc4f4a38674d" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-6d8f-4ad9-acbc-467b78a7f7b4" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> <FilePathCondition Path="%WINDIR%\System32\spool\drivers\color\*" /> <FilePathCondition Path="%WINDIR%\System32\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="%WINDIR%\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="*\msbuild.exe" /> <FilePathCondition Path="*\installutil.exe" /> <FilePathCondition Path="*\mshta.exe" /> <FilePathCondition Path="*\regasm.exe" /> <FilePathCondition Path="*\regsvcs.exe" /> <FilePathCondition Path="*\regsvr32.exe" /> <FilePathCondition Path="*\rundll32.exe" /> <FilePathCondition Path="*\bginfo.exe" /> <FilePathCondition Path="*\cdb.exe" /> <FilePathCondition Path="*\cmstp.exe" /> <FilePathCondition Path="*\control.exe" /> <FilePathCondition Path="*\csi.exe" /> <FilePathCondition Path="*\dfsvc.exe" /> <FilePathCondition Path="*\dnx.exe" /> <FilePathCondition Path="*\fsi.exe" /> <FilePathCondition Path="*\ie4unit.exe" /> <FilePathCondition Path="*\ieexec.exe" /> <FilePathCondition Path="*\infdefaultinstall.exe" /> <FilePathCondition Path="*\mavinject.exe" /> <FilePathCondition Path="*\msdeploy.exe" /> <FilePathCondition Path="*\msdt.exe" /> <FilePathCondition Path="*\msxsl.exe" /> <FilePathCondition Path="*\odbcconf.exe" /> <FilePathCondition Path="*\presentationhost.exe" /> <FilePathCondition Path="*\rcsi.exe" /> <FilePathCondition Path="*\rsi.exe" /> <FilePathCondition Path="*\runscripthelper.exe" /> <FilePathCondition Path="*\te.exe" /> <FilePathCondition Path="*\tracker.exe" /> <FilePathCondition Path="*\xwizard.exe" /> </Exceptions> </FilePathRule> <FilePathRule Id="fd686d83-a829-4351-8ff4-27c1de5732e9" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePathRule Id="5b8fa8b3-3a5e-4c7a-9cb8-b223ff9db271" Name="(Default Rule) All Windows Installer files in Program Files" Description="Allows everyone to run Windows Installer files in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="6b8fa8b3-3a5e-4c7a-9cb8-b223ff9db272" Name="(Default Rule) All Windows Installer files in Windows" Description="Allows everyone to run Windows Installer files in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="7b8fa8b3-3a5e-4c7a-9cb8-b223ff9db273" Name="(Default Rule) All Windows Installer files" Description="Allows administrators to run all Windows Installer files." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Script" EnforcementMode="Enabled"> <FilePathRule Id="1c8fa8b3-3a5e-4c7a-9cb8-b223ff9db274" Name="(Default Rule) All scripts located in the Program Files folder" Description="Allows everyone to run scripts in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="2c8fa8b3-3a5e-4c7a-9cb8-b223ff9db275" Name="(Default Rule) All scripts located in the Windows folder" Description="Allows everyone to run scripts in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="3c8fa8b3-3a5e-4c7a-9cb8-b223ff9db276" Name="(Default Rule) All scripts" Description="Allows administrators to run all scripts." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="1d8fa8b3-3a5e-4c7a-9cb8-b223ff9db279" Name="(Default Rule) All signed packaged apps" Description="Allows everyone to run signed packaged apps." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> </AppLockerPolicy> "@ # Write the temporary XML and import it $TempPath = Join-Path -Path $env:TEMP -ChildPath "AppLockerPawPolicy.xml" $AppLockerXml | Out-File -FilePath $TempPath -Encoding UTF8 -Force # 3. Validate policy using Test-AppLockerPolicy before importing try { Import-Module AppLocker -ErrorAction Stop } catch { Write-Error "AppLocker module is not available on this system. Cannot configure or validate policy." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } $TestPaths = @( # Expected: Allowed "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe", # Expected: DeniedByDefault or ExplicitlyDenied (since it is an exception to an Allow rule) "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) $ValidationFailed = $false try { $TestResults = Test-AppLockerPolicy -XmlPolicy $TempPath -Path $TestPaths -User Everyone -ErrorAction Stop $ExpectedAllow = @( "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe" ) $ExpectedDeny = @( "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) foreach ($Result in $TestResults) { $Path = $Result.FilePath $Decision = $Result.PolicyDecision if ($ExpectedAllow -contains $Path) { if ($Decision -ne "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Allow for: $Path (got: $Decision)" $ValidationFailed = $true } } if ($ExpectedDeny -contains $Path) { if ($Decision -eq "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Deny/Not Allowed for: $Path (got: $Decision)" $ValidationFailed = $true } } } } catch { Write-Warning "Could not perform policy validation tests: $($_.Exception.Message)" $ValidationFailed = $true } if ($ValidationFailed) { Write-Error "AppLocker policy validation failed. Policy was NOT imported." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } Write-Host "[+] AppLocker policy validation passed. Proceeding with import." -ForegroundColor Green # 4. Import the validated AppLocker policy try { Set-AppLockerPolicy -XmlPolicy $TempPath -ErrorAction Stop Write-Host "[+] Local AppLocker policy imported and enforced successfully." -ForegroundColor Green } catch { Write-Error "Failed to import AppLocker policy: $($_.Exception.Message)" } finally { if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } } # 5. Disable NTVDM (16-bit compatibility) via Registry $NtvdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" if (-not (Test-Path $NtvdmPath)) { New-Item -Path $NtvdmPath -Force | Out-Null } Set-ItemProperty -Path $NtvdmPath -Name "Prevent16BitApp" -Value 1 -Type DWord Write-Host "[+] 16-bit NTVDM compatibility disabled in registry." -ForegroundColor Green To verify the AppLocker service status: Download Script: Test-PawAppLockerStatus.ps1 # Test-PawAppLockerStatus.ps1 # Description: Checks the current configuration and operational status of the Application Identity service. Write-Host "--- Auditing AppLocker Service Status ---" -ForegroundColor Cyan # 1. Audit service state $AppIDSvc = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue if ($AppIDSvc) { if ($AppIDSvc.Status -eq "Running" -and $AppIDSvc.StartType -eq "Automatic") { Write-Host " - AppLocker Service Status: Running | Startup: Automatic (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: AppLocker Service Status: $($AppIDSvc.Status) | Startup: $($AppIDSvc.StartType) (Should be Running/Automatic)" -ForegroundColor Red } } else { Write-Host " - VULNERABLE: Application Identity Service (AppIDSvc) is not installed." -ForegroundColor Red } # 2. Audit enforcement registry settings $SrpPath = "HKLM:\Software\Policies\Microsoft\Windows\SrpV2" $Collections = @("Exe", "Msi", "Script", "Appx") if (Test-Path $SrpPath) { foreach ($Col in $Collections) { $ColPath = "$SrpPath\$Col" if (Test-Path $ColPath) { $Val = Get-ItemProperty -Path $ColPath -Name "EnforcementMode" -ErrorAction SilentlyContinue if ($null -ne $Val) { $Mode = if ($Val.EnforcementMode -eq 1) { "Enforced" } else { "Audit Only" } $Color = if ($Val.EnforcementMode -eq 1) { "Green" } else { "Yellow" } Write-Host " - Collection $Col Enforcement: $Mode (Value: $($Val.EnforcementMode))" -ForegroundColor $Color } else { Write-Host " - Collection $Col Enforcement: NOT CONFIGURED" -ForegroundColor Red } } else { Write-Host " - Collection $Col Path: NOT FOUND" -ForegroundColor Red } } } else { Write-Host "[-] AppLocker registry base path (SrpV2) not found. Policy is not deployed." -ForegroundColor Red } # 3. Audit NTVDM Disable Status $NtvdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" if (Test-Path $NtvdmPath) { $AppCompatVal = Get-ItemProperty -Path $NtvdmPath -Name "Prevent16BitApp" -ErrorAction SilentlyContinue if ($null -ne $AppCompatVal -and $AppCompatVal.Prevent16BitApp -eq 1) { Write-Host " - NTVDM (16-bit AppCompat): Disabled (Secure)" -ForegroundColor Green } else { Write-Host " - NTVDM (16-bit AppCompat): Enabled or Not Configured (Expected: Disabled)" -ForegroundColor Yellow } } else { Write-Host " - NTVDM (16-bit AppCompat): Not Configured (Expected: Disabled)" -ForegroundColor Yellow } # Configure-PawAppLockerService.ps1 # Description: Configures the Application Identity service (AppIDSvc) to start automatically and imports a robust AppLocker XML policy. Write-Host "Applying AppLocker Identity service hardening..." -ForegroundColor Cyan # 1. Enable Application Identity service (AppIDSvc) $AppLockerService = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue if ($AppLockerService) { Set-Service -Name AppIDSvc -StartupType Automatic Start-Service -Name AppIDSvc -ErrorAction SilentlyContinue Write-Host "[+] Application Identity Service (AppIDSvc) set to Automatic and started." -ForegroundColor Green } else { Write-Warning "[-] Application Identity Service not found on this machine." } # 2. Configure local AppLocker policy XML content $AppLockerXml = @" <AppLockerPolicy Version="1"> <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e1e-453f-b3a5-bc4f4a38674d" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-6d8f-4ad9-acbc-467b78a7f7b4" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> <FilePathCondition Path="%WINDIR%\System32\spool\drivers\color\*" /> <FilePathCondition Path="%WINDIR%\System32\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="%WINDIR%\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="*\msbuild.exe" /> <FilePathCondition Path="*\installutil.exe" /> <FilePathCondition Path="*\mshta.exe" /> <FilePathCondition Path="*\regasm.exe" /> <FilePathCondition Path="*\regsvcs.exe" /> <FilePathCondition Path="*\regsvr32.exe" /> <FilePathCondition Path="*\rundll32.exe" /> <FilePathCondition Path="*\bginfo.exe" /> <FilePathCondition Path="*\cdb.exe" /> <FilePathCondition Path="*\cmstp.exe" /> <FilePathCondition Path="*\control.exe" /> <FilePathCondition Path="*\csi.exe" /> <FilePathCondition Path="*\dfsvc.exe" /> <FilePathCondition Path="*\dnx.exe" /> <FilePathCondition Path="*\fsi.exe" /> <FilePathCondition Path="*\ie4unit.exe" /> <FilePathCondition Path="*\ieexec.exe" /> <FilePathCondition Path="*\infdefaultinstall.exe" /> <FilePathCondition Path="*\mavinject.exe" /> <FilePathCondition Path="*\msdeploy.exe" /> <FilePathCondition Path="*\msdt.exe" /> <FilePathCondition Path="*\msxsl.exe" /> <FilePathCondition Path="*\odbcconf.exe" /> <FilePathCondition Path="*\presentationhost.exe" /> <FilePathCondition Path="*\rcsi.exe" /> <FilePathCondition Path="*\rsi.exe" /> <FilePathCondition Path="*\runscripthelper.exe" /> <FilePathCondition Path="*\te.exe" /> <FilePathCondition Path="*\tracker.exe" /> <FilePathCondition Path="*\xwizard.exe" /> </Exceptions> </FilePathRule> <FilePathRule Id="fd686d83-a829-4351-8ff4-27c1de5732e9" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePathRule Id="5b8fa8b3-3a5e-4c7a-9cb8-b223ff9db271" Name="(Default Rule) All Windows Installer files in Program Files" Description="Allows everyone to run Windows Installer files in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="6b8fa8b3-3a5e-4c7a-9cb8-b223ff9db272" Name="(Default Rule) All Windows Installer files in Windows" Description="Allows everyone to run Windows Installer files in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="7b8fa8b3-3a5e-4c7a-9cb8-b223ff9db273" Name="(Default Rule) All Windows Installer files" Description="Allows administrators to run all Windows Installer files." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Script" EnforcementMode="Enabled"> <FilePathRule Id="1c8fa8b3-3a5e-4c7a-9cb8-b223ff9db274" Name="(Default Rule) All scripts located in the Program Files folder" Description="Allows everyone to run scripts in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="2c8fa8b3-3a5e-4c7a-9cb8-b223ff9db275" Name="(Default Rule) All scripts located in the Windows folder" Description="Allows everyone to run scripts in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="3c8fa8b3-3a5e-4c7a-9cb8-b223ff9db276" Name="(Default Rule) All scripts" Description="Allows administrators to run all scripts." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="1d8fa8b3-3a5e-4c7a-9cb8-b223ff9db279" Name="(Default Rule) All signed packaged apps" Description="Allows everyone to run signed packaged apps." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> </AppLockerPolicy> "@ # Write the temporary XML and import it $TempPath = Join-Path -Path $env:TEMP -ChildPath "AppLockerPawPolicy.xml" $AppLockerXml | Out-File -FilePath $TempPath -Encoding UTF8 -Force # 3. Validate policy using Test-AppLockerPolicy before importing try { Import-Module AppLocker -ErrorAction Stop } catch { Write-Error "AppLocker module is not available on this system. Cannot configure or validate policy." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } $TestPaths = @( # Expected: Allowed "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe", # Expected: DeniedByDefault or ExplicitlyDenied (since it is an exception to an Allow rule) "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) $ValidationFailed = $false try { $TestResults = Test-AppLockerPolicy -XmlPolicy $TempPath -Path $TestPaths -User Everyone -ErrorAction Stop $ExpectedAllow = @( "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe" ) $ExpectedDeny = @( "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) foreach ($Result in $TestResults) { $Path = $Result.FilePath $Decision = $Result.PolicyDecision if ($ExpectedAllow -contains $Path) { if ($Decision -ne "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Allow for: $Path (got: $Decision)" $ValidationFailed = $true } } if ($ExpectedDeny -contains $Path) { if ($Decision -eq "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Deny/Not Allowed for: $Path (got: $Decision)" $ValidationFailed = $true } } } } catch { Write-Warning "Could not perform policy validation tests: $($_.Exception.Message)" $ValidationFailed = $true } if ($ValidationFailed) { Write-Error "AppLocker policy validation failed. Policy was NOT imported." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } Write-Host "[+] AppLocker policy validation passed. Proceeding with import." -ForegroundColor Green # 4. Import the validated AppLocker policy try { Set-AppLockerPolicy -XmlPolicy $TempPath -ErrorAction Stop Write-Host "[+] Local AppLocker policy imported and enforced successfully." -ForegroundColor Green } catch { Write-Error "Failed to import AppLocker policy: $($_.Exception.Message)" } finally { if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } } # 5. Disable NTVDM (16-bit compatibility) via Registry $NtvdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" if (-not (Test-Path $NtvdmPath)) { New-Item -Path $NtvdmPath -Force | Out-Null } Set-ItemProperty -Path $NtvdmPath -Name "Prevent16BitApp" -Value 1 -Type DWord Write-Host "[+] 16-bit NTVDM compatibility disabled in registry." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/enable-lsa-protection.md The Local Security Authority Subsystem Service (LSASS) process manages security policies, user authentication, and credential tokens on Windows systems. Attackers targeting administrative workstations commonly attempt to extract plain-text credentials or NT hashes from LSASS memory using debugging tools (e.g., Mimikatz, Procdump). Enabling LSA Protection ensures that: 1. Protected Process Light (PPL): The LSASS process runs as a Protected Process Light (PPL). 2. Access Restriction: Only verified, digitally signed code can load into LSASS, and standard processes (even those running as local system/administrator) cannot read the memory space of LSASS or inject code into it. 3. Mitigating Dump Attacks: Credential harvesting tools cannot dump LSASS memory to disk or scrape keys from LSA memory blocks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the PAWs Organizational Unit (OU) (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Local Security Authority Configure the setting: Policy*: Configure LSASS to run as a protected process Setting*: Enabled Configure LSA to run as a protected process*: Enabled with UEFI Lock (or Enabled without UEFI Lock depending on management needs) Link the GPO to the PAWs Organizational Unit (OU). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the local registry key on the PAW to run LSASS as a protected process. Download Script: Configure-PawLsaProtection.ps1 # Configure-PawLsaProtection.ps1 # Description: Configures the RunAsPPL registry key to enable LSA Protection on PAWs. Write-Host "Applying LSA Protection registry hardening..." -ForegroundColor Cyan $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "RunAsPPL" -Value 1 -Type DWord Write-Host "[+] LSA Protection (RunAsPPL) enabled in registry. (Reboot required)." -ForegroundColor Green To verify the local LSA Protection state: Download Script: Test-PawLsaProtection.ps1 # Test-PawLsaProtection.ps1 # Description: Checks the registry settings and running process state to verify LSA Protection is active. Write-Host "--- Auditing LSA Protection Status ---" -ForegroundColor Cyan $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" $RunAsPPL = (Get-ItemProperty -Path $LsaPath -Name "RunAsPPL" -ErrorAction SilentlyContinue).RunAsPPL if ($RunAsPPL -eq 1) { Write-Host " - LSA Protection (RunAsPPL): Enabled (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: LSA Protection (RunAsPPL) is not configured or disabled (Value: $($RunAsPPL))" -ForegroundColor Red } # Configure-PawLsaProtection.ps1 # Description: Configures the RunAsPPL registry key to enable LSA Protection on PAWs. Write-Host "Applying LSA Protection registry hardening..." -ForegroundColor Cyan $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "RunAsPPL" -Value 1 -Type DWord Write-Host "[+] LSA Protection (RunAsPPL) enabled in registry. (Reboot required)." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/restrict-local-administrators.md Privileged Access Workstations (PAWs) represent Tier 0 administrative assets. Any user or group that has local administrative rights on a PAW can bypass operating system security boundaries, disable system protections, capture keystrokes, or extract cached credentials. Restricting local Administrators group membership ensures that: 1. Administrative Rights Restriction: Standard domain users and lower-tiered administrators (e.g., workstation support admins) are strictly prevented from executing code in an elevated context on the PAW. 2. Tier Separation: Administrative credentials from lower security tiers cannot compromise the PAW. Only dedicated Tier 0 administrators are allowed local administrative access. 3. Authorized Control: Membership is strictly controlled and reset periodically via Group Policy (Restricted Groups), preventing persistent privilege creep. Option A: Group Policy Object (GPO) Configuration (Preferred) Deploy Restricted Groups via GPO to enforce local administrators group memberships: 1. Open the Group Policy Management Console (gpmc.msc). 2. Edit the GPO linked to the PAWs Organizational Unit (OU) (e.g., GPO_Hardening_PAW). 3. Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups 4. Right-click Restricted Groups and select Add Group. 5. Type Administrators (or click Browse to find the local group). 6. Under Members of this group, define the allowed members: `Administrator` (the built-in local administrator account) DomainName\Tier0-Admins (dedicated Tier 0 administrative group) Do NOT include any standard domain users or lower-tier administrative groups.* 7. Link the GPO to the PAWs Organizational Unit (OU). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to audit and remediate unauthorized administrative accounts in the local Administrators group. Download Script: Clean-PawLocalAdministrators.ps1 # Clean-PawLocalAdministrators.ps1 # Description: Removes unauthorized accounts from the local Administrators group on PAWs. Write-Host "--- Restricting Local Administrators Group on PAW ---" -ForegroundColor Cyan # Define the list of authorized members # Built-in Administrator and Tier 0 admin groups $AuthorizedMembers = @("Administrator", "Tier0-Admins") $LocalAdmins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue if ($LocalAdmins) { foreach ($Member in $LocalAdmins) { $Match = $false foreach ($Auth in $AuthorizedMembers) { if ($Member.Name -eq $Auth -or $Member.Name -like "*\$Auth" -or $Member.Name -eq "$env:COMPUTERNAME\$Auth") { $Match = $true break } } if (-not $Match) { Write-Host "[-] Removing unauthorized member from Administrators: $($Member.Name) (Source: $($Member.PrincipalSource))" -ForegroundColor Yellow try { Remove-LocalGroupMember -Group "Administrators" -Member $Member.Name -ErrorAction Stop Write-Host " Successfully removed: $($Member.Name)" -ForegroundColor Green } catch { Write-Error " Failed to remove: $($Member.Name). Error: $($_.Exception.Message)" } } else { Write-Host "[+] Member authorized: $($Member.Name)" -ForegroundColor Green } } } else { Write-Error "Could not retrieve members of local Administrators group." } To audit local Administrators group memberships on the PAW: Download Script: Test-PawLocalAdministrators.ps1 # Test-PawLocalAdministrators.ps1 # Description: Audits local Administrators group memberships to ensure only authorized Tier 0 accounts are present. Write-Host "--- Auditing PAW Local Administrators Group ---" -ForegroundColor Cyan # Define the authorized domain/local patterns $AuthorizedMembers = @("Administrator", "Tier0-Admins") $LocalAdmins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue if ($LocalAdmins) { Write-Host "[*] Current members of local Administrators group:" -ForegroundColor Yellow foreach ($Member in $LocalAdmins) { $Match = $false foreach ($Auth in $AuthorizedMembers) { if ($Member.Name -eq $Auth -or $Member.Name -like "*\$Auth" -or $Member.Name -eq "$env:COMPUTERNAME\$Auth") { $Match = $true break } } if (-not $Match) { Write-Host " - VULNERABLE: Unauthorized account '$($Member.Name)' (Source: $($Member.PrincipalSource)) has administrative access." -ForegroundColor Red } else { Write-Host " - Member: $($Member.Name) | Source: $($Member.PrincipalSource) | Class: $($Member.ObjectClass) (Authorized)" -ForegroundColor Green } } } else { Write-Error "Failed to retrieve local Administrators group members." } # Clean-PawLocalAdministrators.ps1 # Description: Removes unauthorized accounts from the local Administrators group on PAWs. Write-Host "--- Restricting Local Administrators Group on PAW ---" -ForegroundColor Cyan # Define the list of authorized members # Built-in Administrator and Tier 0 admin groups $AuthorizedMembers = @("Administrator", "Tier0-Admins") $LocalAdmins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue if ($LocalAdmins) { foreach ($Member in $LocalAdmins) { $Match = $false foreach ($Auth in $AuthorizedMembers) { if ($Member.Name -eq $Auth -or $Member.Name -like "*\$Auth" -or $Member.Name -eq "$env:COMPUTERNAME\$Auth") { $Match = $true break } } if (-not $Match) { Write-Host "[-] Removing unauthorized member from Administrators: $($Member.Name) (Source: $($Member.PrincipalSource))" -ForegroundColor Yellow try { Remove-LocalGroupMember -Group "Administrators" -Member $Member.Name -ErrorAction Stop Write-Host " Successfully removed: $($Member.Name)" -ForegroundColor Green } catch { Write-Error " Failed to remove: $($Member.Name). Error: $($_.Exception.Message)" } } else { Write-Host "[+] Member authorized: $($Member.Name)" -ForegroundColor Green } } } else { Write-Error "Could not retrieve members of local Administrators group." } Target Scope: Applicable Systems: Tier 0 Privileged Access Workstations (PAWs). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/enable-bitlocker.md Privileged Access Workstations (PAWs) serve as the secure root of trust for administering Tier 0 Active Directory resources. Because these devices are physical endpoints, they are susceptible to theft, loss, and unauthorized physical access. To achieve maximum protection, the PAW BitLocker configuration enforces a significantly more stringent baseline than standard client endpoints: 1. TPM and Startup PIN: Enforcing a pre-boot Startup PIN combined with TPM validation ensures that the drive cannot be unlocked or booted without explicit administrator presence. Network Unlock is prohibited on PAWs to prevent automatic decryption when connected to a local switch, ensuring physical presence verification is mandatory for every boot. 2. Disabling Sleep/Standby States (S1-S3): When a system enters a standby/sleep state, the BitLocker volume decryption keys remain stored in the volatile memory (RAM). An attacker with brief physical access to a sleeping PAW can exploit Direct Memory Access (DMA) interfaces (such as Thunderbolt, FireWire, or PCIe slots) or perform a cold-boot attack to extract the decryption keys directly from the RAM. Disabling S1-S3 standby states forces the system to either shut down (S5) or hibernate (S4), writing the RAM contents back to the encrypted disk and purging the keys from volatile memory. 3. Kernel DMA Protection: This blocks peripheral devices (Thunderbolt, PCIe) from initiating DMA requests unless the OS is fully booted, authorized, and running driver-level Input-Output Memory Management Unit (IOMMU) protection, preventing DMA memory extraction during the pre-boot and OS load phases. 4. Enhanced Startup PINs: This allows administrators to use alphanumeric characters, symbols, uppercase and lowercase letters, and spaces in their pre-boot Startup PIN rather than just numbers, increasing entropy and resistance to PIN-guessing attacks. 5. Active Directory Backup & Recovery Password Rotation: Ensures all BitLocker recovery keys are automatically backed up to Active Directory before encryption begins. In addition, when a recovery key is used to unlock a PAW, it must be automatically rotated and updated in Active Directory to prevent the reuse of compromised recovery keys. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Enforce BitLocker Encryption Strength Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption Configure the following setting: Policy*: Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later) Setting*: Enabled Select the encryption method*: XTS-AES 256-bit (for Operating System drives) Step 2: Enforce TPM + Startup PIN and Enhanced PIN Policies In the same GPO, navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives Configure the following settings: Policy*: Require additional authentication at startup Setting*: Enabled Configure Options*: * Set Configure TPM startup: Require TPM * Set Configure TPM startup PIN: Require startup PIN with TPM * Set Configure TPM startup key: Do not allow startup key with TPM * Set Configure TPM startup key and PIN: Do not allow startup key and PIN with TPM * Check Allow BitLocker without a compatible TPM: Disabled Policy*: Configure use of enhanced PINs for startup Setting*: Enabled Policy*: Minimum PIN length for startup Setting*: Enabled Minimum characters*: 8 (or higher depending on local organizational policy) Step 3: Configure Active Directory Backup and Key Rotation In the same OS Drives folder, configure the following settings: Policy*: Choose how BitLocker-protected operating system drives can be recovered Setting*: Enabled Configure Options*: * Check Allow data recovery agent * Check Save BitLocker recovery information to Active Directory Domain Services * Set Configure user storage of BitLocker recovery information: Store recovery passwords and key packages * Check Do not enable BitLocker until recovery information is stored in AD DS for operating system drives Policy*: Configure recovery password rotation for AD DS-joined computers Setting*: Enabled Rotation options*: Must rotate the recovery password for OS drives and fixed data drives Step 4: Disable Sleep/Standby States (S1-S3) In the GPO, navigate to: Computer Configuration\Administrative Templates\System\Power Management\Sleep Settings Configure the following settings: Policy*: Allow standby states (S1-S3) when sleeping (plugged in) Setting*: Disabled Policy*: Allow standby states (S1-S3) when sleeping (on battery) Setting*: Disabled Step 5: Enable Kernel DMA Protection In the GPO, navigate to: Computer Configuration\Administrative Templates\System\Kernel DMA Protection Configure the following setting: Policy*: Enable Kernel DMA Protection Setting*: Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally on the PAW to apply registry configuration baselines and enable BitLocker. Download Script: Set-PAWBitLockerEncryption.ps1 # Set-PAWBitLockerEncryption.ps1 # Configures registry settings for PAW BitLocker, disables sleep states, and enables encryption. Write-Host "--- Enforcing Stringent PAW BitLocker Baseline ---" -ForegroundColor Cyan # 1. Enforce encryption strength (XTS-AES 256 = 7) $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FvePath)) { New-Item -Path $FvePath -Force | Out-Null } Set-ItemProperty -Path $FvePath -Name "EncryptionMethodWithXtsOs" -Value 7 -Type DWord # 2. Configure TPM + Startup PIN, AD Backup, and Enhanced PINs in registry Set-ItemProperty -Path $FvePath -Name "UseAdvancedStartup" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "EnableNonTpm" -Value 0 -Type DWord Set-ItemProperty -Path $FvePath -Name "UseTPM" -Value 2 -Type DWord # 2 = Require Set-ItemProperty -Path $FvePath -Name "UseTPMPIN" -Value 2 -Type DWord # 2 = Require Set-ItemProperty -Path $FvePath -Name "UseEnhancedPINs" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "MinPINLength" -Value 8 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSRecovery" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSRecoveryPassword" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSBackupSaveSource" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSActiveDirectoryBackup" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSRequireActiveDirectoryBackup" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSRecoveryPasswordRotation" -Value 1 -Type DWord # 1 = Enforce rotation # 3. Disable Sleep States S1-S3 via GPO Registry override $PowerSleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc251b-215d-4f10-ae40-e226dbe3c6a3" if (-not (Test-Path $PowerSleepPath)) { New-Item -Path $PowerSleepPath -Force | Out-Null } Set-ItemProperty -Path $PowerSleepPath -Name "ACSettingIndex" -Value 0 -Type DWord Set-ItemProperty -Path $PowerSleepPath -Name "DCSettingIndex" -Value 0 -Type DWord # Enforce hibernate locally using powercfg powercfg /hibernate on Write-Host "[+] Sleep states S1-S3 disabled, and Hibernation enabled." -ForegroundColor Green # 4. Enable Kernel DMA Protection in registry $DmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $DmaPath)) { New-Item -Path $DmaPath -Force | Out-Null } Set-ItemProperty -Path $DmaPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "[+] Kernel DMA Protection registry configuration applied." -ForegroundColor Green # 5. Enable BitLocker on C: drive using TPM and Startup PIN $Volume = Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue if ($Volume.ProtectionStatus -eq "Off") { Write-Host "[+] Activating BitLocker on C: volume..." -ForegroundColor Gray # We must first define a temporary PIN to enable startup PIN protection programmatically # The administrator must change this PIN immediately on next reboot $TempPin = "P@ssw0rdPIN1" $SecurePin = New-Object System.Security.SecureString foreach ($Char in $TempPin.ToCharArray()) { $SecurePin.AppendChar($Char) } Enable-BitLocker -MountPoint "C:" ` -EncryptionMethod XtsAes256 ` -UsedSpaceOnly ` -Pin $SecurePin ` -TpmAndPinProtector ` -AdBackupRequired Write-Host "[+] BitLocker initiated with TPM and Startup PIN. Recovery keys sent to AD." -ForegroundColor Green } else { Write-Host "[+] BitLocker is already enabled on C: (Protection Status: $($Volume.ProtectionStatus))." -ForegroundColor Green } To audit the PAW BitLocker status and security parameters: Download Script: Test-PAWBitLockerStatus.ps1 # Test-PAWBitLockerStatus.ps1 # Audits current BitLocker configuration, active protectors, sleep state, and DMA protection. Write-Host "--- Auditing PAW BitLocker Security Parameters ---" -ForegroundColor Cyan # 1. Query BitLocker protection and key protector types $Volume = Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue if ($Volume) { $StatusColor = if ($Volume.ProtectionStatus -eq "On") { "Green" } else { "Red" } Write-Host " - Protection Status: $($Volume.ProtectionStatus)" -ForegroundColor $StatusColor Write-Host " - Encryption Method: $($Volume.EncryptionMethod)" -ForegroundColor White $HasTpmPin = $false foreach ($Protector in $Volume.KeyProtector) { if ($Protector.KeyProtectorType -eq "TpmAndPin") { $HasTpmPin = $true } Write-Host " - Active Protector: $($Protector.KeyProtectorType)" -ForegroundColor White } if ($HasTpmPin) { Write-Host " [+] TPM and Startup PIN is ACTIVE." -ForegroundColor Green } else { Write-Host " [-] TPM and Startup PIN is MISSING." -ForegroundColor Red } } else { Write-Error "BitLocker volume information could not be retrieved." } # 2. Check Sleep State S1-S3 status $SleepVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc251b-215d-4f10-ae40-e226dbe3c6a3" -Name "ACSettingIndex" -ErrorAction SilentlyContinue if ($SleepVal -and $SleepVal.ACSettingIndex -eq 0) { Write-Host " [+] Standby Sleep States (S1-S3) are disabled." -ForegroundColor Green } else { Write-Host " [-] Standby Sleep States (S1-S3) are enabled (Risk of DMA attack)." -ForegroundColor Red } # 3. Check Kernel DMA Protection $DmaVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" -Name "DeviceEnumerationPolicy" -ErrorAction SilentlyContinue if ($DmaVal -and $DmaVal.DeviceEnumerationPolicy -eq 0) { Write-Host " [+] Kernel DMA Protection is enabled." -ForegroundColor Green } else { Write-Host " [-] Kernel DMA Protection is disabled." -ForegroundColor Red } # Set-PAWBitLockerEncryption.ps1 # Configures registry settings for PAW BitLocker, disables sleep states, and enables encryption. Write-Host "--- Enforcing Stringent PAW BitLocker Baseline ---" -ForegroundColor Cyan # 1. Enforce encryption strength (XTS-AES 256 = 7) $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FvePath)) { New-Item -Path $FvePath -Force | Out-Null } Set-ItemProperty -Path $FvePath -Name "EncryptionMethodWithXtsOs" -Value 7 -Type DWord # 2. Configure TPM + Startup PIN, AD Backup, and Enhanced PINs in registry Set-ItemProperty -Path $FvePath -Name "UseAdvancedStartup" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "EnableNonTpm" -Value 0 -Type DWord Set-ItemProperty -Path $FvePath -Name "UseTPM" -Value 2 -Type DWord # 2 = Require Set-ItemProperty -Path $FvePath -Name "UseTPMPIN" -Value 2 -Type DWord # 2 = Require Set-ItemProperty -Path $FvePath -Name "UseEnhancedPINs" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "MinPINLength" -Value 8 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSRecovery" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSRecoveryPassword" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSBackupSaveSource" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSActiveDirectoryBackup" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSRequireActiveDirectoryBackup" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "OSRecoveryPasswordRotation" -Value 1 -Type DWord # 1 = Enforce rotation # 3. Disable Sleep States S1-S3 via GPO Registry override $PowerSleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc251b-215d-4f10-ae40-e226dbe3c6a3" if (-not (Test-Path $PowerSleepPath)) { New-Item -Path $PowerSleepPath -Force | Out-Null } Set-ItemProperty -Path $PowerSleepPath -Name "ACSettingIndex" -Value 0 -Type DWord Set-ItemProperty -Path $PowerSleepPath -Name "DCSettingIndex" -Value 0 -Type DWord # Enforce hibernate locally using powercfg powercfg /hibernate on Write-Host "[+] Sleep states S1-S3 disabled, and Hibernation enabled." -ForegroundColor Green # 4. Enable Kernel DMA Protection in registry $DmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $DmaPath)) { New-Item -Path $DmaPath -Force | Out-Null } Set-ItemProperty -Path $DmaPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "[+] Kernel DMA Protection registry configuration applied." -ForegroundColor Green # 5. Enable BitLocker on C: drive using TPM and Startup PIN $Volume = Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue if ($Volume.ProtectionStatus -eq "Off") { Write-Host "[+] Activating BitLocker on C: volume..." -ForegroundColor Gray # We must first define a temporary PIN to enable startup PIN protection programmatically # The administrator must change this PIN immediately on next reboot $TempPin = "P@ssw0rdPIN1" $SecurePin = New-Object System.Security.SecureString foreach ($Char in $TempPin.ToCharArray()) { $SecurePin.AppendChar($Char) } Enable-BitLocker -MountPoint "C:" ` -EncryptionMethod XtsAes256 ` -UsedSpaceOnly ` -Pin $SecurePin ` -TpmAndPinProtector ` -AdBackupRequired Write-Host "[+] BitLocker initiated with TPM and Startup PIN. Recovery keys sent to AD." -ForegroundColor Green } else { Write-Host "[+] BitLocker is already enabled on C: (Protection Status: $($Volume.ProtectionStatus))." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Domain Controllers, refer to [REQ-DC-157](../02-domain-controllers/configure-uefi-security.md); for Tier 2 Client Workstations and Member Servers, refer to [REQ-END-013](../08-endpoints/configure-uefi-security.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/configure-uefi-security.md Privileged Access Workstations (PAWs) are dedicated administrative bastions that operate at the pinnacle of the enterprise security architecture (Tier 0). Compromise of a PAW grants adversaries the credentials necessary to commandeer identity infrastructure, cloud tenants, and enterprise directory data. If an attacker obtains physical access to a PAW, or if malicious code gains low-level administrative control, vulnerabilities in the boot chain or legacy firmware interfaces can be exploited to bypass operating system security boundaries, defeat BitLocker disk encryption, or implant persistent firmware bootkits before the Windows kernel loads. Option A: Manual UEFI Firmware Configuration (Preferred) UEFI settings must be configured directly within the hardware platform firmware interface during system startup. Turn on or restart the workstation and access the UEFI setup utility by pressing the vendor-specific key during POST (typically Delete, F2, F10, or F12). Navigate to the Security or Authentication section: Select the option to set the Administrator Password (also referred to as the Supervisor Password*). Do not configure a User Password, as that prompts for authentication on every boot rather than only when entering configuration settings. * Enter a strong, complex password. Record this password in the enterprise Tier 0 credential vault. Navigate to the Boot or System Configuration section: Locate the Boot Mode setting and set it to UEFI Only or Native UEFI*. Locate CSM (Compatibility Support Module) or Legacy Boot Support and set it to Disabled*. Locate Fast Boot or Quick Boot and set it to Disabled* (forcing complete POST diagnostics and full TPM initialization on every boot). Locate Boot Order (or Boot Priority*): * Set the primary boot option to the internal system storage drive (typically containing the Windows Boot Manager partition). * Disable all other boot options (such as USB, SD Card, Optical Drive, and Network PXE Boot) or set them to disabled in the boot menu. * Enable the option to prompt for the UEFI administrator password if a user attempts to access the boot override menu (typically F12 or F8). Navigate to the Advanced, CPU Configuration, or Security Chip section: Locate Intel Virtualization Technology (VT-x) or AMD-V and set it to Enabled*. Locate Intel VT for Directed I/O (VT-d) or AMD IOMMU and set it to Enabled* (required for IOMMU/Kernel DMA Protection). Locate TPM 2.0 Device (or Security Chip / Intel PTT / AMD fTPM ) and set it to Enabled or Active* (with SHA-256 PCR bank). Locate Memory Overwrite Request Control Lock (or MOR Lock ) and set it to Enabled*. Navigate to the Security or Secure Boot section: Ensure Secure Boot is Enabled and the Secure Boot Mode is set to Deployed or User Mode*. * Harden the certificates allowlist: Key Exchange Key (KEK)*: Must only contain "Microsoft Corporation KEK CA 2011" and "Microsoft Corporation KEK 2K CA 2023". Signature Database (db)*: Must only contain "Microsoft Windows Production PCA 2011" and "Windows UEFI CA 2023". Remove "Microsoft UEFI CA 2011" and "Microsoft Option ROM UEFI CA 2023" unless strictly required by specific physical PCIe expansion hardware. Navigate to the Advanced or Firmware Update section: Locate the option for BIOS Flash Protection or Firmware Rollback Protection and set it to Enabled or Block Downgrades*. Save the configuration and restart the workstation. Option B: PowerShell Remediation & OS Boot Hardening Run the following script to configure OS-level boot parameters (disabling Windows Fast Startup, ensuring memory protections), audit OEM firmware capabilities, and guide hardware-level configuration. Download Script: Set-PawUEFISecurity.ps1 # Set-PawUEFISecurity.ps1 # Description: Configures OS-level boot parameters and audits OEM firmware configuration for PAWs. Write-Host "--- Configuring PAW UEFI & Boot Security Baseline ---" -ForegroundColor Cyan # 1. Disable Windows Fast Startup (forces full cold boot and fresh TPM PCR measurements) $PowerPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" if (-not (Test-Path $PowerPath)) { New-Item -Path $PowerPath -Force | Out-Null } try { Set-ItemProperty -Path $PowerPath -Name "HiberbootEnabled" -Value 0 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Windows Fast Startup disabled (HiberbootEnabled = 0)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure HiberbootEnabled: $($_.Exception.Message)" -ForegroundColor Red } # 2. Configure Device Guard Platform Security Flags (Requires UEFI and Secure Boot) $DeviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } try { # 1 = Secure Boot, 2 = DMA Protection, 3 = Secure Boot and DMA Protection Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 3 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Device Guard required platform security features set to Secure Boot and DMA Protection (Value = 3)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure RequirePlatformSecurityFeatures: $($_.Exception.Message)" -ForegroundColor Red } # 3. Detect Hardware OEM and report vendor tooling commands $Bios = Get-CimInstance -ClassName Win32_Bios -ErrorAction SilentlyContinue Write-Host "`nOEM Firmware Detection:" -ForegroundColor Cyan Write-Host " Manufacturer: $($Bios.Manufacturer)" -ForegroundColor White Write-Host " BIOS Version: $($Bios.SMBIOSBIOSVersion)" -ForegroundColor White if ($Bios.Manufacturer -match "Dell") { Write-Host " [i] Dell Platform detected. To enforce UEFI settings via Dell Command | PowerShell Provider:" -ForegroundColor Yellow Write-Host " Import-Module DellBIOSProvider" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\Security\AdminPassword 'YourStrongPassword'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\Boot\BootMode 'UEFI'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\SecureBoot\SecureBoot 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\VirtualizationSupport\Virtualization 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\VirtualizationSupport\VtForDirectIO 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\PostBehavior\Fastboot 'Thorough'" -ForegroundColor Gray } elseif ($Bios.Manufacturer -match "HP") { Write-Host " [i] HP Platform detected. To enforce UEFI settings via HP Client Management Script Library (HPCMSL):" -ForegroundColor Yellow Write-Host " Import-Module HPCMSL" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Boot Mode' -Value 'UEFI Native (without CSM)'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Secure Boot' -Value 'Enable'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Fast Boot' -Value 'Disable'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Virtualization Technology' -Value 'Enable'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Virtualization Technology for Directed I/O' -Value 'Enable'" -ForegroundColor Gray } elseif ($Bios.Manufacturer -match "Lenovo") { Write-Host " [i] Lenovo Platform detected. To enforce UEFI settings via Lenovo BIOS WMI interface:" -ForegroundColor Yellow Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('BootMode,UEFI')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('SecureBoot,Enable')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('IntelVirtualizationTechnology,Enable')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('VTd,Enable')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SaveBiosSettings -namespace root\wmi).SaveBiosSettings()" -ForegroundColor Gray } Write-Host "`n[+] Remediation script completed." -ForegroundColor Green # Set-PawUEFISecurity.ps1 # Description: Configures OS-level boot parameters and audits OEM firmware configuration for PAWs. Write-Host "--- Configuring PAW UEFI & Boot Security Baseline ---" -ForegroundColor Cyan # 1. Disable Windows Fast Startup (forces full cold boot and fresh TPM PCR measurements) $PowerPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" if (-not (Test-Path $PowerPath)) { New-Item -Path $PowerPath -Force | Out-Null } try { Set-ItemProperty -Path $PowerPath -Name "HiberbootEnabled" -Value 0 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Windows Fast Startup disabled (HiberbootEnabled = 0)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure HiberbootEnabled: $($_.Exception.Message)" -ForegroundColor Red } # 2. Configure Device Guard Platform Security Flags (Requires UEFI and Secure Boot) $DeviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } try { # 1 = Secure Boot, 2 = DMA Protection, 3 = Secure Boot and DMA Protection Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 3 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Device Guard required platform security features set to Secure Boot and DMA Protection (Value = 3)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure RequirePlatformSecurityFeatures: $($_.Exception.Message)" -ForegroundColor Red } # 3. Detect Hardware OEM and report vendor tooling commands $Bios = Get-CimInstance -ClassName Win32_Bios -ErrorAction SilentlyContinue Write-Host "`nOEM Firmware Detection:" -ForegroundColor Cyan Write-Host " Manufacturer: $($Bios.Manufacturer)" -ForegroundColor White Write-Host " BIOS Version: $($Bios.SMBIOSBIOSVersion)" -ForegroundColor White if ($Bios.Manufacturer -match "Dell") { Write-Host " [i] Dell Platform detected. To enforce UEFI settings via Dell Command | PowerShell Provider:" -ForegroundColor Yellow Write-Host " Import-Module DellBIOSProvider" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\Security\AdminPassword 'YourStrongPassword'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\Boot\BootMode 'UEFI'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\SecureBoot\SecureBoot 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\VirtualizationSupport\Virtualization 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\VirtualizationSupport\VtForDirectIO 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\PostBehavior\Fastboot 'Thorough'" -ForegroundColor Gray } elseif ($Bios.Manufacturer -match "HP") { Write-Host " [i] HP Platform detected. To enforce UEFI settings via HP Client Management Script Library (HPCMSL):" -ForegroundColor Yellow Write-Host " Import-Module HPCMSL" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Boot Mode' -Value 'UEFI Native (without CSM)'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Secure Boot' -Value 'Enable'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Fast Boot' -Value 'Disable'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Virtualization Technology' -Value 'Enable'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Virtualization Technology for Directed I/O' -Value 'Enable'" -ForegroundColor Gray } elseif ($Bios.Manufacturer -match "Lenovo") { Write-Host " [i] Lenovo Platform detected. To enforce UEFI settings via Lenovo BIOS WMI interface:" -ForegroundColor Yellow Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('BootMode,UEFI')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('SecureBoot,Enable')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('IntelVirtualizationTechnology,Enable')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('VTd,Enable')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SaveBiosSettings -namespace root\wmi).SaveBiosSettings()" -ForegroundColor Gray } Write-Host "`n[+] Remediation script completed." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/enable-hardware-virtualization-and-dma-protection.md Virtualization-Based Security (VBS) and Windows Defender Credential Guard isolate sensitive security processes (like LSA) inside a hardware-virtualized container to prevent memory dumping and credential harvesting. However, these OS-level security boundaries are entirely reliant on hardware-level protections. Enabling hardware virtualization and DMA protection guarantees: 1. Isolated Execution Environment: Enforcing CPU Virtualization Extensions (Intel VT-x or AMD-V) in the UEFI allows the hypervisor to isolate the VBS secure kernel from the host Windows operating system. 2. Physical DMA Protection: Enforcing IOMMU (Intel VT-d or AMD-Vi) at the firmware level enables Kernel DMA Protection. This blocks malicious peripherals (e.g., PCIe cards or Thunderbolt devices) from executing unauthorized Direct Memory Access (DMA) attacks to read or write to host system memory, preventing attackers from extracting BitLocker keys or credential secrets directly from RAM. 3. Hardware Root of Trust: Activating the Trusted Platform Module (TPM) 2.0 enables cryptographic boot measurement logging (PCR banks). TPM 2.0 ensures that the system boot configuration has not been modified prior to unsealing the BitLocker volume decryption keys. Option A: Group Policy Object (GPO) Configuration (Preferred) To enforce Kernel DMA Protection across the PAW infrastructure, implement the following GPO settings: Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Administrative Templates\System\Kernel DMA Protection Configure the following setting: Policy*: Enable Kernel DMA Protection Setting*: Enabled Link the GPO to the appropriate OU containing target PAWs. Note: Enforce hardware-level CPU Virtualization (VT-x/AMD-V), IOMMU (VT-d/AMD-Vi), and TPM 2.0 manually in the UEFI menu of each device. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure local registry keys to enforce Kernel DMA Protection and programmatically audit the hardware security baseline. 1. Local Remediation (Enforce Kernel DMA Protection) Run the following script to enforce the DMA Protection policy locally: Download Script: Configure-KernelDMAProtection.ps1 # Configure-KernelDMAProtection.ps1 # Description: Configures registry keys to enable Kernel DMA Protection. Write-Host "--- Enforcing Kernel DMA Protection ---" -ForegroundColor Cyan $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } # DeviceEnumerationPolicy = 0 (Block all DMA until user logs on) Set-ItemProperty -Path $RegPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "Status: Kernel DMA Protection registry configuration applied." -ForegroundColor Green 2. Local Audit (TPM, Virtualization, and DMA Support) Run the following script to audit the status of the required hardware security components: Download Script: Audit-HardwareSecurityFeatures.ps1 # Audit-HardwareSecurityFeatures.ps1 # Description: Audits TPM 2.0, CPU Virtualization, and IOMMU/DMA status. Write-Host "--- Auditing Hardware Security Features ---" -ForegroundColor Cyan # 1. Audit TPM 2.0 Status $Tpm = Get-Tpm -ErrorAction SilentlyContinue if ($Tpm) { if ($Tpm.TpmPresent -eq $true) { $TpmColor = "Red" if ($Tpm.TpmReady -eq $true) { $TpmColor = "Green" } Write-Host "Status: TPM Present: $($Tpm.TpmPresent) | Ready: $($Tpm.TpmReady)" -ForegroundColor $TpmColor } else { Write-Host "VULNERABLE: TPM 2.0 is not detected on this system." -ForegroundColor Red } } else { Write-Host "VULNERABLE: TPM verification cmdlet failed." -ForegroundColor Red } # 2. Audit VBS and DMA Status via Win32_DeviceGuard try { $DG = Get-CimInstance -Namespace "Root\Microsoft\Windows\DeviceGuard" -ClassName "Win32_DeviceGuard" -ErrorAction Stop # VirtualizationBasedSecurityStatus: 2 = Running $VbsStatus = $DG.VirtualizationBasedSecurityStatus $VbsColor = "Red" if ($VbsStatus -eq 2) { $VbsColor = "Green" } Write-Host "Status: Virtualization-Based Security Status: $($VbsStatus) (Required = 2 [Running])" -ForegroundColor $VbsColor # AvailableSecurityProperties: 3 = DMA Protection (IOMMU) $DmaSupported = $DG.AvailableSecurityProperties -contains 3 $DmaColor = "Red" if ($DmaSupported -eq $true) { $DmaColor = "Green" } Write-Host "Status: Hardware IOMMU/DMA Protection: $($DmaSupported)" -ForegroundColor $DmaColor # RequiredSecurityProperties: 3 = DMA Protection enforced $DmaEnforced = $DG.RequiredSecurityProperties -contains 3 $EnforcedColor = "Red" if ($DmaEnforced -eq $true) { $EnforcedColor = "Green" } Write-Host "Status: DMA Protection Policy Enforced: $($DmaEnforced)" -ForegroundColor $EnforcedColor } catch { Write-Host "VULNERABLE: Win32_DeviceGuard WMI class could not be queried. VBS is likely inactive." -ForegroundColor Red } # Configure-KernelDMAProtection.ps1 # Description: Configures registry keys to enable Kernel DMA Protection. Write-Host "--- Enforcing Kernel DMA Protection ---" -ForegroundColor Cyan $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } # DeviceEnumerationPolicy = 0 (Block all DMA until user logs on) Set-ItemProperty -Path $RegPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "Status: Kernel DMA Protection registry configuration applied." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/disable-wpbt.md The Windows Platform Binary Table (WPBT) is an ACPI firmware table that allows hardware manufacturers (OEMs) to execute proprietary binaries in kernel space during the Windows boot phase. Windows automatically extracts the binary from the table and runs it with system privileges before security software, third-party agents, or standard driver verifications are fully initialized. While designed to facilitate automated driver provisioning and anti-theft services, this mechanism represents a significant security risk: 1. Firmware-to-OS Attack Vector: Malicious actors utilizing UEFI rootkits, physical firmware flashing tools, or supply-chain firmware implants can compromise the WPBT table to execute arbitrary code at boot, bypassing Secure Boot and operating system-level integrity checks. 2. Privilege Escalation Risks: Historically, OEM software delivered via the WPBT has introduced high-severity local privilege escalation and remote code execution vulnerabilities due to inadequate code review or poor permission management. 3. Control and Transparency: Executing firmware-rooted binaries without administrative visibility or operating system validation bypasses normal software lifecycle and endpoint protection policies. Disabling WPBT execution prevents Windows from parsing the ACPI table and running the embedded software, mitigating boot-level integrity bypasses. Option A: Group Policy Object (GPO) Configuration (Preferred) Because there is no default ADMX administrative template to manage WPBT execution, the setting must be configured as a Registry Preference under the PAW policy: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click Registry, select New -> Registry Item. Configure the following properties: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager Value name*: DisableWpbtExecution Value type*: REG_DWORD Value data*: 1 Click OK to save the preference. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script to configure the registry setting locally on the system: Download Script: Configure-DisableWpbt.ps1 # Configure-DisableWpbt.ps1 # Description: Disables Windows Platform Binary Table (WPBT) execution in the registry. Write-Host "Applying hardening requirement: Disable WPBT Execution..." -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" $ValueName = "DisableWpbtExecution" $ValueData = 1 if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord Write-Host "Registry setting DisableWpbtExecution configured to 1." -ForegroundColor Green To verify that the registry value is correctly enforced: Download Script: Get-WpbtStatus.ps1 # Get-WpbtStatus.ps1 # Description: Audits the registry state for WPBT execution prevention. Write-Host "--- Auditing WPBT Security Posture ---" -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" $ValueName = "DisableWpbtExecution" $RegistryValue = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($RegistryValue) { $Setting = $RegistryValue.DisableWpbtExecution if ($Setting -eq 1) { Write-Host "Status: WPBT execution is disabled (DisableWpbtExecution = 1)." -ForegroundColor Green } else { Write-Host "VULNERABLE: WPBT execution is enabled. Value is $($Setting)." -ForegroundColor Red } } else { Write-Host "VULNERABLE: DisableWpbtExecution registry value is not configured (defaulting to execution enabled)." -ForegroundColor Red } # Configure-DisableWpbt.ps1 # Description: Disables Windows Platform Binary Table (WPBT) execution in the registry. Write-Host "Applying hardening requirement: Disable WPBT Execution..." -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" $ValueName = "DisableWpbtExecution" $ValueData = 1 if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord Write-Host "Registry setting DisableWpbtExecution configured to 1." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/enable-vbs-credential-guard.md Privileged Access Workstations (PAWs) contain Tier 0 administrative tokens. A compromise of a PAW leads to a direct compromise of the Active Directory database (NTDS.dit) and full domain domain control. Mitigating credential dumping is the single most critical security objective for a PAW. Virtualization-Based Security (VBS): VBS establishes an isolated, secure kernel space using hypervisor hardware virtualization. This secure kernel is separated from the host operating system, preventing root-level exploits from accessing virtualized memory blocks. Credential Guard: Running within the VBS secure kernel, Credential Guard stores credential secrets (NTLM hashes, Kerberos TGTs) inside an isolated memory container. By shifting these secrets outside the standard Local Security Authority (LSA) process memory space, it blocks credential-dumping utilities (like Mimikatz) from harvesting secrets from memory. Secure Launch: System Guard Secure Launch protects firmware boot integrity by using hardware-enforced boot measurements. It isolates the hypervisor startup from potential rootkits or boot-level malware. UEFI Memory Attributes Table (MAT): Enforcing UEFI MAT ensures that the bootloader validates page permissions in firmware, preventing buffer overflow or execution redirection vulnerabilities in pre-boot configurations. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the setting: Policy*: Turn On Virtualization Based Security Setting*: Enabled Select Platform Security Level*: Secure Boot Virtualization Based Protection of Code Integrity*: Enabled with UEFI lock Credential Guard Configuration*: Enabled with UEFI lock Secure Launch Configuration*: Enabled Require UEFI Memory Attributes Table*: Enabled Link the GPO to the PAWs Organizational Unit (OU). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the local registry parameters to activate VBS, Credential Guard, and Secure Launch. Download Script: Enable-PawVBSCredentialGuard.ps1 # Enable-PawVBSCredentialGuard.ps1 # Description: Configures local registry keys to activate VBS and Credential Guard on PAWs. Write-Host "--- Enforcing VBS & Credential Guard for PAWs ---" -ForegroundColor Cyan $DeviceGuardPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } # Enable Virtualization-Based Security (VBS) Set-ItemProperty -Path $DeviceGuardPath -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord # RequirePlatformSecurityFeatures = 1 (Secure Boot) Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord # HypervisorEnforcedCodeIntegrity = 1 (HVCI / Memory Integrity Enabled) Set-ItemProperty -Path $DeviceGuardPath -Name "HypervisorEnforcedCodeIntegrity" -Value 1 -Type DWord # LsaCfgFlags = 1 (Credential Guard Enabled with UEFI Lock) Set-ItemProperty -Path $DeviceGuardPath -Name "LsaCfgFlags" -Value 1 -Type DWord # ConfigureSystemGuardLaunch = 1 (Secure Launch Enabled) Set-ItemProperty -Path $DeviceGuardPath -Name "ConfigureSystemGuardLaunch" -Value 1 -Type DWord # HVCIMATRequired = 1 (Require UEFI Memory Attributes Table) Set-ItemProperty -Path $DeviceGuardPath -Name "HVCIMATRequired" -Value 1 -Type DWord Write-Host "[+] PAW VBS and Credential Guard registry settings applied. (Reboot required)." -ForegroundColor Green To audit VBS and Credential Guard status using WMI and Registry: Download Script: Test-PawVBSCredentialGuard.ps1 # Test-PawVBSCredentialGuard.ps1 # Description: Queries the local Win32_DeviceGuard class and registry settings to verify VBS protection states on PAWs. Write-Host "--- Auditing PAW Virtualization-Based Security Baseline ---" -ForegroundColor Cyan try { $DG = Get-CimInstance -Namespace "Root\Microsoft\Windows\DeviceGuard" -ClassName "Win32_DeviceGuard" -ErrorAction Stop # SecurityServicesRunning: 1 = Credential Guard, 2 = HVCI $CredGuardRunning = $DG.SecurityServicesRunning -contains 1 $HvciRunning = $DG.SecurityServicesRunning -contains 2 $VbsColor = if ($DG.VirtualizationBasedSecurityStatus -eq 2) { "Green" } else { "Red" } $CredColor = if ($CredGuardRunning) { "Green" } else { "Red" } $HvciColor = if ($HvciRunning) { "Green" } else { "Red" } Write-Host " - VBS Status: $($DG.VirtualizationBasedSecurityStatus) (Required = 2 [Running])" -ForegroundColor $VbsColor Write-Host " - Credential Guard Running: $CredGuardRunning (Required = True)" -ForegroundColor $CredColor Write-Host " - Hypervisor Code Integrity Running: $HvciRunning (Required = True)" -ForegroundColor $HvciColor # Query registry properties for System Guard and UEFI MAT $SystemGuard = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" -Name "ConfigureSystemGuardLaunch" -ErrorAction SilentlyContinue).ConfigureSystemGuardLaunch $MatRequired = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" -Name "HVCIMATRequired" -ErrorAction SilentlyContinue).HVCIMATRequired $SgColor = if ($SystemGuard -eq 1) { "Green" } else { "Red" } $MatColor = if ($MatRequired -eq 1) { "Green" } else { "Red" } Write-Host " - System Guard Secure Launch: $SystemGuard (Required = 1)" -ForegroundColor $SgColor Write-Host " - UEFI Memory Attributes Table Required: $MatRequired (Required = 1)" -ForegroundColor $MatColor } catch { Write-Host " - VULNERABLE: DeviceGuard WMI class could not be queried. VBS is likely disabled." -ForegroundColor Red } # Enable-PawVBSCredentialGuard.ps1 # Description: Configures local registry keys to activate VBS and Credential Guard on PAWs. Write-Host "--- Enforcing VBS & Credential Guard for PAWs ---" -ForegroundColor Cyan $DeviceGuardPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } # Enable Virtualization-Based Security (VBS) Set-ItemProperty -Path $DeviceGuardPath -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord # RequirePlatformSecurityFeatures = 1 (Secure Boot) Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord # HypervisorEnforcedCodeIntegrity = 1 (HVCI / Memory Integrity Enabled) Set-ItemProperty -Path $DeviceGuardPath -Name "HypervisorEnforcedCodeIntegrity" -Value 1 -Type DWord # LsaCfgFlags = 1 (Credential Guard Enabled with UEFI Lock) Set-ItemProperty -Path $DeviceGuardPath -Name "LsaCfgFlags" -Value 1 -Type DWord # ConfigureSystemGuardLaunch = 1 (Secure Launch Enabled) Set-ItemProperty -Path $DeviceGuardPath -Name "ConfigureSystemGuardLaunch" -Value 1 -Type DWord # HVCIMATRequired = 1 (Require UEFI Memory Attributes Table) Set-ItemProperty -Path $DeviceGuardPath -Name "HVCIMATRequired" -Value 1 -Type DWord Write-Host "[+] PAW VBS and Credential Guard registry settings applied. (Reboot required)." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Domain Controllers, refer to [REQ-DC-158](../02-domain-controllers/harden-dma-and-physical-security.md); for Tier 2 Client Workstations and Member Servers, refer to [REQ-END-017](../08-endpoints/harden-dma-and-physical-security.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/harden-dma-and-physical-security.md Privileged Access Workstations (PAWs) represent Tier 0 boundary systems. Because they handle the highest levels of domain authorization, physical threat vectors must be mitigated to the absolute maximum threshold: Direct Memory Access (DMA) Defenses: External interfaces (e.g., Thunderbolt, USB4, PCIe ExpressCard, FireWire) allow attached devices to bypass the OS kernel and read physical RAM contents directly via high-speed buses. Attackers use physical DMA exploitation devices (such as PCILeech) to dump memory-resident Kerberos TGT tickets, NTLM hashes, and LSA secrets: Device Setup Class Blocking*: Disabling the SBP-2 setup class ({d48179be-ec20-11d1-b6b8-00c04fa372a7}) and the IEEE 1394 host controller class ({6bdd1fc1-810f-11d0-bec7-08002be2092f}) prevents Windows from binding drivers to FireWire storage and controllers. Hardware ID Blocking*: Explicitly blocking hardware IDs PCI\CC_0C0A (Thunderbolt), PCI\CC_0C0010 (1394 OHCI FireWire), PCI\CC_0607 (CardBus), and PCI\CC_0605 (PCMCIA) halts driver installation for unauthorized high-speed expansion buses at the PCI enumeration layer. BitLocker DMA Under Lock*: Enforcing DisableExternalDMAUnderLock blocks DMA device operations whenever the PAW workstation is locked, closing the physical window for drive-by attacks on unattended stations. Tightened Enumeration Policy on PAWs : While standard enterprise endpoints might permit external DMA after user authentication, PAWs enforce a strict Block all* policy (DeviceEnumerationPolicy = 0). External peripherals whose drivers do not natively support DMA-remapping isolation are permanently prevented from accessing system memory. Cold Boot Exploits & RAM Decay: Dynamic RAM retains memory contents for seconds or minutes following power loss, especially when cooled with aerosol duster or liquid nitrogen. In standard standby states (S1-S3), the RAM chips remain continuously powered and active. If a PAW is stolen or accessed while in standby, BitLocker master keys and volatile credentials can be read directly from memory. Disabling standby states forces the system to either remain active or transition to Hibernation (S4)/Shutdown, where RAM contents are encrypted on the BitLocker volume and protected by the TPM 2.0 PCR baseline. Enforcing a password on resume guarantees re-authentication upon wake. USB Exfiltration Protection: Restricting write access on removable drives (RDVDenyWriteAccess) ensures administrative materials, directory backups, or sensitive credentials cannot be copied to unencrypted USB media. Setting RDVDenyCrossOrg = 0 prevents cross-organization removable storage exemptions. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Configure the following settings: 1. Power Management (Disable Standby & Require Wake Password) Navigate to: Computer Configuration\Administrative Templates\System\Power Management\Sleep Settings Policy : `Allow standby states (S1-S3) when sleeping (plugged in)` -> Disabled Policy: Allow standby states (S1-S3) when sleeping (on battery) -> Disabled Policy : `Require a password when a computer wakes (plugged in)` -> Enabled Policy: Require a password when a computer wakes (on battery) -> Enabled 2. BitLocker Removable Storage & DMA Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption Policy : `Disable new DMA devices when this computer is locked` -> Enabled Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives Policy : `Deny write access to removable drives not protected by BitLocker` -> Enabled Check Do not allow write access to devices configured in another organization -> Disabled (value 0 / False) 3. Device Installation Restrictions (Block SBP-2, 1394, Thunderbolt, and PCI Bridges) Navigate to: Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions Policy : `Prevent installation of devices using drivers that match these device setup classes` -> Enabled Click Show... and enter: `{d48179be-ec20-11d1-b6b8-00c04fa372a7}` {6bdd1fc1-810f-11d0-bec7-08002be2092f} Check Also apply to matching devices that are already installed -> Enabled (value 1 / True) Policy: Prevent installation of devices that match any of these device IDs -> Enabled Click Show... and enter: PCI\CC_0C0A `PCI\CC_0C0010` PCI\CC_0607 `PCI\CC_0605` Check Also apply to matching devices that are already installed -> Enabled (value 1 / True) 4. Kernel DMA Protection (Block All) Navigate to: Computer Configuration\Administrative Templates\System\Kernel DMA Protection Policy : `Enable Kernel DMA Protection` -> Enabled Enumeration policy: Set to Block all (value 0) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally on the PAW to apply DMA, Sleep, Device Restriction, and BitLocker USB registry parameters. Download Script: Set-PawDMAPhysicalSecurity.ps1 # Set-PawDMAPhysicalSecurity.ps1 # Description: Hardens local registry keys on PAWs to mitigate DMA attacks, disable standby sleep states, enforce wake password, restrict device classes/IDs, and block unencrypted USB writing. Write-Host "Applying PAW DMA and physical security hardening..." -ForegroundColor Cyan # 1. Disable Standby Sleep States (S1-S3) $SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" if (-not (Test-Path $SleepPath)) { New-Item -Path $SleepPath -Force | Out-Null } Set-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -Value 0 -Type DWord Set-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -Value 0 -Type DWord Write-Host "[+] Standby sleep states (S1-S3) disabled." -ForegroundColor Green # 2. Configure Wake Password Requirement $WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" if (-not (Test-Path $WakePath)) { New-Item -Path $WakePath -Force | Out-Null } Set-ItemProperty -Path $WakePath -Name "ACSettingIndex" -Value 1 -Type DWord Set-ItemProperty -Path $WakePath -Name "DCSettingIndex" -Value 1 -Type DWord Write-Host "[+] Wake password requirement enforced." -ForegroundColor Green # 3. BitLocker DMA and Removable Storage Settings $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FvePath)) { New-Item -Path $FvePath -Force | Out-Null } Set-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -Value 0 -Type DWord $FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" if (-not (Test-Path $FvePolicyPath)) { New-Item -Path $FvePolicyPath -Force | Out-Null } Set-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -Value 1 -Type DWord Write-Host "[+] BitLocker DMA under lock and unencrypted USB write blocks configured." -ForegroundColor Green # 4. Device Installation Restrictions (Classes and Hardware IDs) $RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" if (-not (Test-Path $RestrictPath)) { New-Item -Path $RestrictPath -Force | Out-Null } Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClassesRetroactive" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDsRetroactive" -Value 1 -Type DWord $DenyClassPath = Join-Path $RestrictPath "DenyDeviceClasses" if (-not (Test-Path $DenyClassPath)) { New-Item -Path $DenyClassPath -Force | Out-Null } Set-ItemProperty -Path $DenyClassPath -Name "1" -Value "{d48179be-ec20-11d1-b6b8-00c04fa372a7}" -Type String Set-ItemProperty -Path $DenyClassPath -Name "2" -Value "{6bdd1fc1-810f-11d0-bec7-08002be2092f}" -Type String $DenyIdPath = Join-Path $RestrictPath "DenyDeviceIDs" if (-not (Test-Path $DenyIdPath)) { New-Item -Path $DenyIdPath -Force | Out-Null } Set-ItemProperty -Path $DenyIdPath -Name "1" -Value "PCI\CC_0C0A" -Type String Set-ItemProperty -Path $DenyIdPath -Name "2" -Value "PCI\CC_0C0010" -Type String Set-ItemProperty -Path $DenyIdPath -Name "3" -Value "PCI\CC_0607" -Type String Set-ItemProperty -Path $DenyIdPath -Name "4" -Value "PCI\CC_0605" -Type String Write-Host "[+] Device installation blocks for SBP-2, 1394 host controllers, Thunderbolt, and PCI bridges enabled." -ForegroundColor Green # 5. Kernel DMA Protection (Block all external DMA permanently for PAWs) $KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $KDmaPath)) { New-Item -Path $KDmaPath -Force | Out-Null } Set-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "[+] Kernel DMA Protection DeviceEnumerationPolicy set to 0 (Block all)." -ForegroundColor Green Write-Host "PAW DMA and physical security settings applied successfully." -ForegroundColor Green To audit local PAW DMA and physical security configuration: Download Script: Test-PawDMAPhysicalSecurity.ps1 # Test-PawDMAPhysicalSecurity.ps1 # Description: Audits local registry configuration for standby settings, wake password, DMA protection under lock, USB restrictions, and blocked device classes/IDs on PAWs. Write-Host "--- Auditing PAW DMA and Physical Security ---" -ForegroundColor Cyan $isCompliant = $true # 1. Audit Standby Settings $SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" $AcSleep = Get-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -ErrorAction SilentlyContinue $DcSleep = Get-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -ErrorAction SilentlyContinue $AcSleepVal = if ($AcSleep) { $AcSleep.ACSettingIndex } else { 1 } $DcSleepVal = if ($DcSleep) { $DcSleep.DCSettingIndex } else { 1 } $AcSleepColor = if ($AcSleepVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } $DcSleepColor = if ($DcSleepVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Standby Sleep State (Plugged In) Setting: $($AcSleepVal) (Required = 0 [Disabled])" -ForegroundColor $AcSleepColor Write-Host " - Standby Sleep State (On Battery) Setting: $($DcSleepVal) (Required = 0 [Disabled])" -ForegroundColor $DcSleepColor # 2. Audit Wake Password Requirement $WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" $AcWake = Get-ItemProperty -Path $WakePath -Name "ACSettingIndex" -ErrorAction SilentlyContinue $DcWake = Get-ItemProperty -Path $WakePath -Name "DCSettingIndex" -ErrorAction SilentlyContinue $AcWakeVal = if ($AcWake) { $AcWake.ACSettingIndex } else { 0 } $DcWakeVal = if ($DcWake) { $DcWake.DCSettingIndex } else { 0 } $AcWakeColor = if ($AcWakeVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } $DcWakeColor = if ($DcWakeVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Wake Password Required (Plugged In): $($AcWakeVal) (Required = 1 [Enabled])" -ForegroundColor $AcWakeColor Write-Host " - Wake Password Required (On Battery): $($DcWakeVal) (Required = 1 [Enabled])" -ForegroundColor $DcWakeColor # 3. Audit BitLocker Settings $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" $DmaLock = Get-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -ErrorAction SilentlyContinue $DmaLockVal = if ($DmaLock) { $DmaLock.DisableExternalDMAUnderLock } else { 0 } $DmaLockColor = if ($DmaLockVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } $CrossOrg = Get-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -ErrorAction SilentlyContinue $CrossOrgVal = if ($CrossOrg) { $CrossOrg.RDVDenyCrossOrg } else { 1 } $CrossOrgColor = if ($CrossOrgVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } $FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" $UsbWrite = Get-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -ErrorAction SilentlyContinue $UsbWriteVal = if ($UsbWrite) { $UsbWrite.RDVDenyWriteAccess } else { 0 } $UsbWriteColor = if ($UsbWriteVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Disable DMA Under Lock: $($DmaLockVal) (Required = 1)" -ForegroundColor $DmaLockColor Write-Host " - USB Deny Cross Org Removable Drives: $($CrossOrgVal) (Required = 0)" -ForegroundColor $CrossOrgColor Write-Host " - USB Unencrypted Write Block: $($UsbWriteVal) (Required = 1)" -ForegroundColor $UsbWriteColor # 4. Audit Device Restriction Settings $RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" $DenyDev = Get-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -ErrorAction SilentlyContinue $DenyDevVal = if ($DenyDev) { $DenyDev.DenyDeviceClasses } else { 0 } $DenyDevColor = if ($DenyDevVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } $DenyId = Get-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -ErrorAction SilentlyContinue $DenyIdVal = if ($DenyId) { $DenyId.DenyDeviceIDs } else { 0 } $DenyIdColor = if ($DenyIdVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Prevent Device Setup Class Installation: $($DenyDevVal) (Required = 1)" -ForegroundColor $DenyDevColor Write-Host " - Prevent Device ID Installation: $($DenyIdVal) (Required = 1)" -ForegroundColor $DenyIdColor $DenyClassPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses" $Sbp2 = Get-ItemProperty -Path $DenyClassPath -Name "1" -ErrorAction SilentlyContinue $Sbp2Val = if ($Sbp2) { $Sbp2."1" } else { "" } $Sbp2Color = if ($Sbp2Val -eq "{d48179be-ec20-11d1-b6b8-00c04fa372a7}") { "Green" } else { $isCompliant = $false; "Red" } $Host1394 = Get-ItemProperty -Path $DenyClassPath -Name "2" -ErrorAction SilentlyContinue $Host1394Val = if ($Host1394) { $Host1394."2" } else { "" } $Host1394Color = if ($Host1394Val -eq "{6bdd1fc1-810f-11d0-bec7-08002be2092f}") { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Blocked SBP-2 Setup Class: '$($Sbp2Val)' (Required = '{d48179be-ec20-11d1-b6b8-00c04fa372a7}')" -ForegroundColor $Sbp2Color Write-Host " - Blocked 1394 Host Setup Class: '$($Host1394Val)' (Required = '{6bdd1fc1-810f-11d0-bec7-08002be2092f}')" -ForegroundColor $Host1394Color $DenyIdPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs" $DId1 = Get-ItemProperty -Path $DenyIdPath -Name "1" -ErrorAction SilentlyContinue $DId1Val = if ($DId1) { $DId1."1" } else { "" } $DId1Color = if ($DId1Val -eq "PCI\CC_0C0A") { "Green" } else { $isCompliant = $false; "Red" } $DId2 = Get-ItemProperty -Path $DenyIdPath -Name "2" -ErrorAction SilentlyContinue $DId2Val = if ($DId2) { $DId2."2" } else { "" } $DId2Color = if ($DId2Val -eq "PCI\CC_0C0010") { "Green" } else { $isCompliant = $false; "Red" } $DId3 = Get-ItemProperty -Path $DenyIdPath -Name "3" -ErrorAction SilentlyContinue $DId3Val = if ($DId3) { $DId3."3" } else { "" } $DId3Color = if ($DId3Val -eq "PCI\CC_0607") { "Green" } else { $isCompliant = $false; "Red" } $DId4 = Get-ItemProperty -Path $DenyIdPath -Name "4" -ErrorAction SilentlyContinue $DId4Val = if ($DId4) { $DId4."4" } else { "" } $DId4Color = if ($DId4Val -eq "PCI\CC_0605") { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Blocked Device ID PCI\CC_0C0A: '$($DId1Val)' (Required = 'PCI\CC_0C0A')" -ForegroundColor $DId1Color Write-Host " - Blocked Device ID PCI\CC_0C0010: '$($DId2Val)' (Required = 'PCI\CC_0C0010')" -ForegroundColor $DId2Color Write-Host " - Blocked Device ID PCI\CC_0607: '$($DId3Val)' (Required = 'PCI\CC_0607')" -ForegroundColor $DId3Color Write-Host " - Blocked Device ID PCI\CC_0605: '$($DId4Val)' (Required = 'PCI\CC_0605')" -ForegroundColor $DId4Color # 5. Audit Kernel DMA Protection Setting (Stricter for PAWs) $KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" $EnumPol = Get-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -ErrorAction SilentlyContinue $EnumPolVal = if ($EnumPol) { $EnumPol.DeviceEnumerationPolicy } else { 2 } $EnumPolColor = if ($EnumPolVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Kernel DMA Protection Policy: $($EnumPolVal) (Required = 0 [Block all])" -ForegroundColor $EnumPolColor # 6. Final Compliance Assessment if ($isCompliant) { Write-Host "[+] Audit Result: SECURE - PAW DMA and physical security controls are fully compliant." -ForegroundColor Green } else { Write-Host "[-] Audit Result: VULNERABLE - One or more PAW DMA or physical security settings do not meet baseline requirements." -ForegroundColor Red } # Set-PawDMAPhysicalSecurity.ps1 # Description: Hardens local registry keys on PAWs to mitigate DMA attacks, disable standby sleep states, enforce wake password, restrict device classes/IDs, and block unencrypted USB writing. Write-Host "Applying PAW DMA and physical security hardening..." -ForegroundColor Cyan # 1. Disable Standby Sleep States (S1-S3) $SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" if (-not (Test-Path $SleepPath)) { New-Item -Path $SleepPath -Force | Out-Null } Set-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -Value 0 -Type DWord Set-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -Value 0 -Type DWord Write-Host "[+] Standby sleep states (S1-S3) disabled." -ForegroundColor Green # 2. Configure Wake Password Requirement $WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" if (-not (Test-Path $WakePath)) { New-Item -Path $WakePath -Force | Out-Null } Set-ItemProperty -Path $WakePath -Name "ACSettingIndex" -Value 1 -Type DWord Set-ItemProperty -Path $WakePath -Name "DCSettingIndex" -Value 1 -Type DWord Write-Host "[+] Wake password requirement enforced." -ForegroundColor Green # 3. BitLocker DMA and Removable Storage Settings $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FvePath)) { New-Item -Path $FvePath -Force | Out-Null } Set-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -Value 0 -Type DWord $FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" if (-not (Test-Path $FvePolicyPath)) { New-Item -Path $FvePolicyPath -Force | Out-Null } Set-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -Value 1 -Type DWord Write-Host "[+] BitLocker DMA under lock and unencrypted USB write blocks configured." -ForegroundColor Green # 4. Device Installation Restrictions (Classes and Hardware IDs) $RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" if (-not (Test-Path $RestrictPath)) { New-Item -Path $RestrictPath -Force | Out-Null } Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClassesRetroactive" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDsRetroactive" -Value 1 -Type DWord $DenyClassPath = Join-Path $RestrictPath "DenyDeviceClasses" if (-not (Test-Path $DenyClassPath)) { New-Item -Path $DenyClassPath -Force | Out-Null } Set-ItemProperty -Path $DenyClassPath -Name "1" -Value "{d48179be-ec20-11d1-b6b8-00c04fa372a7}" -Type String Set-ItemProperty -Path $DenyClassPath -Name "2" -Value "{6bdd1fc1-810f-11d0-bec7-08002be2092f}" -Type String $DenyIdPath = Join-Path $RestrictPath "DenyDeviceIDs" if (-not (Test-Path $DenyIdPath)) { New-Item -Path $DenyIdPath -Force | Out-Null } Set-ItemProperty -Path $DenyIdPath -Name "1" -Value "PCI\CC_0C0A" -Type String Set-ItemProperty -Path $DenyIdPath -Name "2" -Value "PCI\CC_0C0010" -Type String Set-ItemProperty -Path $DenyIdPath -Name "3" -Value "PCI\CC_0607" -Type String Set-ItemProperty -Path $DenyIdPath -Name "4" -Value "PCI\CC_0605" -Type String Write-Host "[+] Device installation blocks for SBP-2, 1394 host controllers, Thunderbolt, and PCI bridges enabled." -ForegroundColor Green # 5. Kernel DMA Protection (Block all external DMA permanently for PAWs) $KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $KDmaPath)) { New-Item -Path $KDmaPath -Force | Out-Null } Set-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "[+] Kernel DMA Protection DeviceEnumerationPolicy set to 0 (Block all)." -ForegroundColor Green Write-Host "PAW DMA and physical security settings applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10, Windows 11 (Enterprise and Professional editions) File Path: 07-paws/enable-wdac-driver-blocklist.md Attackers frequently employ "Bring Your Own Vulnerable Driver" (BYOVD) attacks to bypass Windows kernel protections on high-value administrative assets like Privileged Access Workstations (PAWs). In a BYOVD attack, an adversary with administrative privileges installs a legitimate, cryptographically signed third-party driver that contains a known, exploitable vulnerability. The attacker then exploits this vulnerability to execute arbitrary code with kernel privileges, allowing them to disable security agents, dump LSASS memory, or tamper with system integrity. Enforcing the Microsoft Vulnerable Driver Blocklist via Windows Defender Application Control (WDAC) prevents known vulnerable or malicious drivers from loading in kernel space. By restricting the WDAC policy to Kernel Mode Code Integrity (KMCI) only (omitting user-mode enforcement), the control shields the system kernel from driver-based exploits on administrative hosts without introducing administrative overhead or blocking standard user-mode admin applications. Option A: Group Policy Object (GPO) Configuration (Preferred) To enforce the driver blocklist across all PAWs, you can deploy the Microsoft recommended block rules as a custom WDAC policy. Download the Microsoft recommended driver block rules XML from the official Microsoft documentation. Edit the XML to ensure it operates in Audit Mode first, then convert the XML configuration into a binary format: `powershell ConvertFrom-CIPolicy -XmlFilePath "C:\WDAC\DriverBlocklist.xml" -BinaryFilePath "C:\WDAC\SIPolicy.p7b" Copy the compiled SIPolicy.p7b file to a secure local path on all target PAWs (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b) or a share. Open the Group Policy Management Console (gpmc.msc) on a domain management host. Create or edit a GPO linked to the PAWs OU (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the following setting: Policy*: Deploy Windows Defender Application Control Setting*: Enabled Code Integrity Policy File Path*: Enter the local or network path to the policy file (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b). To ensure the built-in system driver blocklist is active on modern builds, configure the following registry setting via Group Policy Preferences: Path*: Computer Configuration\Preferences\Windows Settings\Registry Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\CI\Config Value Name*: VulnerableDriverBlocklistEnable Value Type*: REG_DWORD Value Data*: 1 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to enable the Vulnerable Driver Blocklist registry key and ensure proper configuration. Download Script: Configure-DriverBlocklist.ps1 # Configure-DriverBlocklist.ps1 # Description: Enables the Microsoft Vulnerable Driver Blocklist in the registry and validates VBS/HVCI settings. Write-Host "Applying hardening requirement: Enable WDAC Driver Blocklist..." -ForegroundColor Cyan # 1. Configure the registry settings to enable the blocklist $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" $ValueName = "VulnerableDriverBlocklistEnable" if (-not (Test-Path $RegPath)) { Write-Host "[+] Creating registry path: $RegPath" -ForegroundColor Gray New-Item -Path $RegPath -Force | Out-Null } Write-Host "[+] Setting registry value: $ValueName = 1" -ForegroundColor Gray Set-ItemProperty -Path $RegPath -Name $ValueName -Value 1 -Type DWord -ErrorAction Stop # 2. Validate VBS / HVCI Configuration $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Pre-requisite Check: Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] Warning: Memory Integrity (HVCI) is disabled. The blocklist requires HVCI for hypervisor enforcement." -ForegroundColor Yellow } } else { Write-Host "[!] Warning: Memory Integrity scenario configuration not found. Check VBS settings." -ForegroundColor Yellow } Write-Host "[+] Configuration applied successfully. A reboot is required to activate the blocklist." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-DriverBlocklistStatus.ps1 # Get-DriverBlocklistStatus.ps1 # Description: Audits the configuration of the Microsoft Vulnerable Driver Blocklist and HVCI state. Write-Host "--- Auditing Vulnerable Driver Blocklist ---" -ForegroundColor Cyan $Vulnerable = $false # 1. Check registry value $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" $ValueName = "VulnerableDriverBlocklistEnable" if (Test-Path $RegPath) { $RegValue = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $RegValue -and $RegValue.$ValueName -eq 1) { Write-Host "[+] Vulnerable Driver Blocklist is enabled in the registry." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Vulnerable Driver Blocklist is disabled or not set in the registry." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: Code Integrity Config registry key does not exist." -ForegroundColor Red $Vulnerable = $true } # 2. Check HVCI Status $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Memory Integrity (HVCI) is disabled in the registry." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: Memory Integrity scenario registry path does not exist." -ForegroundColor Red $Vulnerable = $true } # 3. Final Verdict if ($Vulnerable) { Write-Host "`n[!] Verification FAILED: The Vulnerable Driver Blocklist is not fully secured." -ForegroundColor Red } else { Write-Host "`n[+] Verification PASSED: The Vulnerable Driver Blocklist and HVCI are correctly configured." -ForegroundColor Green } # Configure-DriverBlocklist.ps1 # Description: Enables the Microsoft Vulnerable Driver Blocklist in the registry and validates VBS/HVCI settings. Write-Host "Applying hardening requirement: Enable WDAC Driver Blocklist..." -ForegroundColor Cyan # 1. Configure the registry settings to enable the blocklist $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" $ValueName = "VulnerableDriverBlocklistEnable" if (-not (Test-Path $RegPath)) { Write-Host "[+] Creating registry path: $RegPath" -ForegroundColor Gray New-Item -Path $RegPath -Force | Out-Null } Write-Host "[+] Setting registry value: $ValueName = 1" -ForegroundColor Gray Set-ItemProperty -Path $RegPath -Name $ValueName -Value 1 -Type DWord -ErrorAction Stop # 2. Validate VBS / HVCI Configuration $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Pre-requisite Check: Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] Warning: Memory Integrity (HVCI) is disabled. The blocklist requires HVCI for hypervisor enforcement." -ForegroundColor Yellow } } else { Write-Host "[!] Warning: Memory Integrity scenario configuration not found. Check VBS settings." -ForegroundColor Yellow } Write-Host "[+] Configuration applied successfully. A reboot is required to activate the blocklist." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs). (For Domain Controllers, refer to [REQ-DC-156](../02-domain-controllers/configure-elam.md); for Tier 2 Client Workstations and Member Servers, refer to [REQ-END-028](../08-endpoints/configure-elam.md)). Operating Systems: Windows 10 Enterprise, Windows 11 Enterprise. File Path: 07-paws/configure-elam.md Privileged Access Workstations (PAWs) are dedicated administrative bastions that operate at the pinnacle of the enterprise security architecture (Tier 0). Compromise of a PAW grants adversaries the credentials necessary to commandeer identity infrastructure, cloud tenants, and enterprise directory data. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the dedicated PAW hardening GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Early Launch Antimalware In the right pane, double-click Boot-Start Driver Initialization Policy. Select Enabled. In the Choose the boot-start drivers that can be initialized dropdown, select: Good and unknown Click Apply, then OK. Link the GPO to the dedicated PAW Organizational Unit (OU=PAWs,OU=Tier0,DC=domain,DC=com). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally on PAWs to configure the tightened ELAM policy. Download Script: Configure-ElamPolicy.ps1 # Configure-ElamPolicy.ps1 # Description: Configures the Early Launch Antimalware (ELAM) boot-start driver load policy on the local system. Write-Host "Applying ELAM Boot-Start driver initialization policy (Tightened for PAWs)..." -ForegroundColor Cyan $ElamPath = "HKLM:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch" if (-not (Test-Path $ElamPath)) { New-Item -Path $ElamPath -Force | Out-Null } Set-ItemProperty -Path $ElamPath -Name "DriverLoadPolicy" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] ELAM Boot-Start driver initialization policy set to 'Good and unknown' (Value = 1)." -ForegroundColor Green # Configure-ElamPolicy.ps1 # Description: Configures the Early Launch Antimalware (ELAM) boot-start driver load policy on the local system. Write-Host "Applying ELAM Boot-Start driver initialization policy (Tightened for PAWs)..." -ForegroundColor Cyan $ElamPath = "HKLM:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch" if (-not (Test-Path $ElamPath)) { New-Item -Path $ElamPath -Force | Out-Null } Set-ItemProperty -Path $ElamPath -Name "DriverLoadPolicy" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] ELAM Boot-Start driver initialization policy set to 'Good and unknown' (Value = 1)." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations. Operating Systems: Windows 10/11 Enterprise. File Path: 07-paws/configure-printing-and-spooler.md The Windows Print Spooler service (Spooler) has been a recurring source of critical privilege escalation and coercion exploits (e.g., the PrintNightmare family). To secure Privileged Access Workstations (PAWs), which host highly privileged Tier 0 credentials: 1. Disable the Print Spooler: PAWs should never act as print servers or need print capabilities. Disabling the Spooler service completely eliminates this massive attack surface. 2. Point and Print Restrictions: As a defense-in-depth fallback, restricting print driver installations and updates to Administrators ensures that even if the spooler service is temporarily enabled for maintenance, standard users cannot load arbitrary, untrusted drivers. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Disable the Print Spooler Service Open the Group Policy Management Console (gpmc.msc). Edit the GPO applied to your PAWs (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Double-click Print Spooler. Check Define this policy setting and select Disabled. Click OK. 2. Restrict Point and Print Driver Installations Navigate to: Computer Configuration\Policies\Administrative Templates\Printers Double-click Limits print driver installation to Administrators. Set it to Enabled and click OK. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to disable the Print Spooler service and enforce driver restrictions. Download Script: Configure-PrintingAndSpooler.ps1 # Configure-PrintingAndSpooler.ps1 # Description: Disables the Print Spooler service and configures Point and Print driver installation restrictions on the local PAW. Write-Host "Hardening Print Spooler and Printer configurations for PAWs..." -ForegroundColor Cyan # 1. Disable the Print Spooler Service if (Get-Service -Name "Spooler" -ErrorAction SilentlyContinue) { Set-Service -Name "Spooler" -StartupType Disabled -Confirm:$false Stop-Service -Name "Spooler" -Force -Confirm:$false Write-Host "[+] Print Spooler service has been stopped and disabled." -ForegroundColor Green } else { Write-Host "[+] Print Spooler service not found on local machine." -ForegroundColor Gray } # 2. Limit Print Driver Installation to Administrators (Defense-in-Depth) $PrinterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" if (-not (Test-Path $PrinterPath)) { New-Item -Path $PrinterPath -Force | Out-Null } Set-ItemProperty -Path $PrinterPath -Name "RestrictDriverInstallationToAdministrators" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] Print driver installation restricted to Administrators." -ForegroundColor Green To audit these printer security configurations on the PAW: Download Script: Get-PrintingAndSpoolerStatus.ps1 # Get-PrintingAndSpoolerStatus.ps1 # Description: Audits print spooler status and Point and Print configurations on the local PAW. Write-Host "--- Auditing PAW Secure Printing and Spooler Hardening ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit Spooler Service Startup Type $Service = Get-Service -Name "Spooler" -ErrorAction SilentlyContinue if ($null -ne $Service) { # Check StartupType $StartupType = (Get-CimInstance -ClassName Win32_Service -Filter "Name='Spooler'").StartMode # StartMode can be "Disabled", "Manual", "Auto" $Color = if ($StartupType -eq "Disabled") { "Green" } else { "Red" } Write-Host " [-] Print Spooler Service Startup: $StartupType (Expected: Disabled)" -ForegroundColor $Color if ($StartupType -ne "Disabled") { $script:Vulnerable = $true } } else { Write-Host " [+] Print Spooler Service is not present on this machine." -ForegroundColor Green } # 2. Audit Point and Print Registry Restriction $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" $Name = "RestrictDriverInstallationToAdministrators" $Expected = 1 if (Test-Path $Path) { $Reg = Get-ItemProperty -Path $Path -ErrorAction SilentlyContinue $Val = $Reg.$Name if ($Val -eq $Expected) { Write-Host " [+] Path $($Path) | $($Name): $Val (Expected: $Expected)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: Path $($Path) | $($Name): $Val (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] NOT FOUND: Path $($Path) (Expected: $Name = $Expected)" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-PrintingAndSpooler.ps1 # Description: Disables the Print Spooler service and configures Point and Print driver installation restrictions on the local PAW. Write-Host "Hardening Print Spooler and Printer configurations for PAWs..." -ForegroundColor Cyan # 1. Disable the Print Spooler Service if (Get-Service -Name "Spooler" -ErrorAction SilentlyContinue) { Set-Service -Name "Spooler" -StartupType Disabled -Confirm:$false Stop-Service -Name "Spooler" -Force -Confirm:$false Write-Host "[+] Print Spooler service has been stopped and disabled." -ForegroundColor Green } else { Write-Host "[+] Print Spooler service not found on local machine." -ForegroundColor Gray } # 2. Limit Print Driver Installation to Administrators (Defense-in-Depth) $PrinterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" if (-not (Test-Path $PrinterPath)) { New-Item -Path $PrinterPath -Force | Out-Null } Set-ItemProperty -Path $PrinterPath -Name "RestrictDriverInstallationToAdministrators" -Value 1 -Type DWord -ErrorAction Stop Write-Host "[+] Print driver installation restricted to Administrators." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs). Operating Systems: Windows 10/11 Enterprise. File Path: 07-paws/configure-untrusted-font-blocking.md Font files (TrueType, OpenType, and others) are highly complex formats that require advanced parsing logic. Historically, font parsing in Windows was performed by the Graphics Device Interface (GDI) within the operating system kernel. Vulnerabilities in the kernel-mode font parser (such as buffer overflows or remote code execution) have been frequently exploited by threat actors to execute arbitrary code with kernel-level privileges. Enabling Untrusted Font Blocking limits the attack surface of the graphics subsystem on Privileged Access Workstations (PAWs): 1. Kernel Attack Surface Reduction: Restricting the system to only load trusted fonts installed in the %windir%\Fonts system directory prevents the processing of malicious, web-delivered, or embedded font files. 2. Mitigation of Document-Based Exploits: Prevents malicious font files embedded in administrative documents, scripts, or web tools from triggering parsing vulnerabilities in the context of high-privileged administrative accounts. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a domain controller or management host. Create a new GPO or edit an existing one (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Mitigation Options Configure the following setting: Policy*: Untrusted Font Blocking Setting*: Enabled Mitigation Options*: Block untrusted fonts and log events Link the GPO to the PAW Organizational Unit (OU) containing the target workstations. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally on standalone systems or during reference image build phases. Download Script: Configure-UntrustedFontBlocking.ps1 # Configure-UntrustedFontBlocking.ps1 # Description: Configures Untrusted Font Blocking mitigation to block untrusted fonts and log events on PAWs. $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions" $ValueName = "MitigationOptions_FontBocking" $ValueData = "1000000000000" Write-Host "Applying hardening requirement: Configure Untrusted Font Blocking..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type String -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-UntrustedFontBlockingStatus.ps1 # Get-UntrustedFontBlockingStatus.ps1 # Description: Checks the current configuration state of Untrusted Font Blocking registry setting on PAWs. $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions" $ValueName = "MitigationOptions_FontBocking" $ExpectedValue = "1000000000000" Write-Host "Auditing hardening requirement: Configure Untrusted Font Blocking..." -ForegroundColor Cyan if (Test-Path $RegPath) { $value = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $value -and $value.$ValueName -eq $ExpectedValue) { Write-Host "Audit Result: Compliant. Untrusted fonts are blocked and logged ($($ValueName) = $($ExpectedValue))." -ForegroundColor Green exit 0 } } Write-Host "Audit Result: Non-Compliant. Untrusted fonts are not configured to block and log." -ForegroundColor Red exit 1 # Configure-UntrustedFontBlocking.ps1 # Description: Configures Untrusted Font Blocking mitigation to block untrusted fonts and log events on PAWs. $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions" $ValueName = "MitigationOptions_FontBocking" $ValueData = "1000000000000" Write-Host "Applying hardening requirement: Configure Untrusted Font Blocking..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type String -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs). (For Domain Controllers and Domain Member Servers, refer to [REQ-DC-029](../02-domain-controllers/configure-svchost-mitigation.md); for Tier 2 Client Workstations, refer to [REQ-END-030](../08-endpoints/configure-svchost-mitigation.md)). Operating Systems: Windows 10 (1903 and above), Windows 11 Enterprise. File Path: 07-paws/configure-svchost-mitigation.md Privileged Access Workstations (PAWs) host the most sensitive administrative credentials in an Active Directory environment, including Tier 0 Domain Admin Kerberos tickets, directory service RPC sessions, and PKI private key operations. Because PAWs are dedicated, single-purpose administrative endpoints, securing the Service Host (svchost.exe) process is critical to preventing kernel-level security evasion, process injection, and credential theft. Adversaries attempting to compromise administrative sessions frequently target svchost.exe: 1. Process Injection & Credential Harvesting: Infiltrating an administrative session by injecting into a high-privilege svchost.exe process (CreateRemoteThread, QueueUserAPC, SetThreadContext) allows attackers to execute shellcode within the NT AUTHORITY\SYSTEM security context, evading endpoint monitoring and attempting to access memory spaces holding privileged administrative tokens. 2. Reflective DLL Loading & Dynamic Code Execution: Advanced persistent threat (APT) frameworks execute memory-only payloads by allocating executable memory (VirtualAlloc with PAGE_EXECUTE_READWRITE) to bypass disk-based file scanners. 3. Ghost Service Implants (MITRE ATT&CK T1574.002): Dropping unsigned service DLLs and registering them under legitimate svchost.exe service groups to gain persistent administrative access. Enabling svchost.exe mitigation options on PAWs restricts the behavior of every svchost.exe process through kernel-level mitigation policies: Microsoft-Only Binary Enforcement (`PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON`) : Requires all binaries and dynamic-link libraries (DLLs) loaded into `svchost.exe` to be digitally signed by Microsoft. This prevents attackers from injecting custom, unsigned malicious DLLs into `svchost.exe` instances to tamper with administrative service processes. Any attempt to load non-Microsoft code is blocked with `STATUS_INVALID_IMAGE_HASH` (`0xC0000428`). Dynamic Code Execution Blocking (`PROCESS_CREATION_MITIGATION_POLICY_PROHIBIT_DYNAMIC_CODE_ALWAYS_ON`): Disallows the generation and execution of dynamic code within svchost.exe processes. This neutralizes in-memory shellcode execution, JIT compilation abuse, and typical process hollowing attack vectors. Service Host Isolation*: On modern Windows 10/11 Enterprise systems with more than 3.5 GB of RAM, services run in separate, dedicated svchost.exe processes, ensuring each administrative service host is strictly isolated and independently enforced. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a PAW or Domain Controller. Edit the dedicated PAW hardening GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Service Control Manager Settings\Security Settings Double-click Enable svchost.exe mitigation options. Select Enabled. Click Apply, then OK. Link the GPO to the dedicated PAW Organizational Unit (OU=PAW,OU=Tier0,DC=contoso,DC=com). Reboot the target PAW systems to ensure the mitigation policy is actively enforced across all system services. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally on standalone PAWs or during initial reference image provisioning. Download Script: Configure-SvchostMitigation.ps1 # Configure-SvchostMitigation.ps1 # Description: Configures svchost.exe mitigation options to enforce Microsoft-signed binaries and block dynamic code on PAWs. [CmdletBinding()] param() $ErrorActionPreference = "Stop" Write-Host "Applying hardening requirement: Configure svchost.exe mitigation options for PAWs..." -ForegroundColor Cyan # Verify minimum operating system build compatibility (Windows 10 1903 / Build 18362 or Windows 11) $osVersion = [System.Environment]::OSVersion.Version $osBuild = $osVersion.Build if ($osBuild -lt 18362) { Write-Warning "The operating system build ($($osBuild)) does not support EnableSvchostMitigationPolicy (requires Windows 10 1903+ or Windows 11)." exit 1 } $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig" $ValueName = "EnableSvchostMitigationPolicy" $ValueData = 1 try { if (-not (Test-Path -Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null Write-Host "Created registry key: $($RegPath)" -ForegroundColor Gray } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null # Validate written value $configuredValue = (Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction Stop).$ValueName if ($configuredValue -eq $ValueData) { Write-Host "Hardening applied successfully: $($ValueName) set to 1." -ForegroundColor Green Write-Host "Note: This policy applies to newly created svchost.exe instances. A full system restart is required to protect services initialized at system boot." -ForegroundColor Yellow exit 0 } else { throw "Failed to verify registry property value after write." } } catch { Write-Error "Error configuring svchost.exe mitigation options on PAW: $($_.Exception.Message)" exit 1 } To verify the setting has been applied: Download Script: Get-SvchostMitigationStatus.ps1 # Get-SvchostMitigationStatus.ps1 # Description: Audits the configuration state of svchost.exe mitigation options on PAWs. [CmdletBinding()] param() $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig" $ValueName = "EnableSvchostMitigationPolicy" $ExpectedValue = 1 Write-Host "Auditing hardening requirement: Configure svchost.exe mitigation options on PAW..." -ForegroundColor Cyan $osVersion = [System.Environment]::OSVersion.Version $osBuild = $osVersion.Build if ($osBuild -lt 18362) { Write-Warning "Audit Result: Non-Applicable / Unsupported. OS build $($osBuild) precedes the introduction of svchost mitigation policy (requires Windows 10 1903+ or Windows 11)." exit 1 } if (Test-Path -Path $RegPath) { $item = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $item -and $item.$ValueName -eq $ExpectedValue) { Write-Host "Audit Result: Compliant. svchost.exe mitigation policy is enabled in registry ($($RegPath)\$($ValueName) = 1)." -ForegroundColor Green # Optional check for running svchost processes $svchostProcesses = Get-Process -Name "svchost" -ErrorAction SilentlyContinue if ($svchostProcesses) { Write-Host "Found $($svchostProcesses.Count) running svchost.exe process instances. Process mitigation flags are enforced dynamically at process spawn by the Service Control Manager." -ForegroundColor Gray } exit 0 } } Write-Host "Audit Result: Non-Compliant. svchost.exe mitigation options are disabled or not configured ($($RegPath)\$($ValueName))." -ForegroundColor Red exit 1 # Configure-SvchostMitigation.ps1 # Description: Configures svchost.exe mitigation options to enforce Microsoft-signed binaries and block dynamic code on PAWs. [CmdletBinding()] param() $ErrorActionPreference = "Stop" Write-Host "Applying hardening requirement: Configure svchost.exe mitigation options for PAWs..." -ForegroundColor Cyan # Verify minimum operating system build compatibility (Windows 10 1903 / Build 18362 or Windows 11) $osVersion = [System.Environment]::OSVersion.Version $osBuild = $osVersion.Build if ($osBuild -lt 18362) { Write-Warning "The operating system build ($($osBuild)) does not support EnableSvchostMitigationPolicy (requires Windows 10 1903+ or Windows 11)." exit 1 } $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig" $ValueName = "EnableSvchostMitigationPolicy" $ValueData = 1 try { if (-not (Test-Path -Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null Write-Host "Created registry key: $($RegPath)" -ForegroundColor Gray } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null # Validate written value $configuredValue = (Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction Stop).$ValueName if ($configuredValue -eq $ValueData) { Write-Host "Hardening applied successfully: $($ValueName) set to 1." -ForegroundColor Green Write-Host "Note: This policy applies to newly created svchost.exe instances. A full system restart is required to protect services initialized at system boot." -ForegroundColor Yellow exit 0 } else { throw "Failed to verify registry property value after write." } } catch { Write-Error "Error configuring svchost.exe mitigation options on PAW: $($_.Exception.Message)" exit 1 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 11 (and above) Enterprise/Professional File Path: 07-paws/enable-kernel-shadow-stacks.md Kernel-mode Hardware-enforced Stack Protection uses CPU hardware features to protect the operating system kernel from memory corruption exploits, specifically Return-Oriented Programming (ROP) attacks. On highly critical endpoints such as Privileged Access Workstations (PAWs), attackers aim to achieve kernel-mode execution to subvert administrative separation controls, bypass Endpoint Detection and Response (EDR) software, and extract domain credential secrets from isolated zones. Intel Control-flow Enforcement Technology (CET) and AMD Shadow Stack technologies create a separate, hardware-secured copy of the call stack (the "shadow stack"). Before returning from a function, the CPU compares the return address on the standard stack with the address stored on the hardware-secured shadow stack. If a mismatch is detected, the processor terminates the thread or crashes the system, neutralizing control-flow hijacking attempts. Deploying Kernel-mode Hardware-enforced Stack Protection on PAWs guarantees that the administrative gateway machines remain resilient against advanced kernel exploits. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the appropriate PAW GPO (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the setting: Policy : `Turn On Virtualization Based Security` -> Set to Enabled Check Kernel-level shadow stacks -> Set to Enabled* (or set registry Enabled = 1) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the registry and activate Kernel-mode Hardware-enforced Stack Protection. Download Script: Enable-PawKernelShadowStacks.ps1 # Enable-PawKernelShadowStacks.ps1 # Description: Configures HKLM registry to enable Kernel-mode Hardware-enforced Stack Protection (Kernel Shadow Stacks) for PAWs. Write-Host "Enabling Kernel-mode Hardware-enforced Stack Protection for PAWs..." -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "Enabled" -Value 1 -Type DWord Write-Host "[+] Registry setting for PAW Kernel Shadow Stacks enabled. (Reboot required)." -ForegroundColor Green To audit the state of Kernel-mode Hardware-enforced Stack Protection: Download Script: Test-PawKernelShadowStacks.ps1 # Test-PawKernelShadowStacks.ps1 # Description: Audits the registry status of Kernel-mode Hardware-enforced Stack Protection (Kernel Shadow Stacks) for PAWs. Write-Host "--- Auditing PAW Kernel-mode Hardware-enforced Stack Protection ---" -ForegroundColor Cyan $script:Vulnerable = $false $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" # Check registry value $val = Get-ItemProperty -Path $RegPath -Name "Enabled" -ErrorAction SilentlyContinue $actual = if ($val) { $val.Enabled } else { "" } if ($actual -eq 1) { Write-Host " - Registry Setting: KernelShadowStacks Enabled | Actual: '1' (Expected: '1')" -ForegroundColor Green } else { $script:Vulnerable = $true Write-Host " - Registry Setting: KernelShadowStacks Enabled | Actual: '$actual' (Expected: '1')" -ForegroundColor Red } # Verify VBS dependency is met try { $DG = Get-CimInstance -Namespace "Root\Microsoft\Windows\DeviceGuard" -ClassName "Win32_DeviceGuard" -ErrorAction Stop if ($DG.VirtualizationBasedSecurityStatus -eq 2) { Write-Host " - VBS Status: Running" -ForegroundColor Green } else { $script:Vulnerable = $true Write-Host " - VBS Status: Not Running (VBS is required for Kernel Shadow Stacks)" -ForegroundColor Red } } catch { $script:Vulnerable = $true Write-Host " - DeviceGuard WMI class query failed. VBS is likely disabled." -ForegroundColor Red } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green } # Enable-PawKernelShadowStacks.ps1 # Description: Configures HKLM registry to enable Kernel-mode Hardware-enforced Stack Protection (Kernel Shadow Stacks) for PAWs. Write-Host "Enabling Kernel-mode Hardware-enforced Stack Protection for PAWs..." -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "Enabled" -Value 1 -Type DWord Write-Host "[+] Registry setting for PAW Kernel Shadow Stacks enabled. (Reboot required)." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/harden-network-and-name-resolution.md Legacy name resolution protocols and insecure default network configurations are heavily targeted by attackers for credential harvesting and man-in-the-middle (MitM) positioning: Legacy Name Resolution (LLMNR / NetBIOS): LLMNR and NBT-NS serve as fallback protocols when DNS resolution fails. When a host queries an unresolvable name, it broadcasts requests over the local subnet. An attacker can spoof responses (e.g., using Responder) to capture NTLMv2 hashes or perform authentication relay attacks. NetBIOS name release requests can be forged to disrupt local names unless protected. NetBIOS Node Type and Name Release: Setting the Node Type to P-node (point-to-point, value 2) disables broadcast resolution fallbacks. Enabling name release protection (NoNameReleaseOnDemand) prevents attackers from spoofing name release requests to deregister local names. ICMP Redirects: ICMP redirect packets can be used by an attacker on the same subnet to dynamically redirect routing for specific hosts through the attacker's machine, enabling full MitM packet sniffing and modification. Disabling ICMP redirects prevents this vector. IP Source Routing: Source routing allows a sender to specify the exact network path a packet should follow. This is commonly abused to bypass firewall routing rules or establish communication paths that violate network segment isolation. Disable Default IPv6 DNS Servers: Disabling default IPv6 DNS servers prevents automated fallback to unauthenticated, dynamic local IPv6 DNS servers advertised by rogue routers or malicious tools (like mitm6), which would otherwise redirect query traffic and coerce NTLM or Kerberos authentication. Disable Web Proxy Auto-Discovery (WPAD): Disabling WPAD removes another name resolution mechanism that Responder exploits to harvest credentials. By disabling the WinHttpAutoProxySvc service and configuring WpadOverride = 1, the workstation is protected from rogue web proxy configurations. Restrict Net Session Enumeration (NetCease): By default, any authenticated domain user can query session information from remote hosts. Attackers utilize session enumeration to locate high-privileged user sessions (e.g., Domain Admins) across the network. Hardening the SrvsvcSessionInfo default security descriptor blocks this remote reconnaissance. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Configure DNS Client Settings Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Administrative Templates\Network\DNS Client Configure the settings: Policy : `Turn off Multicast Name Resolution` -> Enabled Policy : `Configure multicast DNS (mDNS) protocol` -> Enabled with option set to Disabled Policy : `Turn off default IPv6 DNS Servers` -> Enabled Step 2: Configure Network Connections Policies In the target GPO, navigate to: Computer Configuration\Administrative Templates\Network\Network Connections Configure the settings: Policy : `Prohibit use of Internet Connection Sharing on your DNS domain network` -> Enabled Policy : `Prohibit installation and configuration of Network Bridge on your DNS domain network` -> Enabled Policy : `Require domain users to elevate when setting a network's location` -> Enabled Step 3: Configure Windows Connection Manager Policies In the target GPO, navigate to: Computer Configuration\Administrative Templates\Network\Windows Connection Manager Configure the settings: Policy : `Minimize the number of simultaneous connections to the Internet or a Windows Domain` -> Enabled with option set to 3 = Prevent Wi-Fi when on Ethernet Policy : `Prohibit connection to non-domain networks when connected to domain authenticated network` -> Enabled Step 4: Configure WLAN Settings (WiFi Sense) In the target GPO, navigate to: Computer Configuration\Administrative Templates\Network\WLAN Service\WLAN Settings Configure the settings: Policy : `Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services` -> Disabled Step 5: Configure Spooler and HTTP Printing Policies In the target GPO, navigate to: Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings Configure the settings: Policy : `Turn off downloading of print drivers over HTTP` -> Enabled Policy : `Turn off printing over HTTP` -> Enabled Step 6: Configure Network Access Security settings In the target GPO, navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the settings: Policy : `Network access: Restrict anonymous access to Named Pipes and Shares` -> Enabled Step 7: Disable WinHTTP WPAD Service In the target GPO, navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Scroll to WinHTTP Web Proxy Auto-Discovery Service, select Define this service setting, and set the service startup mode to Disabled. Step 8: Configure Registry Network settings via GPO Preferences Under the target GPO, navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click Registry and select New -> Registry Item for each of the following: NetBIOS Name Release Protection: Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Netbt\Parameters Value Name: NoNameReleaseOnDemand Value Type: REG_DWORD Value Data: 1 NetBIOS P-Node Type: Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Netbt\Parameters Value Name: NodeType Value Type: REG_DWORD Value Data: 2 Disable ICMP Redirects: Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Value Name: EnableICMPRedirect Value Type: REG_DWORD Value Data: 0 Disable IP Source Routing (IPv4): Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Value Name: DisableIPSourceRouting Value Type: REG_DWORD Value Data: 2 Disable IP Source Routing (IPv6): Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters Value Name: DisableIPSourceRouting Value Type: REG_DWORD Value Data: 2 Disable WPAD Override (User Preference): Action: Update Hive: HKEY_CURRENT_USER Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Value Name: WpadOverride Value Type: REG_DWORD Value Data: 1 Restrict Net Session Enumeration (NetCease SDDL): Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity Value Name: SrvsvcSessionInfo Value Type: REG_BINARY Value Data: Generate via SDDL D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU) Step 9: Disable NetBIOS (via DHCP Scope Options) Open the DHCP Management Console (dhcpmgmt.msc). Under Scope Options, select Configure Options. Add Option 043 (Vendor Specific Info) and set the NetBIOS over TCP/IP value to 0x2 (Disable NetBIOS over TCP/IP). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to disable legacy resolution and enforce secure TCP/IP registry parameters. Download Script: Set-PawNetworkHardening.ps1 # Set-PawNetworkHardening.ps1 # Description: Configures local registry keys to disable LLMNR/NetBIOS, harden TCP/IP stack, prevent dual-homing, block hotspot auto-connect, print driver web downloads, HTTP printing, and limit anonymous share access on PAWs. Write-Host "Applying network and name resolution hardening..." -ForegroundColor Cyan # Helper to configure registry keys function Set-RegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$path, [string]$name, [int]$value ) if ($PSCmdlet.ShouldProcess($path, "Set registry DWORD value $name to $value")) { $parent = Split-Path -Path $path if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null } Set-ItemProperty -Path $path -Name $name -Value $value -Type DWord -Force } } # 1. Disable LLMNR, mDNS, and default IPv6 DNS Servers Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "EnableMulticast" 0 Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "EnablemDNS" 0 Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "DisableIPv6DefaultDnsServers" 1 Write-Host "[+] LLMNR (Multicast Name Resolution), mDNS, and default IPv6 DNS Servers disabled." -ForegroundColor Green # 2. Configure NetBIOS Parameters $NetbtPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netbt\Parameters" if (-not (Test-Path $NetbtPath)) { New-Item -Path $NetbtPath -Force | Out-Null } Set-ItemProperty -Path $NetbtPath -Name "NoNameReleaseOnDemand" -Value 1 -Type DWord Set-ItemProperty -Path $NetbtPath -Name "NodeType" -Value 2 -Type DWord Write-Host "[+] NetBIOS name release protection and P-node type configured." -ForegroundColor Green # 3. Disable NetBIOS over TCP/IP on all active adapters Write-Host "[+] Disabling NetBIOS on all active network adapters..." -ForegroundColor Gray $Adapters = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -ErrorAction SilentlyContinue | Where-Object { $_.IPEnabled -eq $true } if ($Adapters) { foreach ($Adapter in $Adapters) { Invoke-CimMethod -InputObject $Adapter -MethodName SetTCPIPNetBIOS -Arguments @{ TcpipNetbiosOptions = 2 } | Out-Null } Write-Host " NetBIOS disabled on active network interfaces." -ForegroundColor Green } # 4. Harden TCP/IP Parameters Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "EnableICMPRedirect" 0 Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "DisableIPSourceRouting" 2 Write-Host "[+] IPv4 TCP/IP parameter redirects and source routing disabled." -ForegroundColor Green Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" "DisableIPSourceRouting" 2 Write-Host "[+] IPv6 TCP/IP parameter source routing disabled." -ForegroundColor Green # 5. Prevent Network Connection Sharing and Dual-Homing Bridging Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_ShowSharedAccessUI" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_AllowNetBridge_NLA" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_StdDomainUserSetLocation" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" "fMinimizeConnections" 3 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" "fBlockNonDomain" 1 Set-RegDWord "HKLM:\SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config" "AutoConnectAllowedOEM" 0 Write-Host "[+] Network connections, sharing, bridging, elevation, and hotspot settings configured." -ForegroundColor Green # 6. Printing Spooler Web Downloads and HTTP printing block Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableWebPnPDownload" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableHTTPPrinting" 1 Write-Host "[+] Printing spooler HTTP and Web service options disabled." -ForegroundColor Green # 7. Restrict anonymous access to SAM and Named Pipes/Shares Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" "RestrictNullSessAccess" 1 Write-Host "[+] Anonymous null session share access restricted." -ForegroundColor Green # 8. Disable WPAD Write-Host "[+] Disabling WinHTTP Auto-Proxy service..." -ForegroundColor Gray Set-Service -Name "WinHttpAutoProxySvc" -StartupType Disabled -ErrorAction SilentlyContinue Stop-Service -Name "WinHttpAutoProxySvc" -Force -ErrorAction SilentlyContinue $WpadPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" if (-not (Test-Path $WpadPath)) { New-Item -Path $WpadPath -Force | Out-Null } Set-ItemProperty -Path $WpadPath -Name "WpadOverride" -Value 1 -Type DWord -Force Write-Host "[+] WPAD auto-detection disabled in user preferences registry." -ForegroundColor Green # 9. Restrict Net Session Enumeration (NetCease SDDL) Write-Host "[+] Restricting Net Session Enumeration..." -ForegroundColor Gray try { $SD = New-Object System.Security.AccessControl.CommonSecurityDescriptor($false, $false, "D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU)") $BinaryForm = New-Object byte[] $SD.BinaryLength $SD.GetBinaryForm($BinaryForm, 0) $LanmanSecPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity" if (-not (Test-Path $LanmanSecPath)) { New-Item -Path $LanmanSecPath -Force | Out-Null } Set-ItemProperty -Path $LanmanSecPath -Name "SrvsvcSessionInfo" -Value $BinaryForm -Type Binary -Force Write-Host "[+] Net Session Enumeration restricted to Admins/Operators/Power Users." -ForegroundColor Green } catch { Write-Error " Failed to apply Net Session Enumeration restrictions: $($_.Exception.Message)" } Write-Host "Network and name resolution hardening applied successfully." -ForegroundColor Green To audit the network and name resolution status: Download Script: Test-PawNetworkHardeningStatus.ps1 # Test-PawNetworkHardeningStatus.ps1 # Description: Audits LLMNR, NetBIOS parameters, NetBIOS adapter state, TCP/IP parameters, and print/network connection options on PAWs. Write-Host "--- Auditing Network and Name Resolution Baseline ---" -ForegroundColor Cyan $script:Vulnerable = $false # Helper function to audit registry properties function Test-RegistryValue ($path, $name, $expectedValue) { $val = Get-ItemProperty -Path $path -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } $color = "Red" if ($actual -eq $expectedValue) { $color = "Green" } else { $script:Vulnerable = $true } Write-Host " - Registry Setting: $name | Actual: '$actual' (Expected: '$expectedValue')" -ForegroundColor $color } # 1. Audit LLMNR, mDNS, and default IPv6 DNS Servers $DnsPath = "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" Test-RegistryValue $DnsPath "EnableMulticast" 0 Test-RegistryValue $DnsPath "EnablemDNS" 0 Test-RegistryValue $DnsPath "DisableIPv6DefaultDnsServers" 1 # 2. Audit NetBIOS Parameters $NetbtPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netbt\Parameters" Test-RegistryValue $NetbtPath "NoNameReleaseOnDemand" 1 Test-RegistryValue $NetbtPath "NodeType" 2 # 3. Audit TCP/IP Parameters $TcpipPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" Test-RegistryValue $TcpipPath "EnableICMPRedirect" 0 Test-RegistryValue $TcpipPath "DisableIPSourceRouting" 2 $Tcpip6Path = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" Test-RegistryValue $Tcpip6Path "DisableIPSourceRouting" 2 # 4. Audit Connection Sharing & Dual-Homing Settings $NetConnPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" Test-RegistryValue $NetConnPath "NC_ShowSharedAccessUI" 0 Test-RegistryValue $NetConnPath "NC_AllowNetBridge_NLA" 0 Test-RegistryValue $NetConnPath "NC_StdDomainUserSetLocation" 1 $WcmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" Test-RegistryValue $WcmPath "fMinimizeConnections" 3 Test-RegistryValue $WcmPath "fBlockNonDomain" 1 $WifiPath = "HKLM:\SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config" Test-RegistryValue $WifiPath "AutoConnectAllowedOEM" 0 # 5. Audit HTTP Print Options $PrinterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" Test-RegistryValue $PrinterPath "DisableWebPnPDownload" 1 Test-RegistryValue $PrinterPath "DisableHTTPPrinting" 1 # 6. Audit Null Session Share Restrict $ServerPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" Test-RegistryValue $ServerPath "RestrictNullSessAccess" 1 # 7. Audit WPAD Service and Registry Override $WpadSvc = Get-Service -Name "WinHttpAutoProxySvc" -ErrorAction SilentlyContinue if ($null -ne $WpadSvc) { if ($WpadSvc.StartType -eq "Disabled") { Write-Host " - WPAD Service State: Disabled (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: WPAD Service StartType is $($WpadSvc.StartType) (Expected: Disabled)" -ForegroundColor Red $script:Vulnerable = $true } } $WpadPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" Test-RegistryValue $WpadPath "WpadOverride" 1 # 8. Audit Net Session Enumeration (NetCease) $LanmanSecPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity" if (Test-Path $LanmanSecPath) { $SrvsvcSessionInfo = (Get-ItemProperty -Path $LanmanSecPath -Name "SrvsvcSessionInfo" -ErrorAction SilentlyContinue).SrvsvcSessionInfo if ($null -ne $SrvsvcSessionInfo) { try { $SD = New-Object System.Security.AccessControl.CommonSecurityDescriptor($false, $false, $SrvsvcSessionInfo, 0) $Sddl = $SD.GetSddlForm("Dacl") if ($Sddl -eq "D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU)") { Write-Host " - Net Session Enumeration Security Descriptor: Hardened (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: Net Session Enumeration Security Descriptor is '$Sddl' (Expected: 'D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU)')" -ForegroundColor Red $script:Vulnerable = $true } } catch { Write-Host " - VULNERABLE: Failed to parse Net Session Enumeration security descriptor." -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: SrvsvcSessionInfo registry value not found." -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: LanmanServer\DefaultSecurity path not found." -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Set-PawNetworkHardening.ps1 # Description: Configures local registry keys to disable LLMNR/NetBIOS, harden TCP/IP stack, prevent dual-homing, block hotspot auto-connect, print driver web downloads, HTTP printing, and limit anonymous share access on PAWs. Write-Host "Applying network and name resolution hardening..." -ForegroundColor Cyan # Helper to configure registry keys function Set-RegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$path, [string]$name, [int]$value ) if ($PSCmdlet.ShouldProcess($path, "Set registry DWORD value $name to $value")) { $parent = Split-Path -Path $path if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null } Set-ItemProperty -Path $path -Name $name -Value $value -Type DWord -Force } } # 1. Disable LLMNR, mDNS, and default IPv6 DNS Servers Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "EnableMulticast" 0 Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "EnablemDNS" 0 Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "DisableIPv6DefaultDnsServers" 1 Write-Host "[+] LLMNR (Multicast Name Resolution), mDNS, and default IPv6 DNS Servers disabled." -ForegroundColor Green # 2. Configure NetBIOS Parameters $NetbtPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netbt\Parameters" if (-not (Test-Path $NetbtPath)) { New-Item -Path $NetbtPath -Force | Out-Null } Set-ItemProperty -Path $NetbtPath -Name "NoNameReleaseOnDemand" -Value 1 -Type DWord Set-ItemProperty -Path $NetbtPath -Name "NodeType" -Value 2 -Type DWord Write-Host "[+] NetBIOS name release protection and P-node type configured." -ForegroundColor Green # 3. Disable NetBIOS over TCP/IP on all active adapters Write-Host "[+] Disabling NetBIOS on all active network adapters..." -ForegroundColor Gray $Adapters = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -ErrorAction SilentlyContinue | Where-Object { $_.IPEnabled -eq $true } if ($Adapters) { foreach ($Adapter in $Adapters) { Invoke-CimMethod -InputObject $Adapter -MethodName SetTCPIPNetBIOS -Arguments @{ TcpipNetbiosOptions = 2 } | Out-Null } Write-Host " NetBIOS disabled on active network interfaces." -ForegroundColor Green } # 4. Harden TCP/IP Parameters Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "EnableICMPRedirect" 0 Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "DisableIPSourceRouting" 2 Write-Host "[+] IPv4 TCP/IP parameter redirects and source routing disabled." -ForegroundColor Green Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" "DisableIPSourceRouting" 2 Write-Host "[+] IPv6 TCP/IP parameter source routing disabled." -ForegroundColor Green # 5. Prevent Network Connection Sharing and Dual-Homing Bridging Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_ShowSharedAccessUI" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_AllowNetBridge_NLA" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_StdDomainUserSetLocation" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" "fMinimizeConnections" 3 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" "fBlockNonDomain" 1 Set-RegDWord "HKLM:\SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config" "AutoConnectAllowedOEM" 0 Write-Host "[+] Network connections, sharing, bridging, elevation, and hotspot settings configured." -ForegroundColor Green # 6. Printing Spooler Web Downloads and HTTP printing block Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableWebPnPDownload" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableHTTPPrinting" 1 Write-Host "[+] Printing spooler HTTP and Web service options disabled." -ForegroundColor Green # 7. Restrict anonymous access to SAM and Named Pipes/Shares Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" "RestrictNullSessAccess" 1 Write-Host "[+] Anonymous null session share access restricted." -ForegroundColor Green # 8. Disable WPAD Write-Host "[+] Disabling WinHTTP Auto-Proxy service..." -ForegroundColor Gray Set-Service -Name "WinHttpAutoProxySvc" -StartupType Disabled -ErrorAction SilentlyContinue Stop-Service -Name "WinHttpAutoProxySvc" -Force -ErrorAction SilentlyContinue $WpadPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" if (-not (Test-Path $WpadPath)) { New-Item -Path $WpadPath -Force | Out-Null } Set-ItemProperty -Path $WpadPath -Name "WpadOverride" -Value 1 -Type DWord -Force Write-Host "[+] WPAD auto-detection disabled in user preferences registry." -ForegroundColor Green # 9. Restrict Net Session Enumeration (NetCease SDDL) Write-Host "[+] Restricting Net Session Enumeration..." -ForegroundColor Gray try { $SD = New-Object System.Security.AccessControl.CommonSecurityDescriptor($false, $false, "D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU)") $BinaryForm = New-Object byte[] $SD.BinaryLength $SD.GetBinaryForm($BinaryForm, 0) $LanmanSecPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity" if (-not (Test-Path $LanmanSecPath)) { New-Item -Path $LanmanSecPath -Force | Out-Null } Set-ItemProperty -Path $LanmanSecPath -Name "SrvsvcSessionInfo" -Value $BinaryForm -Type Binary -Force Write-Host "[+] Net Session Enumeration restricted to Admins/Operators/Power Users." -ForegroundColor Green } catch { Write-Error " Failed to apply Net Session Enumeration restrictions: $($_.Exception.Message)" } Write-Host "Network and name resolution hardening applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/configure-uac-policies.md User Account Control (UAC) is a fundamental defense mechanism in Windows. It limits the privilege levels of running applications, executing administrative actions with standard user tokens unless elevated privileges are explicitly approved. Hardening UAC settings ensures: 1. Secure Desktop Enforcement: The elevation prompt is displayed on a separate, secure desktop environment that isolated system threads run on. This prevents third-party malware running in user space from intercepting credentials or programmatically clicking "Yes" to elevate itself. 2. Auto-Denial of Standard User Elevation: Standard users should not be allowed to request elevation. If a standard user triggers a task requiring administrative rights, the prompt should auto-deny rather than requesting an administrator password, preventing users from attempting to bypass controls or exposing local admin passwords on a non-secure user terminal. 3. Admin Approval Mode: Forcing built-in administrators to run in Admin Approval Mode ensures that even administrative users do not run web browsers or document editors with administrative tokens by default. 4. Sudo Command Control: The sudo command introduced in Windows 11 (24H2) allows users to run elevated commands from an unelevated console. Leaving this feature unconfigured or allowing execution within the current console session can expose elevated processes to command injection or token interception in the same console session. Restricting sudo to opening a new elevated window (1) or disabling it entirely (0) mitigates session hijacking risks. 5. Network UAC Restrictions (`LocalAccountTokenFilterPolicy`): Restricting the elevation of local accounts during network logons prevents lateral movement. When set to 0, local accounts (except for the built-in Administrator RID 500 account) connecting remotely via network shares or administrative interfaces cannot obtain administrative tokens, neutralizing pass-the-hash attacks using secondary local administrative accounts. 6. Installer Detection (`EnableInstallDetection`): Detecting installer program behavior prevents silent software execution. When enabled, any execution of an install file or setup program by standard users or administrators triggers a UAC elevation prompt, preventing unauthorized silent program deployments. 7. UAC Virtualization (`EnableVirtualization`): Virtualizing writes redirection keeps the operating system directory space clean. It redirects legacy application registry and file writes targeting system folders (like Program Files or System32) to user-profile-specific folders, allowing legacy applications to run without requiring administrative rights. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following settings: Policy : `User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode` -> Prompt for credentials on the secure desktop Policy : `User Account Control: Behavior of the elevation prompt for standard users` -> Automatically deny elevation requests Policy : `User Account Control: Run all administrators in Admin Approval Mode` -> Enabled Policy : `User Account Control: Switch to the secure desktop when prompting for elevation` -> Enabled Policy : `User Account Control: Detect application installations and prompt for elevation` -> Enabled Policy : `User Account Control: Virtualize file and registry write failures to per-user locations` -> Enabled Since the UAC network restrictions policy is not directly exposed in standard GPO security templates, deploy the registry setting via GPO Preferences: * Navigate to: Computer Configuration\Preferences\Windows Settings\Registry * Create a new Registry Item: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Value Name*: LocalAccountTokenFilterPolicy Value Type*: REG_DWORD Value Data*: 0 Navigate to: Computer Configuration\Administrative Templates\System Policy : `Configure the behavior of the sudo command` -> Enabled with options set to Force a new elevated window Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure maximum security parameters for UAC in the system registry. Download Script: Configure-PawUACPolicies.ps1 # Configure-PawUACPolicies.ps1 # Description: Enforces hardened User Account Control (UAC) registry configuration values including network restrictions, installer detection, and virtualization on PAWs. Write-Host "--- Hardening User Account Control Policies ---" -ForegroundColor Cyan $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path $SystemPath)) { New-Item -Path $SystemPath -Force | Out-Null } # ConsentPromptBehaviorAdmin = 1 (Prompt for credentials on secure desktop) Set-ItemProperty -Path $SystemPath -Name "ConsentPromptBehaviorAdmin" -Value 1 -Type DWord -Force # ConsentPromptBehaviorUser = 0 (Automatically deny elevation requests) Set-ItemProperty -Path $SystemPath -Name "ConsentPromptBehaviorUser" -Value 0 -Type DWord -Force # EnableLUA = 1 (Enable User Account Control / Admin Approval Mode) Set-ItemProperty -Path $SystemPath -Name "EnableLUA" -Value 1 -Type DWord -Force # PromptOnSecureDesktop = 1 (Switch to secure desktop when prompting) Set-ItemProperty -Path $SystemPath -Name "PromptOnSecureDesktop" -Value 1 -Type DWord -Force # LocalAccountTokenFilterPolicy = 0 (Apply UAC restrictions to local accounts on network logons) Set-ItemProperty -Path $SystemPath -Name "LocalAccountTokenFilterPolicy" -Value 0 -Type DWord -Force # EnableInstallDetection = 1 (Detect application installations and prompt for elevation) Set-ItemProperty -Path $SystemPath -Name "EnableInstallDetection" -Value 1 -Type DWord -Force # EnableVirtualization = 1 (Virtualize file and registry write failures to per-user locations) Set-ItemProperty -Path $SystemPath -Name "EnableVirtualization" -Value 1 -Type DWord -Force # Configure Windows Sudo command behavior (Enabled = 1 [Force new elevated window]) $SudoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sudo" if (-not (Test-Path $SudoPath)) { New-Item -Path $SudoPath -Force | Out-Null } Set-ItemProperty -Path $SudoPath -Name "Enabled" -Value 1 -Type DWord -Force Write-Host "[+] UAC registry values configured successfully." -ForegroundColor Green To audit UAC configurations on the PAW: Download Script: Test-PawUACPolicies.ps1 # Test-PawUACPolicies.ps1 # Description: Verifies local system registry settings for User Account Control on PAWs. Write-Host "--- Auditing User Account Control Policies ---" -ForegroundColor Cyan $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $script:Vulnerable = $false function Test-UACRegistryValue ($name, $expected, $message) { $val = Get-ItemProperty -Path $SystemPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { $null } $color = "Red" if ($actual -eq $expected) { $color = "Green" } else { $script:Vulnerable = $true } Write-Host " - Registry Setting: $name | Actual: '$actual' (Expected: '$expected') | $message" -ForegroundColor $color } Test-UACRegistryValue "ConsentPromptBehaviorAdmin" 1 "Behavior of elevation prompt for administrators" Test-UACRegistryValue "ConsentPromptBehaviorUser" 0 "Behavior of elevation prompt for standard users" Test-UACRegistryValue "EnableLUA" 1 "Run all administrators in Admin Approval Mode" Test-UACRegistryValue "PromptOnSecureDesktop" 1 "Switch to secure desktop when prompting" Test-UACRegistryValue "LocalAccountTokenFilterPolicy" 0 "UAC network restrictions" Test-UACRegistryValue "EnableInstallDetection" 1 "Installer detection" Test-UACRegistryValue "EnableVirtualization" 1 "UAC virtualization" # Audit Sudo command $SudoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sudo" if (Test-Path $SudoPath) { $SudoState = Get-ItemProperty -Path $SudoPath -Name "Enabled" -ErrorAction SilentlyContinue $SudoVal = if ($SudoState) { $SudoState.Enabled } else { 0 } $SudoColor = if ($SudoVal -eq 0 -or $SudoVal -eq 1) { "Green" } else { "Red" } Write-Host " - Sudo Command Enabled state: $SudoVal (Required = 1 [New Window] or 0 [Disabled])" -ForegroundColor $SudoColor if ($SudoVal -ne 0 -and $SudoVal -ne 1) { $script:Vulnerable = $true } } else { Write-Host " - Sudo Command Enabled state: Not Configured (Default/Compliant as it inherits disabled)" -ForegroundColor Green } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-PawUACPolicies.ps1 # Description: Enforces hardened User Account Control (UAC) registry configuration values including network restrictions, installer detection, and virtualization on PAWs. Write-Host "--- Hardening User Account Control Policies ---" -ForegroundColor Cyan $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path $SystemPath)) { New-Item -Path $SystemPath -Force | Out-Null } # ConsentPromptBehaviorAdmin = 1 (Prompt for credentials on secure desktop) Set-ItemProperty -Path $SystemPath -Name "ConsentPromptBehaviorAdmin" -Value 1 -Type DWord -Force # ConsentPromptBehaviorUser = 0 (Automatically deny elevation requests) Set-ItemProperty -Path $SystemPath -Name "ConsentPromptBehaviorUser" -Value 0 -Type DWord -Force # EnableLUA = 1 (Enable User Account Control / Admin Approval Mode) Set-ItemProperty -Path $SystemPath -Name "EnableLUA" -Value 1 -Type DWord -Force # PromptOnSecureDesktop = 1 (Switch to secure desktop when prompting) Set-ItemProperty -Path $SystemPath -Name "PromptOnSecureDesktop" -Value 1 -Type DWord -Force # LocalAccountTokenFilterPolicy = 0 (Apply UAC restrictions to local accounts on network logons) Set-ItemProperty -Path $SystemPath -Name "LocalAccountTokenFilterPolicy" -Value 0 -Type DWord -Force # EnableInstallDetection = 1 (Detect application installations and prompt for elevation) Set-ItemProperty -Path $SystemPath -Name "EnableInstallDetection" -Value 1 -Type DWord -Force # EnableVirtualization = 1 (Virtualize file and registry write failures to per-user locations) Set-ItemProperty -Path $SystemPath -Name "EnableVirtualization" -Value 1 -Type DWord -Force # Configure Windows Sudo command behavior (Enabled = 1 [Force new elevated window]) $SudoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sudo" if (-not (Test-Path $SudoPath)) { New-Item -Path $SudoPath -Force | Out-Null } Set-ItemProperty -Path $SudoPath -Name "Enabled" -Value 1 -Type DWord -Force Write-Host "[+] UAC registry values configured successfully." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/disable-autoplay-autorun.md The AutoPlay and AutoRun features in Windows are designed to automatically execute programs or open media when a removable drive, network share, or CD-ROM is inserted or connected. Attackers exploit these features by placing malicious scripts, payloads, or executables on USB drives or external storage media. If AutoPlay is enabled, connecting the drive triggers automatic execution of these scripts or programs without user interaction or approval, allowing malware to achieve immediate execution in the context of the logged-on user. Disabling AutoPlay across all drive types completely mitigates this physical transmission vector. Additionally, non-volume devices (such as mobile phones, cameras, or media players) can still trigger AutoPlay behavior. Disallowing AutoPlay for non-volume devices ensures these devices do not introduce unauthorized execution pathways when plugged into standard client machines. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Administrative Templates\Windows Components\AutoPlay Policies Configure the following settings: Policy*: Turn off AutoPlay Setting*: Enabled Select Options*: All drives Policy*: Set the default behavior for AutoRun Setting*: Enabled Select Options*: Do not execute any autorun commands Policy*: Disallow Autoplay for non-volume devices Setting*: Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure Explorer registry keys to disable AutoPlay, AutoRun, and AutoPlay for non-volume devices. Download Script: Disable-PawAutoPlay.ps1 # Disable-PawAutoPlay.ps1 # Description: Disables AutoPlay/AutoRun registry settings globally on all drive types and non-volume devices on PAWs. Write-Host "--- Disabling AutoPlay and AutoRun ---" -ForegroundColor Cyan $ExplorerPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" if (-not (Test-Path $ExplorerPath)) { New-Item -Path $ExplorerPath -Force | Out-Null } # NoDriveTypeAutoRun = 0xFF (255 in decimal) disables AutoRun on all types of drives Set-ItemProperty -Path $ExplorerPath -Name "NoDriveTypeAutoRun" -Value 255 -Type DWord -Force # NoAutorun = 1 disables AutoRun commands in inf files Set-ItemProperty -Path $ExplorerPath -Name "NoAutorun" -Value 1 -Type DWord -Force # Disallow Autoplay for non-volume devices (NoAutoplayfornonVolume = 1) $PolExplorerPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" if (-not (Test-Path $PolExplorerPath)) { New-Item -Path $PolExplorerPath -Force | Out-Null } Set-ItemProperty -Path $PolExplorerPath -Name "NoAutoplayfornonVolume" -Value 1 -Type DWord -Force Write-Host "[+] AutoPlay and AutoRun registry parameters set." -ForegroundColor Green To audit AutoPlay configurations on the PAW: Download Script: Test-PawAutoPlay.ps1 # Test-PawAutoPlay.ps1 # Description: Audits local system registry parameters for AutoPlay status on PAWs. Write-Host "--- Auditing AutoPlay Configuration ---" -ForegroundColor Cyan $ExplorerPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" $PolExplorerPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" $NoDriveAuto = Get-ItemProperty -Path $ExplorerPath -Name "NoDriveTypeAutoRun" -ErrorAction SilentlyContinue $NoAutoCmd = Get-ItemProperty -Path $ExplorerPath -Name "NoAutorun" -ErrorAction SilentlyContinue $NoNonVol = Get-ItemProperty -Path $PolExplorerPath -Name "NoAutoplayfornonVolume" -ErrorAction SilentlyContinue $NoDriveVal = if ($NoDriveAuto) { $NoDriveAuto.NoDriveTypeAutoRun } else { 0 } $NoAutoVal = if ($NoAutoCmd) { $NoAutoCmd.NoAutorun } else { 0 } $NoNonVolVal = if ($NoNonVol) { $NoNonVol.NoAutoplayfornonVolume } else { 0 } $NoDriveColor = if ($NoDriveVal -eq 255) { "Green" } else { "Red" } $NoAutoColor = if ($NoAutoVal -eq 1) { "Green" } else { "Red" } $NoNonVolColor = if ($NoNonVolVal -eq 1) { "Green" } else { "Red" } Write-Host " - NoDriveTypeAutoRun: $NoDriveVal (Required = 255 to disable all drives)" -ForegroundColor $NoDriveColor Write-Host " - NoAutorun: $NoAutoVal (Required = 1)" -ForegroundColor $NoAutoColor Write-Host " - NoAutoplayfornonVolume: $NoNonVolVal (Required = 1)" -ForegroundColor $NoNonVolColor # Disable-PawAutoPlay.ps1 # Description: Disables AutoPlay/AutoRun registry settings globally on all drive types and non-volume devices on PAWs. Write-Host "--- Disabling AutoPlay and AutoRun ---" -ForegroundColor Cyan $ExplorerPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" if (-not (Test-Path $ExplorerPath)) { New-Item -Path $ExplorerPath -Force | Out-Null } # NoDriveTypeAutoRun = 0xFF (255 in decimal) disables AutoRun on all types of drives Set-ItemProperty -Path $ExplorerPath -Name "NoDriveTypeAutoRun" -Value 255 -Type DWord -Force # NoAutorun = 1 disables AutoRun commands in inf files Set-ItemProperty -Path $ExplorerPath -Name "NoAutorun" -Value 1 -Type DWord -Force # Disallow Autoplay for non-volume devices (NoAutoplayfornonVolume = 1) $PolExplorerPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" if (-not (Test-Path $PolExplorerPath)) { New-Item -Path $PolExplorerPath -Force | Out-Null } Set-ItemProperty -Path $PolExplorerPath -Name "NoAutoplayfornonVolume" -Value 1 -Type DWord -Force Write-Host "[+] AutoPlay and AutoRun registry parameters set." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/restrict-rdp-access.md Remote Desktop Protocol (RDP) is one of the primary mechanisms used by attackers for lateral movement and administrative session hijacking. For Privileged Access Workstations (PAWs), which manage Tier 0 administrative assets: 1. Lateral Movement Prevention: PAWs represent physical console endpoints used to administer the forest. They must never accept inbound network connections. Disabling incoming RDP connections prevents attackers from pivoting from compromised general workstations to the PAW. 2. Session Security: Eliminating RDP listener ports prevents credential sniffing, password spraying, and remote exploitation of remote desktop services vulnerabilities on the administrative root of trust. 3. Remote Assistance Block: Disabling solicited remote assistance prevents potential remote command execution or remote support hijacking. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Disable Inbound Remote Desktop Connections Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections Configure the setting: Policy*: Allow users to connect remotely by using Remote Desktop Services Setting*: Disabled 2. Disable Solicited Remote Assistance Navigate to: Computer Configuration\Administrative Templates\System\Remote Assistance Configure the setting: Policy*: Configure Solicited Remote Assistance Setting*: Disabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to disable Remote Desktop and Remote Assistance, and enforce NLA and secure registry keys. Download Script: Disable-PawRemoteDesktop.ps1 # Disable-PawRemoteDesktop.ps1 # Description: Disables Remote Desktop and Solicited Remote Assistance connections, sets NLA requirements, and cleans parameters on PAWs. Write-Host "--- Restricting Remote Desktop and Remote Assistance Access ---" -ForegroundColor Cyan $RdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" # 1. Disable RDP Connections (fDenyTSConnections = 1) Set-ItemProperty -Path $RdpPath -Name "fDenyTSConnections" -Value 1 -Type DWord -Force Write-Host "[+] Inbound Remote Desktop connections disabled." -ForegroundColor Green # 2. Enforce Network Level Authentication (UserAuthentication = 1) $RdpSecPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" if (Test-Path $RdpSecPath) { Set-ItemProperty -Path $RdpSecPath -Name "UserAuthentication" -Value 1 -Type DWord -Force Write-Host "[+] Network Level Authentication (NLA) enforced." -ForegroundColor Green } # 3. Disable Remote Assistance (fAllowToGetHelp = 0) Set-ItemProperty -Path $RdpPath -Name "fAllowToGetHelp" -Value 0 -Type DWord -Force # 4. Disable and clean Solicited Remote Assistance Policies, set SSL, and delete temp folders $TSPoliciesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" if (-not (Test-Path $TSPoliciesPath)) { New-Item -Path $TSPoliciesPath -Force | Out-Null } Set-ItemProperty -Path $TSPoliciesPath -Name "fAllowToGetHelp" -Value 0 -Type DWord -Force Set-ItemProperty -Path $TSPoliciesPath -Name "SecurityLayer" -Value 2 -Type DWord -Force Set-ItemProperty -Path $TSPoliciesPath -Name "DeleteTempDirsOnExit" -Value 1 -Type DWord -Force $ParamsToDelete = @("MaxTicketExpiryUnits", "MaxTicketExpiry", "fUseMailto", "fAllowFullControl") foreach ($Param in $ParamsToDelete) { if (Get-ItemProperty -Path $TSPoliciesPath -Name $Param -ErrorAction SilentlyContinue) { Remove-ItemProperty -Path $TSPoliciesPath -Name $Param -Force -ErrorAction SilentlyContinue } } Write-Host "[+] Remote Desktop policies (SSL, Temp folders, Solicited Help) configured and cleaned." -ForegroundColor Green To audit Remote Desktop and Remote Assistance status on the PAW: Download Script: Test-PawRemoteDesktopStatus.ps1 # Test-PawRemoteDesktopStatus.ps1 # Description: Audits local RDP, Remote Assistance, security layer, temp folders, and NLA registry configuration and listening firewall ports on PAWs. Write-Host "--- Auditing Remote Desktop Configuration ---" -ForegroundColor Cyan $RdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" $RdpSecPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" $TSPoliciesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" $DenyTS = Get-ItemProperty -Path $RdpPath -Name "fDenyTSConnections" -ErrorAction SilentlyContinue $DenyVal = if ($DenyTS) { $DenyTS.fDenyTSConnections } else { 1 } $NlaProp = Get-ItemProperty -Path $RdpSecPath -Name "UserAuthentication" -ErrorAction SilentlyContinue $NlaVal = if ($NlaProp) { $NlaProp.UserAuthentication } else { 0 } $DenyColor = if ($DenyVal -eq 1) { "Green" } else { "Red" } $NlaColor = if ($NlaVal -eq 1) { "Green" } else { "Red" } Write-Host " - fDenyTSConnections: $DenyVal (Required = 1 to block all)" -ForegroundColor $DenyColor Write-Host " - UserAuthentication (NLA): $NlaVal (Required = 1 if RDP is enabled)" -ForegroundColor $NlaColor # Check if port 3389 firewall rule is active and enabled $RdpFirewall = Get-NetFirewallRule -Name "RemoteDesktop-UserMode-In-TCP" -ErrorAction SilentlyContinue if ($RdpFirewall) { $FirewallColor = if ($RdpFirewall.Enabled -eq $true) { "Red" } else { "Green" } Write-Host " - RDP Inbound Firewall Rule Active: $($RdpFirewall.Enabled) (Expected = False)" -ForegroundColor $FirewallColor } # Audit Remote Assistance $GetHelpTS = Get-ItemProperty -Path $RdpPath -Name "fAllowToGetHelp" -ErrorAction SilentlyContinue $GetHelpTSVal = if ($GetHelpTS) { $GetHelpTS.fAllowToGetHelp } else { 0 } $HelpColor = if ($GetHelpTSVal -eq 0) { "Green" } else { "Red" } Write-Host " - fAllowToGetHelp (Terminal Server): $GetHelpTSVal (Recommended = 0)" -ForegroundColor $HelpColor # Audit Solicited Remote Assistance Policy, Security Layer, and Temp Folders if (Test-Path $TSPoliciesPath) { $PolGetHelp = Get-ItemProperty -Path $TSPoliciesPath -Name "fAllowToGetHelp" -ErrorAction SilentlyContinue $PolGetHelpVal = if ($PolGetHelp) { $PolGetHelp.fAllowToGetHelp } else { $null } $PolHelpColor = if ($PolGetHelpVal -eq 0) { "Green" } else { "Red" } Write-Host " - fAllowToGetHelp (Policies): $PolGetHelpVal (Recommended = 0)" -ForegroundColor $PolHelpColor $SecurityLayerProp = Get-ItemProperty -Path $TSPoliciesPath -Name "SecurityLayer" -ErrorAction SilentlyContinue $SecurityLayerVal = if ($SecurityLayerProp) { $SecurityLayerProp.SecurityLayer } else { $null } $SecLayerColor = if ($SecurityLayerVal -eq 2) { "Green" } else { "Red" } Write-Host " - SecurityLayer (SSL): $SecurityLayerVal (Required = 2)" -ForegroundColor $SecLayerColor $DeleteTempProp = Get-ItemProperty -Path $TSPoliciesPath -Name "DeleteTempDirsOnExit" -ErrorAction SilentlyContinue $DeleteTempVal = if ($DeleteTempProp) { $DeleteTempProp.DeleteTempDirsOnExit } else { $null } $DeleteTempColor = if ($DeleteTempVal -eq 1) { "Green" } else { "Red" } Write-Host " - DeleteTempDirsOnExit (Temp Folders): $DeleteTempVal (Required = 1)" -ForegroundColor $DeleteTempColor $Params = @("MaxTicketExpiryUnits", "MaxTicketExpiry", "fUseMailto", "fAllowFullControl") foreach ($Param in $Params) { $Val = (Get-ItemProperty -Path $TSPoliciesPath -Name $Param -ErrorAction SilentlyContinue).$Param if ($null -ne $Val) { Write-Host " - VULNERABLE: Solicited Remote Assistance parameter '$Param' is set to '$Val' (Expected: Deleted/Not Configured)" -ForegroundColor Red } else { Write-Host " - Parameter '$Param': Not Configured (Correct)" -ForegroundColor Green } } } else { Write-Host " - Solicited Remote Assistance Policy Path does not exist" -ForegroundColor Red } # Disable-PawRemoteDesktop.ps1 # Description: Disables Remote Desktop and Solicited Remote Assistance connections, sets NLA requirements, and cleans parameters on PAWs. Write-Host "--- Restricting Remote Desktop and Remote Assistance Access ---" -ForegroundColor Cyan $RdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" # 1. Disable RDP Connections (fDenyTSConnections = 1) Set-ItemProperty -Path $RdpPath -Name "fDenyTSConnections" -Value 1 -Type DWord -Force Write-Host "[+] Inbound Remote Desktop connections disabled." -ForegroundColor Green # 2. Enforce Network Level Authentication (UserAuthentication = 1) $RdpSecPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" if (Test-Path $RdpSecPath) { Set-ItemProperty -Path $RdpSecPath -Name "UserAuthentication" -Value 1 -Type DWord -Force Write-Host "[+] Network Level Authentication (NLA) enforced." -ForegroundColor Green } # 3. Disable Remote Assistance (fAllowToGetHelp = 0) Set-ItemProperty -Path $RdpPath -Name "fAllowToGetHelp" -Value 0 -Type DWord -Force # 4. Disable and clean Solicited Remote Assistance Policies, set SSL, and delete temp folders $TSPoliciesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" if (-not (Test-Path $TSPoliciesPath)) { New-Item -Path $TSPoliciesPath -Force | Out-Null } Set-ItemProperty -Path $TSPoliciesPath -Name "fAllowToGetHelp" -Value 0 -Type DWord -Force Set-ItemProperty -Path $TSPoliciesPath -Name "SecurityLayer" -Value 2 -Type DWord -Force Set-ItemProperty -Path $TSPoliciesPath -Name "DeleteTempDirsOnExit" -Value 1 -Type DWord -Force $ParamsToDelete = @("MaxTicketExpiryUnits", "MaxTicketExpiry", "fUseMailto", "fAllowFullControl") foreach ($Param in $ParamsToDelete) { if (Get-ItemProperty -Path $TSPoliciesPath -Name $Param -ErrorAction SilentlyContinue) { Remove-ItemProperty -Path $TSPoliciesPath -Name $Param -Force -ErrorAction SilentlyContinue } } Write-Host "[+] Remote Desktop policies (SSL, Temp folders, Solicited Help) configured and cleaned." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/wsus-client-config.md In an isolated, air-gapped network, workstations cannot connect directly to Microsoft's online Update servers. If the system is left in its default configuration: 1. DNS/Firewall Pollution: Workstations will continuously attempt to resolve and connect to public Windows Update URLs (e.g., *.update.microsoft.com), filling firewall and local DNS resolver cache logs with timeouts and block events. 2. Missing Updates: Workstations will fail to receive security patches, critical updates, and Windows Defender definitions. 3. Control Bypass: Attackers or unapproved software could attempt to install out-of-band features or packages if update routes are not explicitly locked to internal sources. Enforcing the intranet update service location redirects all system update queries to the local WSUS server. Furthermore, enforcing Windows Delivery Optimization download mode to Group (2) limits peer-to-peer update sharing strictly to computers within the same active directory domain/group or local subnet boundaries, reducing bandwidth constraints on WAN/intranet segments and preventing unmanaged peer sharing. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Update Configure the following settings: Policy*: Configure Automatic Updates Setting*: Enabled Configure automatic updating*: 4 - Auto download and schedule the install Configure the service location: Policy*: Specify intranet Microsoft update service location Setting*: Enabled Set the intranet update service for detecting updates*: http://local-wsus.domain.local:8530 (Replace with your internal WSUS FQDN or IP) Set the intranet statistics server*: http://local-wsus.domain.local:8530 Navigate to: Policy*: Do not connect to any Windows Update Internet locations Setting*: Enabled (blocks fallback to public servers) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization Configure the following settings: Policy*: Download Mode Setting*: Enabled Download Mode*: Group (2) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure registry keys to enforce local WSUS parameters and Delivery Optimization download mode. Download Script: Set-PawWSUSClientConfiguration.ps1 # Set-PawWSUSClientConfiguration.ps1 # Description: Configures local registry keys to point the Windows Update client to the intranet WSUS server and enforces DO Group mode on PAWs. Write-Host "--- Configuring WSUS Client Settings ---" -ForegroundColor Cyan $WUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $WUAUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $DOPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" # 1. Create keys if they do not exist if (-not (Test-Path $WUPath)) { New-Item -Path $WUPath -Force | Out-Null } if (-not (Test-Path $WUAUPath)) { New-Item -Path $WUAUPath -Force | Out-Null } if (-not (Test-Path $DOPath)) { New-Item -Path $DOPath -Force | Out-Null } # Define intranet WSUS URL $WSUSServer = "http://local-wsus.domain.local:8530" # 2. Configure update location and statistics server Set-ItemProperty -Path $WUPath -Name "WUServer" -Value $WSUSServer -Type String -Force Set-ItemProperty -Path $WUPath -Name "WUStatusServer" -Value $WSUSServer -Type String -Force Set-ItemProperty -Path $WUPath -Name "DoNotConnectToWindowsUpdateInternetLocations" -Value 1 -Type DWord -Force # 3. Configure Automatic Updates behavior (AUOptions = 4: Auto Download & Schedule) Set-ItemProperty -Path $WUAUPath -Name "NoAutoUpdate" -Value 0 -Type DWord -Force Set-ItemProperty -Path $WUAUPath -Name "AUOptions" -Value 4 -Type DWord -Force Set-ItemProperty -Path $WUAUPath -Name "UseWUServer" -Value 1 -Type DWord -Force # 4. Enforce DODownloadMode = 2 (Group) Set-ItemProperty -Path $DOPath -Name "DODownloadMode" -Value 2 -Type DWord -Force Write-Host "[+] Local WSUS parameters and Delivery Optimization download mode applied." -ForegroundColor Green To audit the WSUS client configuration status on the PAW: Download Script: Test-PawWSUSClientStatus.ps1 # Test-PawWSUSClientStatus.ps1 # Description: Audits registry values to verify WSUS server assignment and Delivery Optimization configuration on PAWs. Write-Host "--- Auditing WSUS Client Settings ---" -ForegroundColor Cyan $WUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $WUAUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $DOPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" $WUServerProp = Get-ItemProperty -Path $WUPath -Name "WUServer" -ErrorAction SilentlyContinue $WUStatusProp = Get-ItemProperty -Path $WUPath -Name "WUStatusServer" -ErrorAction SilentlyContinue $UseWUServerProp = Get-ItemProperty -Path $WUAUPath -Name "UseWUServer" -ErrorAction SilentlyContinue $WUServerVal = if ($WUServerProp) { $WUServerProp.WUServer } else { "" } $WUStatusVal = if ($WUStatusProp) { $WUStatusProp.WUStatusServer } else { "" } $UseWUVal = if ($UseWUServerProp) { $UseWUServerProp.UseWUServer } else { 0 } $ServerColor = if ($WUServerVal -like "http*") { "Green" } else { "Red" } $UseColor = if ($UseWUVal -eq 1) { "Green" } else { "Red" } Write-Host " - Intranet WUServer: $WUServerVal" -ForegroundColor $ServerColor Write-Host " - Intranet WUStatusServer: $WUStatusVal" -ForegroundColor $ServerColor Write-Host " - UseWUServer Active: $UseWUVal (Required = 1)" -ForegroundColor $UseColor # Audit Delivery Optimization $DOVal = if (Test-Path $DOPath) { (Get-ItemProperty -Path $DOPath -Name "DODownloadMode" -ErrorAction SilentlyContinue).DODownloadMode } else { $null } $DOColor = if ($DOVal -eq 2) { "Green" } else { "Red" } Write-Host " - Delivery Optimization DODownloadMode: $DOVal (Expected = 2)" -ForegroundColor $DOColor # Set-PawWSUSClientConfiguration.ps1 # Description: Configures local registry keys to point the Windows Update client to the intranet WSUS server and enforces DO Group mode on PAWs. Write-Host "--- Configuring WSUS Client Settings ---" -ForegroundColor Cyan $WUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $WUAUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $DOPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" # 1. Create keys if they do not exist if (-not (Test-Path $WUPath)) { New-Item -Path $WUPath -Force | Out-Null } if (-not (Test-Path $WUAUPath)) { New-Item -Path $WUAUPath -Force | Out-Null } if (-not (Test-Path $DOPath)) { New-Item -Path $DOPath -Force | Out-Null } # Define intranet WSUS URL $WSUSServer = "http://local-wsus.domain.local:8530" # 2. Configure update location and statistics server Set-ItemProperty -Path $WUPath -Name "WUServer" -Value $WSUSServer -Type String -Force Set-ItemProperty -Path $WUPath -Name "WUStatusServer" -Value $WSUSServer -Type String -Force Set-ItemProperty -Path $WUPath -Name "DoNotConnectToWindowsUpdateInternetLocations" -Value 1 -Type DWord -Force # 3. Configure Automatic Updates behavior (AUOptions = 4: Auto Download & Schedule) Set-ItemProperty -Path $WUAUPath -Name "NoAutoUpdate" -Value 0 -Type DWord -Force Set-ItemProperty -Path $WUAUPath -Name "AUOptions" -Value 4 -Type DWord -Force Set-ItemProperty -Path $WUAUPath -Name "UseWUServer" -Value 1 -Type DWord -Force # 4. Enforce DODownloadMode = 2 (Group) Set-ItemProperty -Path $DOPath -Name "DODownloadMode" -Value 2 -Type DWord -Force Write-Host "[+] Local WSUS parameters and Delivery Optimization download mode applied." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/configure-exploit-protection.md Exploit Protection provides a set of advanced memory and vulnerability mitigations. These mitigations protect both the operating system and applications from memory corruption, buffer overflows, execution redirection, and process hijack attempts. By enforcing system-wide mitigations: 1. Data Execution Prevention (DEP): Enforces non-executable memory pages, preventing attackers from executing shellcode injected into data-only memory regions (such as the stack or heap). 2. Address Space Layout Randomization (ASLR): Randomizes the locations where system components, executable code, and memory allocations are loaded. Enabling Mandatory ASLR (Force Relocate Images), Bottom-Up ASLR, and High Entropy ASLR makes memory structures unpredictable, thwarting return-oriented programming (ROP) exploits. 3. Control Flow Guard (CFG): Verifies control flow integrity for indirect call targets at compile time, preventing attackers from hijacking indirect jumps to point to arbitrary payloads. 4. Structured Exception Handler Overwrite Protection (SEHOP): Blocks exploits that overwrite Structured Exception Handlers (SEH) to gain control of execution paths during error handling. 5. Heap Termination on Corruption: Immediately terminates a process if corruption is detected in its heap. This blocks heap-based buffer overflow exploitation before execution control can be seized. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Generate the Reference XML Configuration File Before configuring the GPO, you must create a reference XML file containing the desired Exploit Protection mitigations: 1. On a reference workstation, open the Windows Security app. 2. Select App & browser control and click Exploit protection settings. 3. Under the System settings tab, configure the following: Control Flow Guard (CFG) : On by default Data Execution Prevention (DEP): On by default Force randomization for images (Mandatory ASLR) : On by default Randomize memory allocations (Bottom-up ASLR): On by default High-entropy ASLR : On by default Validate exception chains (SEHOP): On by default Validate heap integrity : On by default 4. Select the Program settings tab and configure application-specific overrides for administrative utilities and scripting hosts (`powershell.exe`, `cmd.exe`, etc.) to apply EAF, IAF, and ROP mitigations. 5. Scroll to the bottom of the page and click Export settings*. 6. Save the file as ExploitProtectionSettings.xml. 7. Copy this XML file to a location accessible by target endpoints, or distribute it to local target directories (e.g., C:\ProgramData\ExploitProtection\ExploitProtectionSettings.xml) via Group Policy Preferences (Files). Step 2: Configure the Group Policy Setting Open the Group Policy Management Console (gpmc.msc) on a domain controller or management host. Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Exploit Guard\Exploit Protection Configure the following setting: Policy*: Use a common set of exploit protection settings Setting*: Enabled Options : Under the Path or Url* field, enter the full path to the XML file (e.g., C:\ProgramData\ExploitProtection\ExploitProtectionSettings.xml or a UNC share path). If utilizing Microsoft Security Guide templates: * Navigate to: Computer Configuration\Administrative Templates\MS Security Guide * Configure policies: Policy : `Enable Certificate Padding` -> Set to Enabled Policy : `Enable Structured Exception Handling Overwrite Protection (SEHOP)` -> Set to Enabled Lock down Exploit Protection settings against user tampering: * Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Security Center\App and Browser protection Configure policy: Prevent users from modifying settings -> Set to Enabled Link the GPO to the appropriate Organizational Unit (OU) containing the target PAWs. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the exploit protection profile locally on individual systems or standalone hosts. Download Script: Configure-PawExploitProtection.ps1 # Configure-PawExploitProtection.ps1 # Description: Generates the system-wide and application-specific Exploit Protection XML profile, applies it locally, and configures the policy registry keys on PAWs. Write-Host "Applying Exploit Protection Profile..." -ForegroundColor Cyan # 1. Define the XML content including System and App settings $XmlContent = @" <?xml version="1.0" encoding="utf-8"?> <MitigationPolicy> <SystemConfig> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <SEHOP Enable="true" TelemetryOnly="false" /> <Heap TerminateOnError="true" /> </SystemConfig> <AppConfig Executable="wscript.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="cscript.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="powershell.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> </MitigationPolicy> "@ # 2. Create the target directory and write the XML file $TargetDir = "C:\ProgramData\ExploitProtection" if (-not (Test-Path $TargetDir)) { New-Item -Path $TargetDir -ItemType Directory -Force | Out-Null } $XmlPath = "$TargetDir\ExploitProtectionSettings.xml" Set-Content -Path $XmlPath -Value $XmlContent -Encoding UTF8 Write-Host "Exploit Protection XML profile written to $($XmlPath)" -ForegroundColor Gray # 3. Apply the settings locally using the cmdlet if (Get-Command Set-ProcessMitigation -ErrorAction SilentlyContinue) { Set-ProcessMitigation -PolicyFilePath $XmlPath Write-Host "[+] Exploit protection system settings applied locally." -ForegroundColor Green } else { Write-Warning "Set-ProcessMitigation cmdlet is not available. Please ensure you are running Windows 10/11 or Windows Server 2016+." } # 4. Configure policy registry keys to point to the XML file $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "ExploitProtectionSettings" -Value $XmlPath -Type String -Force Write-Host "[+] GPO policy registry values configured." -ForegroundColor Green # 5. Configure MS Security Guide mitigations: Certificate Padding check and SEHOP registry keys $WintrustPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" if (-not (Test-Path $WintrustPath)) { New-Item -Path $WintrustPath -Force | Out-Null } Set-ItemProperty -Path $WintrustPath -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force $WintrustWow64Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" if (-not (Test-Path $WintrustWow64Path)) { New-Item -Path $WintrustWow64Path -Force | Out-Null } Set-ItemProperty -Path $WintrustWow64Path -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force $SessionKernelPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" if (-not (Test-Path $SessionKernelPath)) { New-Item -Path $SessionKernelPath -Force | Out-Null } Set-ItemProperty -Path $SessionKernelPath -Name "DisableExceptionChainValidation" -Value 0 -Type DWord -Force Write-Host "[+] Certificate Padding check and SEHOP registry keys applied." -ForegroundColor Green # 6. Prevent users from modifying Exploit Protection settings in Windows Security Center $SecCenterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" if (-not (Test-Path $SecCenterPath)) { New-Item -Path $SecCenterPath -Force | Out-Null } Set-ItemProperty -Path $SecCenterPath -Name "DisallowExploitProtectionOverride" -Value 1 -Type DWord -Force Write-Host "[+] Exploit protection override lockdown applied." -ForegroundColor Green Write-Host "Exploit Protection Profile application completed successfully." -ForegroundColor Cyan To verify the settings have been applied: Download Script: Get-PawExploitProtectionStatus.ps1 # Get-PawExploitProtectionStatus.ps1 # Description: Audits system-wide Exploit Protection settings against the recommended security baseline on PAWs. Write-Host "Auditing system-wide Exploit Protection mitigations..." -ForegroundColor Cyan $BaselineFailed = $false $Mitigations = Get-ProcessMitigation -System # Helper function to evaluate and display status function Test-MitigationSetting { param( [string]$MitigationName, [string]$CurrentValue, [string]$ExpectedValue ) if ($CurrentValue -eq $ExpectedValue) { Write-Host " [PASS] $($MitigationName): $($CurrentValue)" -ForegroundColor Green } else { Write-Host " [FAIL] $($MitigationName): $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:BaselineFailed = $true } } Write-Host "`nSystem-wide Mitigations:" -ForegroundColor Gray # Audit DEP Test-MitigationSetting -MitigationName "DEP Enable" -CurrentValue $Mitigations.DEP.Enable -ExpectedValue "ON" Test-MitigationSetting -MitigationName "DEP EmulateAtlThunks" -CurrentValue $Mitigations.DEP.EmulateAtlThunks -ExpectedValue "OFF" # Audit ASLR Test-MitigationSetting -MitigationName "ASLR ForceRelocateImages" -CurrentValue $Mitigations.ASLR.ForceRelocateImages -ExpectedValue "ON" Test-MitigationSetting -MitigationName "ASLR BottomUp" -CurrentValue $Mitigations.ASLR.BottomUp -ExpectedValue "ON" Test-MitigationSetting -MitigationName "ASLR HighEntropy" -CurrentValue $Mitigations.ASLR.HighEntropy -ExpectedValue "ON" # Audit CFG Test-MitigationSetting -MitigationName "CFG Enable" -CurrentValue $Mitigations.CFG.Enable -ExpectedValue "ON" # Audit SEHOP Test-MitigationSetting -MitigationName "SEHOP Enable" -CurrentValue $Mitigations.SEHOP.Enable -ExpectedValue "ON" # Audit Heap Test-MitigationSetting -MitigationName "Heap TerminateOnError" -CurrentValue $Mitigations.Heap.TerminateOnError -ExpectedValue "ON" # Audit Registry Policy and XML Configuration Write-Host "`nRegistry Policy and XML Configuration:" -ForegroundColor Gray $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection" if (Test-Path $RegPath) { $SettingsValue = Get-ItemProperty -Path $RegPath -Name "ExploitProtectionSettings" -ErrorAction SilentlyContinue if ($SettingsValue -and $SettingsValue.ExploitProtectionSettings -ne "") { $XmlPath = $SettingsValue.ExploitProtectionSettings Write-Host " [PASS] Exploit Protection Policy registry key is configured." -ForegroundColor Green Write-Host " Path: $XmlPath" -ForegroundColor Gray if (Test-Path $XmlPath) { Write-Host " [PASS] Exploit Protection XML file exists." -ForegroundColor Green try { [xml]$xml = Get-Content -Path $XmlPath -Raw -ErrorAction Stop # Verify SystemConfig block if ($xml.MitigationPolicy.SystemConfig) { Write-Host " [PASS] XML contains SystemConfig block." -ForegroundColor Green } else { Write-Host " [FAIL] XML is missing SystemConfig block." -ForegroundColor Red $BaselineFailed = $true } # Verify major AppConfigs $ExpectedApps = @("wscript.exe", "cscript.exe", "powershell.exe") $ConfiguredApps = $xml.MitigationPolicy.AppConfig | ForEach-Object { $_.Executable } foreach ($app in $ExpectedApps) { if ($ConfiguredApps -contains $app) { Write-Host " [PASS] XML contains application profile for: $app" -ForegroundColor Green } else { Write-Host " [FAIL] XML is missing application profile for: $app" -ForegroundColor Red $BaselineFailed = $true } } } catch { Write-Host " [FAIL] Failed to parse Exploit Protection XML. Error: $($_.Exception.Message)" -ForegroundColor Red $BaselineFailed = $true } } else { Write-Host " [FAIL] Exploit Protection XML file does not exist at specified path." -ForegroundColor Red $BaselineFailed = $true } } else { Write-Host " [FAIL] Exploit Protection Policy registry key is empty or missing." -ForegroundColor Red $BaselineFailed = $true } } else { Write-Host " [FAIL] Exploit Protection Policy registry path does not exist." -ForegroundColor Red $BaselineFailed = $true } # Audit MS Security Guide Registry Settings Write-Host "`nMS Security Guide Mitigations (Certificate Padding & SEHOP):" -ForegroundColor Gray function Test-MitigationRegistryValue ($path, $name, $expectedValue) { $val = Get-ItemProperty -Path $path -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } $color = "Red" if ($actual -eq $expectedValue) { $color = "Green" } else { $script:BaselineFailed = $true } Write-Host " - Registry Setting: $name | Actual: '$actual' (Expected: '$expectedValue')" -ForegroundColor $color } $WintrustPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" Test-MitigationRegistryValue $WintrustPath "EnableCertPaddingCheck" 1 $WintrustWow64Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" Test-MitigationRegistryValue $WintrustWow64Path "EnableCertPaddingCheck" 1 $SessionKernelPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" Test-MitigationRegistryValue $SessionKernelPath "DisableExceptionChainValidation" 0 $SecCenterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" Test-MitigationRegistryValue $SecCenterPath "DisallowExploitProtectionOverride" 1 Write-Host "" if ($BaselineFailed) { Write-Host "Auditing FAILED: One or more configurations do not match the secure baseline." -ForegroundColor Red exit 1 } else { Write-Host "Auditing PASSED: All configurations match the secure baseline." -ForegroundColor Green exit 0 } # Configure-PawExploitProtection.ps1 # Description: Generates the system-wide and application-specific Exploit Protection XML profile, applies it locally, and configures the policy registry keys on PAWs. Write-Host "Applying Exploit Protection Profile..." -ForegroundColor Cyan # 1. Define the XML content including System and App settings $XmlContent = @" <?xml version="1.0" encoding="utf-8"?> <MitigationPolicy> <SystemConfig> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <SEHOP Enable="true" TelemetryOnly="false" /> <Heap TerminateOnError="true" /> </SystemConfig> <AppConfig Executable="wscript.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="cscript.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="powershell.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> </MitigationPolicy> "@ # 2. Create the target directory and write the XML file $TargetDir = "C:\ProgramData\ExploitProtection" if (-not (Test-Path $TargetDir)) { New-Item -Path $TargetDir -ItemType Directory -Force | Out-Null } $XmlPath = "$TargetDir\ExploitProtectionSettings.xml" Set-Content -Path $XmlPath -Value $XmlContent -Encoding UTF8 Write-Host "Exploit Protection XML profile written to $($XmlPath)" -ForegroundColor Gray # 3. Apply the settings locally using the cmdlet if (Get-Command Set-ProcessMitigation -ErrorAction SilentlyContinue) { Set-ProcessMitigation -PolicyFilePath $XmlPath Write-Host "[+] Exploit protection system settings applied locally." -ForegroundColor Green } else { Write-Warning "Set-ProcessMitigation cmdlet is not available. Please ensure you are running Windows 10/11 or Windows Server 2016+." } # 4. Configure policy registry keys to point to the XML file $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "ExploitProtectionSettings" -Value $XmlPath -Type String -Force Write-Host "[+] GPO policy registry values configured." -ForegroundColor Green # 5. Configure MS Security Guide mitigations: Certificate Padding check and SEHOP registry keys $WintrustPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" if (-not (Test-Path $WintrustPath)) { New-Item -Path $WintrustPath -Force | Out-Null } Set-ItemProperty -Path $WintrustPath -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force $WintrustWow64Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" if (-not (Test-Path $WintrustWow64Path)) { New-Item -Path $WintrustWow64Path -Force | Out-Null } Set-ItemProperty -Path $WintrustWow64Path -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force $SessionKernelPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" if (-not (Test-Path $SessionKernelPath)) { New-Item -Path $SessionKernelPath -Force | Out-Null } Set-ItemProperty -Path $SessionKernelPath -Name "DisableExceptionChainValidation" -Value 0 -Type DWord -Force Write-Host "[+] Certificate Padding check and SEHOP registry keys applied." -ForegroundColor Green # 6. Prevent users from modifying Exploit Protection settings in Windows Security Center $SecCenterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" if (-not (Test-Path $SecCenterPath)) { New-Item -Path $SecCenterPath -Force | Out-Null } Set-ItemProperty -Path $SecCenterPath -Name "DisallowExploitProtectionOverride" -Value 1 -Type DWord -Force Write-Host "[+] Exploit protection override lockdown applied." -ForegroundColor Green Write-Host "Exploit Protection Profile application completed successfully." -ForegroundColor Cyan Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/disable-safe-mode-for-standard-users.md Malicious actors with standard user credentials can potentially bypass local security policies, local endpoint detection and response (EDR) agents, and group policy restrictions by booting the system into Safe Mode. In Safe Mode, many security agents and services do not load, creating an environment where local controls can be circumvented. By configuring SafeModeBlockNonAdmins = 1: 1. Prevent Credential Bypass: Standard users are blocked from logging in during Safe Mode, ensuring they cannot exploit the disabled security agents to execute unauthorized programs or extract system information. 2. Maintenance Integrity: Safe Mode remains accessible exclusively to system administrators for debugging and recovery, ensuring administrative capability is preserved while mitigating standard user risk. Option A: Group Policy Object (GPO) Configuration (Preferred) Because there is no native Administrative Template (ADMX) policy for this setting, it must be deployed using Group Policy Preferences (GPP) to configure the registry directly. Open the Group Policy Management Console (gpmc.msc) on a domain controller or management host. Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click in the right pane, select New > Registry Item, and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Value Name*: SafeModeBlockNonAdmins Value Type*: REG_DWORD Value Data*: 1 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally on standalone systems or during reference image build phases. Download Script: Configure-PawDisableSafeModeNonAdmins.ps1 # Configure-PawDisableSafeModeNonAdmins.ps1 # Description: Prevents standard users from logging into the system while in Safe Mode by setting SafeModeBlockNonAdmins to 1 on PAWs. $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "SafeModeBlockNonAdmins" $ValueData = 1 Write-Host "Applying hardening requirement: Restrict Safe Mode access to administrators..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-PawSafeModeNonAdminsStatus.ps1 # Get-PawSafeModeNonAdminsStatus.ps1 # Description: Checks the current configuration state of SafeModeBlockNonAdmins registry setting on PAWs. $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "SafeModeBlockNonAdmins" Write-Host "Auditing hardening requirement: Restrict Safe Mode access to administrators..." -ForegroundColor Cyan if (Test-Path $RegPath) { $value = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $value -and $value.$ValueName -eq 1) { Write-Host "Audit Result: Compliant. Standard users are blocked from logging in during Safe Mode ($ValueName = 1)." -ForegroundColor Green exit 0 } } Write-Host "Audit Result: Non-Compliant. Standard users are allowed to log in during Safe Mode." -ForegroundColor Red exit 1 # Configure-PawDisableSafeModeNonAdmins.ps1 # Description: Prevents standard users from logging into the system while in Safe Mode by setting SafeModeBlockNonAdmins to 1 on PAWs. $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "SafeModeBlockNonAdmins" $ValueData = 1 Write-Host "Applying hardening requirement: Restrict Safe Mode access to administrators..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/configure-windows-firewall.md Windows Defender Firewall is the primary host-based security control protecting endpoints from unauthorized incoming network connections and regulating outgoing network behaviors. A secure baseline requires enabling the firewall on all profiles, setting inbound connections to block by default, disabling notification prompts that can be bypassed by users, and implementing detailed auditing/logging to monitor network anomalies. Additionally: 1. Outbound LOLBins Blocking: Malicious actors frequently abuse built-in Windows administrative utilities (known as Living Off the Land Binaries, or LOLBins) to download malicious payloads, exfiltrate sensitive data, and communicate with external command-and-control (C2) servers. Blocking outbound network communication for binaries that have no legitimate business requirement to connect to external networks (such as mshta.exe, certutil.exe, bitsadmin.exe, regsvr32.exe, rundll32.exe, cscript.exe, wscript.exe, and hh.exe) significantly mitigates these threat vectors. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Configure Profile States and Logging Open the Group Policy Management Console (gpmc.msc) on a domain controller or management workstation. Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security Right-click Windows Defender Firewall with Advanced Security and select Properties. Configure the Domain Profile tab: Firewall state*: On (recommended) Inbound connections*: Block (default) Outbound connections*: Allow (default) Click Customize... under Settings*: Display a notification*: No Apply local firewall rules*: No Apply local connection security rules*: No Click Customize... under Logging*: Name*: %SystemRoot%\System32\logfiles\firewall\domainfw.log Size limit (KB)*: 16384 Log dropped packets*: Yes Log successful connections*: No Configure the Private Profile tab: Firewall state*: On (recommended) Inbound connections*: Block (default) Outbound connections*: Allow (default) Click Customize... under Settings*: Display a notification*: No Apply local firewall rules*: No Apply local connection security rules*: No Click Customize... under Logging*: Name*: %SystemRoot%\System32\logfiles\firewall\privatefw.log Size limit (KB)*: 16384 Log dropped packets*: Yes Log successful connections*: No Configure the Public Profile tab: Firewall state*: On (recommended) Inbound connections*: Block (default) Outbound connections*: Allow (default) Click Customize... under Settings*: Display a notification*: No Apply local firewall rules*: No Apply local connection security rules*: No Click Customize... under Logging*: Name*: %SystemRoot%\System32\logfiles\firewall\publicfw.log Size limit (KB)*: 16384 Log dropped packets*: Yes Log successful connections*: No 2. Create Outbound Rules for Known LOLBins Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Outbound Rules Create a new rule for each target LOLBin binary (e.g., mshta.exe, certutil.exe, bitsadmin.exe, regsvr32.exe, rundll32.exe, cscript.exe, wscript.exe, hh.exe, calc.exe, notepad.exe, conhost.exe, RunScriptHelper.exe): Right-click Outbound Rules and select New Rule... Rule Type*: Program Program*: Choose This program path and enter the path matching the binary (both x64 and x86 paths if applicable, e.g., %SystemRoot%\System32\mshta.exe and %SystemRoot%\SysWOW64\mshta.exe). Action*: Block the connection Profile*: Select Domain, Private, and Public. Name*: Specify a descriptive name (e.g., Hardening: Block Outbound mshta.exe (x64)). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure Windows Defender Firewall profiles, logging parameters, merge settings, and outbound LOLBins rules. Download Script: Configure-PawWindowsFirewall.ps1 # Configure-PawWindowsFirewall.ps1 # Description: Configures Windows Defender Firewall profiles (Domain, Private, Public) and blocks outbound traffic for known LOLBins on PAWs. Write-Host "Configuring Windows Defender Firewall profiles..." -ForegroundColor Cyan # 1. Configure profiles $FWProfiles = @("Domain", "Private", "Public") foreach ($FWProfile in $FWProfiles) { $LogFile = "$env:windir\System32\logfiles\firewall\$($FWProfile.ToLower())fw.log" Set-NetFirewallProfile -Profile $FWProfile ` -Enabled True ` -DefaultInboundAction Block ` -DefaultOutboundAction Allow ` -NotifyOnListen False ` -AllowLocalPolicyMerge False ` -AllowLocalIPsecPolicyMerge False ` -LogFileName $LogFile ` -LogMaxSizeKilobytes 16384 ` -LogBlocked True ` -LogAllowed False | Out-Null Write-Host "[+] Profile '$FWProfile' configured with logging and defaults." -ForegroundColor Green } # 2. Block outbound traffic for known LOLBins $Lolbins = @( @{ Name = "mshta.exe (x64)"; Path = "%SystemRoot%\System32\mshta.exe" }, @{ Name = "mshta.exe (x86)"; Path = "%SystemRoot%\SysWOW64\mshta.exe" }, @{ Name = "certutil.exe (x64)"; Path = "%SystemRoot%\System32\certutil.exe" }, @{ Name = "certutil.exe (x86)"; Path = "%SystemRoot%\SysWOW64\certutil.exe" }, @{ Name = "bitsadmin.exe (x64)"; Path = "%SystemRoot%\System32\bitsadmin.exe" }, @{ Name = "bitsadmin.exe (x86)"; Path = "%SystemRoot%\SysWOW64\bitsadmin.exe" }, @{ Name = "regsvr32.exe (x64)"; Path = "%SystemRoot%\System32\regsvr32.exe" }, @{ Name = "regsvr32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\regsvr32.exe" }, @{ Name = "rundll32.exe (x64)"; Path = "%SystemRoot%\System32\rundll32.exe" }, @{ Name = "rundll32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\rundll32.exe" }, @{ Name = "cscript.exe (x64)"; Path = "%SystemRoot%\System32\cscript.exe" }, @{ Name = "cscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\cscript.exe" }, @{ Name = "wscript.exe (x64)"; Path = "%SystemRoot%\System32\wscript.exe" }, @{ Name = "wscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\wscript.exe" }, @{ Name = "hh.exe (x64)"; Path = "%SystemRoot%\hh.exe" }, @{ Name = "hh.exe (x86)"; Path = "%SystemRoot%\SysWOW64\hh.exe" }, @{ Name = "calc.exe (x64)"; Path = "%SystemRoot%\System32\calc.exe" }, @{ Name = "calc.exe (x86)"; Path = "%SystemRoot%\SysWOW64\calc.exe" }, @{ Name = "notepad.exe (x64)"; Path = "%SystemRoot%\System32\notepad.exe" }, @{ Name = "notepad.exe (x86)"; Path = "%SystemRoot%\SysWOW64\notepad.exe" }, @{ Name = "conhost.exe (x64)"; Path = "%SystemRoot%\System32\conhost.exe" }, @{ Name = "conhost.exe (x86)"; Path = "%SystemRoot%\SysWOW64\conhost.exe" }, @{ Name = "RunScriptHelper.exe (x64)"; Path = "%SystemRoot%\System32\RunScriptHelper.exe" }, @{ Name = "RunScriptHelper.exe (x86)"; Path = "%SystemRoot%\SysWOW64\RunScriptHelper.exe" } ) Write-Host "Configuring outbound firewall block rules for known LOLBins..." -ForegroundColor Cyan foreach ($Bin in $Lolbins) { $DisplayName = "Hardening: Block Outbound $($Bin.Name)" $Existing = Get-NetFirewallRule -DisplayName $DisplayName -ErrorAction SilentlyContinue if ($null -eq $Existing) { New-NetFirewallRule -DisplayName $DisplayName ` -Name $DisplayName ` -Direction Outbound ` -Action Block ` -Program $Bin.Path ` -Profile Any ` -Enabled True | Out-Null Write-Host "[+] Outbound block rule created for $($Bin.Name)." -ForegroundColor Green } else { Set-NetFirewallRule -DisplayName $DisplayName -Action Block -Enabled True | Out-Null Write-Host "[~] Outbound block rule for $($Bin.Name) already exists, updated state to Enabled/Block." -ForegroundColor Gray } } Write-Host "Firewall profiles and LOLBins outbound rules configured successfully." -ForegroundColor Green To verify the settings have been applied: Download Script: Get-PawWindowsFirewallStatus.ps1 # Get-PawWindowsFirewallStatus.ps1 # Description: Audits Windows Defender Firewall profile configurations and outbound block rules for known LOLBins on PAWs. Write-Host "--- Auditing Windows Defender Firewall Configuration ---" -ForegroundColor Cyan $script:Vulnerable = $false # Helper function to audit firewall profiles function Test-FirewallProfile ($ProfileName, $ExpectMergeLocal, $ExpectMergeIPsec) { $FWProfile = Get-NetFirewallProfile -Profile $ProfileName -ErrorAction SilentlyContinue if ($null -eq $FWProfile) { Write-Host " - Profile '$ProfileName' NOT FOUND" -ForegroundColor Red $script:Vulnerable = $true return } $EnabledColor = if ($FWProfile.Enabled -eq $true) { "Green" } else { "Red" } $InboundColor = if ($FWProfile.DefaultInboundAction -eq "Block") { "Green" } else { "Red" } $OutboundColor = if ($FWProfile.DefaultOutboundAction -eq "Allow") { "Green" } else { "Red" } $NotifyColor = if ($FWProfile.NotifyOnListen -eq $false) { "Green" } else { "Red" } Write-Host " * Profile: $ProfileName" -ForegroundColor Gray Write-Host " - Enabled: $($FWProfile.Enabled) (Expected: True)" -ForegroundColor $EnabledColor Write-Host " - DefaultInboundAction: $($FWProfile.DefaultInboundAction) (Expected: Block)" -ForegroundColor $InboundColor Write-Host " - DefaultOutboundAction: $($FWProfile.DefaultOutboundAction) (Expected: Allow)" -ForegroundColor $OutboundColor Write-Host " - NotifyOnListen: $($FWProfile.NotifyOnListen) (Expected: False)" -ForegroundColor $NotifyColor # Check log configurations $LogPath = "$env:windir\System32\logfiles\firewall\$($ProfileName.ToLower())fw.log" $LogPathColor = if ($FWProfile.LogFileName -eq $LogPath) { "Green" } else { "Red" } $LogSizeColor = if ($FWProfile.LogMaxSizeKilobytes -ge 16384) { "Green" } else { "Red" } $LogBlockedColor = if ($FWProfile.LogBlocked -eq $true) { "Green" } else { "Red" } $LogAllowedColor = if ($FWProfile.LogAllowed -eq $false) { "Green" } else { "Red" } Write-Host " - LogFileName: $($FWProfile.LogFileName) (Expected: $LogPath)" -ForegroundColor $LogPathColor Write-Host " - LogMaxSizeKilobytes: $($FWProfile.LogMaxSizeKilobytes) (Expected: >= 16384)" -ForegroundColor $LogSizeColor Write-Host " - LogBlocked: $($FWProfile.LogBlocked) (Expected: True)" -ForegroundColor $LogBlockedColor Write-Host " - LogAllowed: $($FWProfile.LogAllowed) (Expected: False)" -ForegroundColor $LogAllowedColor if ($FWProfile.Enabled -ne $true -or $FWProfile.DefaultInboundAction -ne "Block" -or $FWProfile.NotifyOnListen -ne $false -or $FWProfile.LogFileName -ne $LogPath -or $FWProfile.LogMaxSizeKilobytes -lt 16384 -or $FWProfile.LogBlocked -ne $true -or $FWProfile.LogAllowed -ne $false) { $script:Vulnerable = $true } if ($null -ne $ExpectMergeLocal) { $MergeLocalColor = if ($FWProfile.AllowLocalPolicyMerge -eq $ExpectMergeLocal) { "Green" } else { "Red" } Write-Host " - AllowLocalPolicyMerge: $($FWProfile.AllowLocalPolicyMerge) (Expected: $ExpectMergeLocal)" -ForegroundColor $MergeLocalColor if ($FWProfile.AllowLocalPolicyMerge -ne $ExpectMergeLocal) { $script:Vulnerable = $true } } if ($null -ne $ExpectMergeIPsec) { $MergeIPsecColor = if ($FWProfile.AllowLocalIPsecPolicyMerge -eq $ExpectMergeIPsec) { "Green" } else { "Red" } Write-Host " - AllowLocalIPsecPolicyMerge: $($FWProfile.AllowLocalIPsecPolicyMerge) (Expected: $ExpectMergeIPsec)" -ForegroundColor $MergeIPsecColor if ($FWProfile.AllowLocalIPsecPolicyMerge -ne $ExpectMergeIPsec) { $script:Vulnerable = $true } } } Write-Host "Auditing profiles..." -ForegroundColor Gray Test-FirewallProfile -ProfileName "Domain" -ExpectMergeLocal $false -ExpectMergeIPsec $false Test-FirewallProfile -ProfileName "Private" -ExpectMergeLocal $false -ExpectMergeIPsec $false Test-FirewallProfile -ProfileName "Public" -ExpectMergeLocal $false -ExpectMergeIPsec $false # Audit outbound rules for known LOLBins $Lolbins = @( @{ Name = "mshta.exe (x64)"; Path = "%SystemRoot%\System32\mshta.exe" }, @{ Name = "mshta.exe (x86)"; Path = "%SystemRoot%\SysWOW64\mshta.exe" }, @{ Name = "certutil.exe (x64)"; Path = "%SystemRoot%\System32\certutil.exe" }, @{ Name = "certutil.exe (x86)"; Path = "%SystemRoot%\SysWOW64\certutil.exe" }, @{ Name = "bitsadmin.exe (x64)"; Path = "%SystemRoot%\System32\bitsadmin.exe" }, @{ Name = "bitsadmin.exe (x86)"; Path = "%SystemRoot%\SysWOW64\bitsadmin.exe" }, @{ Name = "regsvr32.exe (x64)"; Path = "%SystemRoot%\System32\regsvr32.exe" }, @{ Name = "regsvr32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\regsvr32.exe" }, @{ Name = "rundll32.exe (x64)"; Path = "%SystemRoot%\System32\rundll32.exe" }, @{ Name = "rundll32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\rundll32.exe" }, @{ Name = "cscript.exe (x64)"; Path = "%SystemRoot%\System32\cscript.exe" }, @{ Name = "cscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\cscript.exe" }, @{ Name = "wscript.exe (x64)"; Path = "%SystemRoot%\System32\wscript.exe" }, @{ Name = "wscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\wscript.exe" }, @{ Name = "hh.exe (x64)"; Path = "%SystemRoot%\hh.exe" }, @{ Name = "hh.exe (x86)"; Path = "%SystemRoot%\SysWOW64\hh.exe" }, @{ Name = "calc.exe (x64)"; Path = "%SystemRoot%\System32\calc.exe" }, @{ Name = "calc.exe (x86)"; Path = "%SystemRoot%\SysWOW64\calc.exe" }, @{ Name = "notepad.exe (x64)"; Path = "%SystemRoot%\System32\notepad.exe" }, @{ Name = "notepad.exe (x86)"; Path = "%SystemRoot%\SysWOW64\notepad.exe" }, @{ Name = "conhost.exe (x64)"; Path = "%SystemRoot%\System32\conhost.exe" }, @{ Name = "conhost.exe (x86)"; Path = "%SystemRoot%\SysWOW64\conhost.exe" }, @{ Name = "RunScriptHelper.exe (x64)"; Path = "%SystemRoot%\System32\RunScriptHelper.exe" }, @{ Name = "RunScriptHelper.exe (x86)"; Path = "%SystemRoot%\SysWOW64\RunScriptHelper.exe" } ) Write-Host "Auditing outbound firewall rules for known LOLBins..." -ForegroundColor Gray foreach ($Bin in $Lolbins) { $DisplayName = "Hardening: Block Outbound $($Bin.Name)" $Rule = Get-NetFirewallRule -DisplayName $DisplayName -ErrorAction SilentlyContinue $Color = "Red" if ($null -ne $Rule) { $ProgFilter = Get-NetFirewallApplicationFilter -AssociatedNetFirewallRule $Rule -ErrorAction SilentlyContinue $ProgPath = "None" if ($null -ne $ProgFilter) { $ProgPath = $ProgFilter.Program } if ($Rule.Enabled -eq $true -and $Rule.Direction -eq "Outbound" -and $Rule.Action -eq "Block" -and $ProgPath -eq $Bin.Path) { $Color = "Green" Write-Host " - Firewall Rule: $DisplayName | Enabled: True | Action: Block | Program: $ProgPath (Compliant)" -ForegroundColor $Color } else { $script:Vulnerable = $true Write-Host " - Firewall Rule: $DisplayName | Enabled: $($Rule.Enabled) | Action: $($Rule.Action) | Program: $ProgPath (Non-Compliant)" -ForegroundColor $Color } } else { $script:Vulnerable = $true Write-Host " - Firewall Rule: $DisplayName | NOT FOUND (Non-Compliant)" -ForegroundColor $Color } } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-PawWindowsFirewall.ps1 # Description: Configures Windows Defender Firewall profiles (Domain, Private, Public) and blocks outbound traffic for known LOLBins on PAWs. Write-Host "Configuring Windows Defender Firewall profiles..." -ForegroundColor Cyan # 1. Configure profiles $FWProfiles = @("Domain", "Private", "Public") foreach ($FWProfile in $FWProfiles) { $LogFile = "$env:windir\System32\logfiles\firewall\$($FWProfile.ToLower())fw.log" Set-NetFirewallProfile -Profile $FWProfile ` -Enabled True ` -DefaultInboundAction Block ` -DefaultOutboundAction Allow ` -NotifyOnListen False ` -AllowLocalPolicyMerge False ` -AllowLocalIPsecPolicyMerge False ` -LogFileName $LogFile ` -LogMaxSizeKilobytes 16384 ` -LogBlocked True ` -LogAllowed False | Out-Null Write-Host "[+] Profile '$FWProfile' configured with logging and defaults." -ForegroundColor Green } # 2. Block outbound traffic for known LOLBins $Lolbins = @( @{ Name = "mshta.exe (x64)"; Path = "%SystemRoot%\System32\mshta.exe" }, @{ Name = "mshta.exe (x86)"; Path = "%SystemRoot%\SysWOW64\mshta.exe" }, @{ Name = "certutil.exe (x64)"; Path = "%SystemRoot%\System32\certutil.exe" }, @{ Name = "certutil.exe (x86)"; Path = "%SystemRoot%\SysWOW64\certutil.exe" }, @{ Name = "bitsadmin.exe (x64)"; Path = "%SystemRoot%\System32\bitsadmin.exe" }, @{ Name = "bitsadmin.exe (x86)"; Path = "%SystemRoot%\SysWOW64\bitsadmin.exe" }, @{ Name = "regsvr32.exe (x64)"; Path = "%SystemRoot%\System32\regsvr32.exe" }, @{ Name = "regsvr32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\regsvr32.exe" }, @{ Name = "rundll32.exe (x64)"; Path = "%SystemRoot%\System32\rundll32.exe" }, @{ Name = "rundll32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\rundll32.exe" }, @{ Name = "cscript.exe (x64)"; Path = "%SystemRoot%\System32\cscript.exe" }, @{ Name = "cscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\cscript.exe" }, @{ Name = "wscript.exe (x64)"; Path = "%SystemRoot%\System32\wscript.exe" }, @{ Name = "wscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\wscript.exe" }, @{ Name = "hh.exe (x64)"; Path = "%SystemRoot%\hh.exe" }, @{ Name = "hh.exe (x86)"; Path = "%SystemRoot%\SysWOW64\hh.exe" }, @{ Name = "calc.exe (x64)"; Path = "%SystemRoot%\System32\calc.exe" }, @{ Name = "calc.exe (x86)"; Path = "%SystemRoot%\SysWOW64\calc.exe" }, @{ Name = "notepad.exe (x64)"; Path = "%SystemRoot%\System32\notepad.exe" }, @{ Name = "notepad.exe (x86)"; Path = "%SystemRoot%\SysWOW64\notepad.exe" }, @{ Name = "conhost.exe (x64)"; Path = "%SystemRoot%\System32\conhost.exe" }, @{ Name = "conhost.exe (x86)"; Path = "%SystemRoot%\SysWOW64\conhost.exe" }, @{ Name = "RunScriptHelper.exe (x64)"; Path = "%SystemRoot%\System32\RunScriptHelper.exe" }, @{ Name = "RunScriptHelper.exe (x86)"; Path = "%SystemRoot%\SysWOW64\RunScriptHelper.exe" } ) Write-Host "Configuring outbound firewall block rules for known LOLBins..." -ForegroundColor Cyan foreach ($Bin in $Lolbins) { $DisplayName = "Hardening: Block Outbound $($Bin.Name)" $Existing = Get-NetFirewallRule -DisplayName $DisplayName -ErrorAction SilentlyContinue if ($null -eq $Existing) { New-NetFirewallRule -DisplayName $DisplayName ` -Name $DisplayName ` -Direction Outbound ` -Action Block ` -Program $Bin.Path ` -Profile Any ` -Enabled True | Out-Null Write-Host "[+] Outbound block rule created for $($Bin.Name)." -ForegroundColor Green } else { Set-NetFirewallRule -DisplayName $DisplayName -Action Block -Enabled True | Out-Null Write-Host "[~] Outbound block rule for $($Bin.Name) already exists, updated state to Enabled/Block." -ForegroundColor Gray } } Write-Host "Firewall profiles and LOLBins outbound rules configured successfully." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs). Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows 11 Enterprise. File Path: 07-paws/enable-secure-boot.md Secure Boot is a security standard developed by members of the PC industry to help ensure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system. If Secure Boot is disabled: 1. Bootkits & Rootkits: Attackers with physical access or local administrator privileges can replace the system bootloader with a malicious bootloader (bootkit). This bootkit executes before the Windows operating system loads, allowing it to bypass all Windows security controls, disable antivirus software, and run completely undetected. 2. Virtualization-Based Security: Advanced Windows defenses (like Credential Guard and Device Guard) depend on hardware-rooted trust. If Secure Boot is disabled, Virtualization-Based Security (VBS) cannot verify platform integrity, rendering these protections ineffective. Option A: Manual UEFI Firmware Configuration (Preferred) UEFI Secure Boot must be enabled in the hardware firmware menu directly (BIOS settings) during system startup: Turn on or restart the workstation and access the UEFI utility screen by pressing the vendor-specific key during POST (typically Delete, F2, F10, or F12). Navigate to the Security or Secure Boot section: Ensure Secure Boot is set to Enabled*. Ensure the Secure Boot Mode is set to Deployed or User Mode* (not Setup Mode). Save the configuration and restart the workstation. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Since Secure Boot is a hardware firmware configuration, it cannot be turned on from within Windows using registry settings. However, you can programmatically audit the state of Secure Boot to flag non-compliant hardware. Run the following script to check the status of Secure Boot on the local machine: Download Script: Audit-PawSecureBoot.ps1 # Audit-PawSecureBoot.ps1 # Description: Queries UEFI Secure Boot parameters and audits UEFI Secure Boot status. Write-Host "--- Auditing UEFI Secure Boot ---" -ForegroundColor Cyan $script:NonCompliant = $false # 1. Verify boot environment type if ($env:firmware_type -eq "UEFI") { Write-Host " - Boot Environment Type: UEFI" -ForegroundColor Green } else { Write-Host " - VULNERABLE: System booted in Legacy BIOS mode (CSM enabled) or firmware type is unrecognized." -ForegroundColor Red $script:NonCompliant = $true } # 2. Verify Secure Boot status try { # Confirm-SecureBootUEFI returns $true if Secure Boot is active, $false if disabled, # and throws an exception if the platform does not support UEFI or Secure Boot. $SecureBootState = Confirm-SecureBootUEFI -ErrorAction Stop $Color = if ($SecureBootState -eq $true) { "Green" } else { "Red" } Write-Host " - Secure Boot Active: $SecureBootState" -ForegroundColor $Color if ($SecureBootState -eq $false) { $script:NonCompliant = $true } } catch [System.PlatformNotSupportedException] { Write-Host " - VULNERABLE: UEFI Secure Boot is not supported on this platform (Legacy BIOS mode)." -ForegroundColor Red $script:NonCompliant = $true } catch { # If cmdlet throws unauthorized access or not enabled error Write-Host " - VULNERABLE: Secure Boot is disabled in firmware or cannot be verified. Error: $($_.Exception.Message)" -ForegroundColor Red $script:NonCompliant = $true } if ($script:NonCompliant) { exit 1 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) (Tier 0 Workstations) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/enforce-smartcard-logon-paws.md Enforcing smart card requirements at the local operating system level on administrative workstations provides vital physical and logical isolation: Password Logon Interface Block: Requiring a smart card at logon tells Winlogon to suppress the default username and password fields. This forces the credential provider to only accept certificate-based smart card inserts. An attacker who has somehow acquired a user's password (e.g. via social engineering or physical shoulder surfing) will be unable to log on interactively because the endpoint will not display the password input fields. Mitigation of Credential Replay Attacks: Traditional password logons store NTHashes locally in the LSA database or cache, which can be extracted by dumping LSASS memory. By using smart card credentials, the logon process utilizes public-key cryptography (Kerberos PKINIT) where the private key never leaves the secure boundaries of the smart card's hardware security chip. Session Interruption and Removal Enforcement: Enforcing smart card logons naturally aligns with the smart card removal behavior requirement. Removing the smart card locks the session, and re-entry is impossible without physically re-inserting the token and inputting the PIN. Option A: Group Policy Object (GPO) Configuration (Preferred) To enforce smart card logon on all PAWs via Group Policy: 1. Open the Group Policy Management Console (gpmc.msc) on a domain controller or administrative host. 2. Edit your dedicated PAW Group Policy Object (e.g., GPO_Hardening_PAWs). 3. Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options 4. In the details pane, double-click Interactive logon: Require smart card. 5. Select Enabled and click OK. 6. Ensure the GPO is linked to the PAW Organizational Unit (OU). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use these scripts locally on a PAW endpoint to enforce or audit the local smart card requirement. Download Script: Set-PAWSmartCardEnforcement.ps1 # Set-PAWSmartCardEnforcement.ps1 # Description: Configures the registry to require smart cards for interactive logons on PAWs. # Target Engine: Windows PowerShell 5.1 Write-Host "Enforcing smart card interactive logon requirement..." -ForegroundColor Cyan $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "ScForceOption" $ValueData = 1 if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force Write-Host "Smart card interactive logon requirement applied successfully." -ForegroundColor Green To audit the local smart card requirement on PAWs: Download Script: Test-PAWSmartCardEnforcement.ps1 # Test-PAWSmartCardEnforcement.ps1 # Description: Audits if the registry is configured to require smart cards for interactive logons on PAWs. # Target Engine: Windows PowerShell 5.1 Write-Host "--- Auditing PAW Smart Card Interactive Logon Requirement ---" -ForegroundColor Cyan $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "ScForceOption" $ExpectedValue = 1 $Vulnerable = $false if (Test-Path $RegPath) { $Property = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Property -and $Property.$ValueName -eq $ExpectedValue) { Write-Host " - Registry Setting: $ValueName | Actual: $($Property.$ValueName) (Expected: $ExpectedValue)" -ForegroundColor Green } else { $actualVal = if ($null -ne $Property) { $Property.$ValueName } else { "Not Found" } Write-Host " - Registry Setting: $ValueName | Actual: $actualVal (Expected: $ExpectedValue)" -ForegroundColor Red $Vulnerable = $true } } else { Write-Host " - Registry Path: $RegPath | Actual: Path Not Found (Expected: Path Exists)" -ForegroundColor Red $Vulnerable = $true } if ($Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Set-PAWSmartCardEnforcement.ps1 # Description: Configures the registry to require smart cards for interactive logons on PAWs. # Target Engine: Windows PowerShell 5.1 Write-Host "Enforcing smart card interactive logon requirement..." -ForegroundColor Cyan $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "ScForceOption" $ValueData = 1 if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force Write-Host "Smart card interactive logon requirement applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) (Tier 0 hosts). Operating Systems: Windows 10 (and above) Enterprise/Professional. File Path: 07-paws/disable-unused-features.md To enforce strict isolation and minimize the attack surface of Tier 0 Privileged Access Workstations, all unnecessary legacy protocols, optional features, and runtime engines must be disabled. PowerShell 2.0 Engine: Legacy PowerShell 2.0 does not support modern logging, transcription, or security monitoring mechanisms such as the Antimalware Scan Interface (AMSI). Attackers leverage "downgrade attacks" by executing PowerShell scripts using the -version 2.0 parameter to bypass script block logging and security tooling. Disabling the engine and its parent runtimes eliminates this bypass vector. .NET Framework 3.5: The .NET 3.5 Framework includes the runtime files for .NET 2.0 and 3.0. PowerShell 2.0 requires .NET 2.0/3.5 to run. Disabling .NET Framework 3.5 removes legacy runtime binaries that are susceptible to downgrade attacks and removes support for older, unpatched software. SMBv1 Protocol: The legacy SMBv1 protocol is cryptographically weak, lacks authentication integrity protection, and has been the target of catastrophic remote code execution attacks (such as EternalBlue). Leaving the SMBv1 driver active allows relaying and man-in-the-middle attacks. Internet Explorer 11: Internet Explorer contains obsolete MSHTML render engine components. Disabling this legacy browser reduces vulnerability to web-based code execution. Work Folders, XPS, DirectPlay, and Client Protocols: Services and tools such as Work Folders, XPS Viewer, DirectPlay, Telnet Client, TFTP Client, and Simple TCP/IP Services contain legacy network parsers and protocols that are completely unnecessary for a secure administrative system. WSL and Windows Sandbox: Virtualization layers such as the Windows Subsystem for Linux (WSL) and Windows Sandbox allow the execution of unmonitored binaries, containers, and Linux utilities. On a PAW, these components present an unacceptable audit-bypass risk and must be disabled. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Disable PowerShell 2.0 Compatibility Policy Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the target PAWs GPO (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows PowerShell Configure the following setting: Policy*: Turn on PowerShell 2.0 Compatibility Mode Setting*: Disabled Link the GPO to the PAWs Organizational Unit (OU). Step 2: Deploy Feature Disablement Startup Script Because Windows Optional Features are managed via DISM/Packages and lack direct GPO settings for feature removal, deploy the disablement script as a Computer Startup script: 1. In the same GPO, navigate to: Computer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown) 2. Double-click Startup, click the PowerShell Scripts tab. 3. Add the Disable-PawUnusedFeatures.ps1 script to execute on system startup. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally or run it as a startup script. Download Script: Disable-PawUnusedFeatures.ps1 # Disable-PawUnusedFeatures.ps1 # Description: Disables unused legacy features, .NET 3.5, and PowerShell 2.0 on the local PAW system. Write-Host "Disabling unused legacy features and PowerShell 2.0..." -ForegroundColor Cyan # Check if running as administrator $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if (-not $isAdmin) { Write-Error "This script must be run as an Administrator." exit 1 } # Features to disable (Client OS DISM feature names) $Features = @( "MicrosoftWindowsPowerShellV2", "MicrosoftWindowsPowerShellV2Root", "NetFx3", # .NET Framework 3.5 "SMB1Protocol", # SMBv1 Client "Internet-Explorer-Optional-amd64", # Internet Explorer 11 "WorkFolders-Client", # Work Folders Client "Xps-Viewer-Dependency", # XPS Viewer "DirectPlay", # DirectPlay "TelnetClient", # Telnet Client "TFTP", # TFTP Client "SimpleTCP", # Simple TCP/IP Services "Microsoft-Windows-Subsystem-Linux", # WSL (specifically disabled on PAWs) "Containers-DisposableClientVM" # Windows Sandbox (specifically disabled on PAWs) ) foreach ($Feature in $Features) { $State = Get-WindowsOptionalFeature -Online -FeatureName $Feature -ErrorAction SilentlyContinue if ($null -ne $State) { if ($State.State -eq "Enabled" -or $State.State -eq "EnabledPendingRestart") { Write-Host "[*] Disabling feature: $Feature..." -ForegroundColor Yellow Disable-WindowsOptionalFeature -Online -FeatureName $Feature -NoRestart -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Feature '$Feature' has been disabled." -ForegroundColor Green } else { Write-Host "[~] Feature '$Feature' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Feature '$Feature' is not present in this Windows image." -ForegroundColor Gray } } Write-Host "Optional features configuration completed." -ForegroundColor Green To verify the state of unused features: Download Script: Get-PawUnusedFeaturesStatus.ps1 # Get-PawUnusedFeaturesStatus.ps1 # Description: Audits the installation state of unused legacy features on the local PAW system. Write-Host "--- Auditing Unused Windows Features ---" -ForegroundColor Cyan # Check if running as administrator $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if (-not $isAdmin) { Write-Error "This script must be run as an Administrator." exit 1 } $script:Vulnerable = $false # Features to check (Client OS DISM feature names) $Features = @( "MicrosoftWindowsPowerShellV2", "MicrosoftWindowsPowerShellV2Root", "NetFx3", # .NET Framework 3.5 "SMB1Protocol", # SMBv1 Client "Internet-Explorer-Optional-amd64", # Internet Explorer 11 "WorkFolders-Client", # Work Folders Client "Xps-Viewer-Dependency", # XPS Viewer "DirectPlay", # DirectPlay "TelnetClient", # Telnet Client "TFTP", # TFTP Client "SimpleTCP", # Simple TCP/IP Services "Microsoft-Windows-Subsystem-Linux", # WSL (specifically disabled on PAWs) "Containers-DisposableClientVM" # Windows Sandbox (specifically disabled on PAWs) ) foreach ($Feature in $Features) { $State = Get-WindowsOptionalFeature -Online -FeatureName $Feature -ErrorAction SilentlyContinue if ($null -ne $State) { $IsEnabled = ($State.State -eq "Enabled" -or $State.State -eq "EnabledPendingRestart") $Color = if (-not $IsEnabled) { "Green" } else { "Red" } Write-Host " - Feature: $Feature | State: $($State.State) (Expected: Disabled)" -ForegroundColor $Color if ($IsEnabled) { $script:Vulnerable = $true } } else { Write-Host " - Feature: $Feature | Not Present (Compliant)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Disable-PawUnusedFeatures.ps1 # Description: Disables unused legacy features, .NET 3.5, and PowerShell 2.0 on the local PAW system. Write-Host "Disabling unused legacy features and PowerShell 2.0..." -ForegroundColor Cyan # Check if running as administrator $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if (-not $isAdmin) { Write-Error "This script must be run as an Administrator." exit 1 } # Features to disable (Client OS DISM feature names) $Features = @( "MicrosoftWindowsPowerShellV2", "MicrosoftWindowsPowerShellV2Root", "NetFx3", # .NET Framework 3.5 "SMB1Protocol", # SMBv1 Client "Internet-Explorer-Optional-amd64", # Internet Explorer 11 "WorkFolders-Client", # Work Folders Client "Xps-Viewer-Dependency", # XPS Viewer "DirectPlay", # DirectPlay "TelnetClient", # Telnet Client "TFTP", # TFTP Client "SimpleTCP", # Simple TCP/IP Services "Microsoft-Windows-Subsystem-Linux", # WSL (specifically disabled on PAWs) "Containers-DisposableClientVM" # Windows Sandbox (specifically disabled on PAWs) ) foreach ($Feature in $Features) { $State = Get-WindowsOptionalFeature -Online -FeatureName $Feature -ErrorAction SilentlyContinue if ($null -ne $State) { if ($State.State -eq "Enabled" -or $State.State -eq "EnabledPendingRestart") { Write-Host "[*] Disabling feature: $Feature..." -ForegroundColor Yellow Disable-WindowsOptionalFeature -Online -FeatureName $Feature -NoRestart -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Feature '$Feature' has been disabled." -ForegroundColor Green } else { Write-Host "[~] Feature '$Feature' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Feature '$Feature' is not present in this Windows image." -ForegroundColor Gray } } Write-Host "Optional features configuration completed." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) (Tier 0 Workstations) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/configure-office-security.md Malicious documents (e.g., weaponized Word, Excel, or PowerPoint files) containing embedded VBA macros are a prevalent initial access and execution vector. Similarly, embedding malicious OLE packages inside Outlook items (such as RTF-formatted emails) allows attackers to trigger script execution or execute arbitrary packages via packager.dll when an administrator opens or previews the email. Hardening these settings ensures: 1. Internet Macro Blocking: VBA macros in files downloaded from the Internet or untrusted external attachments are blocked from executing, regardless of user consent. 2. Macro Code Signing: Any locally run macros are restricted to trusted, digitally signed code, preventing the execution of ad-hoc unverified user scripts. 3. OLE Package Disablement: Restricting Outlook OLE package activation (ShowOLEPackageObj = 0) blocks the execution of dangerous embedded objects in email messages. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Enforce Macro Security in ADMX Templates Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO. Navigate to: User Configuration\Policies\Administrative Templates\Microsoft Office 2016\Security Settings\Trust Center Set the following policies: Policy : `VBA Macro Notification Settings` -> Enabled with option set to Disable all except digitally signed macros For each application (Word, Excel, PowerPoint, Access), navigate to: User Configuration\Policies\Administrative Templates\[Application] 2016\[Application] Options\Security\Trust Center Set the policy: Policy : `Block macros from running in Office files from the Internet` -> Enabled Step 2: Disable Outlook OLE Packages Navigate to: User Configuration\Policies\Administrative Templates\Microsoft Outlook 2016\Security Configure the setting: Policy : `Do not allow OLE package execution` -> Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the current user registry hives to enforce macro blocking and OLE package restrictions. Download Script: Configure-PawOfficeSecurity.ps1 # Configure-PawOfficeSecurity.ps1 # Description: Configures registry settings under the HKCU hive to restrict VBA macros and block Outlook OLE package execution on PAWs. Write-Host "Applying Microsoft Office security and OLE restrictions..." -ForegroundColor Cyan # Helper to configure User Registry DWORD values function Set-UserRegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$Path, [string]$Name, [int]$Value ) if ($PSCmdlet.ShouldProcess($Path, "Set registry DWORD value $Name to $Value")) { $FullRegistryPath = "HKCU:\$Path" if (-not (Test-Path $FullRegistryPath)) { New-Item -Path $FullRegistryPath -Force | Out-Null } Set-ItemProperty -Path $FullRegistryPath -Name $Name -Value $Value -Type DWord -Force } } # 1. Enforce macro signing policy (common) Set-UserRegDWord "software\policies\microsoft\office\16.0\common\security" "vbawarnings" 3 Write-Host "[+] Digital signing for Office macros enforced." -ForegroundColor Green # 2. Block macros from the Internet for key Office applications $Apps = @("excel", "word", "powerpoint", "access", "visio") foreach ($App in $Apps) { Set-UserRegDWord "software\policies\microsoft\office\16.0\$App\security" "blockcontentexecutionfrominternet" 1 } Write-Host "[+] VBA macro blocks from Internet applied to Office applications." -ForegroundColor Green # 3. Disable OLE Package execution in Outlook (Policies and Preferences branches) Set-UserRegDWord "software\policies\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 Set-UserRegDWord "software\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 Write-Host "[+] Outlook OLE Package execution blocked." -ForegroundColor Green To verify the current Office security settings: Download Script: Get-PawOfficeSecurityStatus.ps1 # Get-PawOfficeSecurityStatus.ps1 # Description: Audits Microsoft Office macro settings and Outlook OLE package restrictions on PAWs. Write-Host "--- Auditing Microsoft Office Security Baseline ---" -ForegroundColor Cyan $script:Vulnerable = $false # Helper to audit registry values under HKCU function Test-UserRegistryValue ($Path, $Name, $ExpectedValue) { $FullRegistryPath = "HKCU:\$Path" $Val = Get-ItemProperty -Path $FullRegistryPath -Name $Name -ErrorAction SilentlyContinue $Actual = if ($val) { $val.$Name } else { "" } $Color = "Red" if ($Actual -eq $ExpectedValue) { $Color = "Green" } else { $script:Vulnerable = $true } Write-Host " - User Registry: $Name | Actual: '$Actual' (Expected: '$ExpectedValue')" -ForegroundColor $Color } # 1. Audit macro signing warning Test-UserRegistryValue "software\policies\microsoft\office\16.0\common\security" "vbawarnings" 3 # 2. Audit macro Internet blocks $Apps = @("excel", "word", "powerpoint", "access", "visio") foreach ($App in $Apps) { Test-UserRegistryValue "software\policies\microsoft\office\16.0\$App\security" "blockcontentexecutionfrominternet" 1 } # 3. Audit Outlook OLE package block Test-UserRegistryValue "software\policies\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-PawOfficeSecurity.ps1 # Description: Configures registry settings under the HKCU hive to restrict VBA macros and block Outlook OLE package execution on PAWs. Write-Host "Applying Microsoft Office security and OLE restrictions..." -ForegroundColor Cyan # Helper to configure User Registry DWORD values function Set-UserRegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$Path, [string]$Name, [int]$Value ) if ($PSCmdlet.ShouldProcess($Path, "Set registry DWORD value $Name to $Value")) { $FullRegistryPath = "HKCU:\$Path" if (-not (Test-Path $FullRegistryPath)) { New-Item -Path $FullRegistryPath -Force | Out-Null } Set-ItemProperty -Path $FullRegistryPath -Name $Name -Value $Value -Type DWord -Force } } # 1. Enforce macro signing policy (common) Set-UserRegDWord "software\policies\microsoft\office\16.0\common\security" "vbawarnings" 3 Write-Host "[+] Digital signing for Office macros enforced." -ForegroundColor Green # 2. Block macros from the Internet for key Office applications $Apps = @("excel", "word", "powerpoint", "access", "visio") foreach ($App in $Apps) { Set-UserRegDWord "software\policies\microsoft\office\16.0\$App\security" "blockcontentexecutionfrominternet" 1 } Write-Host "[+] VBA macro blocks from Internet applied to Office applications." -ForegroundColor Green # 3. Disable OLE Package execution in Outlook (Policies and Preferences branches) Set-UserRegDWord "software\policies\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 Set-UserRegDWord "software\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 Write-Host "[+] Outlook OLE Package execution blocked." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs - Dedicated Tier 0 Administrative Workstations). (For Tier 2 Client Workstations, refer to [REQ-END-034](../08-endpoints/disable-windows-script-host.md); for Tier 0 Domain Controllers and Member Servers, refer to [REQ-DC-159](../02-domain-controllers/disable-windows-script-host.md)). Operating Systems: Windows 10 Enterprise (1809+), Windows 11 Enterprise (all supported builds). File Path: 07-paws/disable-windows-script-host.md Privileged Access Workstations (PAWs) serve as the dedicated management perimeter for Tier 0 Active Directory assets, enterprise PKI, and virtualization hosts. Because PAWs possess access tokens and administrative credentials with domain-wide authority, eliminating untrusted code execution pathways is paramount: Elimination of Legacy Scripting Engines: Windows Script Host (wscript.exe and cscript.exe) executes legacy VBScript and JScript engines. These hosts are prominent Living-off-the-Land Binaries (LOLBins / LOLBAS) that offer attackers opportunities for defense evasion, memory injection, and unconstrained script execution (MITRE ATT&CK T1059.005, T1059.007, T1218). PAWs have no operational requirement for legacy script execution. Defense-in-Depth Beyond Application Control: Even in environments where Windows Defender Application Control (WDAC) or AppLocker is deployed, disabling WSH at the registry engine layer ensures that wscript.exe and cscript.exe fail immediately upon invocation, preventing script execution even if policies are in audit mode or rule bypasses are attempted. Comprehensive 64-Bit and WOW6432Node Lockdown: Attackers frequently execute 32-bit binaries (%SystemRoot%\SysWOW64\wscript.exe) on 64-bit systems to bypass 64-bit security hooks. Enforcing Enabled = 0 and TrustPolicy = 2 across both native 64-bit and WOW6432Node registry paths ensures that 32-bit execution is completely disabled. TrustPolicy Hardening: Configuring TrustPolicy = 2 ensures that even if WSH were selectively invoked, unsigned and untrusted scripts are disallowed system-wide. Fail-Safe File Extension Remapping: Remapping .vbs, .vbe, .js, .jse, .wsf, .wsh, and .hta file associations to txtfile (notepad.exe) ensures that if an administrator inspects an administrative script or artifact, opening the file in Windows Explorer displays the plain text in Notepad rather than executing the script. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Disable WSH via GPO Computer Preferences Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Item for the native 64-bit hive: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: Enabled Value Type*: REG_DWORD Value Data*: 0 Create a second Registry Item for TrustPolicy: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: TrustPolicy Value Type*: REG_DWORD Value Data*: 2 Create a third Registry Item for 32-bit WOW64 disablement: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings Value Name*: Enabled Value Type*: REG_DWORD Value Data*: 0 Create a fourth Registry Item for 32-bit WOW64 TrustPolicy: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings Value Name*: TrustPolicy Value Type*: REG_DWORD Value Data*: 2 Step 2: Disable WSH in User Configuration Preferences Navigate to: User Configuration\Preferences\Windows Settings\Registry Create a new Registry Item: Action*: Update Hive*: HKEY_CURRENT_USER Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: Enabled Value Type*: REG_DWORD Value Data*: 0 Create a second Registry Item: Action*: Update Hive*: HKEY_CURRENT_USER Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: TrustPolicy Value Type*: REG_DWORD Value Data*: 2 Step 3: Remap Script File Extensions to Notepad Navigate to: User Configuration\Preferences\Control Panel Settings\Folder Options Right-click and select New -> Open With: File Extension*: vbs Associated Program*: %SystemRoot%\System32\notepad.exe Set as default*: Check Repeat for vbe, js, jse, wsf, wsh, and hta. Alternatively, configure system-wide registry preferences under HKLM\SOFTWARE\Classes\.<ext> setting the default string value to txtfile. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the local registry settings to disable WSH and remap associations. Download Script: Disable-PawWsh.ps1 # Disable-PawWsh.ps1 # Description: Disables Windows Script Host globally across 64-bit and 32-bit registry hives, enforces TrustPolicy, and remaps script file associations to Notepad on PAWs. Write-Host "Applying Windows Script Host and file association hardening for PAWs..." -ForegroundColor Cyan # 1. Disable WSH globally in 64-bit HKLM $RegistryHklm = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHklm)) { New-Item -Path $RegistryHklm -Force | Out-Null } Set-ItemProperty -Path $RegistryHklm -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHklm -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM." -ForegroundColor Green # 2. Disable WSH in WOW6432Node on 64-bit systems if ([Environment]::Is64BitOperatingSystem) { $RegistryWow64 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryWow64)) { New-Item -Path $RegistryWow64 -Force | Out-Null } Set-ItemProperty -Path $RegistryWow64 -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryWow64 -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM WOW6432Node." -ForegroundColor Green } # 3. Disable WSH in current user HKCU hive $RegistryHkcu = "HKCU:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHkcu)) { New-Item -Path $RegistryHkcu -Force | Out-Null } Set-ItemProperty -Path $RegistryHkcu -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHkcu -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH disabled in current user HKCU hive." -ForegroundColor Green # 4. Remap script file extensions to notepad $Extensions = @("vbs", "vbe", "js", "jse", "wsf", "wsh", "hta") foreach ($Ext in $Extensions) { $ProgIdPath = "HKLM:\SOFTWARE\Classes\.$Ext" # Update Class Association to Notepad if (-not (Test-Path $ProgIdPath)) { New-Item -Path $ProgIdPath -Force | Out-Null } Set-ItemProperty -Path $ProgIdPath -Name "" -Value "txtfile" -Type String -Force Write-Host " Mapped .$Ext extension to txtfile handler." -ForegroundColor Gray } Write-Host "[+] Script file extension handlers mapped to Notepad." -ForegroundColor Green To verify the WSH configuration state: Download Script: Get-PawWshStatus.ps1 # Get-PawWshStatus.ps1 # Description: Audits Windows Script Host registry state across 64-bit and 32-bit hives and script file extension association handlers on PAWs. Write-Host "--- Auditing Windows Script Host Hardening on PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit WSH Registry settings in 64-bit HKLM $RegistryHklm = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (Test-Path $RegistryHklm) { $ValHklm = (Get-ItemProperty -Path $RegistryHklm -Name "Enabled" -ErrorAction SilentlyContinue).Enabled if ($ValHklm -eq 0) { Write-Host " - HKLM WSH Enabled: 0 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: HKLM WSH is enabled or not configured (Value: '$($ValHklm)')" -ForegroundColor Red $script:Vulnerable = $true } $TrustHklm = (Get-ItemProperty -Path $RegistryHklm -Name "TrustPolicy" -ErrorAction SilentlyContinue).TrustPolicy if ($TrustHklm -eq 2) { Write-Host " - HKLM WSH TrustPolicy: 2 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: HKLM WSH TrustPolicy is not set to 2 (Value: '$($TrustHklm)')" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: HKLM WSH settings key is missing (Expected: Enabled = 0, TrustPolicy = 2)" -ForegroundColor Red $script:Vulnerable = $true } # 2. Audit WSH Registry settings in WOW6432Node on 64-bit systems if ([Environment]::Is64BitOperatingSystem) { $RegistryWow64 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" if (Test-Path $RegistryWow64) { $ValWow64 = (Get-ItemProperty -Path $RegistryWow64 -Name "Enabled" -ErrorAction SilentlyContinue).Enabled if ($ValWow64 -eq 0) { Write-Host " - WOW6432Node WSH Enabled: 0 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: WOW6432Node WSH is enabled or not configured (Value: '$($ValWow64)')" -ForegroundColor Red $script:Vulnerable = $true } $TrustWow64 = (Get-ItemProperty -Path $RegistryWow64 -Name "TrustPolicy" -ErrorAction SilentlyContinue).TrustPolicy if ($TrustWow64 -eq 2) { Write-Host " - WOW6432Node WSH TrustPolicy: 2 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: WOW6432Node WSH TrustPolicy is not set to 2 (Value: '$($TrustWow64)')" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: WOW6432Node WSH settings key is missing (Expected: Enabled = 0, TrustPolicy = 2)" -ForegroundColor Red $script:Vulnerable = $true } } # 3. Audit file associations $Extensions = @("vbs", "vbe", "js", "jse", "wsf", "wsh", "hta") foreach ($Ext in $Extensions) { $ProgIdPath = "HKLM:\SOFTWARE\Classes\.$Ext" if (Test-Path $ProgIdPath) { $Handler = (Get-ItemProperty -Path $ProgIdPath -Name "" -ErrorAction SilentlyContinue)."" if ($Handler -eq "txtfile" -or $Handler -match "notepad") { Write-Host " - Extension .$Ext Handler: $Handler (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: Extension .$Ext Handler is '$($Handler)' (Expected: txtfile/notepad)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: Extension .$Ext Class Registry key not found." -ForegroundColor Red $script:Vulnerable = $true } } if ($script:Vulnerable) { Write-Host "[-] Audit Result: VULNERABLE - Windows Script Host hardening controls on PAW do not meet baseline requirements." -ForegroundColor Red } else { Write-Host "[+] Audit Result: SECURE - Windows Script Host hardening controls on PAW are fully compliant." -ForegroundColor Green } # Disable-PawWsh.ps1 # Description: Disables Windows Script Host globally across 64-bit and 32-bit registry hives, enforces TrustPolicy, and remaps script file associations to Notepad on PAWs. Write-Host "Applying Windows Script Host and file association hardening for PAWs..." -ForegroundColor Cyan # 1. Disable WSH globally in 64-bit HKLM $RegistryHklm = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHklm)) { New-Item -Path $RegistryHklm -Force | Out-Null } Set-ItemProperty -Path $RegistryHklm -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHklm -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM." -ForegroundColor Green # 2. Disable WSH in WOW6432Node on 64-bit systems if ([Environment]::Is64BitOperatingSystem) { $RegistryWow64 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryWow64)) { New-Item -Path $RegistryWow64 -Force | Out-Null } Set-ItemProperty -Path $RegistryWow64 -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryWow64 -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM WOW6432Node." -ForegroundColor Green } # 3. Disable WSH in current user HKCU hive $RegistryHkcu = "HKCU:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHkcu)) { New-Item -Path $RegistryHkcu -Force | Out-Null } Set-ItemProperty -Path $RegistryHkcu -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHkcu -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH disabled in current user HKCU hive." -ForegroundColor Green # 4. Remap script file extensions to notepad $Extensions = @("vbs", "vbe", "js", "jse", "wsf", "wsh", "hta") foreach ($Ext in $Extensions) { $ProgIdPath = "HKLM:\SOFTWARE\Classes\.$Ext" # Update Class Association to Notepad if (-not (Test-Path $ProgIdPath)) { New-Item -Path $ProgIdPath -Force | Out-Null } Set-ItemProperty -Path $ProgIdPath -Name "" -Value "txtfile" -Type String -Force Write-Host " Mapped .$Ext extension to txtfile handler." -ForegroundColor Gray } Write-Host "[+] Script file extension handlers mapped to Notepad." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs). Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows 11 Enterprise. File Path: 07-paws/configure-secure-boot-revocations.md A vulnerability in the Windows Boot Manager allows an attacker with physical access or local administrative rights to bypass UEFI Secure Boot and execute unsigned code during the boot process (BlackLotus bootkit). To fully mitigate this threat (CVE-2023-24932), Windows update revocations must be applied to the UEFI variables (DBX list) and code integrity SVN policies must be updated. This is managed via the AvailableUpdates registry key, which instructs the OS boot manager to write the revocation variables to firmware. According to the latest Microsoft guidelines, the recommended trigger value for enterprise deployments to apply all security updates (including the new Windows UEFI CA 2023 certificates and boot manager updates) is `0x5944` (hex) / `22852` (decimal). As the OS processes this bitmask, the value is cleared incrementally, ending up at `0x4000` (hex) / `16384` (decimal) upon successful completion. Option A: Group Policy Object (GPO) Configuration (Preferred) To configure the update triggers for the DBX and Code Integrity boot manager revocations, define Registry GPO Preferences inside the PAW GPO: Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the PAWs OU (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a registry item to deploy the AvailableUpdates DWORD under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot. Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Secureboot Value Name*: AvailableUpdates Value Type*: REG_DWORD Value Data*: 22852 (Decimal) or 5944 (Hex) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the BlackLotus mitigation update trigger: Download Script: Set-PawSecureBootRevocations.ps1 # Set-PawSecureBootRevocations.ps1 # Description: Triggers Secure Boot DBX and Code Integrity revocation updates for BlackLotus mitigation. Write-Host "--- Configuring BlackLotus Secure Boot Mitigations ---" -ForegroundColor Cyan $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } # Trigger updates (0x5944 = 22852) Set-ItemProperty -Path $Path -Name "AvailableUpdates" -Value 22852 -Type DWord -Force | Out-Null Write-Host "[+] BlackLotus DBX and 2023 CA revocation updates configured in registry. A system reboot is required." -ForegroundColor Green Audit Script Run the following script to check the status of Secure Boot revocations on the local machine: Download Script: Audit-PawSecureBootRevocations.ps1 # Audit-PawSecureBootRevocations.ps1 # Description: Queries UEFI Secure Boot parameters and audits BlackLotus mitigation registry settings. Write-Host "--- Auditing BlackLotus Mitigations ---" -ForegroundColor Cyan $script:NonCompliant = $false # 1. Audit AvailableUpdates registry key $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot" if (Test-Path $Path) { $Val = Get-ItemProperty -Path $Path -Name "AvailableUpdates" -ErrorAction SilentlyContinue $UpdateVal = if ($Val) { $Val.AvailableUpdates } else { 0 } # Check if configured (>= 0x4000 / 16384) if ($UpdateVal -ge 16384) { Write-Host " - BlackLotus Revocation Updates (AvailableUpdates): $UpdateVal (Compliant)" -ForegroundColor Green } else { Write-Host " - BlackLotus Revocation Updates (AvailableUpdates): $UpdateVal (Non-Compliant - DBX/SVN revocations not triggered)" -ForegroundColor Red $script:NonCompliant = $true } } else { Write-Host " - BlackLotus Revocation Updates: Registry path not found (Non-Compliant)" -ForegroundColor Red $script:NonCompliant = $true } # 2. Audit UEFICA2023Status (if present) $ServicingPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" if (Test-Path $ServicingPath) { $ServVal = Get-ItemProperty -Path $ServicingPath -Name "UEFICA2023Status" -ErrorAction SilentlyContinue if ($ServVal) { $Status = $ServVal.UEFICA2023Status $Color = if ($Status -eq "Updated") { "Green" } else { "Yellow" } Write-Host " - UEFI CA 2023 Update Status: $Status" -ForegroundColor $Color } } if ($script:NonCompliant) { exit 1 } # Set-PawSecureBootRevocations.ps1 # Description: Triggers Secure Boot DBX and Code Integrity revocation updates for BlackLotus mitigation. Write-Host "--- Configuring BlackLotus Secure Boot Mitigations ---" -ForegroundColor Cyan $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } # Trigger updates (0x5944 = 22852) Set-ItemProperty -Path $Path -Name "AvailableUpdates" -Value 22852 -Type DWord -Force | Out-Null Write-Host "[+] BlackLotus DBX and 2023 CA revocation updates configured in registry. A system reboot is required." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10, Windows 11 (Enterprise and Professional editions) File Path: 07-paws/configure-wdac.md Privileged Access Workstations (PAWs) are dedicated administrative hosts used to manage high-value assets such as Domain Controllers and identity systems. Because they handle Tier 0 administrative credentials, they are highly targeted by adversaries. Windows Defender Application Control (WDAC) provides kernel-enforced application control to ensure that only trusted code executes on PAWs. Standard application control options like AppLocker operate primarily in user mode, whereas WDAC enforces integrity at both the kernel (KMCI) and user mode (UMCI) levels. Implementing a baseline WDAC policy that restricts software execution exclusively to Microsoft-signed code and trusted system components blocks unauthorized administrative tools, remote monitoring agents, and malicious payloads. Option A: Group Policy Object (GPO) Configuration (Preferred) To deploy WDAC via Group Policy, the policy XML must first be generated, compiled, and placed in a secure shared intranet network path or local path on target hosts. 1. Generate and Compile the Policy (on a Reference PAW Host) Run the following PowerShell commands to generate the Microsoft Default Windows baseline policy: powershell # Generate the baseline policy XML New-CIPolicy -MultiplePolicyFormat -Level FilePublisher -FilePath "C:\WDAC\PawBaselinePolicy.xml" -UserPEs # Compile the XML policy into a binary CIP file ConvertFrom-CIPolicy -XmlFilePath "C:\WDAC\PawBaselinePolicy.xml" -BinaryFilePath "C:\WDAC\PawBaselinePolicy.cip" 2. Deploy the Policy via GPO Copy the compiled PawBaselinePolicy.cip file to a local secure directory on all target PAWs (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b) or host it on a network share. Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the PAWs OU (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the following setting: Policy*: Deploy Windows Defender Application Control Setting*: Enabled Code Integrity Policy File Path*: Enter the local path (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b) or network share path. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to generate a baseline WDAC policy, enable Audit Mode, and configure local parameters. Configure-PawWDACLocalPolicy.ps1 Download Script: Configure-PawWDACLocalPolicy.ps1 # Configure-PawWDACLocalPolicy.ps1 # Description: Generates a baseline local Code Integrity policy for PAWs, sets it to Audit Mode, and compiles it. Write-Host "--- Configuring PAW WDAC Local Policy Baseline ---" -ForegroundColor Cyan # Create working directories $WdacDir = "C:\Windows\System32\CodeIntegrity" if (-not (Test-Path $WdacDir)) { New-Item -Path $WdacDir -ItemType Directory -Force | Out-Null } # 1. Generate the Default Windows Policy Write-Host "[+] Generating Default Windows code integrity rules..." -ForegroundColor Gray $PolicyXml = "C:\Windows\Temp\PawDefaultWindows.xml" $PolicyBin = "$WdacDir\SIPolicy.p7b" # Create a policy based on Microsoft's default rules (trusts Windows, Store, and Driver files) New-CIPolicy -FilePath $PolicyXml -Level Windows -UserPEs -ErrorAction Stop # 2. Set Policy to Audit Mode (Rule Option 3 represents Audit Mode) Write-Host "[+] Setting WDAC policy to Audit Mode for baseline logging..." -ForegroundColor Gray Set-RuleOption -FilePath $PolicyXml -Option 3 -ErrorAction SilentlyContinue # 3. Compile the XML into the binary policy expected by the bootloader Write-Host "[+] Compiling Code Integrity XML into SIPolicy.p7b..." -ForegroundColor Gray ConvertFrom-CIPolicy -XmlFilePath $PolicyXml -BinaryFilePath $PolicyBin -ErrorAction Stop # Cleanup temp files if (Test-Path $PolicyXml) { Remove-Item $PolicyXml -Force } Write-Host "[+] Local WDAC baseline policy configured. Reboot required." -ForegroundColor Green To verify the setting has been applied: Test-PawWDACStatus.ps1 Download Script: Test-PawWDACStatus.ps1 # Test-PawWDACStatus.ps1 # Description: Audits the local PAW to check if Code Integrity policies and HVCI are active. Write-Host "--- Auditing PAW WDAC State ---" -ForegroundColor Cyan $Vulnerable = $false # 1. Query WMI class for Code Integrity status try { $CI = Get-CimInstance -Namespace "Root\Microsoft\Windows\CI" -ClassName "MSFT_Sipolicy" -ErrorAction Stop if ($null -ne $CI -and $CI.Count -gt 0) { Write-Host "`n[+] Found $($CI.Count) active Code Integrity policies." -ForegroundColor Green foreach ($Policy in $CI) { Write-Host " - Policy: $($Policy.FriendlyName) | ID: $($Policy.PolicyID) | Enforced: $($Policy.EnforcementMode)" -ForegroundColor Green } } else { Write-Host "`n[-] No active Code Integrity / WDAC policies detected via WMI." -ForegroundColor Yellow } } catch { Write-Host "`n[-] Could not query WMI MSFT_Sipolicy. This is expected if no WDAC policies are currently deployed." -ForegroundColor Gray } # 2. Check Memory Integrity (HVCI) configuration $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Memory Integrity (HVCI) is disabled in the registry." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: Memory Integrity scenario registry path does not exist." -ForegroundColor Red $Vulnerable = $true } # 3. Final Verdict if ($Vulnerable) { Write-Host "`n[!] Verification FAILED: One or more driver security controls are not configured." -ForegroundColor Red } else { Write-Host "`n[+] Verification PASSED: WDAC driver settings and HVCI are correctly configured." -ForegroundColor Green } # Configure-PawWDACLocalPolicy.ps1 # Description: Generates a baseline local Code Integrity policy for PAWs, sets it to Audit Mode, and compiles it. Write-Host "--- Configuring PAW WDAC Local Policy Baseline ---" -ForegroundColor Cyan # Create working directories $WdacDir = "C:\Windows\System32\CodeIntegrity" if (-not (Test-Path $WdacDir)) { New-Item -Path $WdacDir -ItemType Directory -Force | Out-Null } # 1. Generate the Default Windows Policy Write-Host "[+] Generating Default Windows code integrity rules..." -ForegroundColor Gray $PolicyXml = "C:\Windows\Temp\PawDefaultWindows.xml" $PolicyBin = "$WdacDir\SIPolicy.p7b" # Create a policy based on Microsoft's default rules (trusts Windows, Store, and Driver files) New-CIPolicy -FilePath $PolicyXml -Level Windows -UserPEs -ErrorAction Stop # 2. Set Policy to Audit Mode (Rule Option 3 represents Audit Mode) Write-Host "[+] Setting WDAC policy to Audit Mode for baseline logging..." -ForegroundColor Gray Set-RuleOption -FilePath $PolicyXml -Option 3 -ErrorAction SilentlyContinue # 3. Compile the XML into the binary policy expected by the bootloader Write-Host "[+] Compiling Code Integrity XML into SIPolicy.p7b..." -ForegroundColor Gray ConvertFrom-CIPolicy -XmlFilePath $PolicyXml -BinaryFilePath $PolicyBin -ErrorAction Stop # Cleanup temp files if (Test-Path $PolicyXml) { Remove-Item $PolicyXml -Force } Write-Host "[+] Local WDAC baseline policy configured. Reboot required." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-password-policy.md Privileged Access Workstations host the credential material and management tools responsible for enterprise directory survival. While interactive logons on PAWs mandate hardware-backed multi-factor authentication (smart cards / WHfB), local fallback accounts (such as the local Administrator managed by Windows LAPS) must enforce an impervious password baseline to resist offline cryptanalysis: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy Configure the following settings: Enforce password history*: Set to 24 passwords remembered Maximum password age*: Set to 0 days (never expire) Minimum password age*: Set to 1 day Minimum password length*: Set to 20 characters Password must meet complexity requirements*: Set to Enabled Store passwords using reversible encryption*: Set to Disabled Relax minimum password length limits*: Set to Enabled Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure: Interactive logon: Prompt user to change password before expiration*: Set to 14 days Link the GPO to the dedicated PAW OU and force update via gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountPasswordPolicy.ps1 # Configure-PawAccountPasswordPolicy.ps1 # Description: Configures PAW password policy (20 char minimum, relaxed limits, no expiration) via SecEdit. Write-Host "Configuring PAW password policy..." -ForegroundColor Cyan # 1. Configure PasswordExpiryWarning via Registry $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path $WinlogonPath)) { New-Item -Path $WinlogonPath -Force | Out-Null } Set-ItemProperty -Path $WinlogonPath -Name "PasswordExpiryWarning" -Value 14 -Type DWord -Force # 2. Configure SecEdit System Access password parameters $SecTempDir = Join-Path $env:TEMP "PAWPasswordSecTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "paw_password.cfg" $DbFile = Join-Path $SecTempDir "paw_password.sdb" $LogFile = Join-Path $SecTempDir "paw_password.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export current security template." } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[System Access\]") { $ConfigText += "`r`n[System Access]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InSystemAccess = $false $PwdSettings = @{ "MinimumPasswordLength" = 20 "PasswordComplexity" = 1 "PasswordHistorySize" = 24 "MaxPasswordAge" = 0 "MinPasswordAge" = 1 "ClearTextPassword" = 0 "RelaxMinPasswordLengthLimits" = 1 } foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "System Access") { $InSystemAccess = $true } else { $InSystemAccess = $false } } if ($InSystemAccess) { $IsManaged = $false foreach ($Key in $PwdSettings.Keys) { if ($Line -match "^\s*$($Key)\s*=") { $IsManaged = $true break } } if (-not $IsManaged) { $NewLines += $Line } } else { $NewLines += $Line } } $FinalLines = @() foreach ($Line in $NewLines) { $FinalLines += $Line if ($Line -eq "[System Access]") { foreach ($Key in $PwdSettings.Keys) { $Val = $PwdSettings[$Key] $FinalLines += "$($Key) = $($Val)" } } } $FinalLines -join "`r`n" | Out-File -FilePath $CfgFile -Encoding ascii -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas SECURITYPOLICY /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to apply SecEdit password policy." } Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue Write-Host "PAW password policy applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountPasswordPolicyStatus.ps1 # Get-PawAccountPasswordPolicyStatus.ps1 # Description: Audits PAW password policy parameters via SecEdit and registry queries. Write-Host "--- Auditing PAW Password Policy ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit Registry Setting $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path -Path $WinlogonPath)) { Write-Host " [!] MISSING KEY: $WinlogonPath" -ForegroundColor Red $script:Vulnerable = $true } else { $WarnVal = (Get-ItemProperty -Path $WinlogonPath -Name "PasswordExpiryWarning" -ErrorAction SilentlyContinue).PasswordExpiryWarning if ($null -eq $WarnVal -or $WarnVal -lt 5 -or $WarnVal -gt 14) { Write-Host " [!] VULNERABLE: PasswordExpiryWarning is set to '$WarnVal' (Expected: 5-14)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] PasswordExpiryWarning: $WarnVal (Secure)" -ForegroundColor Green } } # 2. Audit SecEdit Settings $SecTempDir = Join-Path $env:TEMP "PAWPasswordAuditTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "paw_password_audit.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigContent = Get-Content -Path $CfgFile -Raw Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue $ExpectedSettings = @{ "MinimumPasswordLength" = 20 "PasswordComplexity" = 1 "PasswordHistorySize" = 24 "MaxPasswordAge" = 0 "MinPasswordAge" = 1 "ClearTextPassword" = 0 "RelaxMinPasswordLengthLimits" = 1 } foreach ($Key in $ExpectedSettings.Keys) { $Expected = $ExpectedSettings[$Key] if ($ConfigContent -match "(?m)^\s*$($Key)\s*=\s*(.*)\s*$") { $Actual = $Matches[1].Trim() } else { $Actual = "" } if ($Actual -ne [string]$Expected) { Write-Host " [!] VULNERABLE: $($Key) = '$Actual' (Expected: '$Expected')" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Key): $Actual (Secure)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the active local password policy settings using net accounts: cmd net accounts Verify that Minimum password length reflects 20, Length of password history maintained is 24, and Maximum password age (days) indicates Unlimited (value 0). Verify the password expiration warning registry value: cmd reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v PasswordExpiryWarning Confirm that PasswordExpiryWarning is set to 0xe (Decimal 14). Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-lockout-policy.md Account lockout policies define the defensive response when incorrect credentials are submitted against user accounts. On Privileged Access Workstations, tight lockout thresholds protect administrative credentials from automated brute-force attacks and targeted dictionary probes: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy Configure the following settings: Account lockout threshold*: Set to 5 invalid logon attempts Reset account lockout counter after*: Set to 30 minutes Account lockout duration*: Set to 30 minutes Allow Administrator account lockout*: Set to Enabled Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure: Interactive logon: Machine account lockout threshold*: Set to 10 Link the GPO to the dedicated PAW OU and force update via gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountLockoutPolicy.ps1 # Configure-PawAccountLockoutPolicy.ps1 # Description: Configures account lockout parameters and Administrator lockout protection on PAWs via SecEdit. Write-Host "Configuring PAW account lockout policy..." -ForegroundColor Cyan # 1. Configure MaxDevicePasswordFailedAttempts via Registry $SystemPolicyPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path $SystemPolicyPath)) { New-Item -Path $SystemPolicyPath -Force | Out-Null } Set-ItemProperty -Path $SystemPolicyPath -Name "MaxDevicePasswordFailedAttempts" -Value 10 -Type DWord -Force # 2. Configure SecEdit System Access lockout parameters $SecTempDir = Join-Path $env:TEMP "PAWLockoutSecTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "paw_lockout.cfg" $DbFile = Join-Path $SecTempDir "paw_lockout.sdb" $LogFile = Join-Path $SecTempDir "paw_lockout.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export current security template." } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[System Access\]") { $ConfigText += "`r`n[System Access]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InSystemAccess = $false $LockoutSettings = @{ "LockoutBadCount" = 5 "ResetLockoutCount" = 30 "LockoutDuration" = 30 "AllowAdministratorLockout" = 1 } foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "System Access") { $InSystemAccess = $true } else { $InSystemAccess = $false } } if ($InSystemAccess) { $IsManaged = $false foreach ($Key in $LockoutSettings.Keys) { if ($Line -match "^\s*$($Key)\s*=") { $IsManaged = $true break } } if (-not $IsManaged) { $NewLines += $Line } } else { $NewLines += $Line } } $FinalLines = @() foreach ($Line in $NewLines) { $FinalLines += $Line if ($Line -eq "[System Access]") { foreach ($Key in $LockoutSettings.Keys) { $Val = $LockoutSettings[$Key] $FinalLines += "$($Key) = $($Val)" } } } $FinalLines -join "`r`n" | Out-File -FilePath $CfgFile -Encoding ascii -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas SECURITYPOLICY /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to apply SecEdit lockout policy." } Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue Write-Host "PAW lockout policy applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountLockoutPolicyStatus.ps1 # Get-PawAccountLockoutPolicyStatus.ps1 # Description: Audits account lockout policy parameters on PAWs via SecEdit. Write-Host "--- Auditing PAW Account Lockout Policy ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit Registry Setting $SystemPolicyPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $MaxDeviceVal = (Get-ItemProperty -Path $SystemPolicyPath -Name "MaxDevicePasswordFailedAttempts" -ErrorAction SilentlyContinue).MaxDevicePasswordFailedAttempts if ($null -eq $MaxDeviceVal -or $MaxDeviceVal -gt 10 -or $MaxDeviceVal -eq 0) { Write-Host " [!] VULNERABLE: MaxDevicePasswordFailedAttempts is set to '$MaxDeviceVal' (Expected: 10 or fewer, but not 0)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] MaxDevicePasswordFailedAttempts: $MaxDeviceVal (Secure)" -ForegroundColor Green } # 2. Audit SecEdit Settings $SecTempDir = Join-Path $env:TEMP "PAWLockoutAuditTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "paw_lockout_audit.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigContent = Get-Content -Path $CfgFile -Raw Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue $ExpectedSettings = @{ "LockoutBadCount" = 5 "ResetLockoutCount" = 30 "LockoutDuration" = 30 "AllowAdministratorLockout" = 1 } foreach ($Key in $ExpectedSettings.Keys) { $Expected = $ExpectedSettings[$Key] if ($ConfigContent -match "(?m)^\s*$($Key)\s*=\s*(.*)\s*$") { $Actual = $Matches[1].Trim() } else { $Actual = "" } if ($Actual -ne [string]$Expected) { Write-Host " [!] VULNERABLE: $($Key) = '$Actual' (Expected: '$Expected')" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Key): $Actual (Secure)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied account lockout policies using net accounts: cmd net accounts Verify that Lockout threshold shows 5, Lockout duration (minutes) shows 30, and Lockout observation window (minutes) shows 30. Verify the machine account lockout threshold registry value: cmd reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v MaxDevicePasswordFailedAttempts Confirm that MaxDevicePasswordFailedAttempts is set to 0xa (Decimal 10). Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-kerberos-policy.md Kerberos is the foundational authentication protocol of Active Directory Domain Services. Ticket lifetimes and synchronization constraints govern the operational window during which authentication tokens remain valid: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the Default Domain Policy or the target GPO linked to PAWs (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Kerberos Policy Configure the following settings: Enforce user logon restrictions*: Set to Enabled Maximum lifetime for service ticket*: Set to 600 minutes Maximum lifetime for user ticket*: Set to 10 hours Maximum lifetime for user ticket renewal*: Set to 7 days Maximum tolerance for computer clock synchronization*: Set to 5 minutes Link the GPO to the appropriate Organizational Unit and force policy update. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountKerberosPolicy.ps1 # Configure-PawAccountKerberosPolicy.ps1 # Description: Configures Kerberos ticket lifetimes, renewal limits, and client validation on PAWs via SecEdit. Write-Host "Configuring PAW Kerberos policy..." -ForegroundColor Cyan $SecTempDir = Join-Path $env:TEMP "PAWKerberosSecTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "paw_kerberos.cfg" $DbFile = Join-Path $SecTempDir "paw_kerberos.sdb" $LogFile = Join-Path $SecTempDir "paw_kerberos.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export current security template." } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Kerberos Policy\]") { $ConfigText += "`r`n[Kerberos Policy]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InKerb = $false $KerbSettings = @{ "MaxServiceTicketAge" = 600 "MaxTicketAge" = 10 "MaxRenewAge" = 7 "MaxClockSkew" = 5 "TicketValidateClient" = 1 } foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Kerberos Policy") { $InKerb = $true } else { $InKerb = $false } } if ($InKerb) { $IsManaged = $false foreach ($Key in $KerbSettings.Keys) { if ($Line -match "^\s*$($Key)\s*=") { $IsManaged = $true break } } if (-not $IsManaged) { $NewLines += $Line } } else { $NewLines += $Line } } $FinalLines = @() foreach ($Line in $NewLines) { $FinalLines += $Line if ($Line -eq "[Kerberos Policy]") { foreach ($Key in $KerbSettings.Keys) { $Val = $KerbSettings[$Key] $FinalLines += "$($Key) = $($Val)" } } } $FinalLines -join "`r`n" | Out-File -FilePath $CfgFile -Encoding ascii -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas SECURITYPOLICY /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to apply SecEdit Kerberos policy." } Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue Write-Host "PAW Kerberos policy applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountKerberosPolicyStatus.ps1 # Get-PawAccountKerberosPolicyStatus.ps1 # Description: Audits Kerberos ticket policy parameters on PAWs via SecEdit. Write-Host "--- Auditing PAW Kerberos Policy ---" -ForegroundColor Cyan $script:Vulnerable = $false $SecTempDir = Join-Path $env:TEMP "PAWKerberosAuditTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "paw_kerberos_audit.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigContent = Get-Content -Path $CfgFile -Raw Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue $ExpectedSettings = @{ "MaxServiceTicketAge" = 600 "MaxTicketAge" = 10 "MaxRenewAge" = 7 "MaxClockSkew" = 5 "TicketValidateClient" = 1 } foreach ($Key in $ExpectedSettings.Keys) { $Expected = $ExpectedSettings[$Key] if ($ConfigContent -match "(?m)^\s*$($Key)\s*=\s*(.*)\s*$") { $Actual = $Matches[1].Trim() } else { $Actual = "" } if ($Actual -ne [string]$Expected) { Write-Host " [!] VULNERABLE: $($Key) = '$Actual' (Expected: '$Expected')" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Key): $Actual (Secure)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify current Kerberos ticket lifetimes on the active session using klist: cmd klist Inspect the Renew Time and End Time of currently cached TGTs to confirm that ticket duration does not exceed 10 hours. To verify domain controller time synchronization: cmd w32tm /query /status Verify that the Leap Indicator, Stratum, and clock offset reflect healthy synchronization with the PDC emulator (offset < 1 second). Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-smart-card-removal.md Privileged Access Workstations serve as high-value execution environments where an active administrative session possesses unconstrained directory authority. Unattended, unlocked consoles present an immediate target for physical tampering, unauthorized keystroke injection (e.g., Rubber Ducky payloads), and unauthorized administrative actions: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Double-click Interactive logon: Smart card removal behavior. Check Define this policy setting and select Lock Workstation (value 1). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Smart Card Removal Policy service (SCPolicySvc), configure service startup mode to Automatic, and start the service. Link the GPO to the dedicated PAW OU and force replication. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountSmartCardRemoval.ps1 # Configure-PawAccountSmartCardRemoval.ps1 # Description: Configures Smart Card removal behavior to Lock Workstation and enables SCPolicySvc on PAWs. Write-Host "Configuring PAW Smart Card removal behavior..." -ForegroundColor Cyan # 1. Configure Winlogon ScRemoveOption $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path $WinlogonPath)) { New-Item -Path $WinlogonPath -Force | Out-Null } Set-ItemProperty -Path $WinlogonPath -Name "ScRemoveOption" -Value "1" -Type String -Force # 2. Ensure Smart Card Removal Policy service is configured for Automatic start $ServiceName = "SCPolicySvc" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { Set-Service -Name $ServiceName -StartupType Automatic if ($Service.Status -ne "Running") { Start-Service -Name $ServiceName -ErrorAction SilentlyContinue } } Write-Host "Smart card removal behavior set to Lock Workstation ('1') and service configured." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountSmartCardRemovalStatus.ps1 # Get-PawAccountSmartCardRemovalStatus.ps1 # Description: Audits Smart Card removal behavior and service status on PAWs. Write-Host "--- Auditing PAW Smart Card Removal Behavior ---" -ForegroundColor Cyan $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path -Path $WinlogonPath)) { Write-Host " [!] MISSING KEY: $WinlogonPath" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } $Val = (Get-ItemProperty -Path $WinlogonPath -Name "ScRemoveOption" -ErrorAction SilentlyContinue).ScRemoveOption if ($Val -eq "1") { Write-Host " [+] ScRemoveOption is set to '$Val' (Lock Workstation - Secure)." -ForegroundColor Green Write-Output "Compliant" exit 0 } else { Write-Host " [!] VULNERABLE: ScRemoveOption is set to '$Val' (Expected: '1')" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } Option C: Manual Verification Verify the applied smart card removal registry setting using command prompt: cmd reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ScRemoveOption Confirm that ScRemoveOption is of type REG_SZ with value "1". Verify the Smart Card Removal Policy service status: cmd sc query SCPolicySvc Confirm that STATE indicates RUNNING and START_TYPE is AUTO_START. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-cached-logons.md By default, Windows caches authentication verifiers for previously logged-on domain accounts to permit user authentication when an Active Directory Domain Controller cannot be reached. On Privileged Access Workstations, this feature poses an existential risk to Tier 0 directory security: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Double-click Interactive logon: Number of previous logons to cache (in case domain controller is not available). Check Define this policy setting and set the cache value to 0 logons. Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click Registry, select New -> Registry Item: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SECURITY\Cache Value name*: NL$IterationCount Value type*: REG_DWORD Value data*: 1954 (Decimal) Link the GPO to the dedicated PAW OU and verify application using gpresult /r. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountCachedLogons.ps1 # Configure-PawAccountCachedLogons.ps1 # Description: Disables cached domain logons and fortifies PBKDF2 iteration count on PAWs. Write-Host "Configuring PAW cached logon restrictions and PBKDF2 iterations..." -ForegroundColor Cyan # 1. Disable cached logons count $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path -Path $WinlogonPath)) { New-Item -Path $WinlogonPath -Force | Out-Null } Set-ItemProperty -Path $WinlogonPath -Name "CachedLogonsCount" -Value 0 -Type DWord -Force # 2. Configure PBKDF2 Iteration Count $CachePath = "HKLM:\SECURITY\Cache" if (-not (Test-Path -Path $CachePath)) { New-Item -Path $CachePath -Force | Out-Null } Set-ItemProperty -Path $CachePath -Name "NL`$IterationCount" -Value 1954 -Type DWord -Force Write-Host "Cached logons count disabled (0) and PBKDF2 iteration count configured (1954)." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountCachedLogonsStatus.ps1 # Get-PawAccountCachedLogonsStatus.ps1 # Description: Audits cached logons count and PBKDF2 iteration count on PAWs. Write-Host "--- Auditing PAW Cached Logons and PBKDF2 Settings ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit CachedLogonsCount $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path -Path $WinlogonPath)) { Write-Host " [!] MISSING KEY: $WinlogonPath" -ForegroundColor Red $script:Vulnerable = $true } else { $CacheCount = (Get-ItemProperty -Path $WinlogonPath -Name "CachedLogonsCount" -ErrorAction SilentlyContinue).CachedLogonsCount if ($CacheCount -ne 0) { Write-Host " [!] VULNERABLE: CachedLogonsCount is '$CacheCount' (Expected: 0)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] CachedLogonsCount: 0 (Secure - Cache Disabled)" -ForegroundColor Green } } # 2. Audit NL$IterationCount $CachePath = "HKLM:\SECURITY\Cache" if (-not (Test-Path -Path $CachePath)) { Write-Host " [!] MISSING KEY: $CachePath" -ForegroundColor Red $script:Vulnerable = $true } else { $IterCount = (Get-ItemProperty -Path $CachePath -Name "NL`$IterationCount" -ErrorAction SilentlyContinue)."NL`$IterationCount" if ($IterCount -ne 1954) { Write-Host " [!] VULNERABLE: NL`$IterationCount is '$IterCount' (Expected: 1954)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] NL`$IterationCount: 1954 (Secure - ~2M PBKDF2 Iterations)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied settings using administrative command line queries: cmd reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CachedLogonsCount Confirm that CachedLogonsCount returns 0x0. To inspect the SECURITY\Cache key (requires elevated privileges via psexec -s cmd.exe or SYSTEM context): cmd reg query "HKLM\SECURITY\Cache" /v NL$IterationCount Confirm that NL$IterationCount returns 0x7a2 (Decimal 1954). Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-local-blank-passwords.md Restricting local account authentication boundaries, disabling legacy password hashes, and enforcing explicit user identity validation are vital to securing Tier 0 administrative workstations against remote compromise: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Accounts: Limit local account use of blank passwords to console logon only*: Set to Enabled Network security: Do not store LAN Manager hash value on next password change*: Set to Enabled Network access: Sharing and security model for local accounts*: Set to Classic - local users authenticate as themselves Link the GPO to the dedicated PAW OU and force replication. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountLocalBlankPasswords.ps1 # Configure-PawAccountLocalBlankPasswords.ps1 # Description: Enforces blank password restrictions, purges LM hashes, and sets Classic sharing on PAWs. Write-Host "Configuring PAW local account and blank password restrictions..." -ForegroundColor Cyan $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path -Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "LimitBlankPasswordUse" -Value 1 -Type DWord -Force Set-ItemProperty -Path $LsaPath -Name "NoLMHash" -Value 1 -Type DWord -Force Set-ItemProperty -Path $LsaPath -Name "ForceNetworkLogon" -Value 0 -Type DWord -Force Write-Host "Local account and blank password restrictions applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountLocalBlankPasswordsStatus.ps1 # Get-PawAccountLocalBlankPasswordsStatus.ps1 # Description: Audits local account restrictions, LM hash generation, and sharing model on PAWs. Write-Host "--- Auditing PAW Local Account and Blank Password Restrictions ---" -ForegroundColor Cyan $script:Vulnerable = $false $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" function Test-RegVal ($Name, $Expected) { if (-not (Test-Path -Path $LsaPath)) { Write-Host " [!] MISSING KEY: $LsaPath" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $LsaPath -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $LsaPath (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal "LimitBlankPasswordUse" 1 Test-RegVal "NoLMHash" 1 Test-RegVal "ForceNetworkLogon" 0 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied settings using command prompt queries: cmd reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v NoLMHash reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v ForceNetworkLogon Confirm that LimitBlankPasswordUse is 0x1, NoLMHash is 0x1, and ForceNetworkLogon is 0x0. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-ntlm-security.md Legacy LAN Manager (LM) and NT LAN Manager version 1 (NTLMv1) authentication protocols are critically vulnerable to cryptographic recovery, offline dictionary cracking, and man-in-the-middle relaying. On Tier 0 Privileged Access Workstations, legacy authentication must be purged and session security fortified: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Network security: LAN Manager authentication level*: Set to Send NTLMv2 response only. Refuse LM & NTLM (value 5) Network security: Minimum session security for NTLM SSP based (including secure RPC) clients*: Check both Require NTLMv2 session security and Require 128-bit encryption (value 537395200) Network security: Minimum session security for NTLM SSP based (including secure RPC) servers*: Check both Require NTLMv2 session security and Require 128-bit encryption (value 537395200) Network security: Allow LocalSystem NULL session fallback*: Set to Disabled (value 0) Link the GPO to the dedicated PAW OU and force update via gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountNtlmSecurity.ps1 # Configure-PawAccountNtlmSecurity.ps1 # Description: Enforces NTLMv2-only authentication, 128-bit session security, and blocks NULL session fallback on PAWs. Write-Host "Configuring PAW NTLM and LAN Manager authentication security..." -ForegroundColor Cyan $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path -Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "LmCompatibilityLevel" -Value 5 -Type DWord -Force $MsvPath = "HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0" if (-not (Test-Path $MsvPath)) { New-Item -Path $MsvPath -Force | Out-Null } Set-ItemProperty -Path $MsvPath -Name "NTLMMinClientSec" -Value 537395200 -Type DWord -Force Set-ItemProperty -Path $MsvPath -Name "NTLMMinServerSec" -Value 537395200 -Type DWord -Force Set-ItemProperty -Path $MsvPath -Name "allownullsessionfallback" -Value 0 -Type DWord -Force Write-Host "NTLM and LAN Manager authentication security applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountNtlmSecurityStatus.ps1 # Get-PawAccountNtlmSecurityStatus.ps1 # Description: Audits NTLM authentication levels, session security, and NULL session fallback on PAWs. Write-Host "--- Auditing PAW NTLM and LAN Manager Security ---" -ForegroundColor Cyan $script:Vulnerable = $false $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $MsvPath = "HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0" function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal $LsaPath "LmCompatibilityLevel" 5 Test-RegVal $MsvPath "NTLMMinClientSec" 537395200 Test-RegVal $MsvPath "NTLMMinServerSec" 537395200 Test-RegVal $MsvPath "allownullsessionfallback" 0 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied NTLM settings using command prompt queries: cmd reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel reg query "HKLM\System\CurrentControlSet\Control\Lsa\MSV1_0" /v NTLMMinClientSec reg query "HKLM\System\CurrentControlSet\Control\Lsa\MSV1_0" /v NTLMMinServerSec reg query "HKLM\System\CurrentControlSet\Control\Lsa\MSV1_0" /v allownullsessionfallback Confirm that LmCompatibilityLevel is 0x5, NTLMMinClientSec and NTLMMinServerSec are 0x20080000 (Decimal 537395200), and allownullsessionfallback is 0x0. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-wdigest-credentials.md The Local Security Authority Subsystem Service (LSASS) manages active logon sessions and authentication tokens. In legacy Windows architectures, the WDigest provider retained cleartext passwords in memory, creating one of the most prolific post-exploitation attack vectors in Windows history: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click Registry, select New -> Registry Item: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest Value name*: UseLogonCredential Value type*: REG_DWORD Value data*: 0 (Decimal) Click Apply, then OK. Link the GPO to the dedicated PAW OU and force replication. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountWdigestCredentials.ps1 # Configure-PawAccountWdigestCredentials.ps1 # Description: Disables WDigest plaintext credential caching in LSASS memory on PAWs. Write-Host "Disabling WDigest plaintext credential caching on PAWs..." -ForegroundColor Cyan $WDigestPath = "HKLM:\System\CurrentControlSet\Control\SecurityProviders\WDigest" if (-not (Test-Path $WDigestPath)) { New-Item -Path $WDigestPath -Force | Out-Null } Set-ItemProperty -Path $WDigestPath -Name "UseLogonCredential" -Value 0 -Type DWord -Force Write-Host "WDigest credential caching disabled successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountWdigestCredentialsStatus.ps1 # Get-PawAccountWdigestCredentialsStatus.ps1 # Description: Audits WDigest plaintext credential caching status on PAWs. Write-Host "--- Auditing PAW WDigest Credential Caching ---" -ForegroundColor Cyan $WDigestPath = "HKLM:\System\CurrentControlSet\Control\SecurityProviders\WDigest" if (-not (Test-Path -Path $WDigestPath)) { Write-Host " [!] MISSING KEY: $WDigestPath" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } $Val = (Get-ItemProperty -Path $WDigestPath -Name "UseLogonCredential" -ErrorAction SilentlyContinue).UseLogonCredential if ($null -ne $Val -and $Val -eq 0) { Write-Host " [+] UseLogonCredential is set to 0 (Disabled - Secure)." -ForegroundColor Green Write-Output "Compliant" exit 0 } else { Write-Host " [!] VULNERABLE: UseLogonCredential is '$Val' (Expected: 0)" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } Option C: Manual Verification Verify the applied WDigest setting using command prompt: cmd reg query "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v UseLogonCredential Confirm that UseLogonCredential is of type REG_DWORD with a value of 0x0. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-hello-pin.md Modern credential protection relies on hardware-bound asymmetric cryptographic tokens rather than reusable passwords. However, legacy convenience features and unhardened PIN mechanisms can undermine this architecture if not strictly configured on administrative workstations: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Configure System Logon policies: * Navigate to: Computer Configuration\Policies\Administrative Templates\System\Logon Double-click Turn on convenience PIN sign-in and set to Disabled*. Configure PIN Complexity policies: * Navigate to: Computer Configuration\Policies\Administrative Templates\System\PIN Complexity Double-click Minimum PIN length , set to Enabled*, and enter 6. Configure Windows Hello for Business policies: * Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Hello for Business Double-click Use a hardware security device and set to Enabled*. Double-click Use convenience PIN sign-in and set to Disabled*. Double-click Allow Microsoft accounts to be optional and set to Enabled*. Link the GPO to the dedicated PAW OU and verify enforcement. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountHelloPin.ps1 # Configure-PawAccountHelloPin.ps1 # Description: Hardens Windows Hello for Business, disables convenience PINs, and mandates TPM hardware backing on PAWs. Write-Host "Configuring PAW Windows Hello for Business and PIN policies..." -ForegroundColor Cyan # 1. System Logon PIN Policy $SysPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" if (-not (Test-Path $SysPath)) { New-Item -Path $SysPath -Force | Out-Null } Set-ItemProperty -Path $SysPath -Name "AllowDomainPINLogon" -Value 0 -Type DWord -Force # 2. PIN Complexity $PinPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity" if (-not (Test-Path $PinPath)) { New-Item -Path $PinPath -Force | Out-Null } Set-ItemProperty -Path $PinPath -Name "MinimumPINLength" -Value 6 -Type DWord -Force # 3. Hardware Security Device $PfwPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" if (-not (Test-Path $PfwPath)) { New-Item -Path $PfwPath -Force | Out-Null } Set-ItemProperty -Path $PfwPath -Name "RequireSecurityDevice" -Value 1 -Type DWord -Force $TpmPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\ExcludeSecurityDevices" if (-not (Test-Path $TpmPath)) { New-Item -Path $TpmPath -Force | Out-Null } Set-ItemProperty -Path $TpmPath -Name "TPM12" -Value 0 -Type DWord -Force # 4. MSA Optional $SysPolPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path $SysPolPath)) { New-Item -Path $SysPolPath -Force | Out-Null } Set-ItemProperty -Path $SysPolPath -Name "MSAOptional" -Value 1 -Type DWord -Force Write-Host "Windows Hello and PIN policies applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountHelloPinStatus.ps1 # Get-PawAccountHelloPinStatus.ps1 # Description: Audits Windows Hello for Business, PIN complexity, and TPM enforcement status on PAWs. Write-Host "--- Auditing PAW Windows Hello and PIN Policies ---" -ForegroundColor Cyan $script:Vulnerable = $false function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" "AllowDomainPINLogon" 0 Test-RegVal "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity" "MinimumPINLength" 6 Test-RegVal "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" "RequireSecurityDevice" 1 Test-RegVal "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\ExcludeSecurityDevices" "TPM12" 0 Test-RegVal "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "MSAOptional" 1 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied policies using command prompt queries: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowDomainPINLogon reg query "HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity" /v MinimumPINLength reg query "HKLM\SOFTWARE\Policies\Microsoft\PassportForWork" /v RequireSecurityDevice reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v MSAOptional Confirm that AllowDomainPINLogon returns 0x0, MinimumPINLength returns 0x6, RequireSecurityDevice returns 0x1, and MSAOptional returns 0x1. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-block-msa.md Privileged Access Workstations serve as the dedicated management plane for Active Directory Domain Controllers, Tier 0 PKI, and identity federation infrastructure. Introducing consumer cloud identities into this trusted boundary creates critical security exposures: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Microsoft Account Double-click Block all consumer Microsoft account user authentication. Set the policy to Enabled. Click Apply, then OK. Link the GPO to the dedicated PAW OU and verify policy propagation. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountBlockMsa.ps1 # Configure-PawAccountBlockMsa.ps1 # Description: Blocks consumer Microsoft account user authentication on PAWs. Write-Host "Blocking consumer Microsoft account user authentication on PAWs..." -ForegroundColor Cyan $MsaPath = "HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount" if (-not (Test-Path -Path $MsaPath)) { New-Item -Path $MsaPath -Force | Out-Null } Set-ItemProperty -Path $MsaPath -Name "DisableUserAuth" -Value 1 -Type DWord -Force Write-Host "Consumer Microsoft account user authentication blocked successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountBlockMsaStatus.ps1 # Get-PawAccountBlockMsaStatus.ps1 # Description: Audits consumer Microsoft account blocking status on PAWs. Write-Host "--- Auditing PAW Consumer Microsoft Account Restrictions ---" -ForegroundColor Cyan $MsaPath = "HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount" if (-not (Test-Path -Path $MsaPath)) { Write-Host " [!] MISSING KEY: $MsaPath" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } $Val = (Get-ItemProperty -Path $MsaPath -Name "DisableUserAuth" -ErrorAction SilentlyContinue).DisableUserAuth if ($null -ne $Val -and $Val -eq 1) { Write-Host " [+] DisableUserAuth is set to 1 (Enabled - Secure)." -ForegroundColor Green Write-Output "Compliant" exit 0 } else { Write-Host " [!] VULNERABLE: DisableUserAuth is '$Val' (Expected: 1)" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } Option C: Manual Verification Verify the applied policy via command prompt using reg query: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftAccount" /v DisableUserAuth Confirm that the value DisableUserAuth is of type REG_DWORD and set to 0x1. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-secure-channel.md The Netlogon Remote Protocol (MS-NRPC) secure channel forms the cryptographic communication link between domain-joined workstations and Active Directory Domain Controllers. On Privileged Access Workstations, protecting this channel from tampering, session key downgrade, and credential stagnation is essential to directory integrity: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Domain member: Digitally encrypt or sign secure channel data (always)*: Set to Enabled Domain member: Digitally encrypt secure channel data (when possible)*: Set to Enabled Domain member: Digitally sign secure channel data (when possible)*: Set to Enabled Domain member: Disable machine account password changes*: Set to Disabled Domain member: Maximum machine account password age*: Set to 30 days Domain member: Require strong (Windows 2000 or later) session key*: Set to Enabled Link the GPO to the dedicated PAW OU and force update via gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountSecureChannel.ps1 # Configure-PawAccountSecureChannel.ps1 # Description: Configures Netlogon secure channel signing, sealing, strong keys, and password rotation on PAWs. Write-Host "Configuring PAW Domain Member Secure Channel settings..." -ForegroundColor Cyan $NetlogonPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" if (-not (Test-Path -Path $NetlogonPath)) { New-Item -Path $NetlogonPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonPath -Name "RequireSignOrSeal" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "SealSecureChannel" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "SignSecureChannel" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "DisablePasswordChange" -Value 0 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "MaximumPasswordAge" -Value 30 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "RequireStrongKey" -Value 1 -Type DWord -Force Write-Host "Domain Member Secure Channel settings applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountSecureChannelStatus.ps1 # Get-PawAccountSecureChannelStatus.ps1 # Description: Audits Netlogon secure channel parameters on PAWs. Write-Host "--- Auditing PAW Domain Member Secure Channel Settings ---" -ForegroundColor Cyan $script:Vulnerable = $false $NetlogonPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal $NetlogonPath "RequireSignOrSeal" 1 Test-RegVal $NetlogonPath "SealSecureChannel" 1 Test-RegVal $NetlogonPath "SignSecureChannel" 1 Test-RegVal $NetlogonPath "DisablePasswordChange" 0 Test-RegVal $NetlogonPath "MaximumPasswordAge" 30 Test-RegVal $NetlogonPath "RequireStrongKey" 1 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the active secure channel configuration using nltest: cmd nltest /sc_query:%USERDNSDOMAIN% nltest /sc_verify:%USERDNSDOMAIN% Confirm that the secure channel is verified with a trusted Domain Controller and returns status NTRR_SUCCESS (or 0x0). Verify the applied registry settings using reg query: cmd reg query "HKLM\System\CurrentControlSet\Services\Netlogon\Parameters" /v RequireSignOrSeal reg query "HKLM\System\CurrentControlSet\Services\Netlogon\Parameters" /v RequireStrongKey reg query "HKLM\System\CurrentControlSet\Services\Netlogon\Parameters" /v MaximumPasswordAge Confirm that RequireSignOrSeal is 0x1, RequireStrongKey is 0x1, and MaximumPasswordAge is 0x1e (Decimal 30). Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-smb-security.md The Server Message Block (SMB) protocol is utilized extensively for administrative file transfers, Group Policy retrieval, and remote management. Hardening SMB client and server parameters on Privileged Access Workstations prevents cleartext credential exposure, terminates stale dormant sessions, and eliminates unauthenticated network shares: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Microsoft network client: Send unencrypted password to third-party SMB servers*: Set to Disabled Microsoft network server: Amount of idle time required before suspending session*: Set to 15 minutes Microsoft network server: Disconnect clients when logon hours expire*: Set to Enabled Network security: Force logoff when logon hours expire*: Set to Enabled Network access: Shares that can be accessed anonymously*: Set to None (leave field completely empty) Link the GPO to the dedicated PAW OU and force update via gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountSmbSecurity.ps1 # Configure-PawAccountSmbSecurity.ps1 # Description: Configures SMB client and server security options (plaintext block, auto-disconnect, logon hours) on PAWs. Write-Host "Configuring PAW SMB client and server security options..." -ForegroundColor Cyan # 1. LanmanWorkstation: Block plaintext passwords $WorkstationPath = "HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" if (-not (Test-Path -Path $WorkstationPath)) { New-Item -Path $WorkstationPath -Force | Out-Null } Set-ItemProperty -Path $WorkstationPath -Name "EnablePlainTextPassword" -Value 0 -Type DWord -Force # 2. LanmanServer: AutoDisconnect, EnableForcedLogoff, NullSessionShares $ServerPath = "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" if (-not (Test-Path -Path $ServerPath)) { New-Item -Path $ServerPath -Force | Out-Null } Set-ItemProperty -Path $ServerPath -Name "AutoDisconnect" -Value 15 -Type DWord -Force Set-ItemProperty -Path $ServerPath -Name "EnableForcedLogoff" -Value 1 -Type DWord -Force Set-ItemProperty -Path $ServerPath -Name "NullSessionShares" -Value @() -Type MultiString -Force # 3. Netlogon: ForceLogoffWhenHourExpire $NetlogonPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" if (-not (Test-Path -Path $NetlogonPath)) { New-Item -Path $NetlogonPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonPath -Name "ForceLogoffWhenHourExpire" -Value 1 -Type DWord -Force Write-Host "SMB client and server security options applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountSmbSecurityStatus.ps1 # Get-PawAccountSmbSecurityStatus.ps1 # Description: Audits SMB client and server security options on PAWs. Write-Host "--- Auditing PAW SMB Client and Server Security Options ---" -ForegroundColor Cyan $script:Vulnerable = $false $WorkstationPath = "HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" $ServerPath = "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" $NetlogonPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal $WorkstationPath "EnablePlainTextPassword" 0 Test-RegVal $ServerPath "AutoDisconnect" 15 Test-RegVal $ServerPath "EnableForcedLogoff" 1 Test-RegVal $NetlogonPath "ForceLogoffWhenHourExpire" 1 # Audit NullSessionShares if (Test-Path -Path $ServerPath) { $NullShares = (Get-ItemProperty -Path $ServerPath -Name "NullSessionShares" -ErrorAction SilentlyContinue).NullSessionShares if ($null -ne $NullShares -and $NullShares.Count -gt 0 -and ($NullShares -join "") -ne "") { Write-Host " [!] VULNERABLE: NullSessionShares contains: $($NullShares -join ', ')" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] NullSessionShares: Empty (Secure)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied SMB settings using command prompt queries: cmd reg query "HKLM\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v EnablePlainTextPassword reg query "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoDisconnect reg query "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v EnableForcedLogoff reg query "HKLM\System\CurrentControlSet\Services\Netlogon\Parameters" /v ForceLogoffWhenHourExpire reg query "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v NullSessionShares Confirm that EnablePlainTextPassword is 0x0, AutoDisconnect is 0xf (Decimal 15), EnableForcedLogoff is 0x1, ForceLogoffWhenHourExpire is 0x1, and NullSessionShares is empty. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-anonymous-restrictions.md Unauthenticated network enumeration provides initial access actors with reconnaissance data required to map administrative privileges, local accounts, and shared directory resources: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Network access: Do not allow anonymous enumeration of SAM accounts*: Set to Enabled Network access: Do not allow anonymous enumeration of SAM accounts and shares*: Set to Enabled Network access: Allow anonymous SID/Name translation*: Set to Disabled Network security: Allow PKU2U authentication requests to this computer to use online identities*: Set to Disabled System objects: Require case insensitivity for non-Windows subsystems*: Set to Enabled Link the GPO to the dedicated PAW OU and force replication across Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountAnonymousRestrictions.ps1 # Configure-PawAccountAnonymousRestrictions.ps1 # Description: Hardens anonymous access, SAM enumeration, PKU2U, and subsystem object naming on PAWs. Write-Host "Configuring PAW anonymous access and enumeration restrictions..." -ForegroundColor Cyan $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path -Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "RestrictAnonymousSAM" -Value 1 -Type DWord -Force Set-ItemProperty -Path $LsaPath -Name "RestrictAnonymous" -Value 1 -Type DWord -Force Set-ItemProperty -Path $LsaPath -Name "ObaseCaseInsensitive" -Value 1 -Type DWord -Force $KerbPath = "HKLM:\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters" if (-not (Test-Path -Path $KerbPath)) { New-Item -Path $KerbPath -Force | Out-Null } Set-ItemProperty -Path $KerbPath -Name "AllowPKU2U" -Value 0 -Type DWord -Force Write-Host "Anonymous access and enumeration restrictions applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountAnonymousRestrictionsStatus.ps1 # Get-PawAccountAnonymousRestrictionsStatus.ps1 # Description: Audits PAW anonymous enumeration, PKU2U, and subsystem object security configuration. Write-Host "--- Auditing PAW Anonymous Access and Enumeration Restrictions ---" -ForegroundColor Cyan $script:Vulnerable = $false $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $KerbPath = "HKLM:\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters" function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal $LsaPath "RestrictAnonymousSAM" 1 Test-RegVal $LsaPath "RestrictAnonymous" 1 Test-RegVal $LsaPath "ObaseCaseInsensitive" 1 Test-RegVal $KerbPath "AllowPKU2U" 0 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied registry values via command prompt using reg query: cmd reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v RestrictAnonymousSAM reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v RestrictAnonymous reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v ObaseCaseInsensitive reg query "HKLM\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters" /v AllowPKU2U Confirm that RestrictAnonymousSAM, RestrictAnonymous, and ObaseCaseInsensitive return 0x1, and AllowPKU2U returns 0x0. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1809 and above), Windows 11 Enterprise (all builds). File Path: 07-paws/account-policy/configure-paw-account-interactive-logon.md Interactive logon controls establish the initial verification boundary between the physical user, hardware input devices, and the Windows kernel. On Tier 0 Privileged Access Workstations, interactive logon settings must eliminate credential harvesting prompts, shoulder surfing, and denial-of-service vectors: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Interactive logon: Do not require CTRL+ALT+DEL*: Set to Disabled (value 0) Interactive logon: Don't display last signed-in*: Set to Enabled (value 1) Audit: Shut down system immediately if unable to log security audits*: Set to Disabled (value 0) Link the GPO to the dedicated PAW OU and force update via gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAccountInteractiveLogon.ps1 # Configure-PawAccountInteractiveLogon.ps1 # Description: Configures interactive logon security options (SAS requirement, hide last user, audit stability) on PAWs. Write-Host "Configuring PAW interactive logon security options..." -ForegroundColor Cyan $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path -Path $SystemPath)) { New-Item -Path $SystemPath -Force | Out-Null } Set-ItemProperty -Path $SystemPath -Name "DisableCAD" -Value 0 -Type DWord -Force Set-ItemProperty -Path $SystemPath -Name "DontDisplayLastUserName" -Value 1 -Type DWord -Force Set-ItemProperty -Path $SystemPath -Name "CrashOnAuditFail" -Value 0 -Type DWord -Force Write-Host "Interactive logon security options applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAccountInteractiveLogonStatus.ps1 # Get-PawAccountInteractiveLogonStatus.ps1 # Description: Audits interactive logon security options on PAWs. Write-Host "--- Auditing PAW Interactive Logon Security Options ---" -ForegroundColor Cyan $script:Vulnerable = $false $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" function Test-RegVal ($Name, $Expected) { if (-not (Test-Path -Path $SystemPath)) { Write-Host " [!] MISSING KEY: $SystemPath" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $SystemPath -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $SystemPath (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal "DisableCAD" 0 Test-RegVal "DontDisplayLastUserName" 1 Test-RegVal "CrashOnAuditFail" 0 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied registry configuration using command line queries: cmd reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DontDisplayLastUserName reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v CrashOnAuditFail Confirm that DisableCAD is 0x0, DontDisplayLastUserName is 0x1, and CrashOnAuditFail is 0x0. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) (Tier 0 Workstations) Operating Systems: Windows 10 Enterprise, Windows 11 Enterprise File Path: 07-paws/enable-kerberos-armoring.md Privileged Access Workstations (PAWs) host high-privilege administrative sessions used to manage Active Directory Domain Controllers and Tier 0 identity infrastructure. Standard Kerberos pre-authentication transmits the initial authentication request (AS-REQ) containing timestamp data that can be intercepted by adversaries monitoring network traffic, facilitating offline dictionary attacks and password cracking. Furthermore, accounts configured without Kerberos pre-authentication (DONT_REQ_PREAUTH) remain susceptible to AS-REP roasting attacks. Kerberos Armoring, or Flexible Authentication Secure Tunneling (FAST - RFC 6113), establishes an encrypted channel between the Kerberos client and the Key Distribution Center (KDC) using the client computer's account credential or machine certificate. This protects the AS-REQ and AS-REP exchanges against sniffing, offline cracking, and message tampering. In accordance with Tier 0 hardening baselines, the PAW configuration is strictly tightened compared to standard end-user workstations. While standard endpoints negotiate FAST opportunistically, PAWs configure Fail authentication requests when Kerberos armoring is not available (RequireFast = 1). This policy mandates that all authentication service (AS) and ticket-granting service (TGS) exchanges must be armored. If a Domain Controller does not support FAST or an attacker attempts a protocol downgrade, authentication is immediately terminated, ensuring that Tier 0 credentials are never exposed over unarmored channels. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a Tier 0 management host. Edit the dedicated PAW Computer Hardening GPO (e.g., GPO_Hardening_PAW_Computers). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Kerberos Configure the following settings: Policy : `Kerberos client support for claims, compound authentication and Kerberos armoring` -> Enabled Policy : `Support device authentication using certificate` -> Enabled* (Select Automatic in options) Policy : `Fail authentication requests when Kerberos armoring is not available` -> Enabled Link the GPO to the Tier 0 PAWs Organizational Unit (OU). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally (for standalone PAW provisioning or gold image preparation) or if the control is not manageable via standard GPO interfaces. Download Script: Configure-PawKerberosArmoring.ps1 # Configure-PawKerberosArmoring.ps1 # Description: Configures Kerberos Armoring (FAST) with strict enforcement and certificate device authentication on PAWs. Write-Host "Applying hardening requirement: Enable Kerberos Armoring (FAST) on PAWs..." -ForegroundColor Cyan $ClientRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" if (-not (Test-Path $ClientRegPath)) { New-Item -Path $ClientRegPath -Force | Out-Null } # 1. Enable Kerberos client support for claims and armoring Set-ItemProperty -Path $ClientRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord # 2. Support device authentication using certificate (Automatic) Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitEnabled" -Value 1 -Type DWord Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitBehavior" -Value 0 -Type DWord # 3. Fail authentication requests when Kerberos armoring is not available (Strict FAST enforcement on Tier 0 PAWs) Set-ItemProperty -Path $ClientRegPath -Name "RequireFast" -Value 1 -Type DWord Write-Host "PAW Kerberos Armoring configured successfully with strict enforcement (RequireFast = 1)." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-PawKerberosArmoringStatus.ps1 # Get-PawKerberosArmoringStatus.ps1 # Description: Audits Kerberos Armoring (FAST) configuration on Privileged Access Workstations (PAWs). Write-Host "--- Auditing PAW Kerberos Armoring Configuration ---" -ForegroundColor Cyan $ClientRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" $Vulnerable = $false $ClientValue = Get-ItemProperty -Path $ClientRegPath -Name "EnableCbacAndArmor" -ErrorAction SilentlyContinue $DevicePKInit = Get-ItemProperty -Path $ClientRegPath -Name "DevicePKInitEnabled" -ErrorAction SilentlyContinue $DeviceBehavior = Get-ItemProperty -Path $ClientRegPath -Name "DevicePKInitBehavior" -ErrorAction SilentlyContinue $RequireFast = Get-ItemProperty -Path $ClientRegPath -Name "RequireFast" -ErrorAction SilentlyContinue # 1. Audit Client-side support for claims and armoring if ($null -ne $ClientValue -and $ClientValue.EnableCbacAndArmor -eq 1) { Write-Host "[+] Client-side Kerberos Armoring is ENABLED (EnableCbacAndArmor = 1)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Client-side Kerberos Armoring is DISABLED or missing." -ForegroundColor Red $Vulnerable = $true } # 2. Audit Certificate device authentication if ($null -ne $DevicePKInit -and $DevicePKInit.DevicePKInitEnabled -eq 1 -and $null -ne $DeviceBehavior -and $DeviceBehavior.DevicePKInitBehavior -eq 0) { Write-Host "[+] Certificate device authentication is ENABLED: Automatic." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Certificate device authentication is not compliant or not configured." -ForegroundColor Red $Vulnerable = $true } # 3. Audit Strict Armoring Enforcement (RequireFast = 1) if ($null -ne $RequireFast -and $RequireFast.RequireFast -eq 1) { Write-Host "[+] Strict Kerberos Armoring enforcement is ENABLED (RequireFast = 1)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Strict Kerberos Armoring enforcement is NOT configured (RequireFast != 1)." -ForegroundColor Red $Vulnerable = $true } if ($Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawKerberosArmoring.ps1 # Description: Configures Kerberos Armoring (FAST) with strict enforcement and certificate device authentication on PAWs. Write-Host "Applying hardening requirement: Enable Kerberos Armoring (FAST) on PAWs..." -ForegroundColor Cyan $ClientRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" if (-not (Test-Path $ClientRegPath)) { New-Item -Path $ClientRegPath -Force | Out-Null } # 1. Enable Kerberos client support for claims and armoring Set-ItemProperty -Path $ClientRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord # 2. Support device authentication using certificate (Automatic) Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitEnabled" -Value 1 -Type DWord Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitBehavior" -Value 0 -Type DWord # 3. Fail authentication requests when Kerberos armoring is not available (Strict FAST enforcement on Tier 0 PAWs) Set-ItemProperty -Path $ClientRegPath -Name "RequireFast" -Value 1 -Type DWord Write-Host "PAW Kerberos Armoring configured successfully with strict enforcement (RequireFast = 1)." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-179](../../08-endpoints/admin-templates/configure-end-at-smbv1.md); for Domain Controllers, refer to [REQ-DC-016](../../02-domain-controllers/disable-smbv1.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-smbv1.md Privileged Access Workstations (PAWs) serve as the sensitive administrative bridge between Tier 0 operators and Tier 0 Active Directory Domain Controllers. Any security compromise of a PAW results in complete loss of forest integrity. Legacy Server Message Block version 1 (SMBv1) introduces catastrophic architectural vulnerabilities that cannot be permitted on privileged hardware. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Lanman Workstation Configure SMB v1 client driver: Set to Enabled Set Driver state drop-down to: Disable driver (recommended) Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Lanman Server Configure SMB v1 server: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtSmbv1.ps1 #Configure-PawAtSmbv1.ps1 # Description: Configures Administrative Templates: Disable SMBv1 Protocol Components for PAWs. Write-Host "Configuring Administrative Templates: Disable SMBv1 Protocol Components for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" -Name "Start" -Value 4 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "SMB1" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable SMBv1 Protocol Components for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtSmbv1Status.ps1 #Get-PawAtSmbv1Status.ps1 # Description: Audits Administrative Templates: Disable SMBv1 Protocol Components for PAWs. Write-Host "--- Auditing Administrative Templates: Disable SMBv1 Protocol Components for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" $ValueName = "Start" $ExpectedValue = 4 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" $ValueName = "SMB1" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-180](../../08-endpoints/admin-templates/configure-end-at-netbt-nodetype.md); for Domain Controllers, refer to [REQ-DC-017](../../02-domain-controllers/harden-network-parameters.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-netbt-nodetype.md Privileged Access Workstations (PAWs) are high-value targets operating within dedicated administrative management zones. Permitting unauthenticated broadcast resolution protocols on a PAW introduces critical risks of credential relay and network-level denial of service. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Network\TCPIP Settings\Parameters NetBT NodeType configuration: Set to Enabled Set NetBT NodeType drop-down to: P-node (recommended) Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers: Set to Enabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtNetbtNodetype.ps1 #Configure-PawAtNetbtNodetype.ps1 # Description: Configures Administrative Templates: Configure NetBT Node Type and Name Release for PAWs. Write-Host "Configuring Administrative Templates: Configure NetBT Node Type and Name Release for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" -Name "NodeType" -Value 2 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" -Name "NoNameReleaseOnDemand" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Configure NetBT Node Type and Name Release for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtNetbtNodetypeStatus.ps1 #Get-PawAtNetbtNodetypeStatus.ps1 # Description: Audits Administrative Templates: Configure NetBT Node Type and Name Release for PAWs. Write-Host "--- Auditing Administrative Templates: Configure NetBT Node Type and Name Release for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" $ValueName = "NodeType" $ExpectedValue = 2 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" $ValueName = "NoNameReleaseOnDemand" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-181](../../08-endpoints/admin-templates/configure-end-at-mss-ip-source-routing.md); for Domain Controllers, refer to [REQ-DC-018](../../02-domain-controllers/harden-network-parameters.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-mss-ip-source-routing.md Privileged Access Workstations (PAWs) establish highly privileged administrative sessions (including Kerberos-authenticated WinRM, Remote Desktop with Restricted Admin mode, and LDAP over TLS) to Tier 0 infrastructure. Preserving absolute network routing integrity is critical to prevent traffic interception or session manipulation. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options MSS: (DisableIPSourceRouting IPv6) IP source routing protection level: Set to Enabled Select drop-down value: Highest protection, source routing is completely disabled Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options MSS: (DisableIPSourceRouting) IP source routing protection level: Set to Enabled Select drop-down value: Highest protection, source routing is completely disabled Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtMssIpSourceRouting.ps1 #Configure-PawAtMssIpSourceRouting.ps1 # Description: Configures Administrative Templates: MSS IP Source Routing and ICMP Redirects for PAWs. Write-Host "Configuring Administrative Templates: MSS IP Source Routing and ICMP Redirects for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" -Name "DisableIPSourceRouting" -Value 2 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "DisableIPSourceRouting" -Value 2 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "EnableICMPRedirect" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: MSS IP Source Routing and ICMP Redirects for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtMssIpSourceRoutingStatus.ps1 #Get-PawAtMssIpSourceRoutingStatus.ps1 # Description: Audits Administrative Templates: MSS IP Source Routing and ICMP Redirects for PAWs. Write-Host "--- Auditing Administrative Templates: MSS IP Source Routing and ICMP Redirects for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" $ValueName = "DisableIPSourceRouting" $ExpectedValue = 2 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" $ValueName = "DisableIPSourceRouting" $ExpectedValue = 2 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" $ValueName = "EnableICMPRedirect" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-mss-system-protections.md Privileged Access Workstations (PAWs) are hardened bastion hosts utilized by directory administrators to manage Active Directory domain controllers, Kerberos policies, and enterprise identity databases. Because PAWs operate under maximum privilege conditions, fundamental session security, DLL loading mechanisms, physical console timeouts, and security audit log thresholds must be enforced with zero tolerance for compromise. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following MSS policies: MSS: (AutoAdminLogon) Enable Automatic Logon*: Set to Disabled MSS: (SafeDllSearchMode) Enable Safe DLL search mode*: Set to Enabled MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires*: Set to Enabled: 5 or fewer seconds MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning*: Set to Enabled: 90% or less Click Apply, then click OK for each policy. Link the GPO to the dedicated PAW Organizational Unit and verify policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtMssSystemProtections.ps1 #Configure-PawAtMssSystemProtections.ps1 # Description: Configures Administrative Templates: MSS System and Session Security Protections for PAWs. Write-Host "Configuring Administrative Templates: MSS System and Session Security Protections for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "AutoAdminLogon" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "ScreenSaverGracePeriod" -Value 5 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "SafeDllSearchMode" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security" -Name "WarningLevel" -Value 90 -Type DWord -Force Write-Host "[+] Administrative Templates: MSS System and Session Security Protections for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtMssSystemProtectionsStatus.ps1 #Get-PawAtMssSystemProtectionsStatus.ps1 # Description: Audits Administrative Templates: MSS System and Session Security Protections for PAWs. Write-Host "--- Auditing Administrative Templates: MSS System and Session Security Protections for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" $ValueName = "AutoAdminLogon" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" $ValueName = "ScreenSaverGracePeriod" $ExpectedValue = 5 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" $ValueName = "SafeDllSearchMode" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security" $ValueName = "WarningLevel" $ExpectedValue = 90 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ScreenSaverGracePeriod reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode reg query "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security" /v WarningLevel Expected output: text AutoAdminLogon REG_SZ 0 ScreenSaverGracePeriod REG_DWORD 0x5 SafeDllSearchMode REG_DWORD 0x1 WarningLevel REG_DWORD 0x5a Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-device-metadata.md Privileged Access Workstations (PAWs) host high-privilege administrative sessions where access to Active Directory domain controllers, PKI certificate authorities, and Tier 0 identity assets is executed. Hardware peripherals utilized on PAWs are strictly constrained to high-assurance authentication devices, such as smart card readers, cryptographic hardware security keys (FIDO2/YubiKeys), and dedicated administrative input hardware. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Device Installation Double-click Prevent device metadata retrieval from the Internet. Select Enabled. Click Apply, then click OK. Link the GPO to the dedicated PAW Organizational Unit and verify policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtDeviceMetadata.ps1 #Configure-PawAtDeviceMetadata.ps1 # Description: Configures Administrative Templates: Prevent Device Metadata Retrieval from Network for PAWs. Write-Host "Configuring Administrative Templates: Prevent Device Metadata Retrieval from Network for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" -Name "PreventDeviceMetadataFromNetwork" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Prevent Device Metadata Retrieval from Network applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtDeviceMetadataStatus.ps1 #Get-PawAtDeviceMetadataStatus.ps1 # Description: Audits Administrative Templates: Prevent Device Metadata Retrieval from Network for PAWs. Write-Host "--- Auditing Administrative Templates: Prevent Device Metadata Retrieval from Network ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" $ValueName = "PreventDeviceMetadataFromNetwork" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" /v PreventDeviceMetadataFromNetwork Expected output: text PreventDeviceMetadataFromNetwork REG_DWORD 0x1 Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-gp-processing.md Privileged Access Workstations (PAWs) are high-security administrative bastion hosts dedicated exclusively to Tier 0 directory services management. Maintaining a deterministic, tamper-resistant system state on PAWs is a foundational requirement of the Microsoft Clean Source and tiering security models. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Group Policy Double-click Configure registry policy processing: Set to Enabled*. Check Process even if the Group Policy objects have not changed*. Uncheck Do not apply during periodic background processing*. Double-click Configure security policy processing: Set to Enabled*. Check Process even if the Group Policy objects have not changed*. Uncheck Do not apply during periodic background processing*. Click Apply, then click OK for both policies. Link the GPO to the dedicated PAW Organizational Unit and verify policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtGpProcessing.ps1 #Configure-PawAtGpProcessing.ps1 # Description: Configures Administrative Templates: Enforce Group Policy Background Processing for PAWs. Write-Host "Configuring Administrative Templates: Enforce Group Policy Background Processing for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" -Name "NoBackgroundPolicy" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" -Name "NoGPOListChanges" -Value 0 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" -Name "NoBackgroundPolicy" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" -Name "NoGPOListChanges" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Enforce Group Policy Background Processing for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtGpProcessingStatus.ps1 #Get-PawAtGpProcessingStatus.ps1 # Description: Audits Administrative Templates: Enforce Group Policy Background Processing for PAWs. Write-Host "--- Auditing Administrative Templates: Enforce Group Policy Background Processing for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" $ValueName = "NoBackgroundPolicy" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" $ValueName = "NoGPOListChanges" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" $ValueName = "NoBackgroundPolicy" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" $ValueName = "NoGPOListChanges" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" /s reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" /s Verify that NoBackgroundPolicy and NoGPOListChanges are present and set to 0x0. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-cross-device-experiences.md Privileged Access Workstations (PAWs) provide a dedicated, isolated execution environment for managing Tier 0 Active Directory Domain Services, Public Key Infrastructure (PKI), and critical identity systems. The Windows Connected Devices Platform (CDP / Project Rome) introduces capabilities—such as cross-device task roaming, shared activity feeds, and cloud-synchronized clipboard buffers—that are fundamentally incompatible with the strict tiering and isolation guarantees required on a PAW. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Cross-Device Experiences Double-click Continue experiences on this device. Select Disabled. Click Apply, then click OK. Link the GPO to the dedicated PAW Organizational Unit and verify policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtCrossDeviceExperiences.ps1 #Configure-PawAtCrossDeviceExperiences.ps1 # Description: Configures Administrative Templates: Disable Cross-Device Experiences for PAWs. Write-Host "Configuring Administrative Templates: Disable Cross-Device Experiences for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableCdp" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Cross-Device Experiences for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtCrossDeviceExperiencesStatus.ps1 #Get-PawAtCrossDeviceExperiencesStatus.ps1 # Description: Audits Administrative Templates: Disable Cross-Device Experiences for PAWs. Write-Host "--- Auditing Administrative Templates: Disable Cross-Device Experiences for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "EnableCdp" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableCdp Expected output: text EnableCdp REG_DWORD 0x0 Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-186](../../08-endpoints/admin-templates/configure-end-at-internet-communication.md); for Domain Controllers, refer to [REQ-DC-027](../../02-domain-controllers/configure-telemetry-privacy.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-internet-communication.md Privileged Access Workstations (PAWs) reside in isolated administrative zones dedicated to the management of Active Directory Domain Controllers and enterprise tier-0 identity infrastructure. Automated internet communication channels, web wizard downloads, and dynamic HTTP driver retrieval represent intolerable attack surfaces on privileged hosts. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Internet Communication Management\Internet Communication settings Turn off downloading of print drivers over HTTP: Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\System\Internet Communication Management\Internet Communication settings Turn off Internet download for Web publishing and online ordering wizards: Set to Enabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtInternetCommunication.ps1 #Configure-PawAtInternetCommunication.ps1 # Description: Configures Administrative Templates: Restrict Internet Communication and Web Downloads for PAWs. Write-Host "Configuring Administrative Templates: Restrict Internet Communication and Web Downloads for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" -Name "DisableWebPnPDownload" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoWebServices" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Restrict Internet Communication and Web Downloads for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtInternetCommunicationStatus.ps1 #Get-PawAtInternetCommunicationStatus.ps1 # Description: Audits Administrative Templates: Restrict Internet Communication and Web Downloads for PAWs. Write-Host "--- Auditing Administrative Templates: Restrict Internet Communication and Web Downloads for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" $ValueName = "DisableWebPnPDownload" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" $ValueName = "NoWebServices" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-187](../../08-endpoints/admin-templates/configure-end-at-lsa-custom-ssps.md); for complementary LSA Protection, refer to [REQ-PAW-007](../../07-paws/enable-lsa-protection.md)). Operating Systems: Windows 10 Enterprise (1903+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-lsa-custom-ssps.md Privileged Access Workstations (PAWs) operate in the Tier 0 administrative plane, handling Kerberos Ticket Granting Tickets (TGTs), Smart Card PINs, and administrative authentication tokens for Active Directory Domain Controllers. Protecting the Local Security Authority Subsystem Service (lsass.exe) against DLL injection and persistence is a vital baseline defense. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Local Security Authority Allow Custom SSPs and APs to be loaded into LSASS: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtLsaCustomSsps.ps1 #Configure-PawAtLsaCustomSsps.ps1 # Description: Configures Administrative Templates: Block Custom SSPs and APs from Loading into LSASS for PAWs. Write-Host "Configuring Administrative Templates: Block Custom SSPs and APs from Loading into LSASS for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "AllowCustomSSPsAPs" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Block Custom SSPs and APs from Loading into LSASS for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtLsaCustomSspsStatus.ps1 #Get-PawAtLsaCustomSspsStatus.ps1 # Description: Audits Administrative Templates: Block Custom SSPs and APs from Loading into LSASS for PAWs. Write-Host "--- Auditing Administrative Templates: Block Custom SSPs and APs from Loading into LSASS for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "AllowCustomSSPsAPs" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-188](../../08-endpoints/admin-templates/configure-end-at-logon-display-options.md); for Domain Controllers, refer to [REQ-DC-024](../../02-domain-controllers/configure-security-options.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-logon-display-options.md Privileged Access Workstations (PAWs) serve as the dedicated management perimeter for Active Directory Domain Controllers and enterprise tier-0 administrative roles. Visual information disclosure, network re-association controls at lock screen, and consumer authentication features introduce critical exposure to administrative credential theft and physical exploitation. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Logon Block user from showing account details on sign-in: Set to Enabled Do not display network selection UI: Set to Enabled Do not enumerate connected users on domain-joined computers: Set to Enabled Turn off app notifications on the lock screen: Set to Enabled Turn off picture password sign-in: Set to Enabled Turn on convenience PIN sign-in: Set to Disabled Prevent the use of security questions for local accounts: Set to Enabled Configure the transmission of the user's password in the content of MPR notifications sent by winlogon: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtLogonDisplayOptions.ps1 #Configure-PawAtLogonDisplayOptions.ps1 # Description: Configures Administrative Templates: Logon Display and Credential Restrictions for PAWs. Write-Host "Configuring Administrative Templates: Logon Display and Credential Restrictions for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "BlockUserFromShowingAccountDetailsOnSignin" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "DontDisplayNetworkSelectionUI" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "DontEnumerateConnectedUsers" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "DisableLockScreenAppNotifications" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "BlockDomainPicturePassword" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "AllowDomainPINLogon" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "NoLocalPasswordResetQuestions" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableMPR" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Logon Display and Credential Restrictions for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtLogonDisplayOptionsStatus.ps1 #Get-PawAtLogonDisplayOptionsStatus.ps1 # Description: Audits Administrative Templates: Logon Display and Credential Restrictions for PAWs. Write-Host "--- Auditing Administrative Templates: Logon Display and Credential Restrictions for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "BlockUserFromShowingAccountDetailsOnSignin" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "DontDisplayNetworkSelectionUI" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "DontEnumerateConnectedUsers" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "DisableLockScreenAppNotifications" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "BlockDomainPicturePassword" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "AllowDomainPINLogon" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "NoLocalPasswordResetQuestions" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "EnableMPR" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-power-connected-standby.md Privileged Access Workstations (PAWs) are high-assurance hardware platforms dedicated exclusively to Tier 0 directory administration. Modern laptop hardware supporting Modern Standby (S0 Low Power Idle) allows network adapters (Wi-Fi, Ethernet, cellular) to maintain active IP stacks and receive incoming network frames while the machine is sleeping or the lid is closed. Allowing unattended network activity on a PAW directly violates Tier 0 physical and network isolation standards. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Power Management\Sleep Settings Double-click Allow network connectivity during connected-standby (on battery): Set to Disabled*. Double-click Allow network connectivity during connected-standby (plugged in): Set to Disabled*. Click Apply, then click OK for both policies. Link the GPO to the dedicated PAW Organizational Unit and verify policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtPowerConnectedStandby.ps1 #Configure-PawAtPowerConnectedStandby.ps1 # Description: Configures Administrative Templates: Disable Connected Standby Network Connectivity for PAWs. Write-Host "Configuring Administrative Templates: Disable Connected Standby Network Connectivity for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" -Name "DCSettingIndex" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" -Name "ACSettingIndex" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Connected Standby Network Connectivity for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtPowerConnectedStandbyStatus.ps1 #Get-PawAtPowerConnectedStandbyStatus.ps1 # Description: Audits Administrative Templates: Disable Connected Standby Network Connectivity for PAWs. Write-Host "--- Auditing Administrative Templates: Disable Connected Standby Network Connectivity for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" $ValueName = "DCSettingIndex" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" $ValueName = "ACSettingIndex" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" /s Expected output: text DCSettingIndex REG_DWORD 0x0 ACSettingIndex REG_DWORD 0x0 Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-remote-assistance.md Privileged Access Workstations (PAWs) are dedicated exclusively to managing Tier 0 Active Directory Domain Services, root certificate authorities, and core directory security infrastructure. Permitting any form of Remote Assistance on a PAW constitutes an intolerable security architecture violation that shatters Active Directory administrative tiering. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Remote Assistance Double-click Configure Offer Remote Assistance. Select Disabled. Click Apply, then click OK. Link the GPO to the dedicated PAW Organizational Unit and verify policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtRemoteAssistance.ps1 #Configure-PawAtRemoteAssistance.ps1 # Description: Configures Administrative Templates: Disable Remote Assistance for PAWs. Write-Host "Configuring Administrative Templates: Disable Remote Assistance for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name "fAllowUnsolicited" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Remote Assistance for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtRemoteAssistanceStatus.ps1 #Get-PawAtRemoteAssistanceStatus.ps1 # Description: Audits Administrative Templates: Disable Remote Assistance for PAWs. Write-Host "--- Auditing Administrative Templates: Disable Remote Assistance for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" $ValueName = "fAllowUnsolicited" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fAllowUnsolicited Expected output: text fAllowUnsolicited REG_DWORD 0x0 Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-191](../../08-endpoints/admin-templates/configure-end-at-rpc-endpoint-mapper-auth.md); for Domain Controllers, refer to [REQ-DC-018](../../02-domain-controllers/harden-network-parameters.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-rpc-endpoint-mapper-auth.md Privileged Access Workstations (PAWs) execute high-privilege Remote Procedure Call (RPC) routines when administering Domain Controllers, certificate authorities, and directory services. Hardening the RPC resolution mechanism is essential to protect administrative credentials and prevent malicious traffic redirection. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Remote Procedure Call Enable RPC Endpoint Mapper Client Authentication: Set to Enabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtRpcEndpointMapperAuth.ps1 #Configure-PawAtRpcEndpointMapperAuth.ps1 # Description: Configures Administrative Templates: Enable RPC Endpoint Mapper Client Authentication for PAWs. Write-Host "Configuring Administrative Templates: Enable RPC Endpoint Mapper Client Authentication for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" -Name "EnableAuthEpResolution" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Enable RPC Endpoint Mapper Client Authentication for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtRpcEndpointMapperAuthStatus.ps1 #Get-PawAtRpcEndpointMapperAuthStatus.ps1 # Description: Audits Administrative Templates: Enable RPC Endpoint Mapper Client Authentication for PAWs. Write-Host "--- Auditing Administrative Templates: Enable RPC Endpoint Mapper Client Authentication for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" $ValueName = "EnableAuthEpResolution" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-192](../../08-endpoints/admin-templates/configure-end-at-w32time-ntp-client.md); for Domain Controllers, refer to [REQ-DC-020](../../02-domain-controllers/configure-pdc-time-sync.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-w32time-ntp-client.md Privileged Access Workstations (PAWs) perform high-consequence administrative operations across Tier 0 infrastructure. Precise timekeeping is a non-negotiable prerequisite for Kerberos ticket validation, security event audit sequencing, and cryptographic certificate verification. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Windows Time Service\Time Providers Enable Windows NTP Client: Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\System\Windows Time Service\Time Providers Enable Windows NTP Server: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtW32timeNtpClient.ps1 #Configure-PawAtW32timeNtpClient.ps1 # Description: Configures Administrative Templates: Configure Windows Time Service NTP Client and Server for PAWs. Write-Host "Configuring Administrative Templates: Configure Windows Time Service NTP Client and Server for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" -Name "Enabled" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpServer")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpServer" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpServer" -Name "Enabled" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Configure Windows Time Service NTP Client and Server for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtW32timeNtpClientStatus.ps1 #Get-PawAtW32timeNtpClientStatus.ps1 # Description: Audits Administrative Templates: Configure Windows Time Service NTP Client and Server for PAWs. Write-Host "--- Auditing Administrative Templates: Configure Windows Time Service NTP Client and Server for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" $ValueName = "Enabled" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpServer" $ValueName = "Enabled" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-193](../../08-endpoints/admin-templates/configure-end-at-appx-deployment-restrictions.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-appx-deployment-restrictions.md Privileged Access Workstations (PAWs) are dedicated exclusively to directory administration and Tier 0 infrastructure management. Application installation on a PAW must adhere to the strictest change management, code signing, and administrative boundaries. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\App Package Deployment Not allow per-user unsigned packages to install by default (requires explicitly allow per install): Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\App Package Deployment Prevent non-admin users from installing packaged Windows apps: Set to Enabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtAppxDeploymentRestrictions.ps1 #Configure-PawAtAppxDeploymentRestrictions.ps1 # Description: Configures Administrative Templates: App Package Deployment Restrictions for PAWs. Write-Host "Configuring Administrative Templates: App Package Deployment Restrictions for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" -Name "DisablePerUserUnsignedPackagesByDefault" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" -Name "BlockNonAdminUserInstall" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: App Package Deployment Restrictions for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtAppxDeploymentRestrictionsStatus.ps1 #Get-PawAtAppxDeploymentRestrictionsStatus.ps1 # Description: Audits Administrative Templates: App Package Deployment Restrictions for PAWs. Write-Host "--- Auditing Administrative Templates: App Package Deployment Restrictions for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" $ValueName = "DisablePerUserUnsignedPackagesByDefault" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" $ValueName = "BlockNonAdminUserInstall" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-194](../../08-endpoints/admin-templates/configure-end-at-biometrics-anti-spoofing.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-biometrics-anti-spoofing.md Privileged Access Workstations (PAWs) serve as the highest-trust endpoints within an Active Directory enterprise architecture. Physical access to an unlocked PAW grants direct compromise capability over Tier 0 directory services. If biometric facial verification is utilized for PAW operator logon, it must enforce the highest cryptographic and hardware liveness guarantees. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Biometrics\Facial Features Configure enhanced anti-spoofing: Set to Enabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtBiometricsAntiSpoofing.ps1 #Configure-PawAtBiometricsAntiSpoofing.ps1 # Description: Configures Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing for PAWs. Write-Host "Configuring Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures" -Name "EnhancedAntiSpoofing" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtBiometricsAntiSpoofingStatus.ps1 #Get-PawAtBiometricsAntiSpoofingStatus.ps1 # Description: Audits Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing for PAWs. Write-Host "--- Auditing Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures" $ValueName = "EnhancedAntiSpoofing" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-cloud-consumer-content.md Privileged Access Workstations (PAWs) are dedicated, single-purpose endpoints reserved exclusively for Tier 0 Active Directory and infrastructure administration. Windows consumer-oriented shell enhancements—such as promotional subscription cards, consumer OneDrive prompts, and personal Microsoft Account (MSA) suggestions—introduce severe architectural and operational risks to high-assurance administrative hosts. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Administrative Templates\Windows Components\Cloud Content Double-click Turn off cloud consumer account state content. Select Enabled. Click Apply, then click OK. Link the GPO to the dedicated PAW Organizational Unit and initiate policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtCloudConsumerContent.ps1 #Configure-PawAtCloudConsumerContent.ps1 # Description: Configures Administrative Templates: Disable Cloud Consumer Account State Content for PAWs. Write-Host "Configuring Administrative Templates: Disable Cloud Consumer Account State Content for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" -Name "DisableConsumerAccountStateContent" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Cloud Consumer Account State Content for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtCloudConsumerContentStatus.ps1 #Get-PawAtCloudConsumerContentStatus.ps1 # Description: Audits Administrative Templates: Disable Cloud Consumer Account State Content for PAWs. Write-Host "--- Auditing Administrative Templates: Disable Cloud Consumer Account State Content for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" $ValueName = "DisableConsumerAccountStateContent" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableConsumerAccountStateContent Expected output: text DisableConsumerAccountStateContent REG_DWORD 0x1 Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-196](../../08-endpoints/admin-templates/configure-end-at-connect-pin-pairing.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-connect-pin-pairing.md Privileged Access Workstations (PAWs) operate within dedicated administrative perimeters for Tier 0 Active Directory management. Wireless projection capabilities (Miracast over Wi-Fi Direct) introduce serious risks of over-the-air hijacking and unauthenticated input injection if not strictly hardened. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Connect Require pin for pairing: Set to Enabled Select drop-down value: Always (or First Time) Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtConnectPinPairing.ps1 #Configure-PawAtConnectPinPairing.ps1 # Description: Configures Administrative Templates: Require PIN for Connect Wireless Pairing for PAWs. Write-Host "Configuring Administrative Templates: Require PIN for Connect Wireless Pairing for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect" -Name "RequirePinForPairing" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Require PIN for Connect Wireless Pairing for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtConnectPinPairingStatus.ps1 #Get-PawAtConnectPinPairingStatus.ps1 # Description: Audits Administrative Templates: Require PIN for Connect Wireless Pairing for PAWs. Write-Host "--- Auditing Administrative Templates: Require PIN for Connect Wireless Pairing for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect" $ValueName = "RequirePinForPairing" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-197](../../08-endpoints/admin-templates/configure-end-at-credui-protections.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-credui-protections.md Privileged Access Workstations (PAWs) are dedicated exclusively to high-privilege Tier 0 Active Directory management tasks. Credential collection interfaces must maintain maximum visual confidentiality and prevent information disclosure regarding administrative identities. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Credential User Interface Do not display the password reveal button: Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Credential User Interface Enumerate administrator accounts on elevation: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtCreduiProtections.ps1 #Configure-PawAtCreduiProtections.ps1 # Description: Configures Administrative Templates: Credential User Interface Security Protections for PAWs. Write-Host "Configuring Administrative Templates: Credential User Interface Security Protections for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredUI")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredUI" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredUI" -Name "DisablePasswordReveal" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Name "EnumerateAdministrators" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Credential User Interface Security Protections for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtCreduiProtectionsStatus.ps1 #Get-PawAtCreduiProtectionsStatus.ps1 # Description: Audits Administrative Templates: Credential User Interface Security Protections for PAWs. Write-Host "--- Auditing Administrative Templates: Credential User Interface Security Protections for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredUI" $ValueName = "DisablePasswordReveal" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" $ValueName = "EnumerateAdministrators" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-data-collection-preview-builds.md Privileged Access Workstations (PAWs) are the dedicated administrative bastion hosts for Tier 0 Active Directory Domain Services, enterprise root certification authorities, and identity synchronization infrastructure. Workstations in this tier manage unconstrained directory objects, Kerberos Ticket Granting Service (TGS) sessions, and domain administrator secrets. The default Windows diagnostic telemetry, crash reporting, and preview build mechanisms pose catastrophic security risks to high-assurance Tier 0 environments. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Administrative Templates\Windows Components\Data Collection and Preview Builds Configure the following policies: Disable OneSettings Downloads*: Set to Enabled Do not show feedback notifications*: Set to Enabled Enable OneSettings Auditing*: Set to Enabled Limit Diagnostic Log Collection*: Set to Enabled Limit Dump Collection*: Set to Enabled Toggle user control over Insider builds*: Set to Disabled Click Apply, then click OK for each policy. Link the GPO to the dedicated PAW Organizational Unit and verify policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtDataCollectionPreviewBuilds.ps1 #Configure-PawAtDataCollectionPreviewBuilds.ps1 # Description: Configures Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions for PAWs. Write-Host "Configuring Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "DisableOneSettingsDownloads" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "DoNotShowFeedbackNotifications" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "EnableOneSettingsAuditing" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "LimitDiagnosticLogCollection" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "LimitDumpCollection" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -Name "AllowBuildPreview" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtDataCollectionPreviewBuildsStatus.ps1 #Get-PawAtDataCollectionPreviewBuildsStatus.ps1 # Description: Audits Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions for PAWs. Write-Host "--- Auditing Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "DisableOneSettingsDownloads" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "DoNotShowFeedbackNotifications" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "EnableOneSettingsAuditing" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "LimitDiagnosticLogCollection" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "LimitDumpCollection" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" $ValueName = "AllowBuildPreview" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /s reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" /v AllowBuildPreview Verify the expected DWORD values: text DisableOneSettingsDownloads REG_DWORD 0x1 DoNotShowFeedbackNotifications REG_DWORD 0x1 EnableOneSettingsAuditing REG_DWORD 0x1 LimitDiagnosticLogCollection REG_DWORD 0x1 LimitDumpCollection REG_DWORD 0x1 AllowBuildPreview REG_DWORD 0x0 Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-199](../../08-endpoints/admin-templates/configure-end-at-app-installer-controls.md)). Operating Systems: Windows 10 Enterprise (1709+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-app-installer-controls.md Privileged Access Workstations (PAWs) serve as the dedicated platform for Tier 0 Active Directory operations. Protecting the workstation from remote initial access vectors is paramount. The Windows App Installer protocol and package execution mechanisms present a severe vector for untrusted payload delivery that must be comprehensively disabled. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\App Installer Enable App Installer ms-appinstaller protocol: Set to Disabled Enable App Installer Experimental Features: Set to Disabled Enable App Installer Hash Override: Set to Disabled Enable App Installer Local Archive Malware Scan Override: Set to Disabled Enable App Installer Microsoft Store Source Certificate Validation Bypass: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtAppInstallerControls.ps1 #Configure-PawAtAppInstallerControls.ps1 # Description: Configures Administrative Templates: App Installer Protocol and Execution Controls for PAWs. Write-Host "Configuring Administrative Templates: App Installer Protocol and Execution Controls for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableExperimentalFeatures" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableHashOverride" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableLocalArchiveMalwareScanOverride" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableBypassCertificatePinningForMicrosoftStore" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableMSAppInstallerProtocol" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: App Installer Protocol and Execution Controls for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtAppInstallerControlsStatus.ps1 #Get-PawAtAppInstallerControlsStatus.ps1 # Description: Audits Administrative Templates: App Installer Protocol and Execution Controls for PAWs. Write-Host "--- Auditing Administrative Templates: App Installer Protocol and Execution Controls for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableExperimentalFeatures" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableHashOverride" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableLocalArchiveMalwareScanOverride" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableBypassCertificatePinningForMicrosoftStore" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableMSAppInstallerProtocol" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-event-log-sizes.md Privileged Access Workstations (PAWs) serve as the dedicated management plane for Active Directory Domain Controllers, Tier 0 directory services, and critical identity infrastructure. Every interactive logon, administrative command execution, PowerShell script block, and remote management session initiated from a PAW carries severe security sensitivity. Default event log capacities (20 MB) or legacy 192 MB baselines roll over rapidly during heavy administrative activity or forensic investigations, destroying vital attribution evidence. Expanding the Security log to 1 GB (1,048,576 KB), System and Application logs to 128 MB (131,072 KB), and Setup log to 32 MB (32,768 KB) establishes a robust local forensic buffer that preserves audit trails across extended operational periods: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Application Specify the maximum log file size (KB): Set to Enabled (131072 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Security Specify the maximum log file size (KB): Set to Enabled (1048576 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Setup Specify the maximum log file size (KB): Set to Enabled (32768 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\System Specify the maximum log file size (KB): Set to Enabled (131072 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Link the GPO to the dedicated PAW Organizational Unit and verify replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtEventLogSizes.ps1 #Configure-PawAtEventLogSizes.ps1 # Description: Configures Administrative Templates: Event Log Maximum File Sizes and Retention Policies for PAWs. Write-Host "Configuring Administrative Templates: Event Log Maximum File Sizes and Retention Policies for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Name "MaxSize" -Value 131072 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Name "MaxSize" -Value 1048576 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Name "MaxSize" -Value 32768 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Name "MaxSize" -Value 131072 -Type DWord -Force Write-Host "[+] Administrative Templates: Event Log Maximum File Sizes and Retention Policies for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtEventLogSizesStatus.ps1 #Get-PawAtEventLogSizesStatus.ps1 # Description: Audits Administrative Templates: Event Log Maximum File Sizes and Retention Policies for PAWs. Write-Host "--- Auditing Administrative Templates: Event Log Maximum File Sizes and Retention Policies for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" $ValueName = "MaxSize" $ExpectedValue = 131072 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" $ValueName = "MaxSize" $ExpectedValue = 1048576 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" $ValueName = "MaxSize" $ExpectedValue = 32768 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" $ValueName = "MaxSize" $ExpectedValue = 131072 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied log configurations via command line using wevtutil: cmd wevtutil gl Application wevtutil gl Security wevtutil gl Setup wevtutil gl System Verify that maxSize reflects the configured byte values (1073741824 bytes for Security, 134217728 bytes for System/Application, 33554432 bytes for Setup) and retention is set to false. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-201](../../08-endpoints/admin-templates/configure-end-at-file-explorer-motw.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-file-explorer-motw.md Privileged Access Workstations (PAWs) represent Tier 0 administrative boundaries. Protecting these high-value machines against unauthorized code execution requires enforcing all layers of Windows execution policy and download origin tracking. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\File Explorer Do not apply the Mark of the Web tag to files copied from insecure sources: Set to Disabled (Ensures MotW is applied) Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\File Explorer Turn off shell protocol protected mode: Set to Disabled (Ensures Protected Mode is enforced) Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtFileExplorerMotw.ps1 #Configure-PawAtFileExplorerMotw.ps1 # Description: Configures Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security for PAWs. Write-Host "Configuring Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "DisableMotWOnInsecurePathCopy" -Value 0 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "PreXPSP2ShellProtocolBehavior" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtFileExplorerMotwStatus.ps1 #Get-PawAtFileExplorerMotwStatus.ps1 # Description: Audits Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security for PAWs. Write-Host "--- Auditing Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" $ValueName = "DisableMotWOnInsecurePathCopy" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" $ValueName = "PreXPSP2ShellProtocolBehavior" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-202](../../08-endpoints/admin-templates/configure-end-at-internet-explorer-retirement.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-internet-explorer-retirement.md Privileged Access Workstations (PAWs) are hardened environments dedicated to Tier 0 infrastructure management. General web browsing on a PAW is strictly prohibited by design. However, legacy operating system binaries and background feed engines remain embedded in the Windows platform, requiring absolute administrative disabling to prevent exploitation. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer Disable Internet Explorer 11 as a standalone browser: Set to Enabled Select drop-down value: Always Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Feeds Prevent downloading of enclosures: Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Feeds Turn on Basic feed authentication over HTTP: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtInternetExplorerRetirement.ps1 #Configure-PawAtInternetExplorerRetirement.ps1 # Description: Configures Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls for PAWs. Write-Host "Configuring Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Main")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Main" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Main" -Name "NotifyDisableIEOptions" -Value 0 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" -Name "DisableEnclosureDownload" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" -Name "AllowBasicAuthInClear" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtInternetExplorerRetirementStatus.ps1 #Get-PawAtInternetExplorerRetirementStatus.ps1 # Description: Audits Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls for PAWs. Write-Host "--- Auditing Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Main" $ValueName = "NotifyDisableIEOptions" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" $ValueName = "DisableEnclosureDownload" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" $ValueName = "AllowBasicAuthInClear" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-search-cortana-restrictions.md Privileged Access Workstations (PAWs) are dedicated exclusively to Tier 0 Active Directory and core infrastructure administration. Because administrative consoles are used to generate disaster-recovery scripts, inspect Active Directory objects, and manage domain secrets, the operating system search subsystem must be strictly constrained against cryptographic degradation and side-channel leakage. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Administrative Templates\Windows Components\Search Configure the following policies: Allow Cortana*: Set to Disabled Allow Cortana above lock screen*: Set to Disabled Allow indexing of encrypted files*: Set to Disabled Allow search and Cortana to use location*: Set to Disabled Click Apply, then click OK for each policy. Link the GPO to the dedicated PAW Organizational Unit and verify policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtSearchCortanaRestrictions.ps1 #Configure-PawAtSearchCortanaRestrictions.ps1 # Description: Configures Administrative Templates: Windows Search and Cortana Privacy Restrictions for PAWs. Write-Host "Configuring Administrative Templates: Windows Search and Cortana Privacy Restrictions for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Name "AllowCortana" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Name "AllowCortanaAboveLock" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Name "AllowIndexingEncryptedStoresOrItems" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Name "AllowSearchToUseLocation" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Windows Search and Cortana Privacy Restrictions for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtSearchCortanaRestrictionsStatus.ps1 #Get-PawAtSearchCortanaRestrictionsStatus.ps1 # Description: Audits Administrative Templates: Windows Search and Cortana Privacy Restrictions for PAWs. Write-Host "--- Auditing Administrative Templates: Windows Search and Cortana Privacy Restrictions for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" $ValueName = "AllowCortana" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" $ValueName = "AllowCortanaAboveLock" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" $ValueName = "AllowIndexingEncryptedStoresOrItems" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" $ValueName = "AllowSearchToUseLocation" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /s Expected output: text AllowCortana REG_DWORD 0x0 AllowCortanaAboveLock REG_DWORD 0x0 AllowIndexingEncryptedStoresOrItems REG_DWORD 0x0 AllowSearchToUseLocation REG_DWORD 0x0 Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-205](../../08-endpoints/admin-templates/configure-end-at-windows-store-restrictions.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-windows-store-restrictions.md Privileged Access Workstations (PAWs) execute mission-critical directory administration tools. Essential system management utilities (such as Windows Terminal and system runtime dependencies) are maintained through modern packaging pipelines, requiring rigorous patch hygiene without exposing the privileged environment to uncoordinated operating system upgrades. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Store Turn off Automatic Download and Install of updates: Set to Disabled (Ensures updates are downloaded automatically) Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Store Turn off the offer to update to the latest version of Windows: Set to Enabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtWindowsStoreRestrictions.ps1 #Configure-PawAtWindowsStoreRestrictions.ps1 # Description: Configures Administrative Templates: Windows Store Updates and OS Upgrade Restrictions for PAWs. Write-Host "Configuring Administrative Templates: Windows Store Updates and OS Upgrade Restrictions for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" -Name "AutoDownload" -Value 4 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" -Name "DisableOSUpgrade" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Windows Store Updates and OS Upgrade Restrictions for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtWindowsStoreRestrictionsStatus.ps1 #Get-PawAtWindowsStoreRestrictionsStatus.ps1 # Description: Audits Administrative Templates: Windows Store Updates and OS Upgrade Restrictions for PAWs. Write-Host "--- Auditing Administrative Templates: Windows Store Updates and OS Upgrade Restrictions for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" $ValueName = "AutoDownload" $ExpectedValue = 4 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" $ValueName = "DisableOSUpgrade" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-windows-widgets-dsh.md Privileged Access Workstations (PAWs) provide the highest level of security isolation for Tier 0 Active Directory administration. They operate under a strict "clean source" principle where only vetted administrative binaries and management consoles are permitted to execute. Windows Widgets and News and Interests dynamically embed web rendering runtimes (Microsoft Edge WebView2) into the taskbar shell, directly violating core PAW security architecture. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: `text Computer Configuration\Policies\Administrative Templates\Windows Components\Widgets Double-click Allow widgets. Select Disabled. Click Apply, then click OK. Link the GPO to the dedicated PAW Organizational Unit and verify policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtWindowsWidgetsDsh.ps1 #Configure-PawAtWindowsWidgetsDsh.ps1 # Description: Configures Administrative Templates: Disable Windows Widgets and News Feed for PAWs. Write-Host "Configuring Administrative Templates: Disable Windows Widgets and News Feed for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Dsh")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Dsh" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Dsh" -Name "AllowNewsAndInterests" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Windows Widgets and News Feed for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtWindowsWidgetsDshStatus.ps1 #Get-PawAtWindowsWidgetsDshStatus.ps1 # Description: Audits Administrative Templates: Disable Windows Widgets and News Feed for PAWs. Write-Host "--- Auditing Administrative Templates: Disable Windows Widgets and News Feed for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Dsh" $ValueName = "AllowNewsAndInterests" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v AllowNewsAndInterests Expected output: text AllowNewsAndInterests REG_DWORD 0x0 Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-207](../../08-endpoints/admin-templates/configure-end-at-automatic-restart-signon.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-automatic-restart-signon.md Privileged Access Workstations (PAWs) process the enterprise's most sensitive credentials, including Active Directory Domain Admin tokens, Kerberos krbtgt keys, and enterprise root CA certificates. Permitting any automated, unattended credential persistence across reboots is fundamentally incompatible with Tier 0 security architectures. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Logon Options Sign-in and lock last interactive user automatically after a restart: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtAutomaticRestartSignon.ps1 #Configure-PawAtAutomaticRestartSignon.ps1 # Description: Configures Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO) for PAWs. Write-Host "Configuring Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO) for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "DisableAutomaticRestartSignOn" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO) for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtAutomaticRestartSignonStatus.ps1 #Get-PawAtAutomaticRestartSignonStatus.ps1 # Description: Audits Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO) for PAWs. Write-Host "--- Auditing Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO) for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "DisableAutomaticRestartSignOn" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-208](../../08-endpoints/admin-templates/configure-end-at-windows-sandbox-isolation.md)). Operating Systems: Windows 10 Enterprise (1903+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-windows-sandbox-isolation.md Privileged Access Workstations (PAWs) manage the enterprise's most sensitive Tier 0 identity boundaries. While Windows Sandbox allows isolated testing of administrative scripts or packages, running any virtualized container on a PAW without absolute host-isolation controls introduces severe risks to directory security. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Sandbox Allow clipboard sharing with Windows Sandbox: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Sandbox Allow networking in Windows Sandbox: Set to Disabled Link the GPO to the PAW Organizational Unit and enforce policy replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtWindowsSandboxIsolation.ps1 #Configure-PawAtWindowsSandboxIsolation.ps1 # Description: Configures Administrative Templates: Windows Sandbox Clipboard and Network Isolation for PAWs. Write-Host "Configuring Administrative Templates: Windows Sandbox Clipboard and Network Isolation for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" -Name "AllowClipboardRedirection" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" -Name "AllowNetworking" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Windows Sandbox Clipboard and Network Isolation for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtWindowsSandboxIsolationStatus.ps1 #Get-PawAtWindowsSandboxIsolationStatus.ps1 # Description: Audits Administrative Templates: Windows Sandbox Clipboard and Network Isolation for PAWs. Write-Host "--- Auditing Administrative Templates: Windows Sandbox Clipboard and Network Isolation for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" $ValueName = "AllowClipboardRedirection" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" $ValueName = "AllowNetworking" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/admin-templates/configure-paw-at-windows-update-policies.md Privileged Access Workstations (PAWs) host the most sensitive interactive sessions and management credentials across the entire enterprise directory structure. Because PAWs are high-value targets for sophisticated adversaries seeking lateral movement into Active Directory Domain Controllers, applying cumulative security patches without latency is vital to system survival. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update Remove access to 'Pause updates' feature: Set to Enabled Manage preview builds: Set to Disabled Select when Preview Builds and Feature Updates are received: Set to Enabled, select Semi-Annual Channel, and set deferral to 180 days Select when Quality Updates are received: Set to Enabled, set deferral to 0 days Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Manage end user experience Configure Automatic Updates: Set to Enabled, select option 4 - Auto download and schedule the install, set scheduled install day to 0 - Every day, and configure a suitable maintenance hour (e.g., 03:00) No auto-restart with logged on users for scheduled automatic updates installations: Set to Disabled Link the GPO to the dedicated PAW Organizational Unit and verify replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-PawAtWindowsUpdatePolicies.ps1 #Configure-PawAtWindowsUpdatePolicies.ps1 # Description: Configures Administrative Templates: Windows Update Deferral and Automatic Installation Policies for PAWs. Write-Host "Configuring Administrative Templates: Windows Update Deferral and Automatic Installation Policies for PAWs..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "SetDisablePauseUXAccess" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "ManagePreviewBuildsPolicyValue" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "DeferFeatureUpdates" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "DeferFeatureUpdatesPeriodInDays" -Value 180 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "DeferQualityUpdates" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "DeferQualityUpdatesPeriodInDays" -Value 0 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoRebootWithLoggedOnUsers" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "ScheduledInstallDay" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Windows Update Deferral and Automatic Installation Policies for PAWs applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-PawAtWindowsUpdatePoliciesStatus.ps1 #Get-PawAtWindowsUpdatePoliciesStatus.ps1 # Description: Audits Administrative Templates: Windows Update Deferral and Automatic Installation Policies for PAWs. Write-Host "--- Auditing Administrative Templates: Windows Update Deferral and Automatic Installation Policies for PAWs ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "SetDisablePauseUXAccess" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "ManagePreviewBuildsPolicyValue" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "DeferFeatureUpdates" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "DeferFeatureUpdatesPeriodInDays" $ExpectedValue = 180 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "DeferQualityUpdates" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "DeferQualityUpdatesPeriodInDays" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $ValueName = "NoAutoRebootWithLoggedOnUsers" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $ValueName = "ScheduledInstallDay" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /s Verify that all configured values match the defined baseline. Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/disable-real-time-monitoring-and-behavior-monitoring-override.md Real-time scanning, behavior monitoring, and script checking are the core dynamic defense mechanisms of Windows Defender. Disabling or bypassing these controls allows malicious scripts, file-based attacks, and unauthorized in-memory activities to execute undetected. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Real-time Protection Set 'Turn off real-time protection' to 'Disabled' Set 'Turn on behavior monitoring' to 'Enabled' Set 'Scan all downloaded files and attachments' to 'Enabled' Set 'Turn on script scanning' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderRtp.ps1 # Configure-PawDefenderRtp.ps1 Set-MpPreference -DisableRealtimeMonitoring $false Set-MpPreference -DisableBehaviorMonitoring $false Set-MpPreference -DisableIOAVProtection $false Set-MpPreference -DisableScriptScanning $false To audit the hardening status: Download Script: Get-PawDefenderRtpStatus.ps1 # Get-PawDefenderRtpStatus.ps1 $Pref = Get-MpPreference if ($Pref.DisableRealtimeMonitoring -eq $false -and $Pref.DisableBehaviorMonitoring -eq $false -and $Pref.DisableIOAVProtection -eq $false -and $Pref.DisableScriptScanning -eq $false) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderRtp.ps1 Set-MpPreference -DisableRealtimeMonitoring $false Set-MpPreference -DisableBehaviorMonitoring $false Set-MpPreference -DisableIOAVProtection $false Set-MpPreference -DisableScriptScanning $false Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-potentially-unwanted-applications-pua-protection.md Potentially Unwanted Applications (PUA) include adware, torrent clients, cryptominers, and system optimizers that increase risk and resource consumption. Forcing PUA blocking stops standard vectors of shadow IT and unauthorized utility tool execution. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus Set 'Configure detection for potentially unwanted applications' to 'Enabled' Select 'Block' in the options dropdown list Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderPUA.ps1 # Configure-PawDefenderPUA.ps1 Set-MpPreference -PUAProtection 1 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "PUAProtection" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderPUAStatus.ps1 # Get-PawDefenderPUAStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "PUAProtection" -ErrorAction SilentlyContinue if ($Pref.PUAProtection -eq 1 -or ($Reg -and $Reg.PUAProtection -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderPUA.ps1 Set-MpPreference -PUAProtection 1 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "PUAProtection" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/prevent-local-list-merging-and-exclusions-configuration.md If local administrators or compromised administrative accounts can modify Defender exclusions or merge local lists, they can authorize malicious folders or tools. Restricting list configuration to central GPOs ensures consistent security enforcement. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus Set 'Configure local administrator merge behavior for lists' to 'Disabled' Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Exclusions Set 'Prevent users from configuring exclusions' to 'Enabled' Set 'Control whether or not exclusions are visible to Local Admins' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderLocalExclusions.ps1 # Configure-PawDefenderLocalExclusions.ps1 Set-MpPreference -DisableLocalAdminMerge $true Set-MpPreference -DisableExclusionRestriction $false $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableLocalAdminMerge" -Value 1 -Type DWord -Force Set-ItemProperty -Path $Path -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableLocalAdminConfiguration" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderLocalExclusionsStatus.ps1 # Get-PawDefenderLocalExclusionsStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableLocalAdminMerge" -ErrorAction SilentlyContinue $RegHide = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "HideExclusionsFromLocalAdmins" -ErrorAction SilentlyContinue $RegConfig = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" -Name "DisableLocalAdminConfiguration" -ErrorAction SilentlyContinue if (($Pref.DisableLocalAdminMerge -eq $true -or ($Reg -and $Reg.DisableLocalAdminMerge -eq 1)) -and ($RegHide -and $RegHide.HideExclusionsFromLocalAdmins -eq 1) -and ($RegConfig -and $RegConfig.DisableLocalAdminConfiguration -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderLocalExclusions.ps1 Set-MpPreference -DisableLocalAdminMerge $true Set-MpPreference -DisableExclusionRestriction $false $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableLocalAdminMerge" -Value 1 -Type DWord -Force Set-ItemProperty -Path $Path -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableLocalAdminConfiguration" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-auto-exclusions-configuration.md Auto Exclusions automatically configure exclusions for known safe system folders or server roles to reduce performance overhead. Enforcing that auto exclusions are not disabled ensures server performance stability and proper system scanning. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Exclusions Set 'Turn off Auto Exclusions' to 'Disabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderAutoExclusions.ps1 # Configure-PawDefenderAutoExclusions.ps1 $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableAutoExclusions" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderAutoExclusionsStatus.ps1 # Get-PawDefenderAutoExclusionsStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" -Name "DisableAutoExclusions" -ErrorAction SilentlyContinue if ($Reg -and $Reg.DisableAutoExclusions -eq 0) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderAutoExclusions.ps1 $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableAutoExclusions" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/enable-edr-in-block-mode.md Endpoint Detection and Response (EDR) in Block Mode allows Defender to take remediation actions on malicious artifacts detected by Microsoft Defender for Endpoint even if another non-Microsoft antivirus is primary. This establishes secondary defensive block capabilities. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Features Set 'Enable EDR in block mode' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderEdrBlockMode.ps1 # Configure-PawDefenderEdrBlockMode.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } Set-ItemProperty -Path $FeaturesPath -Name "PassiveRemediation" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderEdrBlockModeStatus.ps1 # Get-PawDefenderEdrBlockModeStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features" -Name "PassiveRemediation" -ErrorAction SilentlyContinue if ($Reg -and $Reg.PassiveRemediation -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderEdrBlockMode.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } Set-ItemProperty -Path $FeaturesPath -Name "PassiveRemediation" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/allow-network-protection-on-windows-server.md Network Protection blocks processes from accessing malicious domains, phishing sites, and host IP ranges. Allowing Network Protection on Windows Server ensures that member servers running server workloads possess the same IP filter protections as client platforms. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Network Protection Set 'This setting controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderNetworkProtectionServer.ps1 # Configure-PawDefenderNetworkProtectionServer.ps1 $NetProtPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" if (-not (Test-Path $NetProtPath)) { New-Item -Path $NetProtPath -Force | Out-Null } Set-ItemProperty -Path $NetProtPath -Name "AllowNetworkProtectionOnWinServer" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderNetworkProtectionServerStatus.ps1 # Get-PawDefenderNetworkProtectionServerStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" -Name "AllowNetworkProtectionOnWinServer" -ErrorAction SilentlyContinue if ($Reg -and $Reg.AllowNetworkProtectionOnWinServer -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderNetworkProtectionServer.ps1 $NetProtPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" if (-not (Test-Path $NetProtPath)) { New-Item -Path $NetProtPath -Force | Out-Null } Set-ItemProperty -Path $NetProtPath -Name "AllowNetworkProtectionOnWinServer" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/enable-file-hash-computation.md Computing cryptographic file hashes allows Defender to pass hashes of scanned files to cloud and SIEM PAW platforms. This enables precise IOC matches, file tracking, and correlation with threat intelligence repositories. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\MpEngine Set 'Enable file hash computation feature' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderFileHash.ps1 # Configure-PawDefenderFileHash.ps1 Set-MpPreference -EnableFileHashComputation $true $MpEnginePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" if (-not (Test-Path $MpEnginePath)) { New-Item -Path $MpEnginePath -Force | Out-Null } Set-ItemProperty -Path $MpEnginePath -Name "EnableFileHashComputation" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderFileHashStatus.ps1 # Get-PawDefenderFileHashStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" -Name "EnableFileHashComputation" -ErrorAction SilentlyContinue if ($Pref.EnableFileHashComputation -eq $true -or ($Reg -and $Reg.EnableFileHashComputation -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderFileHash.ps1 Set-MpPreference -EnableFileHashComputation $true $MpEnginePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" if (-not (Test-Path $MpEnginePath)) { New-Item -Path $MpEnginePath -Force | Out-Null } Set-ItemProperty -Path $MpEnginePath -Name "EnableFileHashComputation" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-network-inspection-system-nis-settings.md The Network Inspection System (NIS) inspects network traffic patterns for known exploits. Converting warning verdicts to block enforces inline blocking of zero-day exploits, while allowing async inspection prevents performance overhead from slowing local network interfaces. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Network Inspection System Set 'Convert warn verdict to block' to 'Enabled' Set 'Turn on asynchronous inspection' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderNis.ps1 # Configure-PawDefenderNis.ps1 $NisPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" if (-not (Test-Path $NisPath)) { New-Item -Path $NisPath -Force | Out-Null } Set-ItemProperty -Path $NisPath -Name "EnableConvertWarnToBlock" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NisPath -Name "AllowSwitchToAsyncInspection" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderNisStatus.ps1 # Get-PawDefenderNisStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" -Name "EnableConvertWarnToBlock" -ErrorAction SilentlyContinue $RegAsync = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" -Name "AllowSwitchToAsyncInspection" -ErrorAction SilentlyContinue if (($Reg -and $Reg.EnableConvertWarnToBlock -eq 1) -and ($RegAsync -and $RegAsync.AllowSwitchToAsyncInspection -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderNis.ps1 $NisPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" if (-not (Test-Path $NisPath)) { New-Item -Path $NisPath -Force | Out-Null } Set-ItemProperty -Path $NisPath -Name "EnableConvertWarnToBlock" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NisPath -Name "AllowSwitchToAsyncInspection" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-oobe-real-time-protection-and-security-intelligence.md Enabling real-time protection and intelligence updates during the Out-of-Box Experience (OOBE) ensures that the system is fully updated and protected before the initial administrative user signs in or connects to enterprise network nodes. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Real-time Protection Set 'Configure real-time protection and Security Intelligence Updates during OOBE' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderOobeRtp.ps1 # Configure-PawDefenderOobeRtp.ps1 $RtpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" if (-not (Test-Path $RtpPath)) { New-Item -Path $RtpPath -Force | Out-Null } Set-ItemProperty -Path $RtpPath -Name "OobeEnableRtpAndSigUpdate" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderOobeRtpStatus.ps1 # Get-PawDefenderOobeRtpStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "OobeEnableRtpAndSigUpdate" -ErrorAction SilentlyContinue if ($Reg -and $Reg.OobeEnableRtpAndSigUpdate -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderOobeRtp.ps1 $RtpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" if (-not (Test-Path $RtpPath)) { New-Item -Path $RtpPath -Force | Out-Null } Set-ItemProperty -Path $RtpPath -Name "OobeEnableRtpAndSigUpdate" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/enable-dynamic-signature-dropped-event-reporting.md Enabling this log report generation triggers explicit events when a dynamic scan ruleset signature is dropped. This ensures SIEM integrations can immediately log changes in the local threat signatures dataset. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Reporting Set 'Configure whether to report Dynamic Signature dropped events' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderDynamicReporting.ps1 # Configure-PawDefenderDynamicReporting.ps1 $RepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" if (-not (Test-Path $RepPath)) { New-Item -Path $RepPath -Force | Out-Null } Set-ItemProperty -Path $RepPath -Name "EnableDynamicSignatureDroppedEventReporting" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderDynamicReportingStatus.ps1 # Get-PawDefenderDynamicReportingStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" -Name "EnableDynamicSignatureDroppedEventReporting" -ErrorAction SilentlyContinue if ($Reg -and $Reg.EnableDynamicSignatureDroppedEventReporting -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderDynamicReporting.ps1 $RepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" if (-not (Test-Path $RepPath)) { New-Item -Path $RepPath -Force | Out-Null } Set-ItemProperty -Path $RepPath -Name "EnableDynamicSignatureDroppedEventReporting" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-quick-scan-and-scanning-exclusions.md Malware frequently tries to establish persistence in excluded directories or inside packed/compressed executables. Forcing quick scans to include excluded files and ensuring packed file structures are recursively scanned prevents malware evasion. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Scan Set 'Scan excluded files and directories during quick scans' to 'Enabled' Set 'Turn off scanning of packed executables' to 'Disabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderQuickScan.ps1 # Configure-PawDefenderQuickScan.ps1 Set-MpPreference -DisablePackedExeScanning $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "QuickScanIncludeExclusions" -Value 1 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisablePackedExeScanning" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderQuickScanStatus.ps1 # Get-PawDefenderQuickScanStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "QuickScanIncludeExclusions" -ErrorAction SilentlyContinue $RegPack = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisablePackedExeScanning" -ErrorAction SilentlyContinue if (($Pref.DisablePackedExeScanning -eq $false -or ($RegPack -and $RegPack.DisablePackedExeScanning -eq 0)) -and ($Reg -and $Reg.QuickScanIncludeExclusions -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderQuickScan.ps1 Set-MpPreference -DisablePackedExeScanning $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "QuickScanIncludeExclusions" -Value 1 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisablePackedExeScanning" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-scheduled-scan-parameters.md Ensuring daily scheduled scans, enabling heuristics for behavioral anomaly detection, scan mail attachments, and forcing a catchup scan after at most 7 days ensures system integrity is continually validated. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Scan Set 'Specify the day of the week to run a scheduled scan' to 'Enabled' (Select 'Every day' or '0') Set 'Turn on e-mail scanning' to 'Enabled' Set 'Turn on heuristics' to 'Enabled' Set 'Trigger a quick scan after X days without any scans' to 'Enabled' (7 days) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderScheduledScan.ps1 # Configure-PawDefenderScheduledScan.ps1 Set-MpPreference -DisableEmailScanning $false Set-MpPreference -DisableHeuristics $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "ScheduleDay" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableEmailScanning" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableHeuristics" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DaysWithoutCatchupQuickScan" -Value 7 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderScheduledScanStatus.ps1 # Get-PawDefenderScheduledScanStatus.ps1 $Pref = Get-MpPreference $RegDays = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DaysWithoutCatchupQuickScan" -ErrorAction SilentlyContinue if ($Pref.DisableEmailScanning -eq $false -and $Pref.DisableHeuristics -eq $false -and ($RegDays -and $RegDays.DaysWithoutCatchupQuickScan -eq 7)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderScheduledScan.ps1 Set-MpPreference -DisableEmailScanning $false Set-MpPreference -DisableHeuristics $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "ScheduleDay" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableEmailScanning" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableHeuristics" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DaysWithoutCatchupQuickScan" -Value 7 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-security-intelligence-update-schedule.md Antivirus signatures must remain fresh to block the latest published threats. Mandating daily checks for updates and marking signatures older than 7 days as out-of-date ensures continuous defense parity. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Security Intelligence Updates Set 'Define the number of days before spyware security intelligence is considered out of date' to 'Enabled' (7 days) Set 'Define the number of days before virus security intelligence is considered out of date' to 'Enabled' (7 days) Set 'Specify the day of the week to check for security intelligence updates' to 'Enabled' (Every day or 0) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderUpdateSchedule.ps1 # Configure-PawDefenderUpdateSchedule.ps1 $SigPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" if (-not (Test-Path $SigPath)) { New-Item -Path $SigPath -Force | Out-Null } Set-ItemProperty -Path $SigPath -Name "ASSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "AVSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "ScheduleDay" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderUpdateScheduleStatus.ps1 # Get-PawDefenderUpdateScheduleStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "ASSignatureDue" -ErrorAction SilentlyContinue $RegAV = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "AVSignatureDue" -ErrorAction SilentlyContinue $RegDay = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "ScheduleDay" -ErrorAction SilentlyContinue if (($Reg -and $Reg.ASSignatureDue -eq 7) -and ($RegAV -and $RegAV.AVSignatureDue -eq 7) -and ($RegDay -and $RegDay.ScheduleDay -eq 0)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderUpdateSchedule.ps1 $SigPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" if (-not (Test-Path $SigPath)) { New-Item -Path $SigPath -Force | Out-Null } Set-ItemProperty -Path $SigPath -Name "ASSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "AVSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "ScheduleDay" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-threat-severity-default-quarantine-actions.md By default, Defender may prompt users or take actions (like clean/ignore) that leave malware remnants on the filesystem. Configuring default quarantine actions for all severities (low, medium, high, severe) ensures automated containment. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Threats Set 'Specify threat alert levels at which default action should not be taken when detected' to 'Enabled' Click 'Show...' and enter threat levels (1 -> 2, 2 -> 2, 4 -> 2, 5 -> 2) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderThreatActions.ps1 # Configure-PawDefenderThreatActions.ps1 $ThreatsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats" if (-not (Test-Path $ThreatsPath)) { New-Item -Path $ThreatsPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsPath -Name "Threats_ThreatSeverityDefaultAction" -Value 1 -Type DWord -Force $ThreatsSevPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" if (-not (Test-Path $ThreatsSevPath)) { New-Item -Path $ThreatsSevPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsSevPath -Name "1" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "2" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "4" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "5" -Value 2 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderThreatActionsStatus.ps1 # Get-PawDefenderThreatActionsStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats" -Name "Threats_ThreatSeverityDefaultAction" -ErrorAction SilentlyContinue $RegSev = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" -ErrorAction SilentlyContinue if (($Reg -and $Reg.Threats_ThreatSeverityDefaultAction -eq 1) -and ($RegSev -and $RegSev.1 -eq 2 -and $RegSev.2 -eq 2 -and $RegSev.4 -eq 2 -and $RegSev.5 -eq 2)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderThreatActions.ps1 $ThreatsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats" if (-not (Test-Path $ThreatsPath)) { New-Item -Path $ThreatsPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsPath -Name "Threats_ThreatSeverityDefaultAction" -Value 1 -Type DWord -Force $ThreatsSevPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" if (-not (Test-Path $ThreatsSevPath)) { New-Item -Path $ThreatsSevPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsSevPath -Name "1" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "2" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "4" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "5" -Value 2 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-family-options-ui-lockdown.md Locking down non-essential components of the Windows Security Center interface prevents users from tampering with parental or diagnostic UI controls on enterprise assets. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Security\Family options Set 'Hide the Family options area' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderFamilyLockdown.ps1 # Configure-PawDefenderFamilyLockdown.ps1 $FamilyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" if (-not (Test-Path $FamilyPath)) { New-Item -Path $FamilyPath -Force | Out-Null } Set-ItemProperty -Path $FamilyPath -Name "UILockdown" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderFamilyLockdownStatus.ps1 # Get-PawDefenderFamilyLockdownStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" -Name "UILockdown" -ErrorAction SilentlyContinue if ($Reg -and $Reg.UILockdown -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderFamilyLockdown.ps1 $FamilyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" if (-not (Test-Path $FamilyPath)) { New-Item -Path $FamilyPath -Force | Out-Null } Set-ItemProperty -Path $FamilyPath -Name "UILockdown" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-tamper-protection.md Tamper Protection prevents local administrators or compromised system accounts from disabling Windows Defender services, real-time scanning, or modifying active exclusions locally. This blocks a primary malware persistence vector. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Security\Tamper Protection Set 'Protect Windows Security settings from tampering' to 'Enabled' (Block or On depending on ADMX version) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderTamperProtection.ps1 # Configure-PawDefenderTamperProtection.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } try { Set-ItemProperty -Path $FeaturesPath -Name "TamperProtection" -Value 5 -Type DWord -ErrorAction Stop -Force } catch { Write-Warning "Registry blocked. Tamper Protection registry key is normally protected by TrustedInstaller. Ensure GPO setting is applied." } To audit the hardening status: Download Script: Get-PawDefenderTamperProtectionStatus.ps1 # Get-PawDefenderTamperProtectionStatus.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" $TamperVal = Get-ItemProperty -Path $FeaturesPath -Name "TamperProtection" -ErrorAction SilentlyContinue if ($TamperVal -and $TamperVal.TamperProtection -eq 5) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderTamperProtection.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } try { Set-ItemProperty -Path $FeaturesPath -Name "TamperProtection" -Value 5 -Type DWord -ErrorAction Stop -Force } catch { Write-Warning "Registry blocked. Tamper Protection registry key is normally protected by TrustedInstaller. Ensure GPO setting is applied." } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-sandbox-execution-environment.md Forcing the Windows Defender scanning service (MsMpEng.exe) to run in a restricted AppContainer sandbox prevents privilege escalation. If an attacker exploits a parsing vulnerability in the engine, the compromise is contained inside the sandbox. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Preferences\Windows Settings\Environment Right-click and select New -> Environment Variable Configure Action: Update, Type: System, Name: MP_FORCE_USE_SANDBOX, Value: 1 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderSandbox.ps1 # Configure-PawDefenderSandbox.ps1 $EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" if (-not (Test-Path $EnvPath)) { New-Item -Path $EnvPath -Force | Out-Null } Set-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawDefenderSandboxStatus.ps1 # Get-PawDefenderSandboxStatus.ps1 $EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" $SandboxVar = Get-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -ErrorAction SilentlyContinue if ($SandboxVar -and $SandboxVar.MP_FORCE_USE_SANDBOX -eq "1") { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawDefenderSandbox.ps1 $EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" if (-not (Test-Path $EnvPath)) { New-Item -Path $EnvPath -Force | Out-Null } Set-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-amsi-authenticode-signature-verification.md Enforcing signature checks on registered Antimalware Scan Interface (AMSI) providers blocks attackers from registering unsigned rogue AMSI provider DLLs to bypass script analysis. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click and select New -> Registry Item Configure Action: Update, Hive: HKEY_LOCAL_MACHINE, Key Path: SOFTWARE\Microsoft\AMSI, Value Name: FeatureBits, Value Type: REG_DWORD, Value Data: 2 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawDefenderAmsiSignature.ps1 # Configure-PawDefenderAmsiSignature.ps1 $AmsiPath = "HKLM:\SOFTWARE\Microsoft\AMSI" if (-not (Test-Path $AmsiPath)) { New-Item -Path $AmsiPath -Force | Out-Null } Set-ItemProperty -Path $AmsiPath -Name "FeatureBits" -Value 2 -Type DWord -Force To audit the hardening status: Download Script: Get-PawDefenderAmsiSignatureStatus.ps1 # Get-PawDefenderAmsiSignatureStatus.ps1 $AmsiPath = "HKLM:\SOFTWARE\Microsoft\AMSI" if (Test-Path $AmsiPath) { $AmsiBits = Get-ItemProperty -Path $AmsiPath -Name "FeatureBits" -ErrorAction SilentlyContinue if ($AmsiBits -and $AmsiBits.FeatureBits -eq 2) { Write-Output "Compliant" exit 0 } } Write-Output "Non-Compliant" exit 1 # Configure-PawDefenderAmsiSignature.ps1 $AmsiPath = "HKLM:\SOFTWARE\Microsoft\AMSI" if (-not (Test-Path $AmsiPath)) { New-Item -Path $AmsiPath -Force | Out-Null } Set-ItemProperty -Path $AmsiPath -Name "FeatureBits" -Value 2 -Type DWord -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/configure-remote-encryption-protection.md Privileged Access Workstations (PAWs) must maintain the highest standard of endpoint protection against ransomware and lateral movement attempts. Remote Encryption Protection detects and terminates network ransomware attempting to encrypt files over SMB shares. Enforcing Block mode terminates the malicious remote process or network connection attempting rapid or unauthorized file encryption, safeguarding Tier 0 administrative assets from network-based extortion attacks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to PAWs Organizational Unit (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Antivirus\Remediation\Behavioral Network Blocks\Brute Force Protection Double-click Configure Remote Encryption Protection Mode. Set the policy to Enabled, and select Block (value 2) in the dropdown options. Link the GPO to the appropriate Organizational Unit and verify replication. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the Remote Encryption Protection registry value on PAWs: Download Script: Configure-PawRemoteEncryptionProtection.ps1 # Configure-PawRemoteEncryptionProtection.ps1 # Description: Configures Microsoft Defender Remote Encryption Protection in Block mode on PAWs. Write-Host "Configuring Microsoft Defender Remote Encryption Protection for PAWs..." -ForegroundColor Cyan $KeyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection" if (-not (Test-Path -Path $KeyPath)) { New-Item -Path $KeyPath -Force | Out-Null } Set-ItemProperty -Path $KeyPath -Name "BruteForceProtectionConfiguredState" -Value 2 -Type DWord -Force Write-Host "[+] Remote Encryption Protection applied successfully on PAWs (Block mode)." -ForegroundColor Green To audit the hardening status: Download Script: Get-PawRemoteEncryptionProtectionStatus.ps1 # Get-PawRemoteEncryptionProtectionStatus.ps1 # Description: Audits Microsoft Defender Remote Encryption Protection configuration status on PAWs. $KeyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection" $Reg = Get-ItemProperty -Path $KeyPath -Name "BruteForceProtectionConfiguredState" -ErrorAction SilentlyContinue if ($Reg -and $Reg.BruteForceProtectionConfiguredState -eq 2) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawRemoteEncryptionProtection.ps1 # Description: Configures Microsoft Defender Remote Encryption Protection in Block mode on PAWs. Write-Host "Configuring Microsoft Defender Remote Encryption Protection for PAWs..." -ForegroundColor Cyan $KeyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection" if (-not (Test-Path -Path $KeyPath)) { New-Item -Path $KeyPath -Force | Out-Null } Set-ItemProperty -Path $KeyPath -Name "BruteForceProtectionConfiguredState" -Value 2 -Type DWord -Force Write-Host "[+] Remote Encryption Protection applied successfully on PAWs (Block mode)." -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-vulnerable-signed-drivers.md Prevents an application from writing a vulnerable signed driver to disk. Attackers use Bring Your Own Vulnerable Driver (BYOVD) techniques to bypass Windows kernel protections by loading legitimate, signed third-party drivers that contain known vulnerabilities, allowing them to disable security agents and gain kernel-level privileges. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 56a863a9-875e-4185-98a7-b882c64b5ce5 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrVulnerableDrivers.ps1 # Configure-PawAsrVulnerableDrivers.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "56a863a9-875e-4185-98a7-b882c64b5ce5" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrVulnerableDriversStatus.ps1 # Get-PawAsrVulnerableDriversStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "56a863a9-875e-4185-98a7-b882c64b5ce5" -ErrorAction SilentlyContinue if ($Value -and ($Value."56a863a9-875e-4185-98a7-b882c64b5ce5" -eq "1" -or $Value."56a863a9-875e-4185-98a7-b882c64b5ce5" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrVulnerableDrivers.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "56a863a9-875e-4185-98a7-b882c64b5ce5" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-adobe-reader-child-processes.md Prevents Adobe Reader from launching any child processes. Malicious PDF documents frequently attempt to exploit application vulnerabilities or trick users into executing embedded links, which spawns command shells (cmd.exe, powershell.exe) or scripting hosts (wscript.exe) to download and launch secondary malware payloads. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrAdobeChild.ps1 # Configure-PawAsrAdobeChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrAdobeChildStatus.ps1 # Get-PawAsrAdobeChildStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -ErrorAction SilentlyContinue if ($Value -and ($Value."7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -eq "1" -or $Value."7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrAdobeChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-office-child-processes.md Blocks Microsoft Office applications (Word, Excel, PowerPoint) from creating child processes. This prevents malicious files containing embedded VBA macros or exploiting unpatched vulnerabilities (such as CVE-2021-40444) from launching scripting environments or system commands to download and execute code. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID d4f940ab-401b-4efc-aadc-ad5f3c50688a as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrOfficeChild.ps1 # Configure-PawAsrOfficeChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d4f940ab-401b-4efc-aadc-ad5f3c50688a" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrOfficeChildStatus.ps1 # Get-PawAsrOfficeChildStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "d4f940ab-401b-4efc-aadc-ad5f3c50688a" -ErrorAction SilentlyContinue if ($Value -and ($Value."d4f940ab-401b-4efc-aadc-ad5f3c50688a" -eq "1" -or $Value."d4f940ab-401b-4efc-aadc-ad5f3c50688a" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrOfficeChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d4f940ab-401b-4efc-aadc-ad5f3c50688a" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-lsass-credential-stealing.md Blocks attempts to open or dump the memory of the Local Security Authority Subsystem Service (lsass.exe). Attackers dump LSASS memory using tools like Mimikatz or Task Manager to extract plaintext credentials, Kerberos tickets, or NTLM password hashes from system memory for lateral movement. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrLsassDump.ps1 # Configure-PawAsrLsassDump.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrLsassDumpStatus.ps1 # Get-PawAsrLsassDumpStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -ErrorAction SilentlyContinue if ($Value -and ($Value."9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -eq "1" -or $Value."9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrLsassDump.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-email-executable-content.md Prevents executable files (such as .exe, .com, .scr, .vbs, .js, or .pif) from launching directly from email clients (like Outlook) or webmail accessed via browser sessions. This stops phishing attacks where users accidentally launch malicious attachments or download payloads directly from web-based email links. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrEmailExecutable.ps1 # Configure-PawAsrEmailExecutable.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrEmailExecutableStatus.ps1 # Get-PawAsrEmailExecutableStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -ErrorAction SilentlyContinue if ($Value -and ($Value."be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -eq "1" -or $Value."be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrEmailExecutable.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-low-prevalence-executable-files.md Blocks execution of unrecognized, newly compiled, or low-prevalence executable files. This provides initial protection against zero-day malware campaigns and targeted custom payloads that have not yet established reputation telemetry in the Microsoft Cloud Protection network. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrLowPrevalence.ps1 # Configure-PawAsrLowPrevalence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "01443614-cd74-433a-b99e-2ecdc07bfc25" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrLowPrevalenceStatus.ps1 # Get-PawAsrLowPrevalenceStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "01443614-cd74-433a-b99e-2ecdc07bfc25" -ErrorAction SilentlyContinue if ($Value -and ($Value."01443614-cd74-433a-b99e-2ecdc07bfc25" -eq "1" -or $Value."01443614-cd74-433a-b99e-2ecdc07bfc25" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrLowPrevalence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "01443614-cd74-433a-b99e-2ecdc07bfc25" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-obfuscated-scripts.md Blocks execution of obfuscated or encrypted scripts (such as PowerShell, VBScript, or JavaScript). Threat actors obfuscate their scripts using base64 encoding, custom string manipulation, or encryption to hide the intent of their code and bypass static file scanning and network detection engines. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 5beb7efe-fd9a-4556-801d-275e5ffc04cc as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrObfuscatedScripts.ps1 # Configure-PawAsrObfuscatedScripts.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "5beb7efe-fd9a-4556-801d-275e5ffc04cc" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrObfuscatedScriptsStatus.ps1 # Get-PawAsrObfuscatedScriptsStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "5beb7efe-fd9a-4556-801d-275e5ffc04cc" -ErrorAction SilentlyContinue if ($Value -and ($Value."5beb7efe-fd9a-4556-801d-275e5ffc04cc" -eq "1" -or $Value."5beb7efe-fd9a-4556-801d-275e5ffc04cc" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrObfuscatedScripts.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "5beb7efe-fd9a-4556-801d-275e5ffc04cc" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-script-launching-downloaded-content.md Prevents JavaScript or VBScript running locally from launching executable binaries that were downloaded from the internet. Attackers use malicious scripts inside documents or web browsers to download payloads (like ransomware or trojans) to the disk and launch them using local script engines. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID d3e037e1-3eb8-44c8-a917-57927947596d as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrScriptLaunchExe.ps1 # Configure-PawAsrScriptLaunchExe.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d3e037e1-3eb8-44c8-a917-57927947596d" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrScriptLaunchExeStatus.ps1 # Get-PawAsrScriptLaunchExeStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "d3e037e1-3eb8-44c8-a917-57927947596d" -ErrorAction SilentlyContinue if ($Value -and ($Value."d3e037e1-3eb8-44c8-a917-57927947596d" -eq "1" -or $Value."d3e037e1-3eb8-44c8-a917-57927947596d" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrScriptLaunchExe.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d3e037e1-3eb8-44c8-a917-57927947596d" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-office-executable-content-creation.md Prevents Microsoft Office applications (Word, Excel, PowerPoint) from creating or writing executable files (e.g., .exe, .dll, .scr) to the local filesystem. Malicious documents often attempt to drop payloads directly into the local temp folders or AppData directories before executing them. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 3b576869-a4ec-4529-8536-b80a7769e899 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrOfficeWriteExe.ps1 # Configure-PawAsrOfficeWriteExe.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "3b576869-a4ec-4529-8536-b80a7769e899" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrOfficeWriteExeStatus.ps1 # Get-PawAsrOfficeWriteExeStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "3b576869-a4ec-4529-8536-b80a7769e899" -ErrorAction SilentlyContinue if ($Value -and ($Value."3b576869-a4ec-4529-8536-b80a7769e899" -eq "1" -or $Value."3b576869-a4ec-4529-8536-b80a7769e899" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrOfficeWriteExe.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "3b576869-a4ec-4529-8536-b80a7769e899" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-office-code-injection.md Blocks Microsoft Office applications from writing code or injecting threads directly into external processes. Threat actors use code injection (such as process hollowing or remote thread creation) inside Office macros to hide execution under clean, trusted system binaries like explorer.exe or svchost.exe. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrOfficeInjection.ps1 # Configure-PawAsrOfficeInjection.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrOfficeInjectionStatus.ps1 # Get-PawAsrOfficeInjectionStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -ErrorAction SilentlyContinue if ($Value -and ($Value."75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -eq "1" -or $Value."75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrOfficeInjection.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-office-communication-child-processes.md Blocks Microsoft Outlook or other Office communication applications (e.g., Teams, Skype) from creating child processes. This prevents malware payloads delivered through emails, chats, or calendar invites from spawning command-line utilities or scripting environments. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 26190899-1602-49e8-8b27-eb1d0a1ce869 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrOutlookChild.ps1 # Configure-PawAsrOutlookChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "26190899-1602-49e8-8b27-eb1d0a1ce869" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrOutlookChildStatus.ps1 # Get-PawAsrOutlookChildStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "26190899-1602-49e8-8b27-eb1d0a1ce869" -ErrorAction SilentlyContinue if ($Value -and ($Value."26190899-1602-49e8-8b27-eb1d0a1ce869" -eq "1" -or $Value."26190899-1602-49e8-8b27-eb1d0a1ce869" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrOutlookChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "26190899-1602-49e8-8b27-eb1d0a1ce869" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-wmi-event-subscription-persistence.md Blocks threat actors from achieving system persistence by registering permanent Windows Management Instrumentation (WMI) event subscriptions. WMI event subscriptions allow attackers to automatically launch malicious payloads when system triggers occur (like system boot or user logon) without using traditional startup registry keys. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID e6db77e5-3df2-4cf1-b95a-636979351e5b as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrWmiPersistence.ps1 # Configure-PawAsrWmiPersistence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "e6db77e5-3df2-4cf1-b95a-636979351e5b" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrWmiPersistenceStatus.ps1 # Get-PawAsrWmiPersistenceStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "e6db77e5-3df2-4cf1-b95a-636979351e5b" -ErrorAction SilentlyContinue if ($Value -and ($Value."e6db77e5-3df2-4cf1-b95a-636979351e5b" -eq "1" -or $Value."e6db77e5-3df2-4cf1-b95a-636979351e5b" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrWmiPersistence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "e6db77e5-3df2-4cf1-b95a-636979351e5b" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-psexec-wmi-process-creations.md Blocks processes created via WMI commands or PSExec remote execution utilities. This directly stops lateral movement attacks where compromised accounts or threat actors attempt to start commands, backdoors, or credential dumpers remotely across domain-joined servers and PAW platforms. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID d1e49aac-8f56-4280-b9ba-993a6d77406c as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrPsexecWmi.ps1 # Configure-PawAsrPsexecWmi.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d1e49aac-8f56-4280-b9ba-993a6d77406c" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrPsexecWmiStatus.ps1 # Get-PawAsrPsexecWmiStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "d1e49aac-8f56-4280-b9ba-993a6d77406c" -ErrorAction SilentlyContinue if ($Value -and ($Value."d1e49aac-8f56-4280-b9ba-993a6d77406c" -eq "1" -or $Value."d1e49aac-8f56-4280-b9ba-993a6d77406c" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrPsexecWmi.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d1e49aac-8f56-4280-b9ba-993a6d77406c" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-unsigned-processes-running-from-usb.md Blocks the execution of unsigned or untrusted processes on removable storage devices (USB drives, external SSDs). This stops physical access vectors, rogue USB drops, and automated worm propagation techniques from running unauthorized installers or scripts. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrUsbUnsigned.ps1 # Configure-PawAsrUsbUnsigned.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrUsbUnsignedStatus.ps1 # Get-PawAsrUsbUnsignedStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -ErrorAction SilentlyContinue if ($Value -and ($Value."b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -eq "1" -or $Value."b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrUsbUnsigned.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/block-win32-api-calls-from-office-macros.md Blocks VBA macros inside Microsoft Office documents from invoking Win32 API calls. Malicious documents use macros to call kernel memory functions (such as VirtualAlloc, WriteProcessMemory, or CreateThread) to load and execute shellcode in memory without dropping files to disk, bypassing file scanners. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrOfficeWin32Calls.ps1 # Configure-PawAsrOfficeWin32Calls.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrOfficeWin32CallsStatus.ps1 # Get-PawAsrOfficeWin32CallsStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -ErrorAction SilentlyContinue if ($Value -and ($Value."92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -eq "1" -or $Value."92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrOfficeWin32Calls.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/defender/asr/use-advanced-protection-against-ransomware.md Enables advanced behavioral heuristics and cloud analytics checks on files that attempt to modify multiple user files, detect signature-less encryption behavior, and block rapid write activity to prevent ransomware from encrypting system and user documents. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID c1db55ab-c21a-4637-bb3f-a12568109d35 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAsrRansomware.ps1 # Configure-PawAsrRansomware.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "c1db55ab-c21a-4637-bb3f-a12568109d35" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-PawAsrRansomwareStatus.ps1 # Get-PawAsrRansomwareStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "c1db55ab-c21a-4637-bb3f-a12568109d35" -ErrorAction SilentlyContinue if ($Value -and ($Value."c1db55ab-c21a-4637-bb3f-a12568109d35" -eq "1" -or $Value."c1db55ab-c21a-4637-bb3f-a12568109d35" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawAsrRansomware.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "c1db55ab-c21a-4637-bb3f-a12568109d35" -Value "1" -Type String -Force Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-096](../../08-endpoints/user-rights/configure-ura-setrustedcredmanaccessprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-setrustedcredmanaccessprivilege.md The SeTrustedCredManAccessPrivilege allows a process to access the Windows Credential Manager as a trusted caller via internal Credential Manager APIs. The Credential Manager securely stores user domain credentials, web passwords, and certificate secrets used for network authentication. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Access Credential Manager as a trusted caller`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeTrustedCredManAccessPrivilege.ps1 # Configure-PawUraSeTrustedCredManAccessPrivilege.ps1 # Configure-PawUraSeTrustedCredManAccessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setrustedcredmanaccessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setrustedcredmanaccessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTrustedCredManAccessPrivilege\s*=") { $NewLines += "SeTrustedCredManAccessPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTrustedCredManAccessPrivilege = ") } else { $NewLines += "SeTrustedCredManAccessPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeTrustedCredManAccessPrivilegeStatus.ps1 # Get-PawUraSeTrustedCredManAccessPrivilegeStatus.ps1 # Get-PawUraSeTrustedCredManAccessPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_setrustedcredmanaccessprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeTrustedCredManAccessPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeTrustedCredManAccessPrivilege.ps1 # Configure-PawUraSeTrustedCredManAccessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setrustedcredmanaccessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setrustedcredmanaccessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTrustedCredManAccessPrivilege\s*=") { $NewLines += "SeTrustedCredManAccessPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTrustedCredManAccessPrivilege = ") } else { $NewLines += "SeTrustedCredManAccessPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-097](../../08-endpoints/user-rights/configure-ura-senetworklogonright.md)). (For Domain Controllers, refer to [REQ-DC-104](../../02-domain-controllers/user-rights/configure-ura-senetworklogonright.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-senetworklogonright.md The SeNetworkLogonRight determines which security principals are permitted to authenticate and establish network logon sessions (Logon Type 3) across the network over protocols like SMB, RPC, WMI, WinRM, and LDAP. Network logons authenticate users without creating an interactive desktop shell, enabling file share access, remote management, and inter-system synchronization. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Access this computer from the network`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeNetworkLogonRight.ps1 # Configure-PawUraSeNetworkLogonRight.ps1 # Configure-PawUraSeNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_senetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_senetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeNetworkLogonRight\s*=") { $NewLines += "SeNetworkLogonRight = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeNetworkLogonRight = *S-1-5-32-544") } else { $NewLines += "SeNetworkLogonRight = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeNetworkLogonRightStatus.ps1 # Get-PawUraSeNetworkLogonRightStatus.ps1 # Get-PawUraSeNetworkLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_senetworklogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeNetworkLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeNetworkLogonRight.ps1 # Configure-PawUraSeNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_senetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_senetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeNetworkLogonRight\s*=") { $NewLines += "SeNetworkLogonRight = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeNetworkLogonRight = *S-1-5-32-544") } else { $NewLines += "SeNetworkLogonRight = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-098](../../08-endpoints/user-rights/configure-ura-setcbprivilege.md)). (For Domain Controllers, refer to [REQ-DC-105](../../02-domain-controllers/user-rights/configure-ura-setcbprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-setcbprivilege.md The SeTcbPrivilege identifies its holder as part of the Trusted Computer Base (TCB)—the core inner ring of the operating system. A process possessing this privilege can register as a trusted logon process with the Local Security Authority via LsaRegisterLogonProcess and invoke LsaLogonUser to create an arbitrary, fully authenticated access token for any user without knowing the user's password or requiring credentials. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Act as part of the operating system`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeTcbPrivilege.ps1 # Configure-PawUraSeTcbPrivilege.ps1 # Configure-PawUraSeTcbPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setcbprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setcbprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTcbPrivilege\s*=") { $NewLines += "SeTcbPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTcbPrivilege = ") } else { $NewLines += "SeTcbPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeTcbPrivilegeStatus.ps1 # Get-PawUraSeTcbPrivilegeStatus.ps1 # Get-PawUraSeTcbPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_setcbprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeTcbPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeTcbPrivilege.ps1 # Configure-PawUraSeTcbPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setcbprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setcbprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTcbPrivilege\s*=") { $NewLines += "SeTcbPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTcbPrivilege = ") } else { $NewLines += "SeTcbPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-099](../../08-endpoints/user-rights/configure-ura-seinteractivelogonright.md)). (For Domain Controllers, refer to [REQ-DC-108](../../02-domain-controllers/user-rights/configure-ura-seinteractivelogonright.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-seinteractivelogonright.md The SeInteractiveLogonRight determines which security principals are permitted to start an interactive logon session (Logon Type 2) at the physical keyboard, display, or virtual machine console. An interactive logon spawns a graphical user shell (explorer.exe) and interactive desktop session. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Allow log on locally`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeInteractiveLogonRight.ps1 # Configure-PawUraSeInteractiveLogonRight.ps1 # Configure-PawUraSeInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeInteractiveLogonRight\s*=") { $NewLines += "SeInteractiveLogonRight = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeInteractiveLogonRight = *S-1-5-32-544") } else { $NewLines += "SeInteractiveLogonRight = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeInteractiveLogonRightStatus.ps1 # Get-PawUraSeInteractiveLogonRightStatus.ps1 # Get-PawUraSeInteractiveLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seinteractivelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeInteractiveLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeInteractiveLogonRight.ps1 # Configure-PawUraSeInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeInteractiveLogonRight\s*=") { $NewLines += "SeInteractiveLogonRight = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeInteractiveLogonRight = *S-1-5-32-544") } else { $NewLines += "SeInteractiveLogonRight = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-100](../../08-endpoints/user-rights/configure-ura-sebackupprivilege.md)). (For Domain Controllers, refer to [REQ-DC-110](../../02-domain-controllers/user-rights/configure-ura-sebackupprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-sebackupprivilege.md The SeBackupPrivilege grants the caller the capability to bypass all read-access security controls (Discretionary Access Control Lists - DACLs) across the entire NTFS filesystem and Windows Registry. When an application opens a file handle specifying the FILE_FLAG_BACKUP_SEMANTICS flag in Win32 CreateFile calls, the Windows kernel I/O manager and Object Manager explicitly bypass standard security descriptor evaluation. This design allows legitimate backup utilities to archive files without requiring explicit read permissions on every individual object. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Back up files and directories`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeBackupPrivilege.ps1 # Configure-PawUraSeBackupPrivilege.ps1 # Configure-PawUraSeBackupPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sebackupprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sebackupprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeBackupPrivilege\s*=") { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeBackupPrivilege = *S-1-5-32-544") } else { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeBackupPrivilegeStatus.ps1 # Get-PawUraSeBackupPrivilegeStatus.ps1 # Get-PawUraSeBackupPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sebackupprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeBackupPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeBackupPrivilege.ps1 # Configure-PawUraSeBackupPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sebackupprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sebackupprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeBackupPrivilege\s*=") { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeBackupPrivilege = *S-1-5-32-544") } else { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-103](../../08-endpoints/user-rights/configure-ura-secreatepagefileprivilege.md)). (For Domain Controllers, refer to [REQ-DC-113](../../02-domain-controllers/user-rights/configure-ura-secreatepagefileprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-secreatepagefileprivilege.md The SeCreatePagefilePrivilege allows a process to create, delete, and modify the parameters and allocation sizes of system paging files (pagefile.sys) via the NtCreatePagingFile API. The Windows virtual memory manager uses paging files as secondary backing storage for memory pages that are not backed by files. Paging files contain sensitive plaintext data, including process heap allocations, cached authentication tokens, cryptographic keys, and unencrypted file contents. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create a pagefile`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeCreatePagefilePrivilege.ps1 # Configure-PawUraSeCreatePagefilePrivilege.ps1 # Configure-PawUraSeCreatePagefilePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepagefileprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepagefileprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePagefilePrivilege\s*=") { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePagefilePrivilege = *S-1-5-32-544") } else { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeCreatePagefilePrivilegeStatus.ps1 # Get-PawUraSeCreatePagefilePrivilegeStatus.ps1 # Get-PawUraSeCreatePagefilePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatepagefileprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreatePagefilePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeCreatePagefilePrivilege.ps1 # Configure-PawUraSeCreatePagefilePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepagefileprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepagefileprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePagefilePrivilege\s*=") { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePagefilePrivilege = *S-1-5-32-544") } else { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-104](../../08-endpoints/user-rights/configure-ura-secreatetokenprivilege.md)). (For Domain Controllers, refer to [REQ-DC-114](../../02-domain-controllers/user-rights/configure-ura-secreatetokenprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-secreatetokenprivilege.md The SeCreateTokenPrivilege allows a process to invoke the native API NtCreateToken to forge an arbitrary Windows primary or impersonation access token from scratch. An access token defines an entity's complete security context, including User SID, Group SIDs, Privileges, Default DACL, Token Type, and Mandatory Integrity Level. Normally, tokens are manufactured exclusively by the Local Security Authority Subsystem Service (lsass.exe) following successful authentication. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create a token object`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeCreateTokenPrivilege.ps1 # Configure-PawUraSeCreateTokenPrivilege.ps1 # Configure-PawUraSeCreateTokenPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatetokenprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatetokenprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateTokenPrivilege\s*=") { $NewLines += "SeCreateTokenPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateTokenPrivilege = ") } else { $NewLines += "SeCreateTokenPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeCreateTokenPrivilegeStatus.ps1 # Get-PawUraSeCreateTokenPrivilegeStatus.ps1 # Get-PawUraSeCreateTokenPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatetokenprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreateTokenPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeCreateTokenPrivilege.ps1 # Configure-PawUraSeCreateTokenPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatetokenprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatetokenprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateTokenPrivilege\s*=") { $NewLines += "SeCreateTokenPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateTokenPrivilege = ") } else { $NewLines += "SeCreateTokenPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-105](../../08-endpoints/user-rights/configure-ura-secreateglobalprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-secreateglobalprivilege.md The SeCreateGlobalPrivilege allows a process to create named kernel and user objects (such as named pipes, shared memory sections, mutexes, and events) in the \BaseNamedObjects global namespace accessible across all terminal services sessions and interactive logon sessions. In terminal services and multi-user Windows environments, each interactive session is isolated into a private namespace (\Sessions\X\BaseNamedObjects). The global namespace is reserved for system services that must communicate across session boundaries. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create global objects`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-19 (LocalService), *S-1-5-20 (NetworkService), *S-1-5-32-544 (Administrators), *S-1-5-6 (Service). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeCreateGlobalPrivilege.ps1 # Configure-PawUraSeCreateGlobalPrivilege.ps1 # Configure-PawUraSeCreateGlobalPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreateglobalprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreateglobalprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateGlobalPrivilege\s*=") { $NewLines += "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6") } else { $NewLines += "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeCreateGlobalPrivilegeStatus.ps1 # Get-PawUraSeCreateGlobalPrivilegeStatus.ps1 # Get-PawUraSeCreateGlobalPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreateglobalprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreateGlobalPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeCreateGlobalPrivilege.ps1 # Configure-PawUraSeCreateGlobalPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreateglobalprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreateglobalprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateGlobalPrivilege\s*=") { $NewLines += "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6") } else { $NewLines += "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-106](../../08-endpoints/user-rights/configure-ura-secreatepermanentprivilege.md)). (For Domain Controllers, refer to [REQ-DC-115](../../02-domain-controllers/user-rights/configure-ura-secreatepermanentprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-secreatepermanentprivilege.md The SeCreatePermanentPrivilege allows a process to create permanent object directory objects in the Windows Object Manager namespace (\DirectoryObject) via APIs like NtCreateDirectoryObject. Unlike standard kernel objects which are automatically destroyed when their last handle is closed, permanent objects persist in the object manager namespace across process terminations until explicitly unlinked or until system reboot. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create permanent shared objects`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeCreatePermanentPrivilege.ps1 # Configure-PawUraSeCreatePermanentPrivilege.ps1 # Configure-PawUraSeCreatePermanentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepermanentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepermanentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePermanentPrivilege\s*=") { $NewLines += "SeCreatePermanentPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePermanentPrivilege = ") } else { $NewLines += "SeCreatePermanentPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeCreatePermanentPrivilegeStatus.ps1 # Get-PawUraSeCreatePermanentPrivilegeStatus.ps1 # Get-PawUraSeCreatePermanentPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatepermanentprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreatePermanentPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeCreatePermanentPrivilege.ps1 # Configure-PawUraSeCreatePermanentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepermanentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepermanentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePermanentPrivilege\s*=") { $NewLines += "SeCreatePermanentPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePermanentPrivilege = ") } else { $NewLines += "SeCreatePermanentPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-108](../../08-endpoints/user-rights/configure-ura-sedebugprivilege.md)). (For Domain Controllers, refer to [REQ-DC-116](../../02-domain-controllers/user-rights/configure-ura-sedebugprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-sedebugprivilege.md The SeDebugPrivilege allows a process to attach a debugger to any running process on the system, completely overriding the target process security descriptor and Discretionary Access Control List (DACL). When enabled, calls to OpenProcess with permissions such as PROCESS_ALL_ACCESS or PROCESS_VM_READ succeed even against processes owned by other users or NT AUTHORITY\SYSTEM. This privilege is intended strictly for kernel/application developers debugging live processes. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Debug programs`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeDebugPrivilege.ps1 # Configure-PawUraSeDebugPrivilege.ps1 # Configure-PawUraSeDebugPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedebugprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedebugprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDebugPrivilege\s*=") { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDebugPrivilege = *S-1-5-32-544") } else { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeDebugPrivilegeStatus.ps1 # Get-PawUraSeDebugPrivilegeStatus.ps1 # Get-PawUraSeDebugPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedebugprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDebugPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeDebugPrivilege.ps1 # Configure-PawUraSeDebugPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedebugprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedebugprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDebugPrivilege\s*=") { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDebugPrivilege = *S-1-5-32-544") } else { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-109](../../08-endpoints/user-rights/configure-ura-seenabledelegationprivilege.md)). (For Domain Controllers, refer to [REQ-DC-122](../../02-domain-controllers/user-rights/configure-ura-seenabledelegationprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-seenabledelegationprivilege.md The SeEnableDelegationPrivilege allows a security principal to modify the userAccountControl attribute on Active Directory user and computer objects to enable Kerberos Delegation flags: (1) TRUSTED_FOR_DELEGATION (Unconstrained Delegation); (2) TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (Constrained Delegation with Protocol Transition / S4U2Self). Kerberos delegation permits a service to impersonate an authenticated user to access back-end resources on their behalf. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Enable computer and user accounts to be trusted for delegation`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeEnableDelegationPrivilege.ps1 # Configure-PawUraSeEnableDelegationPrivilege.ps1 # Configure-PawUraSeEnableDelegationPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seenabledelegationprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seenabledelegationprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeEnableDelegationPrivilege\s*=") { $NewLines += "SeEnableDelegationPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeEnableDelegationPrivilege = ") } else { $NewLines += "SeEnableDelegationPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeEnableDelegationPrivilegeStatus.ps1 # Get-PawUraSeEnableDelegationPrivilegeStatus.ps1 # Get-PawUraSeEnableDelegationPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seenabledelegationprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeEnableDelegationPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeEnableDelegationPrivilege.ps1 # Configure-PawUraSeEnableDelegationPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seenabledelegationprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seenabledelegationprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeEnableDelegationPrivilege\s*=") { $NewLines += "SeEnableDelegationPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeEnableDelegationPrivilege = ") } else { $NewLines += "SeEnableDelegationPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-110](../../08-endpoints/user-rights/configure-ura-seremoteshutdownprivilege.md)). (For Domain Controllers, refer to [REQ-DC-123](../../02-domain-controllers/user-rights/configure-ura-seremoteshutdownprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-seremoteshutdownprivilege.md The SeRemoteShutdownPrivilege allows a user authenticating over the network to invoke remote system shutdown and reboot APIs (such as InitiateSystemShutdownEx or shutdown.exe /m \\computer). This function is exposed over named pipe \PIPE\InitShutdown and RPC interface winreg/shutdown. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Force shutdown from a remote system`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeRemoteShutdownPrivilege.ps1 # Configure-PawUraSeRemoteShutdownPrivilege.ps1 # Configure-PawUraSeRemoteShutdownPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seremoteshutdownprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seremoteshutdownprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRemoteShutdownPrivilege\s*=") { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRemoteShutdownPrivilege = *S-1-5-32-544") } else { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeRemoteShutdownPrivilegeStatus.ps1 # Get-PawUraSeRemoteShutdownPrivilegeStatus.ps1 # Get-PawUraSeRemoteShutdownPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seremoteshutdownprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeRemoteShutdownPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeRemoteShutdownPrivilege.ps1 # Configure-PawUraSeRemoteShutdownPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seremoteshutdownprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seremoteshutdownprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRemoteShutdownPrivilege\s*=") { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRemoteShutdownPrivilege = *S-1-5-32-544") } else { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-111](../../08-endpoints/user-rights/configure-ura-seimpersonateprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-seimpersonateprivilege.md The SeImpersonatePrivilege grants a program the ability to impersonate a client that has connected to its local RPC interfaces, named pipes, or COM servers via ImpersonateNamedPipeClient, CoImpersonateClient, or RpcImpersonateClient. Impersonation allows a server process to temporarily run in the security context of the calling client to verify access permissions. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Impersonate a client after authentication`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-19 (LocalService), *S-1-5-20 (NetworkService), *S-1-5-32-544 (Administrators), *S-1-5-6 (Service). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeImpersonatePrivilege.ps1 # Configure-PawUraSeImpersonatePrivilege.ps1 # Configure-PawUraSeImpersonatePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seimpersonateprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seimpersonateprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeImpersonatePrivilege\s*=") { $NewLines += "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6") } else { $NewLines += "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeImpersonatePrivilegeStatus.ps1 # Get-PawUraSeImpersonatePrivilegeStatus.ps1 # Get-PawUraSeImpersonatePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seimpersonateprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeImpersonatePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeImpersonatePrivilege.ps1 # Configure-PawUraSeImpersonatePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seimpersonateprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seimpersonateprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeImpersonatePrivilege\s*=") { $NewLines += "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6") } else { $NewLines += "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-113](../../08-endpoints/user-rights/configure-ura-seloaddriverprivilege.md)). (For Domain Controllers, refer to [REQ-DC-125](../../02-domain-controllers/user-rights/configure-ura-seloaddriverprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-seloaddriverprivilege.md The SeLoadDriverPrivilege allows a process to dynamically load and unload kernel-mode device drivers (.sys files) via NtLoadDriver or the Service Control Manager (CreateService with SERVICE_KERNEL_DRIVER). Kernel-mode drivers execute in Ring 0 with unrestricted hardware access, full kernel memory read/write permissions, and the ability to execute any CPU instruction. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Load and unload device drivers`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeLoadDriverPrivilege.ps1 # Configure-PawUraSeLoadDriverPrivilege.ps1 # Configure-PawUraSeLoadDriverPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seloaddriverprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seloaddriverprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLoadDriverPrivilege\s*=") { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLoadDriverPrivilege = *S-1-5-32-544") } else { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeLoadDriverPrivilegeStatus.ps1 # Get-PawUraSeLoadDriverPrivilegeStatus.ps1 # Get-PawUraSeLoadDriverPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seloaddriverprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeLoadDriverPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeLoadDriverPrivilege.ps1 # Configure-PawUraSeLoadDriverPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seloaddriverprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seloaddriverprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLoadDriverPrivilege\s*=") { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLoadDriverPrivilege = *S-1-5-32-544") } else { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-114](../../08-endpoints/user-rights/configure-ura-selockmemoryprivilege.md)). (For Domain Controllers, refer to [REQ-DC-126](../../02-domain-controllers/user-rights/configure-ura-selockmemoryprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-selockmemoryprivilege.md The SeLockMemoryPrivilege allows a process to lock physical memory pages in RAM using APIs such as VirtualLock and Address Windowing Extensions (AWE) via AllocateUserPhysicalPages. Locking pages prevents the Windows virtual memory manager from paging data out to disk in pagefile.sys, ensuring high-performance memory retention. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Lock pages in memory`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeLockMemoryPrivilege.ps1 # Configure-PawUraSeLockMemoryPrivilege.ps1 # Configure-PawUraSeLockMemoryPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_selockmemoryprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_selockmemoryprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLockMemoryPrivilege\s*=") { $NewLines += "SeLockMemoryPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLockMemoryPrivilege = ") } else { $NewLines += "SeLockMemoryPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeLockMemoryPrivilegeStatus.ps1 # Get-PawUraSeLockMemoryPrivilegeStatus.ps1 # Get-PawUraSeLockMemoryPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_selockmemoryprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeLockMemoryPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeLockMemoryPrivilege.ps1 # Configure-PawUraSeLockMemoryPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_selockmemoryprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_selockmemoryprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLockMemoryPrivilege\s*=") { $NewLines += "SeLockMemoryPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLockMemoryPrivilege = ") } else { $NewLines += "SeLockMemoryPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-115](../../08-endpoints/user-rights/configure-ura-sesecurityprivilege.md)). (For Domain Controllers, refer to [REQ-DC-129](../../02-domain-controllers/user-rights/configure-ura-sesecurityprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-sesecurityprivilege.md The SeSecurityPrivilege controls access to the Windows Security Event Log (Security.evtx) and governs the ability to view, configure, and clear the security log, as well as specify object auditing options (System Access Control Lists - SACLs) on files, registry keys, and directory objects via ACCESS_SYSTEM_SECURITY. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Manage auditing and security log`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeSecurityPrivilege.ps1 # Configure-PawUraSeSecurityPrivilege.ps1 # Configure-PawUraSeSecurityPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesecurityprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesecurityprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSecurityPrivilege\s*=") { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSecurityPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeSecurityPrivilegeStatus.ps1 # Get-PawUraSeSecurityPrivilegeStatus.ps1 # Get-PawUraSeSecurityPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesecurityprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSecurityPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeSecurityPrivilege.ps1 # Configure-PawUraSeSecurityPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesecurityprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesecurityprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSecurityPrivilege\s*=") { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSecurityPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-116](../../08-endpoints/user-rights/configure-ura-sesystemenvironmentprivilege.md)). (For Domain Controllers, refer to [REQ-DC-130](../../02-domain-controllers/user-rights/configure-ura-sesystemenvironmentprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-sesystemenvironmentprivilege.md The SeSystemEnvironmentPrivilege allows a process to query and modify Non-Volatile RAM (NVRAM) firmware environment variables via Win32 APIs GetFirmwareEnvironmentVariable and SetFirmwareEnvironmentVariable. NVRAM variables govern UEFI boot sequences, Secure Boot policies, boot configuration data (BCD) handoffs, and hardware configuration flags. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Modify firmware environment values`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeSystemEnvironmentPrivilege.ps1 # Configure-PawUraSeSystemEnvironmentPrivilege.ps1 # Configure-PawUraSeSystemEnvironmentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemenvironmentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemenvironmentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemEnvironmentPrivilege\s*=") { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemEnvironmentPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeSystemEnvironmentPrivilegeStatus.ps1 # Get-PawUraSeSystemEnvironmentPrivilegeStatus.ps1 # Get-PawUraSeSystemEnvironmentPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesystemenvironmentprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSystemEnvironmentPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeSystemEnvironmentPrivilege.ps1 # Configure-PawUraSeSystemEnvironmentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemenvironmentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemenvironmentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemEnvironmentPrivilege\s*=") { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemEnvironmentPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-117](../../08-endpoints/user-rights/configure-ura-semanagevolumeprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-semanagevolumeprivilege.md The SeManageVolumePrivilege allows a process to perform low-level disk and volume maintenance tasks, including running defragmentation tools, modifying volume quotas, and invoking the SetFileValidData Win32 API. The SetFileValidData function allows a caller to extend the valid data length of an allocated file without zeroing out the intervening disk clusters. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Perform volume maintenance tasks`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeManageVolumePrivilege.ps1 # Configure-PawUraSeManageVolumePrivilege.ps1 # Configure-PawUraSeManageVolumePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_semanagevolumeprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_semanagevolumeprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeManageVolumePrivilege\s*=") { $NewLines += "SeManageVolumePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeManageVolumePrivilege = *S-1-5-32-544") } else { $NewLines += "SeManageVolumePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeManageVolumePrivilegeStatus.ps1 # Get-PawUraSeManageVolumePrivilegeStatus.ps1 # Get-PawUraSeManageVolumePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_semanagevolumeprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeManageVolumePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeManageVolumePrivilege.ps1 # Configure-PawUraSeManageVolumePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_semanagevolumeprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_semanagevolumeprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeManageVolumePrivilege\s*=") { $NewLines += "SeManageVolumePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeManageVolumePrivilege = *S-1-5-32-544") } else { $NewLines += "SeManageVolumePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-118](../../08-endpoints/user-rights/configure-ura-seprofilesingleprocessprivilege.md)). (For Domain Controllers, refer to [REQ-DC-131](../../02-domain-controllers/user-rights/configure-ura-seprofilesingleprocessprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-seprofilesingleprocessprivilege.md The SeProfileSingleProcessPrivilege allows a process to monitor and profile the performance and execution metrics of non-system processes using Windows performance sampling APIs. Profiling tools monitor instruction execution rates, thread context switches, memory cache behavior, and execution sampling. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Profile single process`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeProfileSingleProcessPrivilege.ps1 # Configure-PawUraSeProfileSingleProcessPrivilege.ps1 # Configure-PawUraSeProfileSingleProcessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seprofilesingleprocessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seprofilesingleprocessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeProfileSingleProcessPrivilege\s*=") { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeProfileSingleProcessPrivilege = *S-1-5-32-544") } else { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeProfileSingleProcessPrivilegeStatus.ps1 # Get-PawUraSeProfileSingleProcessPrivilegeStatus.ps1 # Get-PawUraSeProfileSingleProcessPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seprofilesingleprocessprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeProfileSingleProcessPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeProfileSingleProcessPrivilege.ps1 # Configure-PawUraSeProfileSingleProcessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seprofilesingleprocessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seprofilesingleprocessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeProfileSingleProcessPrivilege\s*=") { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeProfileSingleProcessPrivilege = *S-1-5-32-544") } else { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-121](../../08-endpoints/user-rights/configure-ura-serestoreprivilege.md)). (For Domain Controllers, refer to [REQ-DC-132](../../02-domain-controllers/user-rights/configure-ura-serestoreprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-serestoreprivilege.md The SeRestorePrivilege grants the caller the capability to bypass all write-access security controls (DACLs) across the entire NTFS filesystem and Windows Registry. When a process opens a file or registry key handle specifying FILE_FLAG_BACKUP_SEMANTICS in Win32 APIs, the kernel explicitly bypasses standard security descriptor DACL checks, allowing the process to write to, overwrite, or delete any file or key on the system. In addition, this privilege grants the ability to set any valid user or group SID as the owner of an object. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Restore files and directories`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeRestorePrivilege.ps1 # Configure-PawUraSeRestorePrivilege.ps1 # Configure-PawUraSeRestorePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_serestoreprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_serestoreprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRestorePrivilege\s*=") { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRestorePrivilege = *S-1-5-32-544") } else { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeRestorePrivilegeStatus.ps1 # Get-PawUraSeRestorePrivilegeStatus.ps1 # Get-PawUraSeRestorePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_serestoreprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeRestorePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeRestorePrivilege.ps1 # Configure-PawUraSeRestorePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_serestoreprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_serestoreprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRestorePrivilege\s*=") { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRestorePrivilege = *S-1-5-32-544") } else { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-122](../../08-endpoints/user-rights/configure-ura-setakeownershipprivilege.md)). (For Domain Controllers, refer to [REQ-DC-135](../../02-domain-controllers/user-rights/configure-ura-setakeownershipprivilege.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-setakeownershipprivilege.md The SeTakeOwnershipPrivilege allows a user to take ownership of any securable object in the operating system (files, directories, registry keys, Active Directory objects, printers, services) by writing the caller's SID into the object security descriptor owner field via SetNamedSecurityInfo or SetSecurityInfo. The Windows security model grants the owner of an object implicit WRITE_DAC authority. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Take ownership of files or other objects`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeTakeOwnershipPrivilege.ps1 # Configure-PawUraSeTakeOwnershipPrivilege.ps1 # Configure-PawUraSeTakeOwnershipPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setakeownershipprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setakeownershipprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTakeOwnershipPrivilege\s*=") { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTakeOwnershipPrivilege = *S-1-5-32-544") } else { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeTakeOwnershipPrivilegeStatus.ps1 # Get-PawUraSeTakeOwnershipPrivilegeStatus.ps1 # Get-PawUraSeTakeOwnershipPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_setakeownershipprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeTakeOwnershipPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeTakeOwnershipPrivilege.ps1 # Configure-PawUraSeTakeOwnershipPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setakeownershipprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setakeownershipprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTakeOwnershipPrivilege\s*=") { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTakeOwnershipPrivilege = *S-1-5-32-544") } else { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-124](../../08-endpoints/user-rights/configure-ura-sedenynetworklogonright.md)). (For Domain Controllers, refer to [REQ-DC-117](../../02-domain-controllers/user-rights/configure-ura-sedenynetworklogonright.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-sedenynetworklogonright.md The SeDenyNetworkLogonRight explicitly prevents specified security principals from authenticating over network protocols (SMB, RPC, WMI, WinRM, LDAP, etc. - Logon Type 3). Network logons represent the primary highway for lateral movement and remote compromise in Active Directory environments. Enforcing an explicit deny stops network authentication regardless of share-level or NTFS-level permissions. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Deny access to this computer from the network`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-113 (Local Account), *S-1-5-114 (Local Account and member of Administrators group). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeDenyNetworkLogonRight.ps1 # Configure-PawUraSeDenyNetworkLogonRight.ps1 # Configure-PawUraSeDenyNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenynetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenynetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyNetworkLogonRight\s*=") { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114") } else { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeDenyNetworkLogonRightStatus.ps1 # Get-PawUraSeDenyNetworkLogonRightStatus.ps1 # Get-PawUraSeDenyNetworkLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedenynetworklogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDenyNetworkLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-113,*S-1-5-114" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeDenyNetworkLogonRight.ps1 # Configure-PawUraSeDenyNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenynetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenynetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyNetworkLogonRight\s*=") { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114") } else { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) dedicated to Tier 0 and critical administrative functions. (For Tier 2 Client Workstations and Member Servers, refer to standard baseline [REQ-END-125](../../08-endpoints/user-rights/configure-ura-sedenyremoteinteractivelogonright.md)). (For Domain Controllers, refer to [REQ-DC-121](../../02-domain-controllers/user-rights/configure-ura-sedenyremoteinteractivelogonright.md)). Operating Systems: Windows 10 Enterprise (1809 and above) and Windows 11 Enterprise. File Path: 07-paws/user-rights/configure-ura-sedenyremoteinteractivelogonright.md The SeDenyRemoteInteractiveLogonRight explicitly denies designated accounts the ability to establish Remote Desktop Protocol (RDP) sessions (Logon Type 10) on the target system. RDP exposes a full graphical interactive session over TCP port 3389, providing an attacker with interactive desktop capabilities and loading user credentials into memory. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 0 PAW systems (e.g., GPO_Hardening_PAW). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Deny log on through Remote Desktop Services`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-113 (Local Account), *S-1-5-114 (Local Account and member of Administrators group). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawUraSeDenyRemoteInteractiveLogonRight.ps1 # Configure-PawUraSeDenyRemoteInteractiveLogonRight.ps1 # Configure-PawUraSeDenyRemoteInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyremoteinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyremoteinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyRemoteInteractiveLogonRight\s*=") { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114") } else { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-PawUraSeDenyRemoteInteractiveLogonRightStatus.ps1 # Get-PawUraSeDenyRemoteInteractiveLogonRightStatus.ps1 # Get-PawUraSeDenyRemoteInteractiveLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedenyremoteinteractivelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDenyRemoteInteractiveLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-113,*S-1-5-114" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-PawUraSeDenyRemoteInteractiveLogonRight.ps1 # Configure-PawUraSeDenyRemoteInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyremoteinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyremoteinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyRemoteInteractiveLogonRight\s*=") { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114") } else { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-126](../../08-endpoints/user-profile/configure-up-toast-notifications.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-toast-notifications.md Privileged Access Workstations (PAWs) operate in high-security operations centers (SOC/NOC) or dedicated administrative enclaves. Tier 0 administrative operators interact with domain controllers, public key infrastructure (PKI), and cloud identity tenants. Allowing application notifications to render above the lock screen exposes highly confidential administrative context and authentication challenges to physical observation. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: User Configuration \ Administrative Templates \ Start Menu and Taskbar \ Notifications Double-click Turn off toast notifications on the lock screen and set it to Enabled. (Optional Defense-in-Depth) Navigate to: Computer Configuration \ Administrative Templates \ System \ Logon Set Turn off app notifications on the lock screen to Enabled*. Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable toast notifications on the lock screen on the PAW console: Download Script: Configure-PawUptoastnotifications.ps1 # Configure-PawUptoastnotifications.ps1 Write-Host "Applying User Profile restriction: toast-notifications..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "NoToastApplicationNotificationOnLockScreen" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } To audit the hardening status: Download Script: Get-PawUptoastnotificationsStatus.ps1 # Get-PawUptoastnotificationsStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUptoastnotifications.ps1 Write-Host "Applying User Profile restriction: toast-notifications..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "NoToastApplicationNotificationOnLockScreen" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-127](../../08-endpoints/user-profile/configure-up-spotlight-consumer.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-spotlight-consumer.md Privileged Access Workstations (PAWs) operate in dedicated management enclaves with restricted internet egress. Connecting to public consumer clouds to download wallpapers, marketing suggestions, or consumer games introduces unvetted network connections, violates administrative isolation, and increases attack surface on Tier 0 assets. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Cloud Content Turn off Microsoft consumer experiences: Set to Enabled Navigate to: User Configuration \ Administrative Templates \ Windows Components \ Cloud Content Do not show third-party suggestions in Windows spotlight: Set to Enabled Configure Windows spotlight on lock screen: Set to Disabled Turn off Windows spotlight on desktop: Set to Enabled Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure Spotlight and Consumer Features restrictions on the PAW console: Download Script: Configure-PawUpspotlightconsumer.ps1 # Configure-PawUpspotlightconsumer.ps1 Write-Host "Applying User Profile restriction: spotlight-consumer..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableThirdPartySuggestions" "1" "DWord" Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "ConfigureWindowsSpotlight" "2" "DWord" Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableSpotlightCollectionOnDesktop" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableWindowsConsumerFeatures" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "DisableThirdPartySuggestions" -Value "1" -Type DWord -Force $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "ConfigureWindowsSpotlight" -Value "2" -Type DWord -Force $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "DisableSpotlightCollectionOnDesktop" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } To audit the hardening status: Download Script: Get-PawUpspotlightconsumerStatus.ps1 # Get-PawUpspotlightconsumerStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableThirdPartySuggestions" "1" Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "ConfigureWindowsSpotlight" "2" Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableSpotlightCollectionOnDesktop" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableWindowsConsumerFeatures" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUpspotlightconsumer.ps1 Write-Host "Applying User Profile restriction: spotlight-consumer..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableThirdPartySuggestions" "1" "DWord" Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "ConfigureWindowsSpotlight" "2" "DWord" Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableSpotlightCollectionOnDesktop" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableWindowsConsumerFeatures" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "DisableThirdPartySuggestions" -Value "1" -Type DWord -Force $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "ConfigureWindowsSpotlight" -Value "2" -Type DWord -Force $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "DisableSpotlightCollectionOnDesktop" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-128](../../08-endpoints/user-profile/configure-up-windows-copilot.md)). Operating Systems: Windows 11 Enterprise, Windows 10 Enterprise (version 1809 and above). File Path: 07-paws/user-profile/configure-up-windows-copilot.md Privileged Access Workstations (PAWs) handle the most sensitive infrastructure secrets in the Active Directory enterprise: Domain Controller recovery keys, Kerberos KRBTGT hashes, schema definitions, and cloud tenant administrative tokens. Generative AI assistants integrated into the operating system shell present an existential security and confidentiality hazard on dedicated Tier 0 management consoles. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: User Configuration \ Administrative Templates \ Windows Components \ Windows Copilot Turn off Windows Copilot: Set to Enabled Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Copilot Turn off Windows Copilot: Set to Enabled Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable Windows Copilot on the PAW console: Download Script: Configure-PawUpwindowscopilot.ps1 # Configure-PawUpwindowscopilot.ps1 Write-Host "Applying User Profile restriction: windows-copilot..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\WindowsCopilot" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "TurnOffWindowsCopilot" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } To audit the hardening status: Download Script: Get-PawUpwindowscopilotStatus.ps1 # Get-PawUpwindowscopilotStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUpwindowscopilot.ps1 Write-Host "Applying User Profile restriction: windows-copilot..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\WindowsCopilot" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "TurnOffWindowsCopilot" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-129](../../08-endpoints/user-profile/configure-up-inplace-sharing.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-inplace-sharing.md Privileged Access Workstations (PAWs) are dedicated exclusively to directory administration, identity synchronization, and domain-level maintenance. Administrative sessions on PAWs interact with sensitive directory export files (ntds.dit snippets, LDIFDE exports, sensitive PowerShell scripts, and recovery key backups). Allowing interactive, peer-to-peer, or modern shell file sharing from a PAW shatters data containment and provides immediate exfiltration channels. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: User Configuration \ Administrative Templates \ Windows Components \ File Explorer Turn off in-place sharing: Set to Enabled Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ File Explorer Turn off in-place sharing: Set to Enabled Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure In-Place Sharing restrictions on the PAW console: Download Script: Configure-PawUpinplacesharing.ps1 # Configure-PawUpinplacesharing.ps1 Write-Host "Applying User Profile restriction: inplace-sharing..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "NoInplaceSharing" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } To audit the hardening status: Download Script: Get-PawUpinplacesharingStatus.ps1 # Get-PawUpinplacesharingStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKCU:" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUpinplacesharing.ps1 Write-Host "Applying User Profile restriction: inplace-sharing..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "NoInplaceSharing" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-130](../../08-endpoints/user-profile/configure-up-runas-suppression.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-runas-suppression.md Privileged Access Workstations (PAWs) operate under strict dedicated role segregation. An administrator logging into a Tier 0 PAW authenticates directly with their Tier 0 privileged identity (e.g., Domain Admin smart card or FIDO2 key). The Windows Explorer "Run as different user" context menu verb (runasuser) invites multi-account usage patterns, credential confusion, and potential interactive credential theft. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Create four Registry Items with the following parameters: Action*: Update Hive*: HKEY_LOCAL_MACHINE Value Name*: SuppressionPolicy Value Type*: REG_DWORD Value Data*: 4096 Key Paths*: * SOFTWARE\Classes\batfile\shell\runasuser * SOFTWARE\Classes\cmdfile\shell\runasuser * SOFTWARE\Classes\exefile\shell\runasuser * SOFTWARE\Classes\mscfile\shell\runasuser Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure Shell RunAs User suppression on the PAW console: Download Script: Configure-PawUprunassuppression.ps1 # Configure-PawUprunassuppression.ps1 Write-Host "Applying User Profile restriction: runas-suppression..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Classes\batfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\cmdfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\exefile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\mscfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" To audit the hardening status: Download Script: Get-PawUprunassuppressionStatus.ps1 # Get-PawUprunassuppressionStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Classes\batfile\shell\runasuser" "SuppressionPolicy" "4096" Test-RegValue "HKLM:" "SOFTWARE\Classes\cmdfile\shell\runasuser" "SuppressionPolicy" "4096" Test-RegValue "HKLM:" "SOFTWARE\Classes\exefile\shell\runasuser" "SuppressionPolicy" "4096" Test-RegValue "HKLM:" "SOFTWARE\Classes\mscfile\shell\runasuser" "SuppressionPolicy" "4096" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUprunassuppression.ps1 Write-Host "Applying User Profile restriction: runas-suppression..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Classes\batfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\cmdfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\exefile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\mscfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-131](../../08-endpoints/user-profile/configure-up-personalization-privacy.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-personalization-privacy.md Privileged Access Workstations (PAWs) serve as the trusted execution environment for managing Active Directory Domain Services, forest trusts, and cryptographic root keys. Permitting multimedia sensors, unauthenticated camera feeds, dynamic slideshow image parsing, voice assistants, or keystroke learning databases on a Tier 0 console creates intolerable physical security, acoustic surveillance, and local memory exploitation risks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration \ Administrative Templates \ Control Panel \ Personalization Prevent enabling lock screen camera: Set to Enabled Prevent enabling lock screen slide show: Set to Enabled Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ App Privacy Let Windows apps activate with voice above lock: Set to Enabled In the drop-down menu, select: Force Deny Navigate to: Computer Configuration \ Administrative Templates \ Control Panel \ Regional and Language Options \ Handwriting personalization Turn off automatic learning: Set to Enabled Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Personalization and Privacy restrictions on the PAW console: Download Script: Configure-PawUppersonalizationprivacy.ps1 # Configure-PawUppersonalizationprivacy.ps1 Write-Host "Applying User Profile restriction: personalization-privacy..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenCamera" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenSlideshow" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" "LetAppsActivateWithVoiceAboveLock" "2" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\InputPersonalization" "AllowInputPersonalization" "0" "DWord" To audit the hardening status: Download Script: Get-PawUppersonalizationprivacyStatus.ps1 # Get-PawUppersonalizationprivacyStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenCamera" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenSlideshow" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" "LetAppsActivateWithVoiceAboveLock" "2" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\InputPersonalization" "AllowInputPersonalization" "0" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUppersonalizationprivacy.ps1 Write-Host "Applying User Profile restriction: personalization-privacy..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenCamera" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenSlideshow" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" "LetAppsActivateWithVoiceAboveLock" "2" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\InputPersonalization" "AllowInputPersonalization" "0" "DWord" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to reciprocal baseline [REQ-END-132](../../08-endpoints/user-profile/configure-up-gp-processing.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-gp-processing.md Privileged Access Workstations (PAWs) enforce the most stringent security configurations across the enterprise to safeguard Tier 0 identity assets. Group Policy client configuration is applied by specialized Client-Side Extensions (CSEs). The GUID {35378EAC-683F-11D2-A89A-00C04FBBCFA2} corresponds to the core Registry Client-Side Extension (gptext.dll), which reads and applies the administrative templates and security settings packaged within Group Policy Objects. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration \ Administrative Templates \ System \ Group Policy Double-click Configure Registry policy processing and configure: Select Enabled Check Process even if the Group Policy objects have not changed Ensure Do not apply during periodic background processing is unchecked Link the GPO to the dedicated PAW Organizational Unit and enforce policy application using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the Registry CSE processing behaviors on PAWs: Download Script: Configure-PawUpgpprocessing.ps1 # Configure-PawUpgpprocessing.ps1 Write-Host "Applying User Profile restriction: gp-processing..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoBackgroundPolicy" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoGPOListChanges" "0" "DWord" To audit the hardening status: Download Script: Get-PawUpgpprocessingStatus.ps1 # Get-PawUpgpprocessingStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoBackgroundPolicy" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoGPOListChanges" "0" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUpgpprocessing.ps1 Write-Host "Applying User Profile restriction: gp-processing..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoBackgroundPolicy" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoGPOListChanges" "0" "DWord" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to reciprocal baseline [REQ-END-133](../../08-endpoints/user-profile/configure-up-telemetry-inventory.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-telemetry-inventory.md Privileged Access Workstations (PAWs) serve as the most secure bastion tier in an enterprise Active Directory deployment, operating within isolated administrative networks with strictly regulated inbound and outbound communications. Telemetry, diagnostic data collection, and application inventory background tasks represent unnecessary attack surface and data leakage risks when running on Tier 0 consoles. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Application Compatibility Double-click Turn off Inventory Collector -> Select Enabled*. Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Data Collection and Preview Builds Double-click Allow Diagnostic Data (or Allow Telemetry ) -> Select Enabled , and choose Send required diagnostic data (or Diagnostic data off* / 0 if available). Double-click Limit Enhanced diagnostic data to the minimum required by Windows Analytics -> Select Enabled*. Link the GPO to the dedicated PAW Organizational Unit and enforce policy application with gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce inventory and telemetry restrictions on PAWs: Download Script: Configure-PawUptelemetryinventory.ps1 # Configure-PawUptelemetryinventory.ps1 Write-Host "Applying User Profile restriction: telemetry-inventory..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppCompat" "DisableInventory" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "AllowTelemetry" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "LimitEnhancedDiagnosticDataWindowsAnalytics" "1" "DWord" To audit the hardening status: Download Script: Get-PawUptelemetryinventoryStatus.ps1 # Get-PawUptelemetryinventoryStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppCompat" "DisableInventory" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "AllowTelemetry" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "LimitEnhancedDiagnosticDataWindowsAnalytics" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUptelemetryinventory.ps1 Write-Host "Applying User Profile restriction: telemetry-inventory..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppCompat" "DisableInventory" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "AllowTelemetry" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "LimitEnhancedDiagnosticDataWindowsAnalytics" "1" "DWord" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-134](../../08-endpoints/user-profile/configure-up-explorer-security.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-explorer-security.md On Privileged Access Workstations (PAWs), File Explorer (explorer.exe) provides the interactive desktop shell within which all Tier 0 administrative tasks, credential entry, and management utilities operate. If an adversary or malicious script can exploit a memory corruption vulnerability within the Explorer process, they can execute arbitrary shellcode within the interactive administrative desktop station, compromising Kerberos tickets, session tokens, and Active Directory management sessions. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ File Explorer Configure the following policies: Turn off Data Execution Prevention for Explorer : Set to Disabled Turn off heap termination on corruption : Set to Disabled Shell Protocol Protected Mode : Set to Enabled Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Explorer security and memory protections on the PAW console: Download Script: Configure-PawUpexplorersecurity.ps1 # Configure-PawUpexplorersecurity.ps1 Write-Host "Applying User Profile restriction: explorer-security..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoDataExecutionPrevention" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoHeapTerminationOnCorruption" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "PreXPSP2ShellProtocolBehavior" "0" "DWord" To audit the hardening status: Download Script: Get-PawUpexplorersecurityStatus.ps1 # Get-PawUpexplorersecurityStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoDataExecutionPrevention" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoHeapTerminationOnCorruption" "0" Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "PreXPSP2ShellProtocolBehavior" "0" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUpexplorersecurity.ps1 Write-Host "Applying User Profile restriction: explorer-security..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoDataExecutionPrevention" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoHeapTerminationOnCorruption" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "PreXPSP2ShellProtocolBehavior" "0" "DWord" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 Client Workstations and Member Servers, refer to reciprocal baseline [REQ-END-135](../../08-endpoints/user-profile/configure-up-ie-security.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-ie-security.md Privileged Access Workstations (PAWs) are dedicated exclusively to high-privilege administrative tasks, such as managing Active Directory Domain Services, Azure AD Connect, PKI infrastructure, and Domain Controllers. Standard user activities—including general web browsing, personal email, and social media—are strictly forbidden on PAWs by foundational Tier 0 isolation principles. Even when direct interactive browsing is prohibited, background operating system components associated with legacy Internet Explorer, WinINet, and the Windows RSS Platform (msfeeds.dll, msfeedssync.exe) remain installed on Windows clients. Hardening these legacy components is essential to prevent background exploitation vectors on Tier 0 consoles. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Internet Explorer Double-click Disable Internet Explorer 11 as a standalone browser -> Set to Enabled , and select Always*. Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ RSS Feeds Double-click Prevent downloading of enclosures -> Set to Enabled*. Double-click Turn on Basic feed authentication over HTTP -> Set to Disabled*. Link the GPO to the dedicated PAW Organizational Unit and enforce policy application with gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure Internet Explorer and RSS feed security restrictions on PAWs: Download Script: Configure-PawUpiesecurity.ps1 # Configure-PawUpiesecurity.ps1 Write-Host "Applying User Profile restriction: ie-security..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Main" "NotifyDisableIEOptions" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "DisableEnclosureDownload" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "AllowBasicAuthInClear" "0" "DWord" To audit the hardening status: Download Script: Get-PawUpiesecurityStatus.ps1 # Get-PawUpiesecurityStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Main" "NotifyDisableIEOptions" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "DisableEnclosureDownload" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "AllowBasicAuthInClear" "0" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUpiesecurity.ps1 Write-Host "Applying User Profile restriction: ie-security..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Main" "NotifyDisableIEOptions" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "DisableEnclosureDownload" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "AllowBasicAuthInClear" "0" "DWord" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-136](../../08-endpoints/user-profile/configure-up-logon-banners.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-logon-banners.md Privileged Access Workstations (PAWs) operate at the highest classification boundary in the enterprise, dedicated strictly to Tier 0 Active Directory and cloud identity administration. Permitting automated background credential rehydration after reboots, or omitting authoritative legal notice warnings, severely undermines physical device security and legal prosecution capabilities. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Security Options Interactive logon: Message text for users attempting to log on: Enter organizational warning text (e.g., You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS, you consent to routine monitoring.) Interactive logon: Message title for users attempting to log on: Enter warning title (e.g., US Department of Defense Warning Statement) Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Logon Options Sign-in and lock last interactive user automatically after a restart or cold boot: Set to Disabled Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure Interactive Logon warning banners and disable ARSO on the PAW console: Download Script: Configure-PawUplogonbanners.ps1 # Configure-PawUplogonbanners.ps1 Write-Host "Applying User Profile restriction: logon-banners..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "DisableAutomaticRestartSignOn" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeText" "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS, you consent to routine monitoring." "String" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeCaption" "US Department of Defense Warning Statement" "String" To audit the hardening status: Download Script: Get-PawUplogonbannersStatus.ps1 # Get-PawUplogonbannersStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "DisableAutomaticRestartSignOn" "1" Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeText" "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS, you consent to routine monitoring." Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeCaption" "US Department of Defense Warning Statement" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUplogonbanners.ps1 Write-Host "Applying User Profile restriction: logon-banners..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "DisableAutomaticRestartSignOn" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeText" "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS, you consent to routine monitoring." "String" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeCaption" "US Department of Defense Warning Statement" "String" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to [REQ-END-137](../../08-endpoints/user-profile/configure-up-inactivity-timeout.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-inactivity-timeout.md Privileged Access Workstations (PAWs) are dedicated physical or virtual workstations exclusively utilized by Tier 0 identity administrators to manage Active Directory Domain Services, PKI root certification authorities, and privileged directory infrastructure. During an active administrative session, a PAW routinely hosts high-privilege credentials: In-memory Kerberos Ticket Granting Tickets (TGTs) belonging to Domain Admins, Enterprise Admins, or Schema Admins. Physical hardware security tokens (FIDO2 keys, PIV/CAC smart cards, YubiKeys) plugged into USB ports with unlocked PIN caching. * Open elevated PowerShell consoles, Active Directory Administrative Center sessions, and Microsoft Management Consoles (MMCs) possessing unconstrained administrative control over the directory. If an administrator steps away from their PAW without manually locking the console (e.g., to attend a meeting, take a phone call, or converse with colleagues), an unlocked workstation presents an existential threat to the entire Active Directory forest. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to the PAW Organizational Unit (e.g., GPO_Hardening_PAWs). Navigate to: Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Security Options Double-click Interactive logon: Machine inactivity limit and configure: Check Define this policy setting Set The machine will be locked after*: 900 seconds (or 600 seconds for tightened Tier 0 environments) Link the GPO to the dedicated PAW Organizational Unit and enforce policy application using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce the machine inactivity timeout limit on PAWs: Download Script: Configure-PawUpinactivitytimeout.ps1 # Configure-PawUpinactivitytimeout.ps1 Write-Host "Applying User Profile restriction: inactivity-timeout..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "InactivityTimeoutSecs" "900" "DWord" To audit the hardening status: Download Script: Get-PawUpinactivitytimeoutStatus.ps1 # Get-PawUpinactivitytimeoutStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "InactivityTimeoutSecs" "900" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUpinactivitytimeout.ps1 Write-Host "Applying User Profile restriction: inactivity-timeout..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "InactivityTimeoutSecs" "900" "DWord" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-138](../../08-endpoints/user-profile/configure-up-installer-hardening.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-installer-hardening.md Privileged Access Workstations (PAWs) serve as the dedicated management boundary for Tier 0 Active Directory assets. In a hardened PAW environment, local software installations are strictly restricted to enterprise-vetted administrative tooling deployed via central configuration management. Permitting any permissive Windows Installer settings—especially AlwaysInstallElevated—presents an immediate local privilege escalation hazard that could allow a non-administrative account or background worker to seize full NT AUTHORITY\SYSTEM control of the PAW. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Configure the following policies: Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Installer Always install with elevated privileges: Set to Disabled Allow user control over installs: Set to Disabled Navigate to: User Configuration \ Administrative Templates \ Windows Components \ Windows Installer Always install with elevated privileges: Set to Disabled Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Add Registry Item: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer\DisableCoInstallers = 1 (DWord) Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Windows Installer hardening on the PAW console: Download Script: Configure-PawUpinstallerhardening.ps1 # Configure-PawUpinstallerhardening.ps1 Write-Host "Applying User Profile restriction: installer-hardening..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "EnableUserControl" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "AlwaysInstallElevated" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "SafeForScripting" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer" "DisableCoInstallers" "1" "DWord" To audit the hardening status: Download Script: Get-PawUpinstallerhardeningStatus.ps1 # Get-PawUpinstallerhardeningStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "EnableUserControl" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "AlwaysInstallElevated" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "SafeForScripting" "0" Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer" "DisableCoInstallers" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUpinstallerhardening.ps1 Write-Host "Applying User Profile restriction: installer-hardening..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "EnableUserControl" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "AlwaysInstallElevated" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "SafeForScripting" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer" "DisableCoInstallers" "1" "DWord" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-139](../../08-endpoints/user-profile/configure-up-seclogon-service.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-up-seclogon-service.md Privileged Access Workstations (PAWs) are architected according to the "Clean Source" principle: a PAW is dedicated strictly to a single administrative tier, and administrators log in directly with their Tier 0 credentials. The Secondary Logon service (seclogon.dll), which facilitates RunAs and CreateProcessWithLogonW, is not only unnecessary on a dedicated PAW console, but poses an acute attack surface and violates Tier 0 credential hygiene. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Windows Settings \ Security Settings \ System Services Double-click Secondary Logon and configure: Check Define this policy setting Select Disabled Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable the Secondary Logon service on the PAW console: Download Script: Configure-PawUpseclogonservice.ps1 # Configure-PawUpseclogonservice.ps1 Write-Host "Applying User Profile restriction: seclogon-service..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SYSTEM\CurrentControlSet\Services\seclogon" "Start" "4" "DWord" To audit the hardening status: Download Script: Get-PawUpseclogonserviceStatus.ps1 # Get-PawUpseclogonserviceStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SYSTEM\CurrentControlSet\Services\seclogon" "Start" "4" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawUpseclogonservice.ps1 Write-Host "Applying User Profile restriction: seclogon-service..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SYSTEM\CurrentControlSet\Services\seclogon" "Start" "4" "DWord" Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-151](../../08-endpoints/user-profile/configure-end-up-sehop.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-sehop.md Dedicated Privileged Access Workstations (PAWs) are the cornerstone of Tier 0 infrastructure security. While PAWs predominantly run native 64-bit administrative consoles, administrative utilities, MMC snap-ins, or legacy automation tools may invoke 32-bit processes under WOW64. Enforcing Structured Exception Handling Overwrite Protection (SEHOP) system-wide prevents stack corruption exploits from subverting the exception handling mechanism on high-privilege management stations. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager\kernel Value Name*: DisableExceptionChainValidation Value Type*: REG_DWORD Value Data*: 0 Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Note: Enforcing DisableExceptionChainValidation requires a system restart to take effect on the kernel exception dispatcher. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce SEHOP exception chain validation on the PAW console: Download Script: Configure-PawAuditSehop.ps1 # Configure-PawAuditSehop.ps1 Write-Host "Enforcing System Mitigation control: sehop..." -ForegroundColor Cyan # Set Registry value: DisableExceptionChainValidation if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Name "DisableExceptionChainValidation" -Value 0 -Type DWord -Force Write-Host " Enforced DisableExceptionChainValidation = 0" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditSehopStatus.ps1 # Get-PawAuditSehopStatus.ps1 $script:Vulnerable = $false # Audit Registry value: DisableExceptionChainValidation $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Name "DisableExceptionChainValidation" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.DisableExceptionChainValidation -ne 0) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditSehop.ps1 Write-Host "Enforcing System Mitigation control: sehop..." -ForegroundColor Cyan # Set Registry value: DisableExceptionChainValidation if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Name "DisableExceptionChainValidation" -Value 0 -Type DWord -Force Write-Host " Enforced DisableExceptionChainValidation = 0" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-152](../../08-endpoints/user-profile/configure-end-up-protection-mode.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-protection-mode.md Privileged Access Workstations (PAWs) host the most sensitive administrative sessions in the enterprise, including Domain Admin, Enterprise Admin, and Tier 0 identity management credentials. Any unauthorized file placement, symbolic link manipulation, or DLL planting in %SystemRoot% or system object manager namespaces could allow an unprivileged attacker or rogue maintenance utility to compromise the entire workstation integrity, leading to identity store takeover. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager Value Name*: ProtectionMode Value Type*: REG_DWORD Value Data*: 1 Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Note: Enforcing ProtectionMode requires a computer restart to apply to the Session Manager during initial boot. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Directory Protection Mode on the PAW console: Download Script: Configure-PawAuditProtectionmode.ps1 # Configure-PawAuditProtectionmode.ps1 Write-Host "Enforcing System Mitigation control: protection-mode..." -ForegroundColor Cyan # Set Registry value: ProtectionMode if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "ProtectionMode" -Value 1 -Type DWord -Force Write-Host " Enforced ProtectionMode = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditProtectionmodeStatus.ps1 # Get-PawAuditProtectionmodeStatus.ps1 $script:Vulnerable = $false # Audit Registry value: ProtectionMode $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "ProtectionMode" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.ProtectionMode -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditProtectionmode.ps1 Write-Host "Enforcing System Mitigation control: protection-mode..." -ForegroundColor Cyan # Set Registry value: ProtectionMode if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "ProtectionMode" -Value 1 -Type DWord -Force Write-Host " Enforced ProtectionMode = 1" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-153](../../08-endpoints/user-profile/configure-end-up-aslr-relocation.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-aslr-relocation.md Privileged Access Workstations (PAWs) host high-integrity administrative tooling, PowerShell sessions, and directory management utilities where memory safety is critical to preventing credential harvesting. Mandatory Address Space Layout Randomization (ASLR) image relocation enforces systematic randomization across all executable binaries and loaded DLLs, depriving adversaries of static memory targets for Return-Oriented Programming (ROP) exploitation. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management Value Name*: MoveImages Value Type*: REG_DWORD Value Data*: 4294967295 (Decimal) or 0xFFFFFFFF (Hexadecimal) Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Note: Enforcing MoveImages requires a computer restart to apply to core operating system kernel processes. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce system-wide ASLR image relocation on the PAW console: Download Script: Configure-PawAuditAslrrelocation.ps1 # Configure-PawAuditAslrrelocation.ps1 Write-Host "Enforcing System Mitigation control: aslr-relocation..." -ForegroundColor Cyan # Set Registry value: MoveImages if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "MoveImages" -Value 4294967295 -Type DWord -Force Write-Host " Enforced MoveImages = 4294967295" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditAslrrelocationStatus.ps1 # Get-PawAuditAslrrelocationStatus.ps1 $script:Vulnerable = $false # Audit Registry value: MoveImages $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "MoveImages" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.MoveImages -ne 4294967295) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditAslrrelocation.ps1 Write-Host "Enforcing System Mitigation control: aslr-relocation..." -ForegroundColor Cyan # Set Registry value: MoveImages if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "MoveImages" -Value 4294967295 -Type DWord -Force Write-Host " Enforced MoveImages = 4294967295" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-154](../../08-endpoints/user-profile/configure-end-up-speculative-mitigations.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-speculative-mitigations.md Privileged Access Workstations (PAWs) are dedicated exclusively to managing Tier 0 directory assets, where sensitive Kerberos TGTs, domain administrator password hashes, and enterprise PKI keys are processed in volatile memory. Speculative execution side-channel vulnerabilities (Spectre, Meltdown, MDS) allow unprivileged local code or sandboxed scripts to circumvent hardware security boundaries, leaking confidential kernel memory across address spaces. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management Value Name*: FeatureSettingsOverride Value Type*: REG_DWORD Value Data*: 72 Create a second Registry Item: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management Value Name*: FeatureSettingsOverrideMask Value Type*: REG_DWORD Value Data*: 3 Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Note: A computer restart is required for the Windows kernel to initialize speculative CPU execution mitigations. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce speculative execution mitigations on the PAW console: Download Script: Configure-PawAuditSpeculativemitigations.ps1 # Configure-PawAuditSpeculativemitigations.ps1 Write-Host "Enforcing System Mitigation control: speculative-mitigations..." -ForegroundColor Cyan # Set Registry value: FeatureSettingsOverride if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverride" -Value 72 -Type DWord -Force Write-Host " Enforced FeatureSettingsOverride = 72" -ForegroundColor Green # Set Registry value: FeatureSettingsOverrideMask if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverrideMask" -Value 3 -Type DWord -Force Write-Host " Enforced FeatureSettingsOverrideMask = 3" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditSpeculativemitigationsStatus.ps1 # Get-PawAuditSpeculativemitigationsStatus.ps1 $script:Vulnerable = $false # Audit Registry value: FeatureSettingsOverride $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverride" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.FeatureSettingsOverride -ne 72) { $script:Vulnerable = $true } # Audit Registry value: FeatureSettingsOverrideMask $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverrideMask" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.FeatureSettingsOverrideMask -ne 3) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditSpeculativemitigations.ps1 Write-Host "Enforcing System Mitigation control: speculative-mitigations..." -ForegroundColor Cyan # Set Registry value: FeatureSettingsOverride if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverride" -Value 72 -Type DWord -Force Write-Host " Enforced FeatureSettingsOverride = 72" -ForegroundColor Green # Set Registry value: FeatureSettingsOverrideMask if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverrideMask" -Value 3 -Type DWord -Force Write-Host " Enforced FeatureSettingsOverrideMask = 3" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-155](../../08-endpoints/user-profile/configure-end-up-cert-padding.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-cert-padding.md On Privileged Access Workstations (PAWs), Windows Defender Application Control (WDAC) and AppLocker enforce rigorous publisher signature rules to guarantee that only cryptographically verified, Microsoft-signed, or enterprise-approved binaries can execute. A vulnerability in legacy Authenticode processing (CVE-2013-3900) allows adversaries to append unauthorized code or secondary payloads to signed PE files without breaking the signature, creating a critical evasion pathway on administrative systems. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item (Native 64-bit) and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: Software\Microsoft\Cryptography\Wintrust\Config Value Name*: EnableCertPaddingCheck Value Type*: REG_DWORD Value Data*: 1 Right-click Registry -> New -> Registry Item (WOW64 32-bit) and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config Value Name*: EnableCertPaddingCheck Value Type*: REG_DWORD Value Data*: 1 Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Authenticode certificate padding validation on the PAW console: Download Script: Configure-PawAuditCertpadding.ps1 # Configure-PawAuditCertpadding.ps1 Write-Host "Enforcing System Mitigation control: cert-padding..." -ForegroundColor Cyan # Set Registry value: EnableCertPaddingCheck if (-not (Test-Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config")) { New-Item -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force Write-Host " Enforced EnableCertPaddingCheck = 1" -ForegroundColor Green # Set Registry value: EnableCertPaddingCheck if (-not (Test-Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config")) { New-Item -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force Write-Host " Enforced EnableCertPaddingCheck = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditCertpaddingStatus.ps1 # Get-PawAuditCertpaddingStatus.ps1 $script:Vulnerable = $false # Audit Registry value: EnableCertPaddingCheck $RegVal = Get-ItemProperty -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.EnableCertPaddingCheck -ne 1) { $script:Vulnerable = $true } # Audit Registry value: EnableCertPaddingCheck $RegVal = Get-ItemProperty -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.EnableCertPaddingCheck -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditCertpadding.ps1 Write-Host "Enforcing System Mitigation control: cert-padding..." -ForegroundColor Cyan # Set Registry value: EnableCertPaddingCheck if (-not (Test-Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config")) { New-Item -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force Write-Host " Enforced EnableCertPaddingCheck = 1" -ForegroundColor Green # Set Registry value: EnableCertPaddingCheck if (-not (Test-Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config")) { New-Item -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force Write-Host " Enforced EnableCertPaddingCheck = 1" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-156](../../08-endpoints/user-profile/configure-end-up-lock-batch-files.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-lock-batch-files.md Privileged Access Workstations (PAWs) are dedicated exclusively to directory administration, identity synchronization, and domain-level maintenance. Administrative batch scripts running on PAWs often operate in high-integrity or SYSTEM contexts to orchestrate directory backups, certificate rollover tasks, or network diagnostics. Allowing concurrent processes to modify active scripts creates a critical privilege escalation vector. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Command Processor Value Name*: LockBatchFilesWhenInUse Value Type*: REG_DWORD Value Data*: 1 Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Command Processor batch file locking on the PAW console: Download Script: Configure-PawAuditLockbatchfiles.ps1 # Configure-PawAuditLockbatchfiles.ps1 Write-Host "Enforcing System Mitigation control: lock-batch-files..." -ForegroundColor Cyan # Set Registry value: LockBatchFilesWhenInUse if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Command Processor")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Name "LockBatchFilesWhenInUse" -Value 1 -Type DWord -Force Write-Host " Enforced LockBatchFilesWhenInUse = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditLockbatchfilesStatus.ps1 # Get-PawAuditLockbatchfilesStatus.ps1 $script:Vulnerable = $false # Audit Registry value: LockBatchFilesWhenInUse $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Name "LockBatchFilesWhenInUse" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.LockBatchFilesWhenInUse -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditLockbatchfiles.ps1 Write-Host "Enforcing System Mitigation control: lock-batch-files..." -ForegroundColor Cyan # Set Registry value: LockBatchFilesWhenInUse if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Command Processor")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Name "LockBatchFilesWhenInUse" -Value 1 -Type DWord -Force Write-Host " Enforced LockBatchFilesWhenInUse = 1" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-157](../../08-endpoints/user-profile/configure-end-up-ttd-recording.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-ttd-recording.md Privileged Access Workstations (PAWs) process the highest-value authentication secrets in the enterprise, including Kerberos Ticket Granting Tickets (TGTs), domain administrator password hashes, and directory replication metadata. Time-Travel Debugging (TTD) records complete CPU instruction sequences and process memory states into persistent .run trace files. If left unconstrained on a PAW, an adversary could weaponize TTD to harvest Tier 0 credentials without triggering traditional LSASS access alerts. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\TTD Value Name*: RecordingPolicy Value Type*: REG_DWORD Value Data*: 2 Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable Time-Travel Debugging recording on the PAW console: Download Script: Configure-PawAuditTtdrecording.ps1 # Configure-PawAuditTtdrecording.ps1 Write-Host "Enforcing System Mitigation control: ttd-recording..." -ForegroundColor Cyan # Set Registry value: RecordingPolicy if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\TTD")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Name "RecordingPolicy" -Value 2 -Type DWord -Force Write-Host " Enforced RecordingPolicy = 2" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditTtdrecordingStatus.ps1 # Get-PawAuditTtdrecordingStatus.ps1 $script:Vulnerable = $false # Audit Registry value: RecordingPolicy $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Name "RecordingPolicy" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.RecordingPolicy -ne 2) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditTtdrecording.ps1 Write-Host "Enforcing System Mitigation control: ttd-recording..." -ForegroundColor Cyan # Set Registry value: RecordingPolicy if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\TTD")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Name "RecordingPolicy" -Value 2 -Type DWord -Force Write-Host " Enforced RecordingPolicy = 2" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-158](../../08-endpoints/user-profile/configure-end-up-protected-roots.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-protected-roots.md On Privileged Access Workstations (PAWs), cryptographic trust validation is paramount. Administrative sessions connect to Domain Controllers via LDAPS, manage Active Directory Certificate Services (AD CS), authenticate via smart cards / Windows Hello for Business, and execute digitally signed PowerShell scripts. Allowing any local or interactive addition of root certificates to the PAW root store creates a catastrophic risk of rogue CA insertion, enabling transparent interception of Tier 0 authentication traffic. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots Value Name*: Flags Value Type*: REG_DWORD Value Data*: 1 Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Protected Roots certificate restrictions on the PAW console: Download Script: Configure-PawAuditProtectedroots.ps1 # Configure-PawAuditProtectedroots.ps1 Write-Host "Enforcing System Mitigation control: protected-roots..." -ForegroundColor Cyan # Set Registry value: Flags if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Name "Flags" -Value 1 -Type DWord -Force Write-Host " Enforced Flags = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditProtectedrootsStatus.ps1 # Get-PawAuditProtectedrootsStatus.ps1 $script:Vulnerable = $false # Audit Registry value: Flags $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Name "Flags" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.Flags -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditProtectedroots.ps1 Write-Host "Enforcing System Mitigation control: protected-roots..." -ForegroundColor Cyan # Set Registry value: Flags if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Name "Flags" -Value 1 -Type DWord -Force Write-Host " Enforced Flags = 1" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-159](../../08-endpoints/user-profile/configure-end-up-appinit-dlls.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-appinit-dlls.md Privileged Access Workstations (PAWs) are dedicated exclusively to administrative tasks against Tier 0 Active Directory Domain Controllers, Certificate Authorities, and identity infrastructure. In a PAW environment, the presence of legacy process injection pathways creates an unacceptable threat surface that could allow an attacker or malicious user-mode software to hook administrative tools (e.g., PowerShell, RSAT, MMC, dsa.msc, ntdsutil) and compromise Tier 0 credentials. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Value Name*: LoadAppInit_DLLs Value Type*: REG_DWORD Value Data*: 0 Create a secondary Registry Item to clear the DLL list: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Value Name*: AppInit_DLLs Value Type*: REG_SZ Value Data*: "" Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the AppInit DLL lockdown on the PAW console: Download Script: Configure-PawAuditAppinitdlls.ps1 # Configure-PawAuditAppinitdlls.ps1 Write-Host "Enforcing System Mitigation control: appinit-dlls..." -ForegroundColor Cyan # Set Registry value: LoadAppInit_DLLs if (-not (Test-Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows")) { New-Item -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Name "LoadAppInit_DLLs" -Value 0 -Type DWord -Force Write-Host " Enforced LoadAppInit_DLLs = 0" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditAppinitdllsStatus.ps1 # Get-PawAuditAppinitdllsStatus.ps1 $script:Vulnerable = $false # Audit Registry value: LoadAppInit_DLLs $RegVal = Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Name "LoadAppInit_DLLs" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.LoadAppInit_DLLs -ne 0) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditAppinitdlls.ps1 Write-Host "Enforcing System Mitigation control: appinit-dlls..." -ForegroundColor Cyan # Set Registry value: LoadAppInit_DLLs if (-not (Test-Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows")) { New-Item -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Name "LoadAppInit_DLLs" -Value 0 -Type DWord -Force Write-Host " Enforced LoadAppInit_DLLs = 0" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-160](../../08-endpoints/user-profile/configure-end-up-attachment-zone.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-attachment-zone.md Privileged Access Workstations (PAWs) are strictly isolated systems dedicated to managing Tier 0 assets. Web browsing and direct email access are prohibited on PAWs. However, administrative files, deployment scripts, security patches, and utility binaries may occasionally be transferred to PAWs via approved, encrypted management channels or staging shares. Preserving Mark-of-the-Web (MOTW) zone information ensures that the operating system's internal defense layers remain fully informed of the file's external provenance. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: User Configuration \ Administrative Templates \ Windows Components \ Attachment Manager (Optionally also navigate to `Computer Configuration \ Administrative Templates \ Windows Components \ Attachment Manager`) Configure the policy: Policy : `Do not preserve zone information in file attachments` -> Set to Disabled (Note: Setting this policy to Disabled enforces SaveZoneInformation = 2, ensuring zone information is preserved). Alternatively, configure the registry value via Group Policy Preferences: * Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item* and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments Value Name*: SaveZoneInformation Value Type*: REG_DWORD Value Data*: 2 Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce the preservation of attachment zone information on the PAW console: Download Script: Configure-PawAuditAttachmentzone.ps1 # Configure-PawAuditAttachmentzone.ps1 Write-Host "Enforcing System Mitigation control: attachment-zone..." -ForegroundColor Cyan # Set Registry value: SaveZoneInformation if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "SaveZoneInformation" -Value 2 -Type DWord -Force Write-Host " Enforced SaveZoneInformation = 2" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditAttachmentzoneStatus.ps1 # Get-PawAuditAttachmentzoneStatus.ps1 $script:Vulnerable = $false # Audit Registry value: SaveZoneInformation $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "SaveZoneInformation" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.SaveZoneInformation -ne 2) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditAttachmentzone.ps1 Write-Host "Enforcing System Mitigation control: attachment-zone..." -ForegroundColor Cyan # Set Registry value: SaveZoneInformation if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "SaveZoneInformation" -Value 2 -Type DWord -Force Write-Host " Enforced SaveZoneInformation = 2" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-161](../../08-endpoints/user-profile/configure-end-up-game-dvr.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-game-dvr.md Privileged Access Workstations (PAWs) are dedicated exclusively to managing Tier 0 Active Directory infrastructure, where administrators interact with domain controllers, certificate templates, and password vaulting solutions. Allowing consumer multimedia recording subsystems (such as Game DVR and the Windows Game Bar) to run on a PAW console creates an intolerable risk of unmonitored administrative session capture and credential exposure. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Game Recording and Broadcasting Double-click Enables or disables Windows Game Recording and Broadcasting and set it to Disabled. (Note: Setting this policy to Disabled enforces AllowGameDVR = 0). Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable Windows Game DVR on the PAW console: Download Script: Configure-PawAuditGamedvr.ps1 # Configure-PawAuditGamedvr.ps1 Write-Host "Enforcing System Mitigation control: game-dvr..." -ForegroundColor Cyan # Set Registry value: AllowGameDVR if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Value 0 -Type DWord -Force Write-Host " Enforced AllowGameDVR = 0" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditGamedvrStatus.ps1 # Get-PawAuditGamedvrStatus.ps1 $script:Vulnerable = $false # Audit Registry value: AllowGameDVR $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.AllowGameDVR -ne 0) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditGamedvr.ps1 Write-Host "Enforcing System Mitigation control: game-dvr..." -ForegroundColor Cyan # Set Registry value: AllowGameDVR if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Value 0 -Type DWord -Force Write-Host " Enforced AllowGameDVR = 0" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 Active Directory and identity infrastructure administration. (For Tier 2 Client Workstations and Member Servers, refer to baseline [REQ-END-162](../../08-endpoints/user-profile/configure-end-up-ink-workspace.md)). Operating Systems: Windows 10 Enterprise (version 1809 and above), Windows 11 Enterprise. File Path: 07-paws/user-profile/configure-paw-up-ink-workspace.md Privileged Access Workstations (PAWs) serve as the dedicated management boundary for Active Directory forest infrastructure. In a PAW environment, the interactive console must remain completely locked against unauthenticated input, secondary application launching, or cached memory viewing when not actively in use by an authenticated administrator. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to Tier 0 Privileged Access Workstations (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Ink Workspace Double-click Allow Windows Ink Workspace and configure: Select Enabled In the Options drop-down menu, select: On, but disallow access above lock Link the GPO to the dedicated PAW Organizational Unit and enforce replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to restrict Windows Ink Workspace access above the lock screen on the PAW console: Download Script: Configure-PawAuditInkworkspace.ps1 # Configure-PawAuditInkworkspace.ps1 Write-Host "Enforcing System Mitigation control: ink-workspace..." -ForegroundColor Cyan # Set Registry value: AllowWindowsInkWorkspace if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Name "AllowWindowsInkWorkspace" -Value 1 -Type DWord -Force Write-Host " Enforced AllowWindowsInkWorkspace = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditInkworkspaceStatus.ps1 # Get-PawAuditInkworkspaceStatus.ps1 $script:Vulnerable = $false # Audit Registry value: AllowWindowsInkWorkspace $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Name "AllowWindowsInkWorkspace" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.AllowWindowsInkWorkspace -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditInkworkspace.ps1 Write-Host "Enforcing System Mitigation control: ink-workspace..." -ForegroundColor Cyan # Set Registry value: AllowWindowsInkWorkspace if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Name "AllowWindowsInkWorkspace" -Value 1 -Type DWord -Force Write-Host " Enforced AllowWindowsInkWorkspace = 1" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-037](../../08-endpoints/services/disable-browser.md); for Domain Controllers, refer to [REQ-DC-016](../../02-domain-controllers/disable-smbv1.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-browser.md The Computer Browser service (Browser, driven by the kernel driver bowser.sys) maintains an inventory of network servers and domains across local network segments using unauthenticated NetBIOS over TCP/IP (NetBT) broadcast frames and legacy Server Message Block version 1 (SMBv1) protocol datagrams. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Computer Browser (Browser), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawBrowser.ps1 # Configure-DisablePawBrowser.ps1 # Description: Disables the unnecessary Computer Browser (Browser) service on the local PAW. Write-Host "Applying hardening requirement: Disable Computer Browser service on PAW..." -ForegroundColor Cyan $ServiceName = "Browser" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawBrowserStatus.ps1 # Get-PawBrowserStatus.ps1 # Description: Audits the startup configuration of Computer Browser (Browser) service on the local PAW system. Write-Host "--- Auditing Computer Browser (Browser) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "Browser" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawBrowser.ps1 # Description: Disables the unnecessary Computer Browser (Browser) service on the local PAW. Write-Host "Applying hardening requirement: Disable Computer Browser service on PAW..." -ForegroundColor Cyan $ServiceName = "Browser" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 client workstations and member servers, refer to baseline [REQ-END-038](../../08-endpoints/services/disable-irmon.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/services/disable-irmon.md The Infrared Monitor Service (irmon, hosted within svchost.exe via irmon.dll) provides management and discovery functions for the legacy Infrared Data Association (IrDA) optical protocol stack and Object Exchange (OBEX) protocol. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Infrared monitor service (irmon), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawirmon.ps1 # Configure-DisablePawirmon.ps1 # Description: Disables the unnecessary Infrared monitor service (irmon) service on the local PAW. Write-Host "Applying hardening requirement: Disable Infrared monitor service service on PAW..." -ForegroundColor Cyan $ServiceName = "irmon" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawirmonStatus.ps1 # Get-PawirmonStatus.ps1 # Description: Audits the startup configuration of Infrared monitor service (irmon) service on the local PAW system. Write-Host "--- Auditing Infrared monitor service (irmon) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "irmon" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawirmon.ps1 # Description: Disables the unnecessary Infrared monitor service (irmon) service on the local PAW. Write-Host "Applying hardening requirement: Disable Infrared monitor service service on PAW..." -ForegroundColor Cyan $ServiceName = "irmon" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-039](../../08-endpoints/services/disable-sharedaccess.md); for Domain Controllers, refer to [REQ-DC-044](../../02-domain-controllers/services/disable-sharedaccess.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-sharedaccess.md The Internet Connection Sharing service (SharedAccess / ICS) provides Network Address Translation (NAT), dynamic addressing (embedded DHCP server), and name resolution (DNS proxy) capabilities. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Internet Connection Sharing (ICS) (SharedAccess), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawSharedAccess.ps1 # Configure-DisablePawSharedAccess.ps1 # Description: Disables the unnecessary Internet Connection Sharing (ICS) (SharedAccess) service on the local PAW. Write-Host "Applying hardening requirement: Disable Internet Connection Sharing (ICS) service on PAW..." -ForegroundColor Cyan $ServiceName = "SharedAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawSharedAccessStatus.ps1 # Get-PawSharedAccessStatus.ps1 # Description: Audits the startup configuration of Internet Connection Sharing (ICS) (SharedAccess) service on the local PAW system. Write-Host "--- Auditing Internet Connection Sharing (ICS) (SharedAccess) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "SharedAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawSharedAccess.ps1 # Description: Disables the unnecessary Internet Connection Sharing (ICS) (SharedAccess) service on the local PAW. Write-Host "Applying hardening requirement: Disable Internet Connection Sharing (ICS) service on PAW..." -ForegroundColor Cyan $ServiceName = "SharedAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-040](../../08-endpoints/services/disable-lxssmanager.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-lxssmanager.md The Windows Subsystem for Linux (WSL) service (LxssManager) manages the lifecycle, execution, and resource allocation of Linux distributions within Windows, utilizing syscall translation or lightweight Hyper-V micro-virtual machines. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate LxssManager (LxssManager), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawLxssManager.ps1 # Configure-DisablePawLxssManager.ps1 # Description: Disables the unnecessary LxssManager (LxssManager) service on the local PAW. Write-Host "Applying hardening requirement: Disable LxssManager service on PAW..." -ForegroundColor Cyan $ServiceName = "LxssManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawLxssManagerStatus.ps1 # Get-PawLxssManagerStatus.ps1 # Description: Audits the startup configuration of LxssManager (LxssManager) service on the local PAW system. Write-Host "--- Auditing LxssManager (LxssManager) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "LxssManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawLxssManager.ps1 # Description: Disables the unnecessary LxssManager (LxssManager) service on the local PAW. Write-Host "Applying hardening requirement: Disable LxssManager service on PAW..." -ForegroundColor Cyan $ServiceName = "LxssManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-041](../../08-endpoints/services/disable-ftpsvc.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-ftpsvc.md The Microsoft FTP Service (FTPSVC) is an IIS server component that provides File Transfer Protocol (FTP) hosting services over TCP port 21. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Microsoft FTP Service (FTPSVC), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawFTPSVC.ps1 # Configure-DisablePawFTPSVC.ps1 # Description: Disables the unnecessary Microsoft FTP Service (FTPSVC) service on the local PAW. Write-Host "Applying hardening requirement: Disable Microsoft FTP Service service on PAW..." -ForegroundColor Cyan $ServiceName = "FTPSVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawFTPSVCStatus.ps1 # Get-PawFTPSVCStatus.ps1 # Description: Audits the startup configuration of Microsoft FTP Service (FTPSVC) service on the local PAW system. Write-Host "--- Auditing Microsoft FTP Service (FTPSVC) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "FTPSVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawFTPSVC.ps1 # Description: Disables the unnecessary Microsoft FTP Service (FTPSVC) service on the local PAW. Write-Host "Applying hardening requirement: Disable Microsoft FTP Service service on PAW..." -ForegroundColor Cyan $ServiceName = "FTPSVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-042](../../08-endpoints/services/disable-sshd.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-sshd.md The OpenSSH SSH Server service (sshd) provides inbound secure shell access, remote command-line session hosting, and secure file transfer (SFTP/SCP) over TCP port 22. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate OpenSSH SSH Server (sshd), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawsshd.ps1 # Configure-DisablePawsshd.ps1 # Description: Disables the unnecessary OpenSSH SSH Server (sshd) service on the local PAW. Write-Host "Applying hardening requirement: Disable OpenSSH SSH Server service on PAW..." -ForegroundColor Cyan $ServiceName = "sshd" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawsshdStatus.ps1 # Get-PawsshdStatus.ps1 # Description: Audits the startup configuration of OpenSSH SSH Server (sshd) service on the local PAW system. Write-Host "--- Auditing OpenSSH SSH Server (sshd) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "sshd" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawsshd.ps1 # Description: Disables the unnecessary OpenSSH SSH Server (sshd) service on the local PAW. Write-Host "Applying hardening requirement: Disable OpenSSH SSH Server service on PAW..." -ForegroundColor Cyan $ServiceName = "sshd" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-043](../../08-endpoints/services/disable-rpclocator.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-rpclocator.md The Remote Procedure Call (RPC) Locator service (RpcLocator) manages the legacy RPC name service database, historically used in pre-Windows 2000 architectures to locate RPC server interfaces. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Remote Procedure Call (RPC) Locator (RpcLocator), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawRpcLocator.ps1 # Configure-DisablePawRpcLocator.ps1 # Description: Disables the unnecessary Remote Procedure Call (RPC) Locator (RpcLocator) service on the local PAW. Write-Host "Applying hardening requirement: Disable Remote Procedure Call (RPC) Locator service on PAW..." -ForegroundColor Cyan $ServiceName = "RpcLocator" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawRpcLocatorStatus.ps1 # Get-PawRpcLocatorStatus.ps1 # Description: Audits the startup configuration of Remote Procedure Call (RPC) Locator (RpcLocator) service on the local PAW system. Write-Host "--- Auditing Remote Procedure Call (RPC) Locator (RpcLocator) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "RpcLocator" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawRpcLocator.ps1 # Description: Disables the unnecessary Remote Procedure Call (RPC) Locator (RpcLocator) service on the local PAW. Write-Host "Applying hardening requirement: Disable Remote Procedure Call (RPC) Locator service on PAW..." -ForegroundColor Cyan $ServiceName = "RpcLocator" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-044](../../08-endpoints/services/disable-remoteaccess.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-remoteaccess.md The Routing and Remote Access Service (RemoteAccess / RRAS) provides software-based packet routing, Network Address Translation (NAT), and incoming VPN server termination capabilities. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Routing and Remote Access (RemoteAccess), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawRemoteAccess.ps1 # Configure-DisablePawRemoteAccess.ps1 # Description: Disables the unnecessary Routing and Remote Access (RemoteAccess) service on the local PAW. Write-Host "Applying hardening requirement: Disable Routing and Remote Access service on PAW..." -ForegroundColor Cyan $ServiceName = "RemoteAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawRemoteAccessStatus.ps1 # Get-PawRemoteAccessStatus.ps1 # Description: Audits the startup configuration of Routing and Remote Access (RemoteAccess) service on the local PAW system. Write-Host "--- Auditing Routing and Remote Access (RemoteAccess) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "RemoteAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawRemoteAccess.ps1 # Description: Disables the unnecessary Routing and Remote Access (RemoteAccess) service on the local PAW. Write-Host "Applying hardening requirement: Disable Routing and Remote Access service on PAW..." -ForegroundColor Cyan $ServiceName = "RemoteAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-045](../../08-endpoints/services/disable-simptcp.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-simptcp.md The Simple TCP/IP Services (simptcp) implement a suite of legacy diagnostic protocols (Echo, Discard, Character Generator, Daytime, and Quote of the Day) operating across 10 distinct TCP and UDP network ports. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Simple TCP/IP Services (simptcp), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawsimptcp.ps1 # Configure-DisablePawsimptcp.ps1 # Description: Disables the unnecessary Simple TCP/IP Services (simptcp) service on the local PAW. Write-Host "Applying hardening requirement: Disable Simple TCP/IP Services service on PAW..." -ForegroundColor Cyan $ServiceName = "simptcp" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawsimptcpStatus.ps1 # Get-PawsimptcpStatus.ps1 # Description: Audits the startup configuration of Simple TCP/IP Services (simptcp) service on the local PAW system. Write-Host "--- Auditing Simple TCP/IP Services (simptcp) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "simptcp" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawsimptcp.ps1 # Description: Disables the unnecessary Simple TCP/IP Services (simptcp) service on the local PAW. Write-Host "Applying hardening requirement: Disable Simple TCP/IP Services service on PAW..." -ForegroundColor Cyan $ServiceName = "simptcp" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-046](../../08-endpoints/services/disable-sacsvr.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-sacsvr.md The Special Administration Console (SAC) Helper service (sacsvr) facilitates Emergency Management Services (EMS), an out-of-band administrative console subsystem engineered for headless enterprise server hardware to enable text-based diagnostic access over physical or virtual serial (COM) ports. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Special Administration Console Helper (sacsvr), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawsacsvr.ps1 # Configure-DisablePawsacsvr.ps1 # Description: Disables the unnecessary Special Administration Console Helper (sacsvr) service on the local PAW. Write-Host "Applying hardening requirement: Disable Special Administration Console Helper service on PAW..." -ForegroundColor Cyan $ServiceName = "sacsvr" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawsacsvrStatus.ps1 # Get-PawsacsvrStatus.ps1 # Description: Audits the startup configuration of Special Administration Console Helper (sacsvr) service on the local PAW system. Write-Host "--- Auditing Special Administration Console Helper (sacsvr) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "sacsvr" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawsacsvr.ps1 # Description: Disables the unnecessary Special Administration Console Helper (sacsvr) service on the local PAW. Write-Host "Applying hardening requirement: Disable Special Administration Console Helper service on PAW..." -ForegroundColor Cyan $ServiceName = "sacsvr" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-047](../../08-endpoints/services/disable-ssdpsrv.md); for Domain Controllers, refer to [REQ-DC-060](../../02-domain-controllers/services/disable-ssdpsrv.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-ssdpsrv.md The Simple Service Discovery Protocol (SSDP) Discovery service (SSDPSRV) listens on UDP port 1900 multicast (239.255.255.250 for IPv4 and [FF02::C] / [FF05::C] for IPv6) to discover Universal Plug and Play (UPnP) networked devices such as consumer printers, media renderers, and smart appliances. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate SSDP Discovery (SSDPSRV), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawSSDPSRV.ps1 # Configure-DisablePawSSDPSRV.ps1 # Description: Disables the unnecessary SSDP Discovery (SSDPSRV) service on the local PAW. Write-Host "Applying hardening requirement: Disable SSDP Discovery service on PAW..." -ForegroundColor Cyan $ServiceName = "SSDPSRV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawSSDPSRVStatus.ps1 # Get-PawSSDPSRVStatus.ps1 # Description: Audits the startup configuration of SSDP Discovery (SSDPSRV) service on the local PAW system. Write-Host "--- Auditing SSDP Discovery (SSDPSRV) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "SSDPSRV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawSSDPSRV.ps1 # Description: Disables the unnecessary SSDP Discovery (SSDPSRV) service on the local PAW. Write-Host "Applying hardening requirement: Disable SSDP Discovery service on PAW..." -ForegroundColor Cyan $ServiceName = "SSDPSRV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-048](../../08-endpoints/services/disable-upnphost.md); for Domain Controllers, refer to [REQ-DC-063](../../02-domain-controllers/services/disable-upnphost.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-upnphost.md The UPnP Device Host service (upnphost) allows a host to configure, announce, and expose dynamic Universal Plug and Play (UPnP) devices and control points to the local area network over unauthenticated HTTP endpoints. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate UPnP Device Host (upnphost), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawupnphost.ps1 # Configure-DisablePawupnphost.ps1 # Description: Disables the unnecessary UPnP Device Host (upnphost) service on the local PAW. Write-Host "Applying hardening requirement: Disable UPnP Device Host service on PAW..." -ForegroundColor Cyan $ServiceName = "upnphost" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawupnphostStatus.ps1 # Get-PawupnphostStatus.ps1 # Description: Audits the startup configuration of UPnP Device Host (upnphost) service on the local PAW system. Write-Host "--- Auditing UPnP Device Host (upnphost) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "upnphost" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawupnphost.ps1 # Description: Disables the unnecessary UPnP Device Host (upnphost) service on the local PAW. Write-Host "Applying hardening requirement: Disable UPnP Device Host service on PAW..." -ForegroundColor Cyan $ServiceName = "upnphost" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-049](../../08-endpoints/services/disable-wmsvc.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-wmsvc.md The Web Management Service (WMSvc) enables remote web server management for Internet Information Services (IIS), listening for incoming remote connections over HTTPS TCP port 8172. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Web Management Service (WMSvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawWMSvc.ps1 # Configure-DisablePawWMSvc.ps1 # Description: Disables the unnecessary Web Management Service (WMSvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Web Management Service service on PAW..." -ForegroundColor Cyan $ServiceName = "WMSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawWMSvcStatus.ps1 # Get-PawWMSvcStatus.ps1 # Description: Audits the startup configuration of Web Management Service (WMSvc) service on the local PAW system. Write-Host "--- Auditing Web Management Service (WMSvc) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "WMSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawWMSvc.ps1 # Description: Disables the unnecessary Web Management Service (WMSvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Web Management Service service on PAW..." -ForegroundColor Cyan $ServiceName = "WMSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 client workstations and member servers, refer to baseline [REQ-END-050](../../08-endpoints/services/disable-wmpnetworksvc.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/services/disable-wmpnetworksvc.md The Windows Media Player Network Sharing Service (WMPNetworkSvc, hosted by wmpnetwk.exe or svchost.exe) shares local Windows Media Player multimedia libraries across the network using Universal Plug and Play (UPnP) and Digital Living Network Alliance (DLNA) protocols. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Windows Media Player Network Sharing Service (WMPNetworkSvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawWMPNetworkSvc.ps1 # Configure-DisablePawWMPNetworkSvc.ps1 # Description: Disables the unnecessary Windows Media Player Network Sharing Service (WMPNetworkSvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Windows Media Player Network Sharing Service service on PAW..." -ForegroundColor Cyan $ServiceName = "WMPNetworkSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawWMPNetworkSvcStatus.ps1 # Get-PawWMPNetworkSvcStatus.ps1 # Description: Audits the startup configuration of Windows Media Player Network Sharing Service (WMPNetworkSvc) service on the local PAW system. Write-Host "--- Auditing Windows Media Player Network Sharing Service (WMPNetworkSvc) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "WMPNetworkSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawWMPNetworkSvc.ps1 # Description: Disables the unnecessary Windows Media Player Network Sharing Service (WMPNetworkSvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Windows Media Player Network Sharing Service service on PAW..." -ForegroundColor Cyan $ServiceName = "WMPNetworkSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-051](../../08-endpoints/services/disable-icssvc.md); for Domain Controllers, refer to [REQ-DC-072](../../02-domain-controllers/services/disable-icssvc.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-icssvc.md The Windows Mobile Hotspot Service (icssvc) manages software-based wireless access point (SoftAP) hosting and network tethering features. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Windows Mobile Hotspot Service (icssvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawicssvc.ps1 # Configure-DisablePawicssvc.ps1 # Description: Disables the unnecessary Windows Mobile Hotspot Service (icssvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Windows Mobile Hotspot Service service on PAW..." -ForegroundColor Cyan $ServiceName = "icssvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawicssvcStatus.ps1 # Get-PawicssvcStatus.ps1 # Description: Audits the startup configuration of Windows Mobile Hotspot Service (icssvc) service on the local PAW system. Write-Host "--- Auditing Windows Mobile Hotspot Service (icssvc) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "icssvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawicssvc.ps1 # Description: Disables the unnecessary Windows Mobile Hotspot Service (icssvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Windows Mobile Hotspot Service service on PAW..." -ForegroundColor Cyan $ServiceName = "icssvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-052](../../08-endpoints/services/disable-w3svc.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-w3svc.md The World Wide Web Publishing Service (W3SVC) is the core engine for Internet Information Services (IIS), responsible for managing HTTP/HTTPS listeners, routing requests to w3wp.exe worker processes, and hosting web applications. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate World Wide Web Publishing Service (W3SVC), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawW3SVC.ps1 # Configure-DisablePawW3SVC.ps1 # Description: Disables the unnecessary World Wide Web Publishing Service (W3SVC) service on the local PAW. Write-Host "Applying hardening requirement: Disable World Wide Web Publishing Service service on PAW..." -ForegroundColor Cyan $ServiceName = "W3SVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawW3SVCStatus.ps1 # Get-PawW3SVCStatus.ps1 # Description: Audits the startup configuration of World Wide Web Publishing Service (W3SVC) service on the local PAW system. Write-Host "--- Auditing World Wide Web Publishing Service (W3SVC) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "W3SVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawW3SVC.ps1 # Description: Disables the unnecessary World Wide Web Publishing Service (W3SVC) service on the local PAW. Write-Host "Applying hardening requirement: Disable World Wide Web Publishing Service service on PAW..." -ForegroundColor Cyan $ServiceName = "W3SVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 client workstations and member servers, refer to baseline [REQ-END-053](../../08-endpoints/services/disable-xboxgipsvc.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/services/disable-xboxgipsvc.md The Xbox Accessory Management Service (XboxGipSvc, hosted in svchost.exe via XboxGipSvc.dll) manages Xbox gamepads, wireless gaming dongles, and consumer gaming accessories by interfacing directly with the Xbox Game Input Protocol (GIP) driver stack (xboxgip.sys). Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Xbox Accessory Management Service (XboxGipSvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawXboxGipSvc.ps1 # Configure-DisablePawXboxGipSvc.ps1 # Description: Disables the unnecessary Xbox Accessory Management Service (XboxGipSvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Xbox Accessory Management Service service on PAW..." -ForegroundColor Cyan $ServiceName = "XboxGipSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawXboxGipSvcStatus.ps1 # Get-PawXboxGipSvcStatus.ps1 # Description: Audits the startup configuration of Xbox Accessory Management Service (XboxGipSvc) service on the local PAW system. Write-Host "--- Auditing Xbox Accessory Management Service (XboxGipSvc) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "XboxGipSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawXboxGipSvc.ps1 # Description: Disables the unnecessary Xbox Accessory Management Service (XboxGipSvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Xbox Accessory Management Service service on PAW..." -ForegroundColor Cyan $ServiceName = "XboxGipSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 client workstations and member servers, refer to baseline [REQ-END-054](../../08-endpoints/services/disable-xblauthmanager.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/services/disable-xblauthmanager.md The Xbox Live Auth Manager (XblAuthManager, hosted in svchost.exe via XblAuthManager.dll) provides programmatic token brokering and identity authentication services for consumer Microsoft Accounts (MSA) and the Xbox Live ecosystem. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Xbox Live Auth Manager (XblAuthManager), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawXblAuthManager.ps1 # Configure-DisablePawXblAuthManager.ps1 # Description: Disables the unnecessary Xbox Live Auth Manager (XblAuthManager) service on the local PAW. Write-Host "Applying hardening requirement: Disable Xbox Live Auth Manager service on PAW..." -ForegroundColor Cyan $ServiceName = "XblAuthManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawXblAuthManagerStatus.ps1 # Get-PawXblAuthManagerStatus.ps1 # Description: Audits the startup configuration of Xbox Live Auth Manager (XblAuthManager) service on the local PAW system. Write-Host "--- Auditing Xbox Live Auth Manager (XblAuthManager) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "XblAuthManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawXblAuthManager.ps1 # Description: Disables the unnecessary Xbox Live Auth Manager (XblAuthManager) service on the local PAW. Write-Host "Applying hardening requirement: Disable Xbox Live Auth Manager service on PAW..." -ForegroundColor Cyan $ServiceName = "XblAuthManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 client workstations and member servers, refer to baseline [REQ-END-055](../../08-endpoints/services/disable-xblgamesave.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/services/disable-xblgamesave.md The Xbox Live Game Save Service (XblGameSave, hosted in svchost.exe via XblGameSave.dll) performs background synchronization of game save containers and application state to Microsoft Xbox Live consumer cloud infrastructure. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Xbox Live Game Save (XblGameSave), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawXblGameSave.ps1 # Configure-DisablePawXblGameSave.ps1 # Description: Disables the unnecessary Xbox Live Game Save (XblGameSave) service on the local PAW. Write-Host "Applying hardening requirement: Disable Xbox Live Game Save service on PAW..." -ForegroundColor Cyan $ServiceName = "XblGameSave" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawXblGameSaveStatus.ps1 # Get-PawXblGameSaveStatus.ps1 # Description: Audits the startup configuration of Xbox Live Game Save (XblGameSave) service on the local PAW system. Write-Host "--- Auditing Xbox Live Game Save (XblGameSave) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "XblGameSave" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawXblGameSave.ps1 # Description: Disables the unnecessary Xbox Live Game Save (XblGameSave) service on the local PAW. Write-Host "Applying hardening requirement: Disable Xbox Live Game Save service on PAW..." -ForegroundColor Cyan $ServiceName = "XblGameSave" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Tier 2 client workstations and member servers, refer to baseline [REQ-END-056](../../08-endpoints/services/disable-xboxnetapisvc.md)). Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise. File Path: 07-paws/services/disable-xboxnetapisvc.md The Xbox Live Networking Service (XboxNetApiSvc, hosted in svchost.exe via XboxNetApiSvc.dll) provides network interface abstraction, peer-to-peer session negotiation, and Teredo NAT traversal tunneling for consumer gaming applications. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Xbox Live Networking Service (XboxNetApiSvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawXboxNetApiSvc.ps1 # Configure-DisablePawXboxNetApiSvc.ps1 # Description: Disables the unnecessary Xbox Live Networking Service (XboxNetApiSvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Xbox Live Networking Service service on PAW..." -ForegroundColor Cyan $ServiceName = "XboxNetApiSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service on the PAW: Download Script: Get-PawXboxNetApiSvcStatus.ps1 # Get-PawXboxNetApiSvcStatus.ps1 # Description: Audits the startup configuration of Xbox Live Networking Service (XboxNetApiSvc) service on the local PAW system. Write-Host "--- Auditing Xbox Live Networking Service (XboxNetApiSvc) Service on PAW ---" -ForegroundColor Cyan $ServiceName = "XboxNetApiSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawXboxNetApiSvc.ps1 # Description: Disables the unnecessary Xbox Live Networking Service (XboxNetApiSvc) service on the local PAW. Write-Host "Applying hardening requirement: Disable Xbox Live Networking Service service on PAW..." -ForegroundColor Cyan $ServiceName = "XboxNetApiSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For standard client workstations and member servers, refer to baseline [REQ-END-177](../../08-endpoints/services/disable-webclient.md); for Domain Controllers, refer to [REQ-DC-146](../../02-domain-controllers/services/disable-webclient.md)). Operating Systems: Windows 10 Enterprise (all supported builds) and Windows 11 Enterprise. File Path: 07-paws/services/disable-webclient.md The WebClient service (WebClient, driven by davclnt.sys) handles Web Distributed Authoring and Versioning (WebDAV) file requests over HTTP and HTTPS. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the PAW GPO (e.g., GPO_Hardening_PAW). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate WebClient, double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisablePawWebClient.ps1 # Configure-DisablePawWebClient.ps1 # Description: Disables the unnecessary WebClient service on the local PAW system. Write-Host "Applying hardening requirement: Disable WebClient service on PAW..." -ForegroundColor Cyan $ServiceName = "WebClient" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup configuration of the WebClient service on the PAW: Download Script: Get-PawWebClientStatus.ps1 # Get-PawWebClientStatus.ps1 # Description: Audits the startup configuration of the WebClient service on the local PAW system. Write-Host "--- Auditing WebClient Service on PAW ---" -ForegroundColor Cyan $ServiceName = "WebClient" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisablePawWebClient.ps1 # Description: Disables the unnecessary WebClient service on the local PAW system. Write-Host "Applying hardening requirement: Disable WebClient service on PAW..." -ForegroundColor Cyan $ServiceName = "WebClient" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/audit-policy/configure-paw-audit-audit-override.md Enforcing advanced audit policy overrides prevents legacy category settings from overriding refined subcategory policies, and disabling verbose Kerberos logging ensures that event logs are not flooded with diagnostic events. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Registry: HKLM\System\CurrentControlSet\Control\Lsa\ SCENoApplyLegacyAuditPolicy = 1 (DWord) * Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\ LogLevel = 0 (DWord) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAuditAuditoverride.ps1 # Configure-PawAuditAuditoverride.ps1 Write-Host "Applying Audit Policy category: audit-override..." -ForegroundColor Cyan # Set Registry Override: SCENoApplyLegacyAuditPolicy if (-not (Test-Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa")) { New-Item -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -Value 1 -Type DWord -Force Write-Host " Enforced SCENoApplyLegacyAuditPolicy = 1" -ForegroundColor Green # Set Registry Override: LogLevel if (-not (Test-Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters")) { New-Item -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "LogLevel" -Value 0 -Type DWord -Force Write-Host " Enforced LogLevel = 0" -ForegroundColor Green To audit the hardening status: Download Script: Get-PawAuditAuditoverrideStatus.ps1 # Get-PawAuditAuditoverrideStatus.ps1 $script:Vulnerable = $false # Audit Registry: SCENoApplyLegacyAuditPolicy $RegVal = Get-ItemProperty -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.SCENoApplyLegacyAuditPolicy -ne 1) { $script:Vulnerable = $true } # Audit Registry: LogLevel $RegVal = Get-ItemProperty -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "LogLevel" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.LogLevel -ne 0) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditAuditoverride.ps1 Write-Host "Applying Audit Policy category: audit-override..." -ForegroundColor Cyan # Set Registry Override: SCENoApplyLegacyAuditPolicy if (-not (Test-Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa")) { New-Item -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -Value 1 -Type DWord -Force Write-Host " Enforced SCENoApplyLegacyAuditPolicy = 1" -ForegroundColor Green # Set Registry Override: LogLevel if (-not (Test-Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters")) { New-Item -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "LogLevel" -Value 0 -Type DWord -Force Write-Host " Enforced LogLevel = 0" -ForegroundColor Green Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/audit-policy/configure-paw-audit-account-logon.md Auditing account logon events captures authentication requests processed by the local system or the workstation, which is critical for identifying Kerberoasting, NTLM relaying, and brute-force attempts. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Credential Validation -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAuditAccountlogon.ps1 # Configure-PawAuditAccountlogon.ps1 Write-Host "Applying Audit Policy category: account-logon..." -ForegroundColor Cyan # Set Audit Subcategory: Credential Validation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Credential Validation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Credential Validation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Credential Validation. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-PawAuditAccountlogonStatus.ps1 # Get-PawAuditAccountlogonStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Credential Validation $RawOutput = auditpol.exe /get /subcategory:"Credential Validation" /r if ($RawOutput -notmatch ",Credential Validation,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditAccountlogon.ps1 Write-Host "Applying Audit Policy category: account-logon..." -ForegroundColor Cyan # Set Audit Subcategory: Credential Validation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Credential Validation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Credential Validation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Credential Validation. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/audit-policy/configure-paw-audit-account-management.md Auditing account management logs security principal modifications (creations, deletions, password resets, group modifications) to detect privilege escalation attempts on domain or local administrative groups. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: User Account Management -> Success and Failure * Subcategory: Security Group Management -> Success and Failure * Subcategory: Computer Account Management -> Success and Failure * Subcategory: Other Account Management Events -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAuditAccountmanagement.ps1 # Configure-PawAuditAccountmanagement.ps1 Write-Host "Applying Audit Policy category: account-management..." -ForegroundColor Cyan # Set Audit Subcategory: User Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"User Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory User Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory User Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security Group Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Computer Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Computer Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Computer Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Computer Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Account Management Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Account Management Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Account Management Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Account Management Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-PawAuditAccountmanagementStatus.ps1 # Get-PawAuditAccountmanagementStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: User Account Management $RawOutput = auditpol.exe /get /subcategory:"User Account Management" /r if ($RawOutput -notmatch ",User Account Management,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Security Group Management $RawOutput = auditpol.exe /get /subcategory:"Security Group Management" /r if ($RawOutput -notmatch ",Security Group Management,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Computer Account Management $RawOutput = auditpol.exe /get /subcategory:"Computer Account Management" /r if ($RawOutput -notmatch ",Computer Account Management,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other Account Management Events $RawOutput = auditpol.exe /get /subcategory:"Other Account Management Events" /r if ($RawOutput -notmatch ",Other Account Management Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditAccountmanagement.ps1 Write-Host "Applying Audit Policy category: account-management..." -ForegroundColor Cyan # Set Audit Subcategory: User Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"User Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory User Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory User Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security Group Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Computer Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Computer Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Computer Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Computer Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Account Management Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Account Management Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Account Management Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Account Management Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/audit-policy/configure-paw-audit-detailed-tracking.md Detailed tracking records process creations and device arrivals to ensure EDR/SIEM visibility into executable command lines and hardware plug events. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Process Creation -> Success and Failure * Subcategory: DPAPI Activity -> Success and Failure * Subcategory: PNP Activity -> Success Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAuditDetailedtracking.ps1 # Configure-PawAuditDetailedtracking.ps1 Write-Host "Applying Audit Policy category: detailed-tracking..." -ForegroundColor Cyan # Set Audit Subcategory: Process Creation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Process Creation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Process Creation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Process Creation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: DPAPI Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"DPAPI Activity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory DPAPI Activity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory DPAPI Activity. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: PNP Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"PNP Activity`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory PNP Activity to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory PNP Activity. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-PawAuditDetailedtrackingStatus.ps1 # Get-PawAuditDetailedtrackingStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Process Creation $RawOutput = auditpol.exe /get /subcategory:"Process Creation" /r if ($RawOutput -notmatch ",Process Creation,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: DPAPI Activity $RawOutput = auditpol.exe /get /subcategory:"DPAPI Activity" /r if ($RawOutput -notmatch ",DPAPI Activity,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: PNP Activity $RawOutput = auditpol.exe /get /subcategory:"PNP Activity" /r if ($RawOutput -notmatch ",PNP Activity,.*,Success") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditDetailedtracking.ps1 Write-Host "Applying Audit Policy category: detailed-tracking..." -ForegroundColor Cyan # Set Audit Subcategory: Process Creation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Process Creation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Process Creation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Process Creation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: DPAPI Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"DPAPI Activity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory DPAPI Activity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory DPAPI Activity. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: PNP Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"PNP Activity`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory PNP Activity to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory PNP Activity. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/audit-policy/configure-paw-audit-logon-logoff.md Auditing logon/logoff events monitors administrative session states, special elevations, and failed logon attempts, which is critical for finding unauthorized remote access or lateral movement. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Logon -> Success and Failure * Subcategory: Logoff -> Success * Subcategory: Special Logon -> Success and Failure * Subcategory: Account Lockout -> Success and Failure * Subcategory: Other Logon/Logoff Events -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAuditLogonlogoff.ps1 # Configure-PawAuditLogonlogoff.ps1 Write-Host "Applying Audit Policy category: logon-logoff..." -ForegroundColor Cyan # Set Audit Subcategory: Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Logoff $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logoff`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logoff to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logoff. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Special Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Special Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Special Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Special Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Account Lockout $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Account Lockout`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Account Lockout to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Account Lockout. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Logon/Logoff Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Logon/Logoff Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Logon/Logoff Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Logon/Logoff Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-PawAuditLogonlogoffStatus.ps1 # Get-PawAuditLogonlogoffStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Logon $RawOutput = auditpol.exe /get /subcategory:"Logon" /r if ($RawOutput -notmatch ",Logon,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Logoff $RawOutput = auditpol.exe /get /subcategory:"Logoff" /r if ($RawOutput -notmatch ",Logoff,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: Special Logon $RawOutput = auditpol.exe /get /subcategory:"Special Logon" /r if ($RawOutput -notmatch ",Special Logon,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Account Lockout $RawOutput = auditpol.exe /get /subcategory:"Account Lockout" /r if ($RawOutput -notmatch ",Account Lockout,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other Logon/Logoff Events $RawOutput = auditpol.exe /get /subcategory:"Other Logon/Logoff Events" /r if ($RawOutput -notmatch ",Other Logon/Logoff Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditLogonlogoff.ps1 Write-Host "Applying Audit Policy category: logon-logoff..." -ForegroundColor Cyan # Set Audit Subcategory: Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Logoff $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logoff`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logoff to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logoff. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Special Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Special Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Special Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Special Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Account Lockout $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Account Lockout`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Account Lockout to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Account Lockout. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Logon/Logoff Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Logon/Logoff Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Logon/Logoff Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Logon/Logoff Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/audit-policy/configure-paw-audit-object-access.md Auditing object access (files, registry keys, and shares) helps monitor unauthorized modifications to system configuration files and access to restricted shares. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Handle Manipulation -> Success and Failure * Subcategory: Registry -> Success and Failure * Subcategory: File Share -> Success and Failure * Subcategory: Detailed File Share -> Failure * Subcategory: Other Object Access Events -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAuditObjectaccess.ps1 # Configure-PawAuditObjectaccess.ps1 Write-Host "Applying Audit Policy category: object-access..." -ForegroundColor Cyan # Set Audit Subcategory: Handle Manipulation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Handle Manipulation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Handle Manipulation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Handle Manipulation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Registry $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Registry`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Registry to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Registry. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"File Share`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory File Share to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Detailed File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Detailed File Share`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Detailed File Share to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Detailed File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Object Access Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Object Access Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Object Access Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Object Access Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-PawAuditObjectaccessStatus.ps1 # Get-PawAuditObjectaccessStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Handle Manipulation $RawOutput = auditpol.exe /get /subcategory:"Handle Manipulation" /r if ($RawOutput -notmatch ",Handle Manipulation,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Registry $RawOutput = auditpol.exe /get /subcategory:"Registry" /r if ($RawOutput -notmatch ",Registry,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: File Share $RawOutput = auditpol.exe /get /subcategory:"File Share" /r if ($RawOutput -notmatch ",File Share,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Detailed File Share $RawOutput = auditpol.exe /get /subcategory:"Detailed File Share" /r if ($RawOutput -notmatch ",Detailed File Share,.*,Failure") { $script:Vulnerable = $true } # Audit Subcategory: Other Object Access Events $RawOutput = auditpol.exe /get /subcategory:"Other Object Access Events" /r if ($RawOutput -notmatch ",Other Object Access Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditObjectaccess.ps1 Write-Host "Applying Audit Policy category: object-access..." -ForegroundColor Cyan # Set Audit Subcategory: Handle Manipulation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Handle Manipulation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Handle Manipulation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Handle Manipulation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Registry $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Registry`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Registry to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Registry. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"File Share`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory File Share to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Detailed File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Detailed File Share`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Detailed File Share to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Detailed File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Object Access Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Object Access Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Object Access Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Object Access Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/audit-policy/configure-paw-audit-policy-change.md Auditing policy changes tracks attempts to modify authorization policies, auditing configuration changes, or firewall rule alterations to hide adversarial tracks. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Policy Change -> Success and Failure * Subcategory: Authentication Policy Change -> Success * Subcategory: Authorization Policy Change -> Success * Subcategory: MPSSVC Rule-Level Policy Change -> Success and Failure * Subcategory: Other Policy Change Events -> Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAuditPolicychange.ps1 # Configure-PawAuditPolicychange.ps1 Write-Host "Applying Audit Policy category: policy-change..." -ForegroundColor Cyan # Set Audit Subcategory: Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authentication Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authentication Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authentication Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authentication Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authorization Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authorization Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authorization Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authorization Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: MPSSVC Rule-Level Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"MPSSVC Rule-Level Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory MPSSVC Rule-Level Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory MPSSVC Rule-Level Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Policy Change Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Policy Change Events`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Policy Change Events to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Policy Change Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-PawAuditPolicychangeStatus.ps1 # Get-PawAuditPolicychangeStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Policy Change $RawOutput = auditpol.exe /get /subcategory:"Policy Change" /r if ($RawOutput -notmatch ",Policy Change,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Authentication Policy Change $RawOutput = auditpol.exe /get /subcategory:"Authentication Policy Change" /r if ($RawOutput -notmatch ",Authentication Policy Change,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: Authorization Policy Change $RawOutput = auditpol.exe /get /subcategory:"Authorization Policy Change" /r if ($RawOutput -notmatch ",Authorization Policy Change,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: MPSSVC Rule-Level Policy Change $RawOutput = auditpol.exe /get /subcategory:"MPSSVC Rule-Level Policy Change" /r if ($RawOutput -notmatch ",MPSSVC Rule-Level Policy Change,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other Policy Change Events $RawOutput = auditpol.exe /get /subcategory:"Other Policy Change Events" /r if ($RawOutput -notmatch ",Other Policy Change Events,.*,Failure") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditPolicychange.ps1 Write-Host "Applying Audit Policy category: policy-change..." -ForegroundColor Cyan # Set Audit Subcategory: Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authentication Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authentication Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authentication Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authentication Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authorization Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authorization Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authorization Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authorization Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: MPSSVC Rule-Level Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"MPSSVC Rule-Level Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory MPSSVC Rule-Level Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory MPSSVC Rule-Level Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Policy Change Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Policy Change Events`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Policy Change Events to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Policy Change Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/audit-policy/configure-paw-audit-privilege-use.md Auditing sensitive privilege use logs attempts by processes or users to exercise rights like ActAsPartOfTypeOperatingSystem or LoadDrivers, identifying potential privilege escalations. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Sensitive Privilege Use -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAuditPrivilegeuse.ps1 # Configure-PawAuditPrivilegeuse.ps1 Write-Host "Applying Audit Policy category: privilege-use..." -ForegroundColor Cyan # Set Audit Subcategory: Sensitive Privilege Use $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Sensitive Privilege Use`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Sensitive Privilege Use to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Sensitive Privilege Use. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-PawAuditPrivilegeuseStatus.ps1 # Get-PawAuditPrivilegeuseStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Sensitive Privilege Use $RawOutput = auditpol.exe /get /subcategory:"Sensitive Privilege Use" /r if ($RawOutput -notmatch ",Sensitive Privilege Use,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditPrivilegeuse.ps1 Write-Host "Applying Audit Policy category: privilege-use..." -ForegroundColor Cyan # Set Audit Subcategory: Sensitive Privilege Use $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Sensitive Privilege Use`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Sensitive Privilege Use to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Sensitive Privilege Use. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Privileged Access Workstations (PAWs) Operating Systems: Windows 10/11 Enterprise File Path: 07-paws/audit-policy/configure-paw-audit-system-events.md Auditing system security extensions, integrity violations, and driver arrivals monitors boot health and tampering of host security services. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: IPsec Driver -> Success and Failure * Subcategory: Other System Events -> Success and Failure * Subcategory: Security State Change -> Success and Failure * Subcategory: Security System Extension -> Success and Failure * Subcategory: System Integrity -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-PawAuditSystemevents.ps1 # Configure-PawAuditSystemevents.ps1 Write-Host "Applying Audit Policy category: system-events..." -ForegroundColor Cyan # Set Audit Subcategory: IPsec Driver $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"IPsec Driver`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory IPsec Driver to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory IPsec Driver. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other System Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other System Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other System Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other System Events. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security State Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security State Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security State Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security State Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security System Extension $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security System Extension`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security System Extension to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security System Extension. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: System Integrity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"System Integrity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory System Integrity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory System Integrity. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-PawAuditSystemeventsStatus.ps1 # Get-PawAuditSystemeventsStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: IPsec Driver $RawOutput = auditpol.exe /get /subcategory:"IPsec Driver" /r if ($RawOutput -notmatch ",IPsec Driver,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other System Events $RawOutput = auditpol.exe /get /subcategory:"Other System Events" /r if ($RawOutput -notmatch ",Other System Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Security State Change $RawOutput = auditpol.exe /get /subcategory:"Security State Change" /r if ($RawOutput -notmatch ",Security State Change,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Security System Extension $RawOutput = auditpol.exe /get /subcategory:"Security System Extension" /r if ($RawOutput -notmatch ",Security System Extension,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: System Integrity $RawOutput = auditpol.exe /get /subcategory:"System Integrity" /r if ($RawOutput -notmatch ",System Integrity,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-PawAuditSystemevents.ps1 Write-Host "Applying Audit Policy category: system-events..." -ForegroundColor Cyan # Set Audit Subcategory: IPsec Driver $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"IPsec Driver`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory IPsec Driver to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory IPsec Driver. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other System Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other System Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other System Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other System Events. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security State Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security State Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security State Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security State Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security System Extension $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security System Extension`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security System Extension to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security System Extension. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: System Integrity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"System Integrity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory System Integrity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory System Integrity. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/harden-network-and-name-resolution.md Legacy name resolution protocols and insecure default network configurations are heavily targeted by attackers for credential harvesting and man-in-the-middle (MitM) positioning: Legacy Name Resolution (LLMNR / NetBIOS): LLMNR and NBT-NS serve as fallback protocols when DNS resolution fails. When a host queries an unresolvable name, it broadcasts requests over the local subnet. An attacker can spoof responses (e.g., using Responder) to capture NTLMv2 hashes or perform authentication relay attacks. NetBIOS name release requests can be forged to disrupt local names unless protected. NetBIOS Node Type and Name Release: Setting the Node Type to P-node (point-to-point, value 2) disables broadcast resolution fallbacks. Enabling name release protection (NoNameReleaseOnDemand) prevents attackers from spoofing name release requests to deregister local names. ICMP Redirects: ICMP redirect packets can be used by an attacker on the same subnet to dynamically redirect routing for specific hosts through the attacker's machine, enabling full MitM packet sniffing and modification. Disabling ICMP redirects prevents this vector. IP Source Routing: Source routing allows a sender to specify the exact network path a packet should follow. This is commonly abused to bypass firewall routing rules or establish communication paths that violate network segment isolation. Disable Default IPv6 DNS Servers: Disabling default IPv6 DNS servers prevents automated fallback to unauthenticated, dynamic local IPv6 DNS servers advertised by rogue routers or malicious tools (like mitm6), which would otherwise redirect query traffic and coerce NTLM or Kerberos authentication. Disable Web Proxy Auto-Discovery (WPAD): Disabling WPAD removes another name resolution mechanism that Responder exploits to harvest credentials. By disabling the WinHttpAutoProxySvc service and configuring WpadOverride = 1, the workstation is protected from rogue web proxy configurations. Restrict Net Session Enumeration (NetCease): By default, any authenticated domain user can query session information from remote hosts. Attackers utilize session enumeration to locate high-privileged user sessions (e.g., Domain Admins) across the network. Hardening the SrvsvcSessionInfo default security descriptor blocks this remote reconnaissance. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Configure DNS Client Settings Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO. Navigate to: Computer Configuration\Administrative Templates\Network\DNS Client Configure the settings: Policy : `Turn off Multicast Name Resolution` -> Enabled Policy : `Configure multicast DNS (mDNS) protocol` -> Enabled with option set to Disabled Policy : `Turn off default IPv6 DNS Servers` -> Enabled Step 2: Configure Network Connections Policies In the target GPO, navigate to: Computer Configuration\Administrative Templates\Network\Network Connections Configure the settings: Policy : `Prohibit use of Internet Connection Sharing on your DNS domain network` -> Enabled Policy : `Prohibit installation and configuration of Network Bridge on your DNS domain network` -> Enabled Policy : `Require domain users to elevate when setting a network's location` -> Enabled Step 3: Configure Windows Connection Manager Policies In the target GPO, navigate to: Computer Configuration\Administrative Templates\Network\Windows Connection Manager Configure the settings: Policy : `Minimize the number of simultaneous connections to the Internet or a Windows Domain` -> Enabled with option set to 3 = Prevent Wi-Fi when on Ethernet Policy : `Prohibit connection to non-domain networks when connected to domain authenticated network` -> Enabled Step 4: Configure WLAN Settings (WiFi Sense) In the target GPO, navigate to: Computer Configuration\Administrative Templates\Network\WLAN Service\WLAN Settings Configure the settings: Policy : `Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services` -> Disabled Step 5: Configure Spooler and HTTP Printing Policies In the target GPO, navigate to: Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings Configure the settings: Policy : `Turn off downloading of print drivers over HTTP` -> Enabled Policy : `Turn off printing over HTTP` -> Enabled Step 6: Configure Network Access Security settings In the target GPO, navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the settings: Policy : `Network access: Restrict anonymous access to Named Pipes and Shares` -> Enabled Step 7: Disable WinHTTP WPAD Service In the target GPO, navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Scroll to WinHTTP Web Proxy Auto-Discovery Service, select Define this service setting, and set the service startup mode to Disabled. Step 8: Configure Registry Network settings via GPO Preferences Under the target GPO, navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click Registry and select New -> Registry Item for each of the following: NetBIOS Name Release Protection: Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Netbt\Parameters Value Name: NoNameReleaseOnDemand Value Type: REG_DWORD Value Data: 1 NetBIOS P-Node Type: Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Netbt\Parameters Value Name: NodeType Value Type: REG_DWORD Value Data: 2 Disable ICMP Redirects: Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Value Name: EnableICMPRedirect Value Type: REG_DWORD Value Data: 0 Disable IP Source Routing (IPv4): Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Value Name: DisableIPSourceRouting Value Type: REG_DWORD Value Data: 2 Disable IP Source Routing (IPv6): Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters Value Name: DisableIPSourceRouting Value Type: REG_DWORD Value Data: 2 Disable WPAD Override (User Preference): Action: Update Hive: HKEY_CURRENT_USER Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Value Name: WpadOverride Value Type: REG_DWORD Value Data: 1 Restrict Net Session Enumeration (NetCease SDDL): Action: Update Hive: HKEY_LOCAL_MACHINE Key Path: SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity Value Name: SrvsvcSessionInfo Value Type: REG_BINARY Value Data: Generate via SDDL D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU) Step 9: Disable NetBIOS (via DHCP Scope Options) Open the DHCP Management Console (dhcpmgmt.msc). Under Scope Options, select Configure Options. Add Option 043 (Vendor Specific Info) and set the NetBIOS over TCP/IP value to 0x2 (Disable NetBIOS over TCP/IP). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to disable legacy resolution and enforce secure TCP/IP registry parameters. Download Script: Set-NetworkHardeningSettings.ps1 # Set-NetworkHardeningSettings.ps1 # Description: Configures local registry keys to disable LLMNR/NetBIOS, harden TCP/IP stack, prevent dual-homing, block hotspot auto-connect, print driver web downloads, HTTP printing, and limit anonymous share access. Write-Host "Applying network and name resolution hardening..." -ForegroundColor Cyan # Helper to configure registry keys function Set-RegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$path, [string]$name, [int]$value ) if ($PSCmdlet.ShouldProcess($path, "Set registry DWORD value $name to $value")) { $parent = Split-Path -Path $path if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null } Set-ItemProperty -Path $path -Name $name -Value $value -Type DWord -Force } } # 1. Disable LLMNR, mDNS, and default IPv6 DNS Servers Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "EnableMulticast" 0 Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "EnablemDNS" 0 Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "DisableIPv6DefaultDnsServers" 1 Write-Host "[+] LLMNR (Multicast Name Resolution), mDNS, and default IPv6 DNS Servers disabled." -ForegroundColor Green # 2. Configure NetBIOS Parameters $NetbtPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netbt\Parameters" if (-not (Test-Path $NetbtPath)) { New-Item -Path $NetbtPath -Force | Out-Null } Set-ItemProperty -Path $NetbtPath -Name "NoNameReleaseOnDemand" -Value 1 -Type DWord Set-ItemProperty -Path $NetbtPath -Name "NodeType" -Value 2 -Type DWord Write-Host "[+] NetBIOS name release protection and P-node type configured." -ForegroundColor Green # 3. Disable NetBIOS over TCP/IP on all active adapters Write-Host "[+] Disabling NetBIOS on all active network adapters..." -ForegroundColor Gray $Adapters = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -ErrorAction SilentlyContinue | Where-Object { $_.IPEnabled -eq $true } if ($Adapters) { foreach ($Adapter in $Adapters) { Invoke-CimMethod -InputObject $Adapter -MethodName SetTCPIPNetBIOS -Arguments @{ TcpipNetbiosOptions = 2 } | Out-Null } Write-Host " NetBIOS disabled on active network interfaces." -ForegroundColor Green } # 4. Harden TCP/IP Parameters Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "EnableICMPRedirect" 0 Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "DisableIPSourceRouting" 2 Write-Host "[+] IPv4 TCP/IP parameter redirects and source routing disabled." -ForegroundColor Green Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" "DisableIPSourceRouting" 2 Write-Host "[+] IPv6 TCP/IP parameter source routing disabled." -ForegroundColor Green # 5. Prevent Network Connection Sharing and Dual-Homing Bridging Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_ShowSharedAccessUI" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_AllowNetBridge_NLA" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_StdDomainUserSetLocation" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" "fMinimizeConnections" 3 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" "fBlockNonDomain" 1 Set-RegDWord "HKLM:\SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config" "AutoConnectAllowedOEM" 0 Write-Host "[+] Network connections, sharing, bridging, elevation, and hotspot settings configured." -ForegroundColor Green # 6. Printing Spooler Web Downloads and HTTP printing block Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableWebPnPDownload" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableHTTPPrinting" 1 Write-Host "[+] Printing spooler HTTP and Web service options disabled." -ForegroundColor Green # 7. Restrict anonymous access to SAM and Named Pipes/Shares Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" "RestrictNullSessAccess" 1 Write-Host "[+] Anonymous null session share access restricted." -ForegroundColor Green # 8. Disable WPAD Write-Host "[+] Disabling WinHTTP Auto-Proxy service..." -ForegroundColor Gray Set-Service -Name "WinHttpAutoProxySvc" -StartupType Disabled -ErrorAction SilentlyContinue Stop-Service -Name "WinHttpAutoProxySvc" -Force -ErrorAction SilentlyContinue $WpadPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" if (-not (Test-Path $WpadPath)) { New-Item -Path $WpadPath -Force | Out-Null } Set-ItemProperty -Path $WpadPath -Name "WpadOverride" -Value 1 -Type DWord -Force Write-Host "[+] WPAD auto-detection disabled in user preferences registry." -ForegroundColor Green # 9. Restrict Net Session Enumeration (NetCease SDDL) Write-Host "[+] Restricting Net Session Enumeration..." -ForegroundColor Gray try { $SD = New-Object System.Security.AccessControl.CommonSecurityDescriptor($false, $false, "D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU)") $BinaryForm = New-Object byte[] $SD.BinaryLength $SD.GetBinaryForm($BinaryForm, 0) $LanmanSecPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity" if (-not (Test-Path $LanmanSecPath)) { New-Item -Path $LanmanSecPath -Force | Out-Null } Set-ItemProperty -Path $LanmanSecPath -Name "SrvsvcSessionInfo" -Value $BinaryForm -Type Binary -Force Write-Host "[+] Net Session Enumeration restricted to Admins/Operators/Power Users." -ForegroundColor Green } catch { Write-Error " Failed to apply Net Session Enumeration restrictions: $($_.Exception.Message)" } Write-Host "Network and name resolution hardening applied successfully." -ForegroundColor Green To audit the network and name resolution status: Download Script: Test-NetworkHardeningStatus.ps1 # Test-NetworkHardeningStatus.ps1 # Description: Audits LLMNR, NetBIOS parameters, NetBIOS adapter state, TCP/IP parameters, and STIG print / network connection options. Write-Host "--- Auditing Network and Name Resolution Baseline ---" -ForegroundColor Cyan $script:Vulnerable = $false # Helper function to audit registry properties function Test-RegistryValue ($path, $name, $expectedValue) { $val = Get-ItemProperty -Path $path -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } $color = "Red" if ($actual -eq $expectedValue) { $color = "Green" } else { $script:Vulnerable = $true } Write-Host " - Registry Setting: $name | Actual: '$actual' (Expected: '$expectedValue')" -ForegroundColor $color } # 1. Audit LLMNR, mDNS, and default IPv6 DNS Servers $DnsPath = "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" Test-RegistryValue $DnsPath "EnableMulticast" 0 Test-RegistryValue $DnsPath "EnablemDNS" 0 Test-RegistryValue $DnsPath "DisableIPv6DefaultDnsServers" 1 # 2. Audit NetBIOS Parameters $NetbtPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netbt\Parameters" Test-RegistryValue $NetbtPath "NoNameReleaseOnDemand" 1 Test-RegistryValue $NetbtPath "NodeType" 2 # 3. Audit TCP/IP Parameters $TcpipPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" Test-RegistryValue $TcpipPath "EnableICMPRedirect" 0 Test-RegistryValue $TcpipPath "DisableIPSourceRouting" 2 $Tcpip6Path = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" Test-RegistryValue $Tcpip6Path "DisableIPSourceRouting" 2 # 4. Audit Connection Sharing & Dual-Homing Settings $NetConnPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" Test-RegistryValue $NetConnPath "NC_ShowSharedAccessUI" 0 Test-RegistryValue $NetConnPath "NC_AllowNetBridge_NLA" 0 Test-RegistryValue $NetConnPath "NC_StdDomainUserSetLocation" 1 $WcmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" Test-RegistryValue $WcmPath "fMinimizeConnections" 3 Test-RegistryValue $WcmPath "fBlockNonDomain" 1 $WifiPath = "HKLM:\SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config" Test-RegistryValue $WifiPath "AutoConnectAllowedOEM" 0 # 5. Audit HTTP Print Options $PrinterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" Test-RegistryValue $PrinterPath "DisableWebPnPDownload" 1 Test-RegistryValue $PrinterPath "DisableHTTPPrinting" 1 # 6. Audit Null Session Share Restrict $ServerPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" Test-RegistryValue $ServerPath "RestrictNullSessAccess" 1 # 7. Audit WPAD Service and Registry Override $WpadSvc = Get-Service -Name "WinHttpAutoProxySvc" -ErrorAction SilentlyContinue if ($null -ne $WpadSvc) { if ($WpadSvc.StartType -eq "Disabled") { Write-Host " - WPAD Service State: Disabled (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: WPAD Service StartType is $($WpadSvc.StartType) (Expected: Disabled)" -ForegroundColor Red $script:Vulnerable = $true } } $WpadPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" Test-RegistryValue $WpadPath "WpadOverride" 1 # 8. Audit Net Session Enumeration (NetCease) $LanmanSecPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity" if (Test-Path $LanmanSecPath) { $SrvsvcSessionInfo = (Get-ItemProperty -Path $LanmanSecPath -Name "SrvsvcSessionInfo" -ErrorAction SilentlyContinue).SrvsvcSessionInfo if ($null -ne $SrvsvcSessionInfo) { try { $SD = New-Object System.Security.AccessControl.CommonSecurityDescriptor($false, $false, $SrvsvcSessionInfo, 0) $Sddl = $SD.GetSddlForm("Dacl") if ($Sddl -eq "D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU)") { Write-Host " - Net Session Enumeration Security Descriptor: Hardened (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: Net Session Enumeration Security Descriptor is '$Sddl' (Expected: 'D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU)')" -ForegroundColor Red $script:Vulnerable = $true } } catch { Write-Host " - VULNERABLE: Failed to parse Net Session Enumeration security descriptor." -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: SrvsvcSessionInfo registry value not found." -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: LanmanServer\DefaultSecurity path not found." -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green } # Set-NetworkHardeningSettings.ps1 # Description: Configures local registry keys to disable LLMNR/NetBIOS, harden TCP/IP stack, prevent dual-homing, block hotspot auto-connect, print driver web downloads, HTTP printing, and limit anonymous share access. Write-Host "Applying network and name resolution hardening..." -ForegroundColor Cyan # Helper to configure registry keys function Set-RegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$path, [string]$name, [int]$value ) if ($PSCmdlet.ShouldProcess($path, "Set registry DWORD value $name to $value")) { $parent = Split-Path -Path $path if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null } Set-ItemProperty -Path $path -Name $name -Value $value -Type DWord -Force } } # 1. Disable LLMNR, mDNS, and default IPv6 DNS Servers Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "EnableMulticast" 0 Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "EnablemDNS" 0 Set-RegDWord "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" "DisableIPv6DefaultDnsServers" 1 Write-Host "[+] LLMNR (Multicast Name Resolution), mDNS, and default IPv6 DNS Servers disabled." -ForegroundColor Green # 2. Configure NetBIOS Parameters $NetbtPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Netbt\Parameters" if (-not (Test-Path $NetbtPath)) { New-Item -Path $NetbtPath -Force | Out-Null } Set-ItemProperty -Path $NetbtPath -Name "NoNameReleaseOnDemand" -Value 1 -Type DWord Set-ItemProperty -Path $NetbtPath -Name "NodeType" -Value 2 -Type DWord Write-Host "[+] NetBIOS name release protection and P-node type configured." -ForegroundColor Green # 3. Disable NetBIOS over TCP/IP on all active adapters Write-Host "[+] Disabling NetBIOS on all active network adapters..." -ForegroundColor Gray $Adapters = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -ErrorAction SilentlyContinue | Where-Object { $_.IPEnabled -eq $true } if ($Adapters) { foreach ($Adapter in $Adapters) { Invoke-CimMethod -InputObject $Adapter -MethodName SetTCPIPNetBIOS -Arguments @{ TcpipNetbiosOptions = 2 } | Out-Null } Write-Host " NetBIOS disabled on active network interfaces." -ForegroundColor Green } # 4. Harden TCP/IP Parameters Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "EnableICMPRedirect" 0 Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "DisableIPSourceRouting" 2 Write-Host "[+] IPv4 TCP/IP parameter redirects and source routing disabled." -ForegroundColor Green Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" "DisableIPSourceRouting" 2 Write-Host "[+] IPv6 TCP/IP parameter source routing disabled." -ForegroundColor Green # 5. Prevent Network Connection Sharing and Dual-Homing Bridging Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_ShowSharedAccessUI" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_AllowNetBridge_NLA" 0 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" "NC_StdDomainUserSetLocation" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" "fMinimizeConnections" 3 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WcmSvc\GroupPolicy" "fBlockNonDomain" 1 Set-RegDWord "HKLM:\SOFTWARE\Microsoft\wcmsvc\wifinetworkmanager\config" "AutoConnectAllowedOEM" 0 Write-Host "[+] Network connections, sharing, bridging, elevation, and hotspot settings configured." -ForegroundColor Green # 6. Printing Spooler Web Downloads and HTTP printing block Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableWebPnPDownload" 1 Set-RegDWord "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" "DisableHTTPPrinting" 1 Write-Host "[+] Printing spooler HTTP and Web service options disabled." -ForegroundColor Green # 7. Restrict anonymous access to SAM and Named Pipes/Shares Set-RegDWord "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" "RestrictNullSessAccess" 1 Write-Host "[+] Anonymous null session share access restricted." -ForegroundColor Green # 8. Disable WPAD Write-Host "[+] Disabling WinHTTP Auto-Proxy service..." -ForegroundColor Gray Set-Service -Name "WinHttpAutoProxySvc" -StartupType Disabled -ErrorAction SilentlyContinue Stop-Service -Name "WinHttpAutoProxySvc" -Force -ErrorAction SilentlyContinue $WpadPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" if (-not (Test-Path $WpadPath)) { New-Item -Path $WpadPath -Force | Out-Null } Set-ItemProperty -Path $WpadPath -Name "WpadOverride" -Value 1 -Type DWord -Force Write-Host "[+] WPAD auto-detection disabled in user preferences registry." -ForegroundColor Green # 9. Restrict Net Session Enumeration (NetCease SDDL) Write-Host "[+] Restricting Net Session Enumeration..." -ForegroundColor Gray try { $SD = New-Object System.Security.AccessControl.CommonSecurityDescriptor($false, $false, "D:(A;;CC;;;BA)(A;;CC;;;SO)(A;;CC;;;PU)") $BinaryForm = New-Object byte[] $SD.BinaryLength $SD.GetBinaryForm($BinaryForm, 0) $LanmanSecPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity" if (-not (Test-Path $LanmanSecPath)) { New-Item -Path $LanmanSecPath -Force | Out-Null } Set-ItemProperty -Path $LanmanSecPath -Name "SrvsvcSessionInfo" -Value $BinaryForm -Type Binary -Force Write-Host "[+] Net Session Enumeration restricted to Admins/Operators/Power Users." -ForegroundColor Green } catch { Write-Error " Failed to apply Net Session Enumeration restrictions: $($_.Exception.Message)" } Write-Host "Network and name resolution hardening applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/configure-uac-policies.md User Account Control (UAC) is a fundamental defense mechanism in Windows. It limits the privilege levels of running applications, executing administrative actions with standard user tokens unless elevated privileges are explicitly approved. Hardening UAC settings ensures: 1. Secure Desktop Enforcement: The elevation prompt is displayed on a separate, secure desktop environment that isolated system threads run on. This prevents third-party malware running in user space from intercepting credentials or programmatically clicking "Yes" to elevate itself. 2. Auto-Denial of Standard User Elevation: Standard users should not be allowed to request elevation. If a standard user triggers a task requiring administrative rights, the prompt should auto-deny rather than requesting an administrator password, preventing users from attempting to bypass controls or exposing local admin passwords on a non-secure user terminal. 3. Admin Approval Mode: Forcing built-in administrators to run in Admin Approval Mode ensures that even administrative users do not run web browsers or document editors with administrative tokens by default. 4. Sudo Command Control: The sudo command introduced in Windows 11 (24H2) allows users to run elevated commands from an unelevated console. Leaving this feature unconfigured or allowing execution within the current console session can expose elevated processes to command injection or token interception in the same console session. Restricting sudo to opening a new elevated window (1) or disabling it entirely (0) mitigates session hijacking risks. 5. Network UAC Restrictions (`LocalAccountTokenFilterPolicy`): Restricting the elevation of local accounts during network logons prevents lateral movement. When set to 0, local accounts (except for the built-in Administrator RID 500 account) connecting remotely via network shares or administrative interfaces cannot obtain administrative tokens, neutralizing pass-the-hash attacks using secondary local administrative accounts. 6. Installer Detection (`EnableInstallDetection`): Detecting installer program behavior prevents silent software execution. When enabled, any execution of an install file or setup program by standard users or administrators triggers a UAC elevation prompt, preventing unauthorized silent program deployments. 7. UAC Virtualization (`EnableVirtualization`): Virtualizing writes redirection keeps the operating system directory space clean. It redirects legacy application registry and file writes targeting system folders (like Program Files or System32) to user-profile-specific folders, allowing legacy applications to run without requiring administrative rights. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following settings: Policy : `User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode` -> Prompt for credentials on the secure desktop Policy : `User Account Control: Behavior of the elevation prompt for standard users` -> Automatically deny elevation requests Policy : `User Account Control: Run all administrators in Admin Approval Mode` -> Enabled Policy : `User Account Control: Switch to the secure desktop when prompting for elevation` -> Enabled Policy : `User Account Control: Detect application installations and prompt for elevation` -> Enabled Policy : `User Account Control: Virtualize file and registry write failures to per-user locations` -> Enabled Since the UAC network restrictions policy is not directly exposed in standard GPO security templates, deploy the registry setting via GPO Preferences: * Navigate to: Computer Configuration\Preferences\Windows Settings\Registry * Create a new Registry Item: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Value Name*: LocalAccountTokenFilterPolicy Value Type*: REG_DWORD Value Data*: 0 Navigate to: Computer Configuration\Administrative Templates\System Policy : `Configure the behavior of the sudo command` -> Enabled with options set to Force a new elevated window Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure maximum security parameters for UAC in the system registry. Download Script: Configure-UACPolicies.ps1 # Configure-UACPolicies.ps1 # Enforces hardened User Account Control (UAC) registry configuration values including network restrictions, installer detection, and virtualization. Write-Host "--- Hardening User Account Control Policies ---" -ForegroundColor Cyan $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path $SystemPath)) { New-Item -Path $SystemPath -Force | Out-Null } # ConsentPromptBehaviorAdmin = 1 (Prompt for credentials on secure desktop) Set-ItemProperty -Path $SystemPath -Name "ConsentPromptBehaviorAdmin" -Value 1 -Type DWord -Force # ConsentPromptBehaviorUser = 0 (Automatically deny elevation requests) Set-ItemProperty -Path $SystemPath -Name "ConsentPromptBehaviorUser" -Value 0 -Type DWord -Force # EnableLUA = 1 (Enable User Account Control / Admin Approval Mode) Set-ItemProperty -Path $SystemPath -Name "EnableLUA" -Value 1 -Type DWord -Force # PromptOnSecureDesktop = 1 (Switch to secure desktop when prompting) Set-ItemProperty -Path $SystemPath -Name "PromptOnSecureDesktop" -Value 1 -Type DWord -Force # LocalAccountTokenFilterPolicy = 0 (Apply UAC restrictions to local accounts on network logons) Set-ItemProperty -Path $SystemPath -Name "LocalAccountTokenFilterPolicy" -Value 0 -Type DWord -Force # EnableInstallDetection = 1 (Detect application installations and prompt for elevation) Set-ItemProperty -Path $SystemPath -Name "EnableInstallDetection" -Value 1 -Type DWord -Force # EnableVirtualization = 1 (Virtualize file and registry write failures to per-user locations) Set-ItemProperty -Path $SystemPath -Name "EnableVirtualization" -Value 1 -Type DWord -Force # Configure Windows Sudo command behavior (Enabled = 1 [Force new elevated window]) $SudoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sudo" if (-not (Test-Path $SudoPath)) { New-Item -Path $SudoPath -Force | Out-Null } Set-ItemProperty -Path $SudoPath -Name "Enabled" -Value 1 -Type DWord -Force Write-Host "[+] UAC registry values configured successfully." -ForegroundColor Green To audit UAC configurations: Download Script: Test-UACPolicies.ps1 # Test-UACPolicies.ps1 # Verifies local system registry settings for User Account Control. Write-Host "--- Auditing User Account Control Policies ---" -ForegroundColor Cyan $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $script:Vulnerable = $false function Test-UACRegistryValue ($name, $expected, $message) { $val = Get-ItemProperty -Path $SystemPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { $null } $color = "Red" if ($actual -eq $expected) { $color = "Green" } else { $script:Vulnerable = $true } Write-Host " - Registry Setting: $name | Actual: '$actual' (Expected: '$expected') | $message" -ForegroundColor $color } Test-UACRegistryValue "ConsentPromptBehaviorAdmin" 1 "Behavior of elevation prompt for administrators" Test-UACRegistryValue "ConsentPromptBehaviorUser" 0 "Behavior of elevation prompt for standard users" Test-UACRegistryValue "EnableLUA" 1 "Run all administrators in Admin Approval Mode" Test-UACRegistryValue "PromptOnSecureDesktop" 1 "Switch to secure desktop when prompting" Test-UACRegistryValue "LocalAccountTokenFilterPolicy" 0 "UAC network restrictions" Test-UACRegistryValue "EnableInstallDetection" 1 "Installer detection" Test-UACRegistryValue "EnableVirtualization" 1 "UAC virtualization" # Audit Sudo command $SudoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sudo" if (Test-Path $SudoPath) { $SudoState = Get-ItemProperty -Path $SudoPath -Name "Enabled" -ErrorAction SilentlyContinue $SudoVal = if ($SudoState) { $SudoState.Enabled } else { 0 } $SudoColor = if ($SudoVal -eq 0 -or $SudoVal -eq 1) { "Green" } else { "Red" } Write-Host " - Sudo Command Enabled state: $SudoVal (Required = 1 [New Window] or 0 [Disabled])" -ForegroundColor $SudoColor if ($SudoVal -ne 0 -and $SudoVal -ne 1) { $script:Vulnerable = $true } } else { Write-Host " - Sudo Command Enabled state: Not Configured (Default/Compliant as it inherits disabled)" -ForegroundColor Green } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-UACPolicies.ps1 # Enforces hardened User Account Control (UAC) registry configuration values including network restrictions, installer detection, and virtualization. Write-Host "--- Hardening User Account Control Policies ---" -ForegroundColor Cyan $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path $SystemPath)) { New-Item -Path $SystemPath -Force | Out-Null } # ConsentPromptBehaviorAdmin = 1 (Prompt for credentials on secure desktop) Set-ItemProperty -Path $SystemPath -Name "ConsentPromptBehaviorAdmin" -Value 1 -Type DWord -Force # ConsentPromptBehaviorUser = 0 (Automatically deny elevation requests) Set-ItemProperty -Path $SystemPath -Name "ConsentPromptBehaviorUser" -Value 0 -Type DWord -Force # EnableLUA = 1 (Enable User Account Control / Admin Approval Mode) Set-ItemProperty -Path $SystemPath -Name "EnableLUA" -Value 1 -Type DWord -Force # PromptOnSecureDesktop = 1 (Switch to secure desktop when prompting) Set-ItemProperty -Path $SystemPath -Name "PromptOnSecureDesktop" -Value 1 -Type DWord -Force # LocalAccountTokenFilterPolicy = 0 (Apply UAC restrictions to local accounts on network logons) Set-ItemProperty -Path $SystemPath -Name "LocalAccountTokenFilterPolicy" -Value 0 -Type DWord -Force # EnableInstallDetection = 1 (Detect application installations and prompt for elevation) Set-ItemProperty -Path $SystemPath -Name "EnableInstallDetection" -Value 1 -Type DWord -Force # EnableVirtualization = 1 (Virtualize file and registry write failures to per-user locations) Set-ItemProperty -Path $SystemPath -Name "EnableVirtualization" -Value 1 -Type DWord -Force # Configure Windows Sudo command behavior (Enabled = 1 [Force new elevated window]) $SudoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sudo" if (-not (Test-Path $SudoPath)) { New-Item -Path $SudoPath -Force | Out-Null } Set-ItemProperty -Path $SudoPath -Name "Enabled" -Value 1 -Type DWord -Force Write-Host "[+] UAC registry values configured successfully." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/disable-autoplay-autorun.md The AutoPlay and AutoRun features in Windows are designed to automatically execute programs or open media when a removable drive, network share, or CD-ROM is inserted or connected. Attackers exploit these features by placing malicious scripts, payloads, or executables on USB drives or external storage media. If AutoPlay is enabled, connecting the drive triggers automatic execution of these scripts or programs without user interaction or approval, allowing malware to achieve immediate execution in the context of the logged-on user. Disabling AutoPlay across all drive types completely mitigates this physical transmission vector. Additionally, non-volume devices (such as mobile phones, cameras, or media players) can still trigger AutoPlay behavior. Disallowing AutoPlay for non-volume devices ensures these devices do not introduce unauthorized execution pathways when plugged into standard client machines. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Administrative Templates\Windows Components\AutoPlay Policies Configure the following settings: Policy*: Turn off AutoPlay Setting*: Enabled Select Options*: All drives Policy*: Set the default behavior for AutoRun Setting*: Enabled Select Options*: Do not execute any autorun commands Policy*: Disallow Autoplay for non-volume devices Setting*: Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure Explorer registry keys to disable AutoPlay, AutoRun, and AutoPlay for non-volume devices. Download Script: Disable-AutoPlay.ps1 # Disable-AutoPlay.ps1 # Disables AutoPlay/AutoRun registry settings globally on all drive types and non-volume devices. Write-Host "--- Disabling AutoPlay and AutoRun ---" -ForegroundColor Cyan $ExplorerPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" if (-not (Test-Path $ExplorerPath)) { New-Item -Path $ExplorerPath -Force | Out-Null } # NoDriveTypeAutoRun = 0xFF (255 in decimal) disables AutoRun on all types of drives Set-ItemProperty -Path $ExplorerPath -Name "NoDriveTypeAutoRun" -Value 255 -Type DWord -Force # NoAutorun = 1 disables AutoRun commands in inf files Set-ItemProperty -Path $ExplorerPath -Name "NoAutorun" -Value 1 -Type DWord -Force # Disallow Autoplay for non-volume devices (NoAutoplayfornonVolume = 1) $PolExplorerPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" if (-not (Test-Path $PolExplorerPath)) { New-Item -Path $PolExplorerPath -Force | Out-Null } Set-ItemProperty -Path $PolExplorerPath -Name "NoAutoplayfornonVolume" -Value 1 -Type DWord -Force Write-Host "[+] AutoPlay and AutoRun registry parameters set." -ForegroundColor Green To audit AutoPlay configurations: Download Script: Test-AutoPlay.ps1 # Test-AutoPlay.ps1 # Audits local system registry parameters for AutoPlay status. Write-Host "--- Auditing AutoPlay Configuration ---" -ForegroundColor Cyan $ExplorerPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" $PolExplorerPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" $NoDriveAuto = Get-ItemProperty -Path $ExplorerPath -Name "NoDriveTypeAutoRun" -ErrorAction SilentlyContinue $NoAutoCmd = Get-ItemProperty -Path $ExplorerPath -Name "NoAutorun" -ErrorAction SilentlyContinue $NoNonVol = Get-ItemProperty -Path $PolExplorerPath -Name "NoAutoplayfornonVolume" -ErrorAction SilentlyContinue $NoDriveVal = if ($NoDriveAuto) { $NoDriveAuto.NoDriveTypeAutoRun } else { 0 } $NoAutoVal = if ($NoAutoCmd) { $NoAutoCmd.NoAutorun } else { 0 } $NoNonVolVal = if ($NoNonVol) { $NoNonVol.NoAutoplayfornonVolume } else { 0 } $NoDriveColor = if ($NoDriveVal -eq 255) { "Green" } else { "Red" } $NoAutoColor = if ($NoAutoVal -eq 1) { "Green" } else { "Red" } $NoNonVolColor = if ($NoNonVolVal -eq 1) { "Green" } else { "Red" } Write-Host " - NoDriveTypeAutoRun: $NoDriveVal (Required = 255 to disable all drives)" -ForegroundColor $NoDriveColor Write-Host " - NoAutorun: $NoAutoVal (Required = 1)" -ForegroundColor $NoAutoColor Write-Host " - NoAutoplayfornonVolume: $NoNonVolVal (Required = 1)" -ForegroundColor $NoNonVolColor # Disable-AutoPlay.ps1 # Disables AutoPlay/AutoRun registry settings globally on all drive types and non-volume devices. Write-Host "--- Disabling AutoPlay and AutoRun ---" -ForegroundColor Cyan $ExplorerPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" if (-not (Test-Path $ExplorerPath)) { New-Item -Path $ExplorerPath -Force | Out-Null } # NoDriveTypeAutoRun = 0xFF (255 in decimal) disables AutoRun on all types of drives Set-ItemProperty -Path $ExplorerPath -Name "NoDriveTypeAutoRun" -Value 255 -Type DWord -Force # NoAutorun = 1 disables AutoRun commands in inf files Set-ItemProperty -Path $ExplorerPath -Name "NoAutorun" -Value 1 -Type DWord -Force # Disallow Autoplay for non-volume devices (NoAutoplayfornonVolume = 1) $PolExplorerPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" if (-not (Test-Path $PolExplorerPath)) { New-Item -Path $PolExplorerPath -Force | Out-Null } Set-ItemProperty -Path $PolExplorerPath -Name "NoAutoplayfornonVolume" -Value 1 -Type DWord -Force Write-Host "[+] AutoPlay and AutoRun registry parameters set." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations. Operating Systems: Windows 10 (and above) Enterprise/Professional. File Path: 08-endpoints/block-removable-storage.md Removable storage media, such as USB flash drives, external SSDs, and optical discs, represent a significant risk vector for corporate network environments. Attackers use USB drives to bypass network-based security boundaries (such as firewalls and intrusion detection systems), introducing malware directly onto local workstation hosts via physical sneakernets. USB drives are also a primary tool for insider threat data exfiltration, enabling users to copy proprietary or sensitive information off company terminals onto untracked hardware. Restricting removable storage access at the operating system level prevents both unauthorized data ingress (malware infection) and data egress (unauthorized data copying). Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Administrative Templates\System\Removable Storage Access Configure the setting: Policy*: All Removable Storage classes: Deny all access Setting*: Enabled Alternatively, if you only want to block write access while allowing read-only access (for specific profiles), configure: Policy*: Removable Disks: Deny write access -> Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure registry keys to block all removable storage devices. Download Script: Block-RemovableStorage.ps1 # Block-RemovableStorage.ps1 # Configures local registry parameters to deny access to all removable storage classes. Write-Host "--- Restricting Removable Storage Devices ---" -ForegroundColor Cyan $RemovableStoragePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" if (-not (Test-Path $RemovableStoragePath)) { New-Item -Path $RemovableStoragePath -Force | Out-Null } # Deny_All = 1 blocks all removable storage classes Set-ItemProperty -Path $RemovableStoragePath -Name "Deny_All" -Value 1 -Type DWord Write-Host "[+] Removable storage block configured." -ForegroundColor Green To audit removable storage block configurations: Download Script: Test-RemovableStorage.ps1 # Test-RemovableStorage.ps1 # Audits registry values for removable storage blocks. Write-Host "--- Auditing Removable Storage Restrictions ---" -ForegroundColor Cyan $RemovableStoragePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" $DenyAllProp = Get-ItemProperty -Path $RemovableStoragePath -Name "Deny_All" -ErrorAction SilentlyContinue $DenyAllVal = if ($DenyAllProp) { $DenyAllProp.Deny_All } else { 0 } $DenyColor = if ($DenyAllVal -eq 1) { "Green" } else { "Red" } Write-Host " - Removable Storage Deny_All: $DenyAllVal (Required = 1)" -ForegroundColor $DenyColor # Block-RemovableStorage.ps1 # Configures local registry parameters to deny access to all removable storage classes. Write-Host "--- Restricting Removable Storage Devices ---" -ForegroundColor Cyan $RemovableStoragePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" if (-not (Test-Path $RemovableStoragePath)) { New-Item -Path $RemovableStoragePath -Force | Out-Null } # Deny_All = 1 blocks all removable storage classes Set-ItemProperty -Path $RemovableStoragePath -Name "Deny_All" -Value 1 -Type DWord Write-Host "[+] Removable storage block configured." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/restrict-rdp-access.md Remote Desktop Protocol (RDP) is one of the primary mechanisms used by attackers for lateral movement and administrative session hijacking. If inbound RDP is enabled globally on workstations: 1. Lateral Movement: An attacker who compromises a single standard user's credentials with administrative permissions on other machines can RDP from workstation to workstation across the network. 2. Session Hijacking: Attackers can hijack existing administrative RDP sessions using built-in command-line tools (such as tscon.exe) if they obtain administrator privileges on the system. 3. Password Spraying: Open RDP ports allow attackers to attempt password spraying or brute-force attacks against local administrative accounts. Furthermore, Windows Remote Assistance allows helper connections that can lead to remote code execution or unauthorized access if not properly restricted. Disabling Solicited Remote Assistance and removing any legacy configuration values limits the workstation's attack surface. The safest configuration is to disable Remote Desktop Services and Remote Assistance entirely on all Tier 2 workstations. If RDP is strictly necessary for remote technical support, it must require Network Level Authentication (NLA) and the listening firewall rules must restrict access to authorized management subnets only. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Disable Inbound Remote Desktop Connections (Default Hardening) Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections Configure the setting: Policy*: Allow users to connect remotely by using Remote Desktop Services Setting*: Disabled 2. Enforce NLA and High Encryption (If RDP is Required for Admins) If RDP is strictly required, enable it but restrict it using the following settings: 1. Under the same path: Policy : `Allow users to connect remotely by using Remote Desktop Services` -> `Enabled` 2. Navigate to: `Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security` 3. Configure the following settings: Policy: Require user authentication for remote connections by using Network Level Authentication Setting : `Enabled` Policy: Set client connection encryption level Setting : `Enabled` (Select `High Level` in the options dropdown) Policy: Require use of specific security layer for remote (RDP) connections Setting*: Enabled: SSL 4. Deploy local firewall rules via GPO to restrict TCP port 3389 inbound to administrative subnet ranges only. 3. Configure Temporary Folders Deletion on Exit Navigate to: Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Temporary Folders Configure the setting: Policy*: Do not delete temp folders upon exit Setting*: Disabled (ensures session temporary directories are deleted when users log off) 4. Disable Solicited Remote Assistance Navigate to: Computer Configuration\Administrative Templates\System\Remote Assistance Configure the setting: Policy*: Configure Solicited Remote Assistance Setting*: Disabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to disable Remote Desktop and Remote Assistance, and enforce NLA and secure registry keys. Download Script: Disable-RemoteDesktop.ps1 # Disable-RemoteDesktop.ps1 # Disables Remote Desktop and Solicited Remote Assistance connections, sets NLA requirements, sets Security Layer to SSL, configures temp folder deletion, and cleans parameters. Write-Host "--- Restricting Remote Desktop and Remote Assistance Access ---" -ForegroundColor Cyan $RdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" # 1. Disable RDP Connections (fDenyTSConnections = 1) Set-ItemProperty -Path $RdpPath -Name "fDenyTSConnections" -Value 1 -Type DWord -Force Write-Host "[+] Inbound Remote Desktop connections disabled." -ForegroundColor Green # 2. Enforce Network Level Authentication (UserAuthentication = 1) $RdpSecPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" if (Test-Path $RdpSecPath) { Set-ItemProperty -Path $RdpSecPath -Name "UserAuthentication" -Value 1 -Type DWord -Force Write-Host "[+] Network Level Authentication (NLA) enforced." -ForegroundColor Green } # 3. Disable Remote Assistance (fAllowToGetHelp = 0) Set-ItemProperty -Path $RdpPath -Name "fAllowToGetHelp" -Value 0 -Type DWord -Force # 4. Disable and clean Solicited Remote Assistance Policies, set SSL, and delete temp folders $TSPoliciesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" if (-not (Test-Path $TSPoliciesPath)) { New-Item -Path $TSPoliciesPath -Force | Out-Null } Set-ItemProperty -Path $TSPoliciesPath -Name "fAllowToGetHelp" -Value 0 -Type DWord -Force Set-ItemProperty -Path $TSPoliciesPath -Name "SecurityLayer" -Value 2 -Type DWord -Force Set-ItemProperty -Path $TSPoliciesPath -Name "DeleteTempDirsOnExit" -Value 1 -Type DWord -Force $ParamsToDelete = @("MaxTicketExpiryUnits", "MaxTicketExpiry", "fUseMailto", "fAllowFullControl") foreach ($Param in $ParamsToDelete) { if (Get-ItemProperty -Path $TSPoliciesPath -Name $Param -ErrorAction SilentlyContinue) { Remove-ItemProperty -Path $TSPoliciesPath -Name $Param -Force -ErrorAction SilentlyContinue } } Write-Host "[+] Remote Desktop policies (SSL, Temp folders, Solicited Help) configured and cleaned." -ForegroundColor Green To audit Remote Desktop and Remote Assistance status: Download Script: Test-RemoteDesktopStatus.ps1 # Test-RemoteDesktopStatus.ps1 # Audits local RDP, Remote Assistance, security layer, temp folders, and NLA registry configuration and listening firewall ports. Write-Host "--- Auditing Remote Desktop Configuration ---" -ForegroundColor Cyan $RdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" $RdpSecPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" $TSPoliciesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" $DenyTS = Get-ItemProperty -Path $RdpPath -Name "fDenyTSConnections" -ErrorAction SilentlyContinue $DenyVal = if ($DenyTS) { $DenyTS.fDenyTSConnections } else { 1 } $NlaProp = Get-ItemProperty -Path $RdpSecPath -Name "UserAuthentication" -ErrorAction SilentlyContinue $NlaVal = if ($NlaProp) { $NlaProp.UserAuthentication } else { 0 } $DenyColor = if ($DenyVal -eq 1) { "Green" } else { "Yellow" } $NlaColor = if ($NlaVal -eq 1) { "Green" } else { "Red" } Write-Host " - fDenyTSConnections: $DenyVal (Recommended = 1 to block all)" -ForegroundColor $DenyColor Write-Host " - UserAuthentication (NLA): $NlaVal (Required = 1 if RDP is enabled)" -ForegroundColor $NlaColor # Check if port 3389 firewall rule is active and enabled $RdpFirewall = Get-NetFirewallRule -Name "RemoteDesktop-UserMode-In-TCP" -ErrorAction SilentlyContinue if ($RdpFirewall) { $FirewallColor = if ($RdpFirewall.Enabled -eq $true) { "Yellow" } else { "Green" } Write-Host " - RDP Inbound Firewall Rule Active: $($RdpFirewall.Enabled)" -ForegroundColor $FirewallColor } # Audit Remote Assistance $GetHelpTS = Get-ItemProperty -Path $RdpPath -Name "fAllowToGetHelp" -ErrorAction SilentlyContinue $GetHelpTSVal = if ($GetHelpTS) { $GetHelpTS.fAllowToGetHelp } else { 0 } $HelpColor = if ($GetHelpTSVal -eq 0) { "Green" } else { "Red" } Write-Host " - fAllowToGetHelp (Terminal Server): $GetHelpTSVal (Recommended = 0)" -ForegroundColor $HelpColor # Audit Solicited Remote Assistance Policy, Security Layer, and Temp Folders if (Test-Path $TSPoliciesPath) { $PolGetHelp = Get-ItemProperty -Path $TSPoliciesPath -Name "fAllowToGetHelp" -ErrorAction SilentlyContinue $PolGetHelpVal = if ($PolGetHelp) { $PolGetHelp.fAllowToGetHelp } else { $null } $PolHelpColor = if ($PolGetHelpVal -eq 0) { "Green" } else { "Red" } Write-Host " - fAllowToGetHelp (Policies): $PolGetHelpVal (Recommended = 0)" -ForegroundColor $PolHelpColor $SecurityLayerProp = Get-ItemProperty -Path $TSPoliciesPath -Name "SecurityLayer" -ErrorAction SilentlyContinue $SecurityLayerVal = if ($SecurityLayerProp) { $SecurityLayerProp.SecurityLayer } else { $null } $SecLayerColor = if ($SecurityLayerVal -eq 2) { "Green" } else { "Red" } Write-Host " - SecurityLayer (SSL): $SecurityLayerVal (Required = 2)" -ForegroundColor $SecLayerColor $DeleteTempProp = Get-ItemProperty -Path $TSPoliciesPath -Name "DeleteTempDirsOnExit" -ErrorAction SilentlyContinue $DeleteTempVal = if ($DeleteTempProp) { $DeleteTempProp.DeleteTempDirsOnExit } else { $null } $DeleteTempColor = if ($DeleteTempVal -eq 1) { "Green" } else { "Red" } Write-Host " - DeleteTempDirsOnExit (Temp Folders): $DeleteTempVal (Required = 1)" -ForegroundColor $DeleteTempColor $Params = @("MaxTicketExpiryUnits", "MaxTicketExpiry", "fUseMailto", "fAllowFullControl") foreach ($Param in $Params) { $Val = (Get-ItemProperty -Path $TSPoliciesPath -Name $Param -ErrorAction SilentlyContinue).$Param if ($null -ne $Val) { Write-Host " - VULNERABLE: Solicited Remote Assistance parameter '$Param' is set to '$Val' (Expected: Deleted/Not Configured)" -ForegroundColor Red } else { Write-Host " - Parameter '$Param': Not Configured (Correct)" -ForegroundColor Green } } } else { Write-Host " - Solicited Remote Assistance Policy Path does not exist" -ForegroundColor Red } # Disable-RemoteDesktop.ps1 # Disables Remote Desktop and Solicited Remote Assistance connections, sets NLA requirements, sets Security Layer to SSL, configures temp folder deletion, and cleans parameters. Write-Host "--- Restricting Remote Desktop and Remote Assistance Access ---" -ForegroundColor Cyan $RdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" # 1. Disable RDP Connections (fDenyTSConnections = 1) Set-ItemProperty -Path $RdpPath -Name "fDenyTSConnections" -Value 1 -Type DWord -Force Write-Host "[+] Inbound Remote Desktop connections disabled." -ForegroundColor Green # 2. Enforce Network Level Authentication (UserAuthentication = 1) $RdpSecPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" if (Test-Path $RdpSecPath) { Set-ItemProperty -Path $RdpSecPath -Name "UserAuthentication" -Value 1 -Type DWord -Force Write-Host "[+] Network Level Authentication (NLA) enforced." -ForegroundColor Green } # 3. Disable Remote Assistance (fAllowToGetHelp = 0) Set-ItemProperty -Path $RdpPath -Name "fAllowToGetHelp" -Value 0 -Type DWord -Force # 4. Disable and clean Solicited Remote Assistance Policies, set SSL, and delete temp folders $TSPoliciesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" if (-not (Test-Path $TSPoliciesPath)) { New-Item -Path $TSPoliciesPath -Force | Out-Null } Set-ItemProperty -Path $TSPoliciesPath -Name "fAllowToGetHelp" -Value 0 -Type DWord -Force Set-ItemProperty -Path $TSPoliciesPath -Name "SecurityLayer" -Value 2 -Type DWord -Force Set-ItemProperty -Path $TSPoliciesPath -Name "DeleteTempDirsOnExit" -Value 1 -Type DWord -Force $ParamsToDelete = @("MaxTicketExpiryUnits", "MaxTicketExpiry", "fUseMailto", "fAllowFullControl") foreach ($Param in $ParamsToDelete) { if (Get-ItemProperty -Path $TSPoliciesPath -Name $Param -ErrorAction SilentlyContinue) { Remove-ItemProperty -Path $TSPoliciesPath -Name $Param -Force -ErrorAction SilentlyContinue } } Write-Host "[+] Remote Desktop policies (SSL, Temp folders, Solicited Help) configured and cleaned." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations. Operating Systems: Windows 10 (and above) Enterprise/Professional. File Path: 08-endpoints/restrict-local-admins.md Local administrator rights on workstations are a significant source of operational vulnerability. If standard end-users run as local administrators: 1. Malware Propagation: Malware executed by the user runs in an administrative context, allowing it to bypass local firewalls, alter registry hives, disable security controls (like Windows Defender), and persist across reboots. 2. Credential Harvesting: Compromised local admin accounts allow attackers to execute memory-dumping tools (e.g., Mimikatz) to harvest stored domain credentials of other users who have logged on to that machine. 3. Software Control Bypass: Users can install arbitrary, unapproved software, introducing license compliance risks and unmonitored security vulnerabilities. Securing the local Administrators group ensures only local security accounts (like the local Administrator managed by LAPS) or dedicated workstation support accounts are members. The default Domain Users or standard domain accounts must never be allowed local administrative rights. Option A: Group Policy Object (GPO) Configuration (Preferred) Enforce local Administrators group membership and restrict remote execution via local accounts (UAC remote restrictions): 1. Open the Group Policy Management Console (gpmc.msc). 2. Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). 3. Configure Restricted Groups: Navigate to: `Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups` Right-click Restricted Groups and select Add Group. Type `Administrators` (or click Browse to find the local group). Under Members of this group, define the allowed members: `Administrator` (the built-in local administrator account) DomainName\Workstation-Support-Admins (dedicated Tier 2 support team group, if used) Leave out Domain Users or any other general domain accounts. Applying this GPO will overwrite the membership of the local Administrators group, immediately removing any account not explicitly listed. 4. Configure Local Account Token Filter Policy: Navigate to: `Computer Configuration\Preferences\Windows Settings\Registry` Right-click Registry and select New -> Registry Item. Set Action : `Update` Set Hive: HKEY_LOCAL_MACHINE Set Key Path : `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System` Set Value name: LocalAccountTokenFilterPolicy Set Value type : `REG_DWORD` Set Value data: 0 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to audit and remediate unauthorized administrative accounts in the local Administrators group and enforce local account remote token restrictions. Download Script: Clean-LocalAdministrators.ps1 # Clean-LocalAdministrators.ps1 # Removes unauthorized domain or local accounts from the local Administrators group and disables local account remote token filtering bypass. Write-Host "--- Restricting Local Administrators Group ---" -ForegroundColor Cyan # Define the list of authorized members # The built-in Administrator account (RID 500) and authorized domain support groups. $AuthorizedMembers = @("Administrator", "Workstation-Support-Admins") $LocalAdmins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue if ($LocalAdmins) { foreach ($Member in $LocalAdmins) { # Check if the member is not in the authorized list $Match = $false foreach ($Auth in $AuthorizedMembers) { # Check for exact matches or matches against SAM / SID formats if ($Member.Name -eq $Auth -or $Member.Name -like "*\$Auth" -or $Member.Name -eq "$env:COMPUTERNAME\$Auth") { $Match = $true break } } if (-not $Match) { Write-Host "[-] Removing unauthorized member: $($Member.Name) (Source: $($Member.PrincipalSource))" -ForegroundColor Yellow try { Remove-LocalGroupMember -Group "Administrators" -Member $Member.Name -ErrorAction Stop Write-Host " Successfully removed: $($Member.Name)" -ForegroundColor Green } catch { Write-Error " Failed to remove: $($Member.Name). Error: $($_.Exception.Message)" } } else { Write-Host "[+] Member authorized: $($Member.Name)" -ForegroundColor Green } } } else { Write-Error "Could not retrieve members of local Administrators group." } # Enforce LocalAccountTokenFilterPolicy = 0 $RegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "LocalAccountTokenFilterPolicy" try { if (-not (Test-Path $RegistryPath)) { New-Item -Path $RegistryPath -Force | Out-Null } Set-ItemProperty -Path $RegistryPath -Name $ValueName -Value 0 -Type DWord -Force | Out-Null Write-Host "[+] LocalAccountTokenFilterPolicy configured to 0." -ForegroundColor Green } catch { Write-Error "Failed to configure LocalAccountTokenFilterPolicy. Error: $($_.Exception.Message)" } To audit local Administrators group memberships and UAC token filtering policy: Download Script: Test-LocalAdministrators.ps1 # Test-LocalAdministrators.ps1 # Audits membership of the local Administrators group and checks local account remote token filtering bypass policy. Write-Host "--- Auditing Local Administrators Group ---" -ForegroundColor Cyan $LocalAdmins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue if ($LocalAdmins) { Write-Host "[*] Current members of local Administrators group:" -ForegroundColor Yellow foreach ($Member in $LocalAdmins) { # Flag any domain user accounts that might have been added to administrators group $StatusColor = "Green" if ($Member.PrincipalSource -eq "ActiveDirectory" -and $Member.Name -notmatch "Workstation-Support-Admins") { $StatusColor = "Red" Write-Host " - VULNERABLE: Domain Account '$($Member.Name)' has local admin rights." -ForegroundColor $StatusColor } else { Write-Host " - Member: $($Member.Name) | Source: $($Member.PrincipalSource) | Class: $($Member.ObjectClass)" -ForegroundColor $StatusColor } } } else { Write-Error "Failed to retrieve local Administrators group members." } # Audit LocalAccountTokenFilterPolicy $RegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "LocalAccountTokenFilterPolicy" if (Test-Path $RegistryPath) { $Val = (Get-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction SilentlyContinue).$ValueName if ($Val -eq 0) { Write-Host "[+] LocalAccountTokenFilterPolicy is configured correctly (0)." -ForegroundColor Green } elseif ($null -eq $Val) { Write-Host "[-] LocalAccountTokenFilterPolicy is not explicitly set (Expected: 0)." -ForegroundColor Red } else { Write-Host "[-] LocalAccountTokenFilterPolicy is vulnerable: $Val (Expected: 0)." -ForegroundColor Red } } else { Write-Host "[-] LocalAccountTokenFilterPolicy is not configured (Expected: 0)." -ForegroundColor Red } # Clean-LocalAdministrators.ps1 # Removes unauthorized domain or local accounts from the local Administrators group and disables local account remote token filtering bypass. Write-Host "--- Restricting Local Administrators Group ---" -ForegroundColor Cyan # Define the list of authorized members # The built-in Administrator account (RID 500) and authorized domain support groups. $AuthorizedMembers = @("Administrator", "Workstation-Support-Admins") $LocalAdmins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue if ($LocalAdmins) { foreach ($Member in $LocalAdmins) { # Check if the member is not in the authorized list $Match = $false foreach ($Auth in $AuthorizedMembers) { # Check for exact matches or matches against SAM / SID formats if ($Member.Name -eq $Auth -or $Member.Name -like "*\$Auth" -or $Member.Name -eq "$env:COMPUTERNAME\$Auth") { $Match = $true break } } if (-not $Match) { Write-Host "[-] Removing unauthorized member: $($Member.Name) (Source: $($Member.PrincipalSource))" -ForegroundColor Yellow try { Remove-LocalGroupMember -Group "Administrators" -Member $Member.Name -ErrorAction Stop Write-Host " Successfully removed: $($Member.Name)" -ForegroundColor Green } catch { Write-Error " Failed to remove: $($Member.Name). Error: $($_.Exception.Message)" } } else { Write-Host "[+] Member authorized: $($Member.Name)" -ForegroundColor Green } } } else { Write-Error "Could not retrieve members of local Administrators group." } # Enforce LocalAccountTokenFilterPolicy = 0 $RegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "LocalAccountTokenFilterPolicy" try { if (-not (Test-Path $RegistryPath)) { New-Item -Path $RegistryPath -Force | Out-Null } Set-ItemProperty -Path $RegistryPath -Name $ValueName -Value 0 -Type DWord -Force | Out-Null Write-Host "[+] LocalAccountTokenFilterPolicy configured to 0." -ForegroundColor Green } catch { Write-Error "Failed to configure LocalAccountTokenFilterPolicy. Error: $($_.Exception.Message)" } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/wsus-client-config.md In an isolated, air-gapped network, workstations cannot connect directly to Microsoft's online Update servers. If the system is left in its default configuration: 1. DNS/Firewall Pollution: Workstations will continuously attempt to resolve and connect to public Windows Update URLs (e.g., *.update.microsoft.com), filling firewall and local DNS resolver cache logs with timeouts and block events. 2. Missing Updates: Workstations will fail to receive security patches, critical updates, and Windows Defender definitions. 3. Control Bypass: Attackers or unapproved software could attempt to install out-of-band features or packages if update routes are not explicitly locked to internal sources. Enforcing the intranet update service location redirects all system update queries to the local WSUS server. Furthermore, enforcing Windows Delivery Optimization download mode to Group (2) limits peer-to-peer update sharing strictly to computers within the same active directory domain/group or local subnet boundaries, reducing bandwidth constraints on WAN/intranet segments and preventing unmanaged peer sharing. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Update Configure the following settings: Policy*: Configure Automatic Updates Setting*: Enabled Configure automatic updating*: 4 - Auto download and schedule the install Configure the service location: Policy*: Specify intranet Microsoft update service location Setting*: Enabled Set the intranet update service for detecting updates*: http://local-wsus.domain.local:8530 (Replace with your internal WSUS FQDN or IP) Set the intranet statistics server*: http://local-wsus.domain.local:8530 Navigate to: Policy*: Do not connect to any Windows Update Internet locations Setting*: Enabled (blocks fallback to public servers) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization Configure the following settings: Policy*: Download Mode Setting*: Enabled Download Mode*: Group (2) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure registry keys to enforce local WSUS parameters and Delivery Optimization download mode. Download Script: Set-WSUSClientConfiguration.ps1 # Set-WSUSClientConfiguration.ps1 # Configures local registry keys to point the Windows Update client to the intranet WSUS server and enforces DO Group mode. Write-Host "--- Configuring WSUS Client Settings ---" -ForegroundColor Cyan $WUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $WUAUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $DOPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" # 1. Create keys if they do not exist if (-not (Test-Path $WUPath)) { New-Item -Path $WUPath -Force | Out-Null } if (-not (Test-Path $WUAUPath)) { New-Item -Path $WUAUPath -Force | Out-Null } if (-not (Test-Path $DOPath)) { New-Item -Path $DOPath -Force | Out-Null } # Define intranet WSUS URL $WSUSServer = "http://local-wsus.domain.local:8530" # 2. Configure update location and statistics server Set-ItemProperty -Path $WUPath -Name "WUServer" -Value $WSUSServer -Type String -Force Set-ItemProperty -Path $WUPath -Name "WUStatusServer" -Value $WSUSServer -Type String -Force Set-ItemProperty -Path $WUPath -Name "DoNotConnectToWindowsUpdateInternetLocations" -Value 1 -Type DWord -Force # 3. Configure Automatic Updates behavior (AUOptions = 4: Auto Download & Schedule) Set-ItemProperty -Path $WUAUPath -Name "NoAutoUpdate" -Value 0 -Type DWord -Force Set-ItemProperty -Path $WUAUPath -Name "AUOptions" -Value 4 -Type DWord -Force Set-ItemProperty -Path $WUAUPath -Name "UseWUServer" -Value 1 -Type DWord -Force # 4. Enforce DODownloadMode = 2 (Group) Set-ItemProperty -Path $DOPath -Name "DODownloadMode" -Value 2 -Type DWord -Force Write-Host "[+] Local WSUS parameters and Delivery Optimization download mode applied." -ForegroundColor Green To audit the WSUS client configuration status: Download Script: Test-WSUSClientStatus.ps1 # Test-WSUSClientStatus.ps1 # Audits registry values to verify WSUS server assignment and Delivery Optimization configuration. Write-Host "--- Auditing WSUS Client Settings ---" -ForegroundColor Cyan $WUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $WUAUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $DOPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" $WUServerProp = Get-ItemProperty -Path $WUPath -Name "WUServer" -ErrorAction SilentlyContinue $WUStatusProp = Get-ItemProperty -Path $WUPath -Name "WUStatusServer" -ErrorAction SilentlyContinue $UseWUServerProp = Get-ItemProperty -Path $WUAUPath -Name "UseWUServer" -ErrorAction SilentlyContinue $WUServerVal = if ($WUServerProp) { $WUServerProp.WUServer } else { "" } $WUStatusVal = if ($WUStatusProp) { $WUStatusProp.WUStatusServer } else { "" } $UseWUVal = if ($UseWUServerProp) { $UseWUServerProp.UseWUServer } else { 0 } $ServerColor = if ($WUServerVal -like "http*") { "Green" } else { "Red" } $UseColor = if ($UseWUVal -eq 1) { "Green" } else { "Red" } Write-Host " - Intranet WUServer: $WUServerVal" -ForegroundColor $ServerColor Write-Host " - Intranet WUStatusServer: $WUStatusVal" -ForegroundColor $ServerColor Write-Host " - UseWUServer Active: $UseWUVal (Required = 1)" -ForegroundColor $UseColor # Audit Delivery Optimization $DOVal = if (Test-Path $DOPath) { (Get-ItemProperty -Path $DOPath -Name "DODownloadMode" -ErrorAction SilentlyContinue).DODownloadMode } else { $null } $DOColor = if ($DOVal -eq 2) { "Green" } else { "Red" } Write-Host " - Delivery Optimization DODownloadMode: $($DOVal | Out-String).Trim() (Expected = 2)" -ForegroundColor $DOColor # Set-WSUSClientConfiguration.ps1 # Configures local registry keys to point the Windows Update client to the intranet WSUS server and enforces DO Group mode. Write-Host "--- Configuring WSUS Client Settings ---" -ForegroundColor Cyan $WUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $WUAUPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $DOPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" # 1. Create keys if they do not exist if (-not (Test-Path $WUPath)) { New-Item -Path $WUPath -Force | Out-Null } if (-not (Test-Path $WUAUPath)) { New-Item -Path $WUAUPath -Force | Out-Null } if (-not (Test-Path $DOPath)) { New-Item -Path $DOPath -Force | Out-Null } # Define intranet WSUS URL $WSUSServer = "http://local-wsus.domain.local:8530" # 2. Configure update location and statistics server Set-ItemProperty -Path $WUPath -Name "WUServer" -Value $WSUSServer -Type String -Force Set-ItemProperty -Path $WUPath -Name "WUStatusServer" -Value $WSUSServer -Type String -Force Set-ItemProperty -Path $WUPath -Name "DoNotConnectToWindowsUpdateInternetLocations" -Value 1 -Type DWord -Force # 3. Configure Automatic Updates behavior (AUOptions = 4: Auto Download & Schedule) Set-ItemProperty -Path $WUAUPath -Name "NoAutoUpdate" -Value 0 -Type DWord -Force Set-ItemProperty -Path $WUAUPath -Name "AUOptions" -Value 4 -Type DWord -Force Set-ItemProperty -Path $WUAUPath -Name "UseWUServer" -Value 1 -Type DWord -Force # 4. Enforce DODownloadMode = 2 (Group) Set-ItemProperty -Path $DOPath -Name "DODownloadMode" -Value 2 -Type DWord -Force Write-Host "[+] Local WSUS parameters and Delivery Optimization download mode applied." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/enable-secure-boot.md Secure Boot is a security standard developed by members of the PC industry to help ensure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots, and the firmware gives control to the operating system. If Secure Boot is disabled: 1. Bootkits & Rootkits: Attackers with physical access or local administrator privileges can replace the system bootloader with a malicious bootloader (bootkit). This bootkit executes before the Windows operating system loads, allowing it to bypass all Windows security controls, disable antivirus software, and run completely undetected. 2. Virtualization-Based Security: Advanced Windows defenses (like Credential Guard and Device Guard) depend on hardware-rooted trust. If Secure Boot is disabled, Virtualization-Based Security (VBS) cannot verify platform integrity, rendering these protections ineffective. Option A: Manual UEFI Firmware Configuration (Preferred) UEFI Secure Boot must be enabled in the hardware firmware menu directly (BIOS settings) during system startup: Turn on or restart the workstation and access the UEFI utility screen by pressing the vendor-specific key during POST (typically Delete, F2, F10, or F12). Navigate to the Security or Secure Boot section: Ensure Secure Boot is set to Enabled*. Ensure the Secure Boot Mode is set to Deployed or User Mode* (not Setup Mode). Save the configuration and restart the workstation. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Since Secure Boot is a hardware firmware configuration, it cannot be turned on from within Windows using registry settings. However, you can programmatically audit the state of Secure Boot to flag non-compliant hardware. Run the following script to check the status of Secure Boot on the local machine: Download Script: Audit-SecureBoot.ps1 # Audit-SecureBoot.ps1 # Description: Queries UEFI Secure Boot parameters and audits UEFI Secure Boot status. Write-Host "--- Auditing UEFI Secure Boot ---" -ForegroundColor Cyan $script:NonCompliant = $false # 1. Verify boot environment type if ($env:firmware_type -eq "UEFI") { Write-Host " - Boot Environment Type: UEFI" -ForegroundColor Green } else { Write-Host " - VULNERABLE: System booted in Legacy BIOS mode (CSM enabled) or firmware type is unrecognized." -ForegroundColor Red $script:NonCompliant = $true } # 2. Verify Secure Boot status try { # Confirm-SecureBootUEFI returns $true if Secure Boot is active, $false if disabled, # and throws an exception if the platform does not support UEFI or Secure Boot. $SecureBootState = Confirm-SecureBootUEFI -ErrorAction Stop $Color = if ($SecureBootState -eq $true) { "Green" } else { "Red" } Write-Host " - Secure Boot Active: $SecureBootState" -ForegroundColor $Color if ($SecureBootState -eq $false) { $script:NonCompliant = $true } } catch [System.PlatformNotSupportedException] { Write-Host " - VULNERABLE: UEFI Secure Boot is not supported on this platform (Legacy BIOS mode)." -ForegroundColor Red $script:NonCompliant = $true } catch { # If cmdlet throws unauthorized access or not enabled error Write-Host " - VULNERABLE: Secure Boot is disabled in firmware or cannot be verified. Error: $($_.Exception.Message)" -ForegroundColor Red $script:NonCompliant = $true } if ($script:NonCompliant) { exit 1 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/enable-vbs-credential-guard.md Virtualization-Based Security (VBS) uses hardware virtualization features to create and isolate a secure region of memory from the normal operating system. Windows Defender Credential Guard runs inside this isolated VBS environment (known as the secure kernel). By moving NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and other domain credentials into this virtualized container, Credential Guard ensures they are inaccessible to the standard operating system. If VBS and Credential Guard are not enabled: 1. LSASS Access: Attackers running with administrative rights on the workstation can query the LSASS process memory space and extract Active Directory authentication tokens using memory-dumping tools (e.g., Mimikatz). 2. Pass-the-Hash / Pass-the-Ticket: Attackers can use the extracted hashes or Kerberos tickets to log on to other domain systems, leading to rapid lateral movement and domain compromise. Enforcing VBS and Credential Guard prevents in-memory credential harvesting, breaking the primary lateral movement escalation vector. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the setting: Policy*: Turn On Virtualization Based Security Setting*: Enabled Select Platform Security Level*: Secure Boot Virtualization Based Protection of Code Integrity*: Enabled with UEFI lock Credential Guard Configuration*: Enabled with UEFI lock Secure Launch Configuration*: Enabled Require UEFI Memory Attributes Table*: Enabled Note: The "Enabled with UEFI lock" setting ensures that an administrator cannot remotely disable Credential Guard via registry changes alone; it requires physical access to the machine to clear UEFI variables on reboot. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure registry keys to enable VBS and Credential Guard. Download Script: Enable-VBSCredentialGuard.ps1 # Enable-VBSCredentialGuard.ps1 # Configures local registry keys to activate VBS and Credential Guard. Write-Host "--- Enforcing VBS & Credential Guard ---" -ForegroundColor Cyan $DeviceGuardPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } # Enable Virtualization-Based Security (VBS) Set-ItemProperty -Path $DeviceGuardPath -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord # RequirePlatformSecurityFeatures = 1 (Secure Boot) Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord # HypervisorEnforcedCodeIntegrity = 1 (HVCI / Memory Integrity Enabled) Set-ItemProperty -Path $DeviceGuardPath -Name "HypervisorEnforcedCodeIntegrity" -Value 1 -Type DWord # LsaCfgFlags = 1 (Credential Guard Enabled with UEFI Lock) Set-ItemProperty -Path $DeviceGuardPath -Name "LsaCfgFlags" -Value 1 -Type DWord # ConfigureSystemGuardLaunch = 1 (Secure Launch Enabled) Set-ItemProperty -Path $DeviceGuardPath -Name "ConfigureSystemGuardLaunch" -Value 1 -Type DWord # HVCIMATRequired = 1 (Require UEFI Memory Attributes Table) Set-ItemProperty -Path $DeviceGuardPath -Name "HVCIMATRequired" -Value 1 -Type DWord Write-Host "[+] VBS and Credential Guard registry settings applied. (Reboot required)." -ForegroundColor Green To audit VBS and Credential Guard status using WMI: Download Script: Test-VBSCredentialGuard.ps1 # Test-VBSCredentialGuard.ps1 # Queries the local Win32_DeviceGuard class to verify active protection states. Write-Host "--- Auditing Virtualization-Based Security Baseline ---" -ForegroundColor Cyan try { $DG = Get-CimInstance -Namespace "Root\Microsoft\Windows\DeviceGuard" -ClassName "Win32_DeviceGuard" -ErrorAction Stop # SecurityServicesRunning: 1 = Credential Guard, 2 = HVCI $CredGuardRunning = $DG.SecurityServicesRunning -contains 1 $HvciRunning = $DG.SecurityServicesRunning -contains 2 $VbsColor = if ($DG.VirtualizationBasedSecurityStatus -eq 2) { "Green" } else { "Red" } $CredColor = if ($CredGuardRunning) { "Green" } else { "Red" } $HvciColor = if ($HvciRunning) { "Green" } else { "Red" } Write-Host " - VBS Status: $($DG.VirtualizationBasedSecurityStatus) (Required = 2 [Running])" -ForegroundColor $VbsColor Write-Host " - Credential Guard Running: $CredGuardRunning (Required = True)" -ForegroundColor $CredColor Write-Host " - Hypervisor Code Integrity Running: $HvciRunning (Required = True)" -ForegroundColor $HvciColor # Query registry properties for System Guard and UEFI MAT $SystemGuard = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" -Name "ConfigureSystemGuardLaunch" -ErrorAction SilentlyContinue).ConfigureSystemGuardLaunch $MatRequired = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" -Name "HVCIMATRequired" -ErrorAction SilentlyContinue).HVCIMATRequired $SgColor = if ($SystemGuard -eq 1) { "Green" } else { "Red" } $MatColor = if ($MatRequired -eq 1) { "Green" } else { "Red" } Write-Host " - System Guard Secure Launch: $SystemGuard (Required = 1)" -ForegroundColor $SgColor Write-Host " - UEFI Memory Attributes Table Required: $MatRequired (Required = 1)" -ForegroundColor $MatColor } catch { Write-Host " - VULNERABLE: DeviceGuard WMI class could not be queried. VBS is likely disabled." -ForegroundColor Red } # Enable-VBSCredentialGuard.ps1 # Configures local registry keys to activate VBS and Credential Guard. Write-Host "--- Enforcing VBS & Credential Guard ---" -ForegroundColor Cyan $DeviceGuardPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } # Enable Virtualization-Based Security (VBS) Set-ItemProperty -Path $DeviceGuardPath -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord # RequirePlatformSecurityFeatures = 1 (Secure Boot) Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord # HypervisorEnforcedCodeIntegrity = 1 (HVCI / Memory Integrity Enabled) Set-ItemProperty -Path $DeviceGuardPath -Name "HypervisorEnforcedCodeIntegrity" -Value 1 -Type DWord # LsaCfgFlags = 1 (Credential Guard Enabled with UEFI Lock) Set-ItemProperty -Path $DeviceGuardPath -Name "LsaCfgFlags" -Value 1 -Type DWord # ConfigureSystemGuardLaunch = 1 (Secure Launch Enabled) Set-ItemProperty -Path $DeviceGuardPath -Name "ConfigureSystemGuardLaunch" -Value 1 -Type DWord # HVCIMATRequired = 1 (Require UEFI Memory Attributes Table) Set-ItemProperty -Path $DeviceGuardPath -Name "HVCIMATRequired" -Value 1 -Type DWord Write-Host "[+] VBS and Credential Guard registry settings applied. (Reboot required)." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations. Operating Systems: Windows 10 (and above) Enterprise/Professional. File Path: 08-endpoints/configure-wdac.md Traditional signature-based antivirus solutions scan for known malware patterns. However, they are easily bypassed by custom, compiled executables, dynamic scripts, or zero-day payloads. Windows Defender Application Control (WDAC) is a kernel-enforced application control framework. Instead of asking "Is this file malicious?", WDAC asks "Is this file explicitly trusted?". If WDAC is not configured: 1. Payload Execution: Standard users can execute downloaded scripts (e.g., PowerShell, VBScript) or binary files, facilitating initial access. 2. Antivirus Bypass: Attackers can run obfuscated code, compile payloads on the target endpoint using built-in Windows compilers (e.g., csc.exe), or run memory injection scripts that standard antivirus signatures miss. Deploying a strict WDAC baseline ensures that only binaries and scripts signed by Microsoft, trusted system developers, or located in protected directories (such as Windows system folders) are allowed to execute. Option A: Group Policy Object (GPO) Configuration (Preferred) To deploy WDAC via Group Policy, the policy XML must first be generated, compiled, and placed in a shared intranet network share. 1. Generate and Compile the Policy (on a Reference Machine) Run the following PowerShell commands to generate the Microsoft Default Windows baseline policy: powershell # Generate the baseline policy XML New-CIPolicy -MultiplePolicyFormat -Level FilePublisher -FilePath "C:\WDAC\BaselinePolicy.xml" -UserPEs # Compile the XML policy into a binary CIP file ConvertFrom-CIPolicy -XmlFilePath "C:\WDAC\BaselinePolicy.xml" -BinaryFilePath "C:\WDAC\BaselinePolicy.cip" 2. Deploy the Policy via GPO Copy the compiled BaselinePolicy.cip file to a local secure directory on the target clients (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b) or host it on a network path. Open the Group Policy Management Console (gpmc.msc). Create or edit the GPO linked to your workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the setting: Policy*: Deploy Windows Defender Application Control Setting*: Enabled Code Integrity Policy File Path*: Enter the path to the policy file (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b or a UNC share path). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to generate a baseline WDAC policy, enable Audit Mode, and configure local registry parameters. Configure-WDACLocalPolicy.ps1 Download Script: Configure-WDACLocalPolicy.ps1 # Configure-WDACLocalPolicy.ps1 # Description: Generates a baseline local Code Integrity policy, sets it to Audit Mode, and compiles it. Write-Host "--- Configuring WDAC Local Policy Baseline ---" -ForegroundColor Cyan # Create working directories $WdacDir = "C:\Windows\System32\CodeIntegrity" if (-not (Test-Path $WdacDir)) { New-Item -Path $WdacDir -ItemType Directory -Force | Out-Null } # 1. Generate the Default Windows Policy Write-Host "[+] Generating Default Windows code integrity rules..." -ForegroundColor Gray $PolicyXml = "C:\Windows\Temp\DefaultWindows.xml" $PolicyBin = "$WdacDir\SIPolicy.p7b" # Create a policy based on Microsoft's default rules (trusts Windows, Store, and Driver files) New-CIPolicy -FilePath $PolicyXml -Level Windows -UserPEs -ErrorAction Stop # 2. Set Policy to Audit Mode (Rule Option 3 represents Audit Mode) Write-Host "[+] Setting WDAC policy to Audit Mode for baseline logging..." -ForegroundColor Gray Set-RuleOption -FilePath $PolicyXml -Option 3 -ErrorAction SilentlyContinue # 3. Compile the XML into the binary policy expected by the bootloader Write-Host "[+] Compiling Code Integrity XML into SIPolicy.p7b..." -ForegroundColor Gray ConvertFrom-CIPolicy -XmlFilePath $PolicyXml -BinaryFilePath $PolicyBin -ErrorAction Stop # Cleanup temp files if (Test-Path $PolicyXml) { Remove-Item $PolicyXml -Force } Write-Host "[+] Local WDAC baseline policy configured. Reboot required." -ForegroundColor Green To audit the running WDAC policy states: Test-WDACStatus.ps1 Download Script: Test-WDACStatus.ps1 # Test-WDACStatus.ps1 # Description: Audits the local system to check if Code Integrity policies and HVCI are active. Write-Host "--- Auditing WDAC State ---" -ForegroundColor Cyan $Vulnerable = $false # 1. Query WMI class for Code Integrity status try { $CI = Get-CimInstance -Namespace "Root\Microsoft\Windows\CI" -ClassName "MSFT_Sipolicy" -ErrorAction Stop if ($null -ne $CI -and $CI.Count -gt 0) { Write-Host "`n[+] Found $($CI.Count) active Code Integrity policies." -ForegroundColor Green foreach ($Policy in $CI) { Write-Host " - Policy: $($Policy.FriendlyName) | ID: $($Policy.PolicyID) | Enforced: $($Policy.EnforcementMode)" -ForegroundColor Green } } else { Write-Host "`n[-] No active Code Integrity / WDAC policies detected via WMI." -ForegroundColor Yellow } } catch { Write-Host "`n[-] Could not query WMI MSFT_Sipolicy. This is expected if no WDAC policies are currently deployed." -ForegroundColor Gray } # 2. Check Memory Integrity (HVCI) configuration $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Memory Integrity (HVCI) is disabled in the registry." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: Memory Integrity scenario registry path does not exist." -ForegroundColor Red $Vulnerable = $true } # 3. Final Verdict if ($Vulnerable) { Write-Host "`n[!] Verification FAILED: One or more driver security controls are not configured." -ForegroundColor Red } else { Write-Host "`n[+] Verification PASSED: WDAC driver settings and HVCI are correctly configured." -ForegroundColor Green } # Configure-WDACLocalPolicy.ps1 # Description: Generates a baseline local Code Integrity policy, sets it to Audit Mode, and compiles it. Write-Host "--- Configuring WDAC Local Policy Baseline ---" -ForegroundColor Cyan # Create working directories $WdacDir = "C:\Windows\System32\CodeIntegrity" if (-not (Test-Path $WdacDir)) { New-Item -Path $WdacDir -ItemType Directory -Force | Out-Null } # 1. Generate the Default Windows Policy Write-Host "[+] Generating Default Windows code integrity rules..." -ForegroundColor Gray $PolicyXml = "C:\Windows\Temp\DefaultWindows.xml" $PolicyBin = "$WdacDir\SIPolicy.p7b" # Create a policy based on Microsoft's default rules (trusts Windows, Store, and Driver files) New-CIPolicy -FilePath $PolicyXml -Level Windows -UserPEs -ErrorAction Stop # 2. Set Policy to Audit Mode (Rule Option 3 represents Audit Mode) Write-Host "[+] Setting WDAC policy to Audit Mode for baseline logging..." -ForegroundColor Gray Set-RuleOption -FilePath $PolicyXml -Option 3 -ErrorAction SilentlyContinue # 3. Compile the XML into the binary policy expected by the bootloader Write-Host "[+] Compiling Code Integrity XML into SIPolicy.p7b..." -ForegroundColor Gray ConvertFrom-CIPolicy -XmlFilePath $PolicyXml -BinaryFilePath $PolicyBin -ErrorAction Stop # Cleanup temp files if (Test-Path $PolicyXml) { Remove-Item $PolicyXml -Force } Write-Host "[+] Local WDAC baseline policy configured. Reboot required." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations. Operating Systems: Windows 10 (and above) Enterprise/Professional. File Path: 08-endpoints/enable-bitlocker.md BitLocker Drive Encryption protects the operating system volume from offline attacks, data tampering, and data theft when the device is powered off or stolen. Without full disk encryption, an attacker with physical access to a workstation can extract the hard drive, mount it on a non-secure system, bypass operating system security controls, dump local password databases (SAM), and access cached domain credentials. Enforcing specific BitLocker startup parameters, such as a minimum PIN length of at least 6 characters, ensures that if a startup PIN is used, it cannot be easily brute-forced. Restricting how the TPM, startup keys, and PINs are configured ensures consistent security policy application. To maximize security, standard endpoints (Tier 2) should use BitLocker Network Unlock to prevent operational overhead in managing startup PINs for thousands of workstations. Option A: Group Policy and Server Configuration (Preferred) Step 1: Configure the WDS Server for Network Unlock Install the Windows Deployment Services (WDS) role on an internal Windows Server. In Server Manager, select Add Roles and Features and check BitLocker Network Unlock under Features. Open the Local PKI CA console (certsrv.msc) and issue a certificate using the BitLocker Network Unlock template. Export the certificate public key (.cer file) and export the private key (.pfx file). Import the .pfx private key certificate into the local WDS server's Local Computer\Personal certificate store. Restart the WDS service (wdssvc). Step 2: Distribute the Network Unlock Certificate via GPO Open the Group Policy Management Console (gpmc.msc). Edit your GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies Right-click BitLocker Network Unlock and select Add Network Unlock Certificate. Import the public .cer file exported in Step 1. Step 3: Enforce GPO BitLocker Settings Navigate to Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption and configure: 1. General Settings Policy: Allow Network Unlock at startup -> Enabled Policy: Configure minimum PIN length for startup -> Enabled (Minimum characters: 6) Policy: Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later) -> Enabled (OS, Fixed, and Removable: XTS-AES 256-bit) 2. Operating System Drives Navigate to Operating System Drives subfolder: Policy : `Require additional authentication at startup` -> Enabled Allow BitLocker without a compatible TPM -> Disabled (unchecked) `Configure TPM startup` -> Require TPM Configure TPM startup PIN -> Allow startup PIN with TPM (Allows Network Unlock auto-unlock) `Configure TPM startup key` -> Allow startup key with TPM Configure TPM startup key and PIN -> Allow startup key and PIN with TPM Policy : `Allow enhanced PINs for startup` -> Enabled Policy: Allow Secure Boot for integrity validation -> Enabled Policy : `Choose how BitLocker-protected operating system drives can be recovered` -> Enabled Allow data recovery agent -> Disabled (unchecked) `Configure user storage of BitLocker recovery information` -> Require 48-digit recovery password Configure user storage of BitLocker recovery key -> Do not allow 256-bit recovery key `Omit recovery options from the BitLocker setup wizard` -> Enabled (checked) Save BitLocker recovery information to AD DS for operating system drives -> Enabled (checked) `Configure storage of BitLocker recovery information to AD DS` -> Store recovery passwords and key packages Do not enable BitLocker until recovery information is stored to AD DS for operating system drives -> Enabled (checked) Policy : `Configure use of hardware-based encryption for operating system drives` -> Disabled Policy: Configure use of passwords for operating system drives -> Disabled 3. Fixed Data Drives Navigate to Fixed Data Drives subfolder: Policy : `Allow access to BitLocker-protected fixed data drives from earlier versions of Windows` -> Disabled Policy: Choose how BitLocker-protected fixed drives can be recovered -> Enabled `Allow data recovery agent` -> Enabled (checked) Configure user storage of BitLocker recovery information -> Allow 48-digit recovery password `Configure user storage of BitLocker recovery key` -> Allow 256-bit recovery key Omit recovery options from the BitLocker setup wizard -> Enabled (checked) `Save BitLocker recovery information to AD DS for fixed data drives` -> Enabled (checked - overridden per user decision) Configure storage of BitLocker recovery information to AD DS -> Backup recovery passwords and key packages `Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives` -> Enabled (checked - overridden to enforce AD backup) Policy: Configure use of hardware-based encryption for fixed data drives -> Disabled Policy : `Configure use of passwords for fixed data drives` -> Disabled Policy: Configure use of smart cards on fixed data drives -> Enabled `Require use of smart cards on fixed data drives` -> Enabled* (checked) 4. Removable Data Drives Navigate to Removable Data Drives subfolder: Policy : `Allow access to BitLocker-protected removable data drives from earlier versions of Windows` -> Disabled Policy: Choose how BitLocker-protected removable drives can be recovered -> Enabled `Allow data recovery agent` -> Enabled (checked) Configure user storage of BitLocker recovery information -> Do not allow 48-digit recovery password `Configure user storage of BitLocker recovery key` -> Do not allow 256-bit recovery key Omit recovery options from the BitLocker setup wizard -> Enabled (checked) `Save BitLocker recovery information to AD DS for removable data drives` -> Disabled (unchecked) Configure storage of BitLocker recovery information to AD DS -> Backup recovery passwords and key packages `Do not enable BitLocker until recovery information is stored to AD DS for removable data drives` -> Disabled (unchecked) Policy: Configure use of hardware-based encryption for removable data drives -> Disabled Policy : `Configure use of passwords for removable data drives` -> Disabled Policy: Configure use of smart cards on removable data drives -> Enabled `Require use of smart cards on removable data drives` -> Enabled (checked) Policy: Deny write access to removable drives not protected by BitLocker -> Enabled `Do not allow write access to devices configured in another organization` -> Disabled* (unchecked) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to audit and configure BitLocker parameters. Download Script: Set-BitLockerEncryption.ps1 # Set-BitLockerEncryption.ps1 # Enables BitLocker encryption locally, configures startup policies/PIN lengths, and backs up recovery keys to AD. Write-Host "--- Enforcing BitLocker Drive Encryption ---" -ForegroundColor Cyan # 1. Configure FVE Registry settings $FveRegPath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FveRegPath)) { New-Item -Path $FveRegPath -Force | Out-Null } # General Startup and Network Unlock settings Set-ItemProperty -Path $FveRegPath -Name "AllowNetworkUnlock" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "MinimumPIN" -Value 6 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseTPM" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseTPMPIN" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseTPMKey" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseTPMKeyPIN" -Value 2 -Type DWord -Force # OS Drive Settings (18.10.10.2.x) Set-ItemProperty -Path $FveRegPath -Name "UseEnhancedPin" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSAllowSecureBootForIntegrity" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSRecovery" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSManageDRA" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSRecoveryPassword" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSRecoveryKey" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSHideRecoveryPage" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSActiveDirectoryBackup" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSActiveDirectoryInfoToStore" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSRequireActiveDirectoryBackup" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSHardwareEncryption" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSPassphrase" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseAdvancedStartup" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "EnableBDEWithNoTPM" -Value 0 -Type DWord -Force # Fixed Drive Settings (18.10.10.1.x) Set-ItemProperty -Path $FveRegPath -Name "FDVDiscoveryVolumeType" -Value "" -Type String -Force Set-ItemProperty -Path $FveRegPath -Name "FDVRecovery" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVManageDRA" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVRecoveryPassword" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVRecoveryKey" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVHideRecoveryPage" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVActiveDirectoryBackup" -Value 1 -Type DWord -Force # Overridden to enable AD backups Set-ItemProperty -Path $FveRegPath -Name "FDVActiveDirectoryInfoToStore" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVRequireActiveDirectoryBackup" -Value 1 -Type DWord -Force # Overridden to require AD backups Set-ItemProperty -Path $FveRegPath -Name "FDVHardwareEncryption" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVPassphrase" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVAllowUserCert" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVEnforceUserCert" -Value 1 -Type DWord -Force # Removable Drive Settings (18.10.10.3.x) Set-ItemProperty -Path $FveRegPath -Name "RDVDiscoveryVolumeType" -Value "" -Type String -Force Set-ItemProperty -Path $FveRegPath -Name "RDVRecovery" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVManageDRA" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVRecoveryPassword" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVRecoveryKey" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVHideRecoveryPage" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVActiveDirectoryBackup" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVActiveDirectoryInfoToStore" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVRequireActiveDirectoryBackup" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVHardwareEncryption" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVPassphrase" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVAllowUserCert" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVEnforceUserCert" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVDenyCrossOrg" -Value 0 -Type DWord -Force # Removable Drive Write Blocks (System FVE Policies) $FveSystemPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" if (-not (Test-Path $FveSystemPath)) { New-Item -Path $FveSystemPath -Force | Out-Null } Set-ItemProperty -Path $FveSystemPath -Name "RDVDenyWriteAccess" -Value 1 -Type DWord -Force Write-Host "[+] BitLocker startup authentication and volume encryption policies configured." -ForegroundColor Green # 2. Enable BitLocker on C: drive using TPM protection $Volume = Get-BitLockerVolume -MountPoint "C:" # Check if protection is already active if ($Volume.ProtectionStatus -eq "Off") { Write-Host "[+] Activating BitLocker on C: drive using XTS-AES 256 encryption..." -ForegroundColor Gray # Enable BitLocker and backup recovery password protector to Active Directory Enable-BitLocker -MountPoint "C:" ` -EncryptionMethod XtsAes256 ` -UsedSpaceOnly ` -TpmProtector ` -AdBackupRequired Write-Host "[+] BitLocker encryption initiated. Recovery key backed up to AD." -ForegroundColor Green } else { Write-Host "[+] BitLocker is already enabled on C: (Protection Status: $($Volume.ProtectionStatus))." -ForegroundColor Green } To audit local BitLocker and Network Unlock registry settings: Download Script: Test-BitLockerStatus.ps1 # Test-BitLockerStatus.ps1 # Audits current BitLocker protection state, key protector types, and Network Unlock/Startup PIN configuration. Write-Host "--- Auditing BitLocker Status ---" -ForegroundColor Cyan # 1. Query local BitLocker state $Volume = Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue if ($Volume) { $StatusColor = if ($Volume.ProtectionStatus -eq "On") { "Green" } else { "Red" } Write-Host " - Protection Status: $($Volume.ProtectionStatus)" -ForegroundColor $StatusColor Write-Host " - Encryption Method: $($Volume.EncryptionMethod)" -ForegroundColor White Write-Host "`n[+] Active Key Protectors:" -ForegroundColor Yellow foreach ($Protector in $Volume.KeyProtector) { Write-Host " - Type: $($Protector.KeyProtectorType) | ID: $($Protector.KeyProtectorId)" -ForegroundColor White } } else { Write-Error "BitLocker volume information could not be retrieved." } # 2. Check Network Unlock and Startup Authentication registry configuration $FveRegPath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" $FveSysPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" $Params = @( @{ Name = "AllowNetworkUnlock"; Expected = 1; Path = $FveRegPath }, @{ Name = "MinimumPIN"; Expected = 6; Path = $FveRegPath }, @{ Name = "UseTPM"; Expected = 2; Path = $FveRegPath }, @{ Name = "UseTPMPIN"; Expected = 2; Path = $FveRegPath }, @{ Name = "UseTPMKey"; Expected = 2; Path = $FveRegPath }, @{ Name = "UseTPMKeyPIN"; Expected = 2; Path = $FveRegPath }, # OS Drives @{ Name = "UseEnhancedPin"; Expected = 1; Path = $FveRegPath }, @{ Name = "OSAllowSecureBootForIntegrity"; Expected = 1; Path = $FveRegPath }, @{ Name = "OSRecovery"; Expected = 1; Path = $FveRegPath }, @{ Name = "OSManageDRA"; Expected = 0; Path = $FveRegPath }, @{ Name = "OSRecoveryPassword"; Expected = 1; Path = $FveRegPath }, @{ Name = "OSRecoveryKey"; Expected = 0; Path = $FveRegPath }, @{ Name = "OSHideRecoveryPage"; Expected = 1; Path = $FveRegPath }, @{ Name = "OSActiveDirectoryBackup"; Expected = 1; Path = $FveRegPath }, @{ Name = "OSActiveDirectoryInfoToStore"; Expected = 1; Path = $FveRegPath }, @{ Name = "OSRequireActiveDirectoryBackup"; Expected = 1; Path = $FveRegPath }, @{ Name = "OSHardwareEncryption"; Expected = 0; Path = $FveRegPath }, @{ Name = "OSPassphrase"; Expected = 0; Path = $FveRegPath }, @{ Name = "UseAdvancedStartup"; Expected = 1; Path = $FveRegPath }, @{ Name = "EnableBDEWithNoTPM"; Expected = 0; Path = $FveRegPath }, # Fixed Drives @{ Name = "FDVDiscoveryVolumeType"; Expected = ""; Path = $FveRegPath }, @{ Name = "FDVRecovery"; Expected = 1; Path = $FveRegPath }, @{ Name = "FDVManageDRA"; Expected = 1; Path = $FveRegPath }, @{ Name = "FDVRecoveryPassword"; Expected = 2; Path = $FveRegPath }, @{ Name = "FDVRecoveryKey"; Expected = 2; Path = $FveRegPath }, @{ Name = "FDVHideRecoveryPage"; Expected = 1; Path = $FveRegPath }, @{ Name = "FDVActiveDirectoryBackup"; Expected = 1; Path = $FveRegPath }, @{ Name = "FDVActiveDirectoryInfoToStore"; Expected = 1; Path = $FveRegPath }, @{ Name = "FDVRequireActiveDirectoryBackup"; Expected = 1; Path = $FveRegPath }, @{ Name = "FDVHardwareEncryption"; Expected = 0; Path = $FveRegPath }, @{ Name = "FDVPassphrase"; Expected = 0; Path = $FveRegPath }, @{ Name = "FDVAllowUserCert"; Expected = 1; Path = $FveRegPath }, @{ Name = "FDVEnforceUserCert"; Expected = 1; Path = $FveRegPath }, # Removable Drives @{ Name = "RDVDiscoveryVolumeType"; Expected = ""; Path = $FveRegPath }, @{ Name = "RDVRecovery"; Expected = 1; Path = $FveRegPath }, @{ Name = "RDVManageDRA"; Expected = 1; Path = $FveRegPath }, @{ Name = "RDVRecoveryPassword"; Expected = 0; Path = $FveRegPath }, @{ Name = "RDVRecoveryKey"; Expected = 0; Path = $FveRegPath }, @{ Name = "RDVHideRecoveryPage"; Expected = 1; Path = $FveRegPath }, @{ Name = "RDVActiveDirectoryBackup"; Expected = 0; Path = $FveRegPath }, @{ Name = "RDVActiveDirectoryInfoToStore"; Expected = 1; Path = $FveRegPath }, @{ Name = "RDVRequireActiveDirectoryBackup"; Expected = 0; Path = $FveRegPath }, @{ Name = "RDVHardwareEncryption"; Expected = 0; Path = $FveRegPath }, @{ Name = "RDVPassphrase"; Expected = 0; Path = $FveRegPath }, @{ Name = "RDVAllowUserCert"; Expected = 1; Path = $FveRegPath }, @{ Name = "RDVEnforceUserCert"; Expected = 1; Path = $FveRegPath }, @{ Name = "RDVDenyCrossOrg"; Expected = 0; Path = $FveRegPath }, @{ Name = "RDVDenyWriteAccess"; Expected = 1; Path = $FveSysPath } ) Write-Host "`n[*] Auditing BitLocker settings:" -ForegroundColor Yellow $script:Vulnerable = $false foreach ($Param in $Params) { if (Test-Path $Param.Path) { $Val = Get-ItemProperty -Path $Param.Path -Name $Param.Name -ErrorAction SilentlyContinue $ActualVal = if ($Val) { $Val.$($Param.Name) } else { $null } $IsMatch = $false if ($Param.Expected -eq "") { $IsMatch = ($null -eq $ActualVal -or $ActualVal -eq "") } else { $IsMatch = ($ActualVal -eq $Param.Expected) } $Color = if ($IsMatch) { "Green" } else { "Red" } if (-not $IsMatch) { $script:Vulnerable = $true } Write-Host " - $($Param.Name): $ActualVal (Expected = $($Param.Expected))" -ForegroundColor $Color } else { Write-Host " - Policy key $($Param.Path) does not exist." -ForegroundColor Red $script:Vulnerable = $true } } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green } # Set-BitLockerEncryption.ps1 # Enables BitLocker encryption locally, configures startup policies/PIN lengths, and backs up recovery keys to AD. Write-Host "--- Enforcing BitLocker Drive Encryption ---" -ForegroundColor Cyan # 1. Configure FVE Registry settings $FveRegPath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FveRegPath)) { New-Item -Path $FveRegPath -Force | Out-Null } # General Startup and Network Unlock settings Set-ItemProperty -Path $FveRegPath -Name "AllowNetworkUnlock" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "MinimumPIN" -Value 6 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseTPM" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseTPMPIN" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseTPMKey" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseTPMKeyPIN" -Value 2 -Type DWord -Force # OS Drive Settings (18.10.10.2.x) Set-ItemProperty -Path $FveRegPath -Name "UseEnhancedPin" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSAllowSecureBootForIntegrity" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSRecovery" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSManageDRA" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSRecoveryPassword" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSRecoveryKey" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSHideRecoveryPage" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSActiveDirectoryBackup" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSActiveDirectoryInfoToStore" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSRequireActiveDirectoryBackup" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSHardwareEncryption" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "OSPassphrase" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "UseAdvancedStartup" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "EnableBDEWithNoTPM" -Value 0 -Type DWord -Force # Fixed Drive Settings (18.10.10.1.x) Set-ItemProperty -Path $FveRegPath -Name "FDVDiscoveryVolumeType" -Value "" -Type String -Force Set-ItemProperty -Path $FveRegPath -Name "FDVRecovery" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVManageDRA" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVRecoveryPassword" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVRecoveryKey" -Value 2 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVHideRecoveryPage" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVActiveDirectoryBackup" -Value 1 -Type DWord -Force # Overridden to enable AD backups Set-ItemProperty -Path $FveRegPath -Name "FDVActiveDirectoryInfoToStore" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVRequireActiveDirectoryBackup" -Value 1 -Type DWord -Force # Overridden to require AD backups Set-ItemProperty -Path $FveRegPath -Name "FDVHardwareEncryption" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVPassphrase" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVAllowUserCert" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "FDVEnforceUserCert" -Value 1 -Type DWord -Force # Removable Drive Settings (18.10.10.3.x) Set-ItemProperty -Path $FveRegPath -Name "RDVDiscoveryVolumeType" -Value "" -Type String -Force Set-ItemProperty -Path $FveRegPath -Name "RDVRecovery" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVManageDRA" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVRecoveryPassword" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVRecoveryKey" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVHideRecoveryPage" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVActiveDirectoryBackup" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVActiveDirectoryInfoToStore" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVRequireActiveDirectoryBackup" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVHardwareEncryption" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVPassphrase" -Value 0 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVAllowUserCert" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVEnforceUserCert" -Value 1 -Type DWord -Force Set-ItemProperty -Path $FveRegPath -Name "RDVDenyCrossOrg" -Value 0 -Type DWord -Force # Removable Drive Write Blocks (System FVE Policies) $FveSystemPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" if (-not (Test-Path $FveSystemPath)) { New-Item -Path $FveSystemPath -Force | Out-Null } Set-ItemProperty -Path $FveSystemPath -Name "RDVDenyWriteAccess" -Value 1 -Type DWord -Force Write-Host "[+] BitLocker startup authentication and volume encryption policies configured." -ForegroundColor Green # 2. Enable BitLocker on C: drive using TPM protection $Volume = Get-BitLockerVolume -MountPoint "C:" # Check if protection is already active if ($Volume.ProtectionStatus -eq "Off") { Write-Host "[+] Activating BitLocker on C: drive using XTS-AES 256 encryption..." -ForegroundColor Gray # Enable BitLocker and backup recovery password protector to Active Directory Enable-BitLocker -MountPoint "C:" ` -EncryptionMethod XtsAes256 ` -UsedSpaceOnly ` -TpmProtector ` -AdBackupRequired Write-Host "[+] BitLocker encryption initiated. Recovery key backed up to AD." -ForegroundColor Green } else { Write-Host "[+] BitLocker is already enabled on C: (Protection Status: $($Volume.ProtectionStatus))." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-005](../07-paws/configure-uefi-security.md); for Domain Controllers, refer to [REQ-DC-157](../02-domain-controllers/configure-uefi-security.md)). Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/configure-uefi-security.md Standard Tier 2 endpoints (such as corporate laptops and desktop workstations) and member servers are frequently exposed to physical theft, unauthorized local access in branch offices, or untrusted local networks. If system firmware remains unconfigured or relies on legacy BIOS modes, attackers can alter boot settings, subvert operating system security features, bypass disk encryption, or execute physical DMA and bootkit attacks. Option A: Manual UEFI Firmware Configuration (Preferred) UEFI settings must be configured directly within the hardware platform firmware interface during system startup. Turn on or restart the workstation and access the UEFI utility screen by pressing the vendor-specific key during POST (typically Delete, F2, F10, or F12). Navigate to the Security or Authentication section: Select the option to set the Administrator Password (also referred to as the Supervisor Password*). Do not configure a User Password, as that prompts for authentication on every boot rather than only when entering configuration settings. * Enter a strong, complex password. Record this password in the enterprise credential vault. Navigate to the Boot or System Configuration section: Locate the Boot Mode setting and set it to UEFI Only or Native UEFI*. Locate CSM (Compatibility Support Module) or Legacy Boot Support and set it to Disabled*. Locate Fast Boot or Quick Boot and set it to Disabled* (forcing complete POST diagnostics and full TPM initialization on every boot). Locate Boot Order (or Boot Priority*): * Set the primary boot option to the internal system storage drive (typically containing the Windows Boot Manager partition). * Disable unauthorized external boot devices (such as optical drives and unauthorized USB boot) or require the administrator password to boot from alternate media. * Enable the option to prompt for the UEFI administrator password if a user attempts to access the boot override menu (typically F12 or F8). Navigate to the Advanced, CPU Configuration, or Security Chip section: Locate Intel Virtualization Technology (VT-x) or AMD-V and set it to Enabled*. Locate Intel VT for Directed I/O (VT-d) or AMD IOMMU and set it to Enabled* (required for IOMMU/Kernel DMA Protection). Locate TPM 2.0 Device (or Security Chip / Intel PTT / AMD fTPM ) and set it to Enabled or Active* (with SHA-256 PCR bank). Navigate to the Security or Secure Boot section: Ensure Secure Boot is Enabled and the Secure Boot Mode is set to Deployed or User Mode*. Navigate to the Advanced or Firmware Update section: Locate the option for BIOS Flash Protection or Firmware Rollback Protection and set it to Enabled or Block Downgrades*. Save the configuration and restart the workstation. Option B: PowerShell Remediation & OS Boot Hardening Run the following script to configure OS-level boot parameters (disabling Windows Fast Startup, ensuring Device Guard platform flags), detect the hardware vendor, and provide enterprise OEM automation commands. Download Script: Set-UEFISecurity.ps1 # Set-UEFISecurity.ps1 # Description: Configures OS-level boot parameters and audits OEM firmware configuration for endpoints and member servers. Write-Host "--- Configuring Endpoint UEFI & Boot Security Baseline ---" -ForegroundColor Cyan # 1. Disable Windows Fast Startup (forces full cold boot and fresh TPM PCR measurements) $PowerPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" if (-not (Test-Path $PowerPath)) { New-Item -Path $PowerPath -Force | Out-Null } try { Set-ItemProperty -Path $PowerPath -Name "HiberbootEnabled" -Value 0 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Windows Fast Startup disabled (HiberbootEnabled = 0)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure HiberbootEnabled: $($_.Exception.Message)" -ForegroundColor Red } # 2. Configure Device Guard Platform Security Flags $DeviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } try { # 1 = Secure Boot, 3 = Secure Boot and DMA Protection Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Device Guard required platform security features configured (Value = 1)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure RequirePlatformSecurityFeatures: $($_.Exception.Message)" -ForegroundColor Red } # 3. Detect Hardware OEM and report vendor tooling commands $Bios = Get-CimInstance -ClassName Win32_Bios -ErrorAction SilentlyContinue Write-Host "`nOEM Firmware Detection:" -ForegroundColor Cyan Write-Host " Manufacturer: $($Bios.Manufacturer)" -ForegroundColor White Write-Host " BIOS Version: $($Bios.SMBIOSBIOSVersion)" -ForegroundColor White if ($Bios.Manufacturer -match "Dell") { Write-Host " [i] Dell Platform detected. Enterprise configuration via Dell Command | PowerShell Provider:" -ForegroundColor Yellow Write-Host " Import-Module DellBIOSProvider" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\Boot\BootMode 'UEFI'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\SecureBoot\SecureBoot 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\VirtualizationSupport\Virtualization 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\VirtualizationSupport\VtForDirectIO 'Enabled'" -ForegroundColor Gray } elseif ($Bios.Manufacturer -match "HP") { Write-Host " [i] HP Platform detected. Enterprise configuration via HP Client Management Script Library (HPCMSL):" -ForegroundColor Yellow Write-Host " Import-Module HPCMSL" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Boot Mode' -Value 'UEFI Native (without CSM)'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Secure Boot' -Value 'Enable'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Virtualization Technology' -Value 'Enable'" -ForegroundColor Gray } elseif ($Bios.Manufacturer -match "Lenovo") { Write-Host " [i] Lenovo Platform detected. Enterprise configuration via Lenovo BIOS WMI interface:" -ForegroundColor Yellow Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('BootMode,UEFI')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('SecureBoot,Enable')" -ForegroundColor Gray } Write-Host "`n[+] Remediation script completed." -ForegroundColor Green # Set-UEFISecurity.ps1 # Description: Configures OS-level boot parameters and audits OEM firmware configuration for endpoints and member servers. Write-Host "--- Configuring Endpoint UEFI & Boot Security Baseline ---" -ForegroundColor Cyan # 1. Disable Windows Fast Startup (forces full cold boot and fresh TPM PCR measurements) $PowerPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" if (-not (Test-Path $PowerPath)) { New-Item -Path $PowerPath -Force | Out-Null } try { Set-ItemProperty -Path $PowerPath -Name "HiberbootEnabled" -Value 0 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Windows Fast Startup disabled (HiberbootEnabled = 0)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure HiberbootEnabled: $($_.Exception.Message)" -ForegroundColor Red } # 2. Configure Device Guard Platform Security Flags $DeviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" if (-not (Test-Path $DeviceGuardPath)) { New-Item -Path $DeviceGuardPath -Force | Out-Null } try { # 1 = Secure Boot, 3 = Secure Boot and DMA Protection Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord -Force -ErrorAction Stop Write-Host "[+] Device Guard required platform security features configured (Value = 1)." -ForegroundColor Green } catch { Write-Host "[!] Failed to configure RequirePlatformSecurityFeatures: $($_.Exception.Message)" -ForegroundColor Red } # 3. Detect Hardware OEM and report vendor tooling commands $Bios = Get-CimInstance -ClassName Win32_Bios -ErrorAction SilentlyContinue Write-Host "`nOEM Firmware Detection:" -ForegroundColor Cyan Write-Host " Manufacturer: $($Bios.Manufacturer)" -ForegroundColor White Write-Host " BIOS Version: $($Bios.SMBIOSBIOSVersion)" -ForegroundColor White if ($Bios.Manufacturer -match "Dell") { Write-Host " [i] Dell Platform detected. Enterprise configuration via Dell Command | PowerShell Provider:" -ForegroundColor Yellow Write-Host " Import-Module DellBIOSProvider" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\Boot\BootMode 'UEFI'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\SecureBoot\SecureBoot 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\VirtualizationSupport\Virtualization 'Enabled'" -ForegroundColor Gray Write-Host " Set-Item -Path DellSmbios:\VirtualizationSupport\VtForDirectIO 'Enabled'" -ForegroundColor Gray } elseif ($Bios.Manufacturer -match "HP") { Write-Host " [i] HP Platform detected. Enterprise configuration via HP Client Management Script Library (HPCMSL):" -ForegroundColor Yellow Write-Host " Import-Module HPCMSL" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Boot Mode' -Value 'UEFI Native (without CSM)'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Secure Boot' -Value 'Enable'" -ForegroundColor Gray Write-Host " Set-HPBIOSSettingValue -Name 'Virtualization Technology' -Value 'Enable'" -ForegroundColor Gray } elseif ($Bios.Manufacturer -match "Lenovo") { Write-Host " [i] Lenovo Platform detected. Enterprise configuration via Lenovo BIOS WMI interface:" -ForegroundColor Yellow Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('BootMode,UEFI')" -ForegroundColor Gray Write-Host " (gwmi -class Lenovo_SetBiosSetting -namespace root\wmi).SetBiosSetting('SecureBoot,Enable')" -ForegroundColor Gray } Write-Host "`n[+] Remediation script completed." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (version 1803 and above) Enterprise/Professional, Windows 11 Enterprise/Professional, Windows Server 2019 (and above). File Path: 08-endpoints/enable-hardware-virtualization-and-dma-protection.md Direct Memory Access (DMA) allows hardware devices to read and write directly to physical system memory (RAM) over high-speed buses without CPU or operating system arbitration. External expansion ports—such as Thunderbolt 3, Thunderbolt 4, USB4, and hot-plug PCIe slots—expose internal PCI Express lanes directly to external peripherals. If external DMA interfaces are left unprotected, an attacker with physical access to an unattended, locked, or stolen endpoint can connect malicious hardware tools or implants (such as PCILeech or USB3380 DMA attack adapters) to perform drive-by physical DMA attacks. Through unrestricted DMA access, attackers can extract sensitive secrets directly from RAM—including BitLocker full-volume encryption keys, DPAPI master keys, LSASS authentication tokens, Kerberos tickets, and cached credentials—or write to memory to inject kernel payloads and bypass Windows lock screens. Configuring Kernel DMA Protection and enforcing strict external device enumeration mitigates this threat vector: 1. IOMMU Memory Isolation: Kernel DMA Protection utilizes the system's Input-Output Memory Management Unit (IOMMU: Intel VT-d or AMD-Vi) and ACPI DMAR tables to create hypervisor-enforced memory sandboxes for peripheral devices. For DMA-remapping-compatible devices, the operating system isolates device DMA transfers exclusively to the specific memory buffers allocated to that device's driver, blocking unauthorized access to adjacent physical RAM. 2. Mitigating Incompatible External Devices: External devices and drivers are classified into two categories: those that support DMA remapping and those that do not. If an incompatible or rogue peripheral without DMA-remapping support is connected, Windows default behavior may permit enumeration or delay it until user login. Setting the enumeration policy to Block All (DeviceEnumerationPolicy = 0) guarantees that any external device whose drivers do not explicitly support DMA remapping is unconditionally blocked from initializing, loading drivers, or executing DMA transfers. 3. Closing the Physical Hot-Plug Attack Surface: By blocking incompatible external DMA devices, the operating system ensures that only verified, DMA-remapping-compliant peripherals operate under strict hypervisor IOMMU containment, preventing drive-by memory dumping attacks while preserving device functionality for certified hardware. Option A: Group Policy Object (GPO) Configuration (Preferred) To enforce the Kernel DMA Protection external device enumeration policy across standard client workstations and member servers, implement the following GPO settings: Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the target workstations and member servers OUs (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Administrative Templates\System\Kernel DMA Protection Configure the following setting: Policy*: Enumeration policy for external devices incompatible with Kernel DMA Protection Setting*: Enabled Enumeration policy : Select Block All* (value 0) Link the GPO to the appropriate OUs. Note: For Kernel DMA Protection to operate with maximum security, ensure platform hardware virtualization and IOMMU extensions (Intel VT-d or AMD-Vi) are enabled in the UEFI configuration menu as outlined in [REQ-END-013 - UEFI Firmware Security Hardening](configure-uefi-security.md). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure local registry keys to enforce Kernel DMA Protection and programmatically audit the hardware security baseline. 1. Local Remediation (Enforce Kernel DMA Protection) Run the following script to configure the Kernel DMA Protection policy locally: Download Script: Configure-KernelDMAProtection.ps1 # Configure-KernelDMAProtection.ps1 # Description: Configures registry keys to enable Kernel DMA Protection and block incompatible external DMA devices. Write-Host "--- Enforcing Kernel DMA Protection ---" -ForegroundColor Cyan $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path -Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } # DeviceEnumerationPolicy = 0 (Block all external DMA devices incompatible with Kernel DMA Protection) Set-ItemProperty -Path $RegPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "Status: Kernel DMA Protection registry configuration applied (DeviceEnumerationPolicy = 0 [Block All])." -ForegroundColor Green 2. Local Audit (Kernel DMA Protection, IOMMU, and Hardware Baseline) Run the following script to audit the status of Kernel DMA Protection, IOMMU support, and the required hardware security components: Download Script: Audit-HardwareSecurityFeatures.ps1 # Audit-HardwareSecurityFeatures.ps1 # Description: Audits Kernel DMA Protection registry policy, hardware IOMMU/DMA status, VBS state, and TPM readiness. Write-Host "--- Auditing Kernel DMA Protection and Hardware Security Baseline ---" -ForegroundColor Cyan # 1. Audit Kernel DMA Protection Registry Policy $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" $EnumPolicy = Get-ItemProperty -Path $RegPath -Name "DeviceEnumerationPolicy" -ErrorAction SilentlyContinue if ($null -ne $EnumPolicy -and $EnumPolicy.DeviceEnumerationPolicy -eq 0) { Write-Host "Status: Kernel DMA Protection Policy (DeviceEnumerationPolicy): 0 (Block All) [COMPLIANT]" -ForegroundColor Green } else { $CurrentVal = if ($null -ne $EnumPolicy) { $EnumPolicy.DeviceEnumerationPolicy } else { "Not Configured" } Write-Host "VULNERABLE: Kernel DMA Protection Policy is '$($CurrentVal)'. Expected: 0 (Block All)." -ForegroundColor Red } # 2. Audit VBS and Hardware DMA/IOMMU Status via Win32_DeviceGuard try { $DG = Get-CimInstance -Namespace "Root\Microsoft\Windows\DeviceGuard" -ClassName "Win32_DeviceGuard" -ErrorAction Stop # VirtualizationBasedSecurityStatus: 2 = Running $VbsStatus = $DG.VirtualizationBasedSecurityStatus if ($VbsStatus -eq 2) { Write-Host "Status: Virtualization-Based Security (VBS) Status: 2 (Running) [COMPLIANT]" -ForegroundColor Green } else { Write-Host "VULNERABLE: Virtualization-Based Security (VBS) is not running (Status: $($VbsStatus))." -ForegroundColor Red } # AvailableSecurityProperties: 3 = DMA Protection (IOMMU) $DmaSupported = $DG.AvailableSecurityProperties -contains 3 if ($DmaSupported -eq $true) { Write-Host "Status: Hardware IOMMU / DMA Remapping Support: True [COMPLIANT]" -ForegroundColor Green } else { Write-Host "VULNERABLE: Hardware IOMMU / DMA Protection is not available on this platform." -ForegroundColor Red } # RequiredSecurityProperties: 3 = DMA Protection enforced $DmaEnforced = $DG.RequiredSecurityProperties -contains 3 if ($DmaEnforced -eq $true) { Write-Host "Status: DMA Protection Security Policy Enforced: True [COMPLIANT]" -ForegroundColor Green } else { Write-Host "Status: DMA Protection Security Policy Enforced: False [INFO]" -ForegroundColor Yellow } } catch { Write-Host "VULNERABLE: Win32_DeviceGuard WMI class could not be queried. VBS / Device Guard is inactive." -ForegroundColor Red } # 3. Audit TPM 2.0 Status $Tpm = Get-Tpm -ErrorAction SilentlyContinue if ($null -ne $Tpm) { if ($Tpm.TpmPresent -eq $true -and $Tpm.TpmReady -eq $true) { Write-Host "Status: TPM 2.0 Present: True | Ready: True [COMPLIANT]" -ForegroundColor Green } else { Write-Host "VULNERABLE: TPM Present: $($Tpm.TpmPresent) | Ready: $($Tpm.TpmReady) (Expected: Present and Ready)." -ForegroundColor Red } } else { Write-Host "VULNERABLE: TPM verification cmdlet failed." -ForegroundColor Red } # Configure-KernelDMAProtection.ps1 # Description: Configures registry keys to enable Kernel DMA Protection and block incompatible external DMA devices. Write-Host "--- Enforcing Kernel DMA Protection ---" -ForegroundColor Cyan $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path -Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } # DeviceEnumerationPolicy = 0 (Block all external DMA devices incompatible with Kernel DMA Protection) Set-ItemProperty -Path $RegPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "Status: Kernel DMA Protection registry configuration applied (DeviceEnumerationPolicy = 0 [Block All])." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/disable-wpbt.md The Windows Platform Binary Table (WPBT) is an ACPI firmware table that allows hardware manufacturers (OEMs) to execute proprietary binaries in kernel space during the Windows boot phase. Windows automatically extracts the binary from the table and runs it with system privileges before security software, third-party agents, or standard driver verifications are fully initialized. While designed to facilitate automated driver provisioning and anti-theft services, this mechanism represents a significant security risk: 1. Firmware-to-OS Attack Vector: Malicious actors utilizing UEFI rootkits, physical firmware flashing tools, or supply-chain firmware implants can compromise the WPBT table to execute arbitrary code at boot, bypassing Secure Boot and operating system-level integrity checks. 2. Privilege Escalation Risks: Historically, OEM software delivered via the WPBT has introduced high-severity local privilege escalation and remote code execution vulnerabilities due to inadequate code review or poor permission management. 3. Control and Transparency: Executing firmware-rooted binaries without administrative visibility or operating system validation bypasses normal software lifecycle and endpoint protection policies. Disabling WPBT execution prevents Windows from parsing the ACPI table and running the embedded software, mitigating boot-level integrity bypasses. Option A: Group Policy Object (GPO) Configuration (Preferred) Because there is no default ADMX administrative template to manage WPBT execution, the setting must be configured as a Registry Preference under the endpoint policy: Open the Group Policy Management Console (gpmc.msc) on a domain management host. Edit the GPO linked to your workstations Organizational Unit (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click Registry, select New -> Registry Item. Configure the following properties: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager Value name*: DisableWpbtExecution Value type*: REG_DWORD Value data*: 1 Click OK to save the preference. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script to configure the registry setting locally on the system: Download Script: Configure-DisableWpbt.ps1 # Configure-DisableWpbt.ps1 # Description: Disables Windows Platform Binary Table (WPBT) execution in the registry. Write-Host "Applying hardening requirement: Disable WPBT Execution..." -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" $ValueName = "DisableWpbtExecution" $ValueData = 1 if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord Write-Host "Registry setting DisableWpbtExecution configured to 1." -ForegroundColor Green To verify that the registry value is correctly enforced: Download Script: Get-WpbtStatus.ps1 # Get-WpbtStatus.ps1 # Description: Audits the registry state for WPBT execution prevention. Write-Host "--- Auditing WPBT Security Posture ---" -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" $ValueName = "DisableWpbtExecution" $RegistryValue = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($RegistryValue) { $Setting = $RegistryValue.DisableWpbtExecution if ($Setting -eq 1) { Write-Host "Status: WPBT execution is disabled (DisableWpbtExecution = 1)." -ForegroundColor Green } else { Write-Host "VULNERABLE: WPBT execution is enabled. Value is $($Setting)." -ForegroundColor Red } } else { Write-Host "VULNERABLE: DisableWpbtExecution registry value is not configured (defaulting to execution enabled)." -ForegroundColor Red } # Configure-DisableWpbt.ps1 # Description: Disables Windows Platform Binary Table (WPBT) execution in the registry. Write-Host "Applying hardening requirement: Disable WPBT Execution..." -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" $ValueName = "DisableWpbtExecution" $ValueData = 1 if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord Write-Host "Registry setting DisableWpbtExecution configured to 1." -ForegroundColor Green Target Scope: Applicable Systems: Member Servers, Tier 2 Clients (Workstations / Laptops). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-011](../07-paws/harden-dma-and-physical-security.md); for Domain Controllers, refer to [REQ-DC-158](../02-domain-controllers/harden-dma-and-physical-security.md)). Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/harden-dma-and-physical-security.md Physical access to an endpoint introduces distinct attack vectors that bypass traditional OS privilege separation: Direct Memory Access (DMA) Attacks: Hot-plug buses (such as FireWire, Thunderbolt, and USB4) permit connected peripherals to read and write directly to system memory without operating system mediation. Attackers connect specialized hardware (e.g., PCILeech) to exposed external ports to extract BitLocker encryption keys, NTLM hashes, or active session tokens directly from RAM: * Disabling the Serial Bus Protocol 2 (SBP-2) setup class ({d48179be-ec20-11d1-b6b8-00c04fa372a7}) blocks FireWire/IEEE 1394 DMA controllers. Blocking hardware device IDs `PCI\CC_0C0A` (Thunderbolt) and `PCI\CC_0C0010` (1394 OHCI FireWire) halts driver initialization for dangerous hot-plug controllers. (Note: On Tier 0 PAWs, additional legacy controller setup classes and CardBus/PCMCIA bridges are blocked under REQ-PAW-011).* * Enforcing DisableExternalDMAUnderLock prevents DMA requests while the workstation screen is locked. `DeviceEnumerationPolicy` set to Block all* (0) ensures devices lacking DMA-remapping isolation support cannot execute unauthorized memory access transfers. Cold Boot Attacks & Sleep Vulnerabilities: When an endpoint enters standby sleep states (S1-S3), system RAM remains powered and active. If an unattended laptop or desktop is stolen while in standby, an attacker can quickly reboot the machine or chill the DRAM chips to dump memory contents and retrieve BitLocker keys. Disabling standby forces systems to transition to Hibernation (S4)/Shutdown, where RAM contents are flushed to the BitLocker-encrypted disk and sealed by the TPM. Enforcing a password upon wake prevents unauthorized physical resumption. USB Data Exfiltration: Blocking write access to removable drives unless they are encrypted with BitLocker (RDVDenyWriteAccess) prevents users or malicious agents from copying confidential organizational data to unauthorized, unencrypted USB media. Setting RDVDenyCrossOrg = 0 enforces organization-wide BitLocker compliance. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO targeting endpoints (e.g., GPO_Hardening_DMA_Physical). Configure the following settings: 1. Power Management (Disable Standby & Require Wake Password) Navigate to: Computer Configuration\Administrative Templates\System\Power Management\Sleep Settings Policy : `Allow standby states (S1-S3) when sleeping (plugged in)` -> Disabled Policy: Allow standby states (S1-S3) when sleeping (on battery) -> Disabled Policy : `Require a password when a computer wakes (plugged in)` -> Enabled Policy: Require a password when a computer wakes (on battery) -> Enabled 2. BitLocker Removable Storage & DMA Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption Policy : `Disable new DMA devices when this computer is locked` -> Enabled Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives Policy : `Deny write access to removable drives not protected by BitLocker` -> Enabled Check Do not allow write access to devices configured in another organization -> Disabled (value 0 / False) 3. Device Installation Restrictions (Block SBP-2 Setup Class & PCI Device IDs) Navigate to: Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions Policy : `Prevent installation of devices using drivers that match these device setup classes` -> Enabled Click Show... and enter: {d48179be-ec20-11d1-b6b8-00c04fa372a7} Check Also apply to matching devices that are already installed -> Enabled (value 1 / True) Policy: Prevent installation of devices that match any of these device IDs -> Enabled Click Show... and enter: PCI\CC_0C0A `PCI\CC_0C0010` Check Also apply to matching devices that are already installed -> Enabled (value 1 / True) 4. Kernel DMA Protection (Block All) Navigate to: Computer Configuration\Administrative Templates\System\Kernel DMA Protection Policy : `Enable Kernel DMA Protection` -> Enabled Enumeration policy: Set to Block all (value 0) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to apply DMA, Sleep, Device Restriction, and BitLocker USB registry parameters. Download Script: Set-DMAPhysicalSecurity.ps1 # Set-DMAPhysicalSecurity.ps1 # Description: Hardens local registry keys to mitigate DMA attacks, disable standby sleep states, enforce wake password, and restrict unencrypted USB writing. Write-Host "Applying DMA and physical security hardening..." -ForegroundColor Cyan # 1. Disable Standby Sleep States (S1-S3) $SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" if (-not (Test-Path $SleepPath)) { New-Item -Path $SleepPath -Force | Out-Null } Set-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -Value 0 -Type DWord Set-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -Value 0 -Type DWord Write-Host "[+] Standby sleep states (S1-S3) disabled." -ForegroundColor Green # 2. Configure Wake Password Requirement $WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" if (-not (Test-Path $WakePath)) { New-Item -Path $WakePath -Force | Out-Null } Set-ItemProperty -Path $WakePath -Name "ACSettingIndex" -Value 1 -Type DWord Set-ItemProperty -Path $WakePath -Name "DCSettingIndex" -Value 1 -Type DWord Write-Host "[+] Wake password requirement enforced." -ForegroundColor Green # 3. BitLocker DMA and Removable Storage Settings $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FvePath)) { New-Item -Path $FvePath -Force | Out-Null } Set-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -Value 0 -Type DWord $FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" if (-not (Test-Path $FvePolicyPath)) { New-Item -Path $FvePolicyPath -Force | Out-Null } Set-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -Value 1 -Type DWord Write-Host "[+] BitLocker DMA under lock and unencrypted USB write blocks configured." -ForegroundColor Green # 4. Device Installation Restrictions (Block SBP-2 class and PCI device IDs) $RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" if (-not (Test-Path $RestrictPath)) { New-Item -Path $RestrictPath -Force | Out-Null } Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClassesRetroactive" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDsRetroactive" -Value 1 -Type DWord $DenyClassPath = Join-Path $RestrictPath "DenyDeviceClasses" if (-not (Test-Path $DenyClassPath)) { New-Item -Path $DenyClassPath -Force | Out-Null } Set-ItemProperty -Path $DenyClassPath -Name "1" -Value "{d48179be-ec20-11d1-b6b8-00c04fa372a7}" -Type String $DenyIDPath = Join-Path $RestrictPath "DenyDeviceIDs" if (-not (Test-Path $DenyIDPath)) { New-Item -Path $DenyIDPath -Force | Out-Null } Set-ItemProperty -Path $DenyIDPath -Name "1" -Value "PCI\CC_0C0A" -Type String Set-ItemProperty -Path $DenyIDPath -Name "2" -Value "PCI\CC_0C0010" -Type String Write-Host "[+] Device installation blocks for SBP-2 class, PCI\CC_0C0A, and PCI\CC_0C0010 enabled." -ForegroundColor Green # 5. Kernel DMA Protection (Block all external DMA) $KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $KDmaPath)) { New-Item -Path $KDmaPath -Force | Out-Null } Set-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "[+] Kernel DMA Protection DeviceEnumerationPolicy set to 0 (Block all)." -ForegroundColor Green Write-Host "DMA and physical security settings applied successfully." -ForegroundColor Green To audit local DMA and physical security configuration: Download Script: Test-DMAPhysicalSecurity.ps1 # Test-DMAPhysicalSecurity.ps1 # Description: Audits local registry configuration for standby settings, wake password, DMA protection under lock, USB restrictions, and blocked device setup classes/IDs. Write-Host "--- Auditing DMA and Physical Security ---" -ForegroundColor Cyan $isCompliant = $true # 1. Audit Standby Settings $SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" $AcSleep = Get-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -ErrorAction SilentlyContinue $DcSleep = Get-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -ErrorAction SilentlyContinue $AcSleepVal = if ($AcSleep) { $AcSleep.ACSettingIndex } else { 1 } $DcSleepVal = if ($DcSleep) { $DcSleep.DCSettingIndex } else { 1 } $AcSleepColor = if ($AcSleepVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } $DcSleepColor = if ($DcSleepVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Standby Sleep State (Plugged In) Setting: $($AcSleepVal) (Required = 0 [Disabled])" -ForegroundColor $AcSleepColor Write-Host " - Standby Sleep State (On Battery) Setting: $($DcSleepVal) (Required = 0 [Disabled])" -ForegroundColor $DcSleepColor # 2. Audit Wake Password Requirement $WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" $AcWake = Get-ItemProperty -Path $WakePath -Name "ACSettingIndex" -ErrorAction SilentlyContinue $DcWake = Get-ItemProperty -Path $WakePath -Name "DCSettingIndex" -ErrorAction SilentlyContinue $AcWakeVal = if ($AcWake) { $AcWake.ACSettingIndex } else { 0 } $DcWakeVal = if ($DcWake) { $DcWake.DCSettingIndex } else { 0 } $AcWakeColor = if ($AcWakeVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } $DcWakeColor = if ($DcWakeVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Wake Password Required (Plugged In): $($AcWakeVal) (Required = 1 [Enabled])" -ForegroundColor $AcWakeColor Write-Host " - Wake Password Required (On Battery): $($DcWakeVal) (Required = 1 [Enabled])" -ForegroundColor $DcWakeColor # 3. Audit BitLocker Settings $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" $DmaLock = Get-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -ErrorAction SilentlyContinue $DmaLockVal = if ($DmaLock) { $DmaLock.DisableExternalDMAUnderLock } else { 0 } $DmaLockColor = if ($DmaLockVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } $CrossOrg = Get-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -ErrorAction SilentlyContinue $CrossOrgVal = if ($CrossOrg) { $CrossOrg.RDVDenyCrossOrg } else { 1 } $CrossOrgColor = if ($CrossOrgVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } $FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" $UsbWrite = Get-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -ErrorAction SilentlyContinue $UsbWriteVal = if ($UsbWrite) { $UsbWrite.RDVDenyWriteAccess } else { 0 } $UsbWriteColor = if ($UsbWriteVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Disable DMA Under Lock: $($DmaLockVal) (Required = 1)" -ForegroundColor $DmaLockColor Write-Host " - USB Deny Cross Org Removable Drives: $($CrossOrgVal) (Required = 0)" -ForegroundColor $CrossOrgColor Write-Host " - USB Unencrypted Write Block: $($UsbWriteVal) (Required = 1)" -ForegroundColor $UsbWriteColor # 4. Audit Device Restriction Settings $RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" $DenyDev = Get-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -ErrorAction SilentlyContinue $DenyDevVal = if ($DenyDev) { $DenyDev.DenyDeviceClasses } else { 0 } $DenyDevColor = if ($DenyDevVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } $DenyID = Get-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -ErrorAction SilentlyContinue $DenyIDVal = if ($DenyID) { $DenyID.DenyDeviceIDs } else { 0 } $DenyIDColor = if ($DenyIDVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Prevent Device Setup Class Installation: $($DenyDevVal) (Required = 1)" -ForegroundColor $DenyDevColor Write-Host " - Prevent Device ID Installation: $($DenyIDVal) (Required = 1)" -ForegroundColor $DenyIDColor $DenyClassPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses" $Sbp2 = Get-ItemProperty -Path $DenyClassPath -Name "1" -ErrorAction SilentlyContinue $Sbp2Val = if ($Sbp2) { $Sbp2."1" } else { "" } $Sbp2Color = if ($Sbp2Val -eq "{d48179be-ec20-11d1-b6b8-00c04fa372a7}") { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Blocked SBP-2 Setup Class: '$($Sbp2Val)' (Required = '{d48179be-ec20-11d1-b6b8-00c04fa372a7}')" -ForegroundColor $Sbp2Color $DenyIDPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs" $DId1 = Get-ItemProperty -Path $DenyIDPath -Name "1" -ErrorAction SilentlyContinue $DId1Val = if ($DId1) { $DId1."1" } else { "" } $DId1Color = if ($DId1Val -eq "PCI\CC_0C0A") { "Green" } else { $isCompliant = $false; "Red" } $DId2 = Get-ItemProperty -Path $DenyIDPath -Name "2" -ErrorAction SilentlyContinue $DId2Val = if ($DId2) { $DId2."2" } else { "" } $DId2Color = if ($DId2Val -eq "PCI\CC_0C0010") { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Blocked Device ID PCI\CC_0C0A: '$($DId1Val)' (Required = 'PCI\CC_0C0A')" -ForegroundColor $DId1Color Write-Host " - Blocked Device ID PCI\CC_0C0010: '$($DId2Val)' (Required = 'PCI\CC_0C0010')" -ForegroundColor $DId2Color # 5. Audit Kernel DMA Protection Setting $KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" $EnumPol = Get-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -ErrorAction SilentlyContinue $EnumPolVal = if ($EnumPol) { $EnumPol.DeviceEnumerationPolicy } else { 2 } $EnumPolColor = if ($EnumPolVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" } Write-Host " - Kernel DMA Protection Policy: $($EnumPolVal) (Required = 0 [Block all])" -ForegroundColor $EnumPolColor # 6. Final Compliance Assessment if ($isCompliant) { Write-Host "[+] Audit Result: SECURE - Endpoint DMA and physical security controls are fully compliant." -ForegroundColor Green } else { Write-Host "[-] Audit Result: VULNERABLE - One or more endpoint DMA or physical security settings do not meet baseline requirements." -ForegroundColor Red } # Set-DMAPhysicalSecurity.ps1 # Description: Hardens local registry keys to mitigate DMA attacks, disable standby sleep states, enforce wake password, and restrict unencrypted USB writing. Write-Host "Applying DMA and physical security hardening..." -ForegroundColor Cyan # 1. Disable Standby Sleep States (S1-S3) $SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" if (-not (Test-Path $SleepPath)) { New-Item -Path $SleepPath -Force | Out-Null } Set-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -Value 0 -Type DWord Set-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -Value 0 -Type DWord Write-Host "[+] Standby sleep states (S1-S3) disabled." -ForegroundColor Green # 2. Configure Wake Password Requirement $WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51" if (-not (Test-Path $WakePath)) { New-Item -Path $WakePath -Force | Out-Null } Set-ItemProperty -Path $WakePath -Name "ACSettingIndex" -Value 1 -Type DWord Set-ItemProperty -Path $WakePath -Name "DCSettingIndex" -Value 1 -Type DWord Write-Host "[+] Wake password requirement enforced." -ForegroundColor Green # 3. BitLocker DMA and Removable Storage Settings $FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE" if (-not (Test-Path $FvePath)) { New-Item -Path $FvePath -Force | Out-Null } Set-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -Value 1 -Type DWord Set-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -Value 0 -Type DWord $FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE" if (-not (Test-Path $FvePolicyPath)) { New-Item -Path $FvePolicyPath -Force | Out-Null } Set-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -Value 1 -Type DWord Write-Host "[+] BitLocker DMA under lock and unencrypted USB write blocks configured." -ForegroundColor Green # 4. Device Installation Restrictions (Block SBP-2 class and PCI device IDs) $RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" if (-not (Test-Path $RestrictPath)) { New-Item -Path $RestrictPath -Force | Out-Null } Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClassesRetroactive" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -Value 1 -Type DWord Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDsRetroactive" -Value 1 -Type DWord $DenyClassPath = Join-Path $RestrictPath "DenyDeviceClasses" if (-not (Test-Path $DenyClassPath)) { New-Item -Path $DenyClassPath -Force | Out-Null } Set-ItemProperty -Path $DenyClassPath -Name "1" -Value "{d48179be-ec20-11d1-b6b8-00c04fa372a7}" -Type String $DenyIDPath = Join-Path $RestrictPath "DenyDeviceIDs" if (-not (Test-Path $DenyIDPath)) { New-Item -Path $DenyIDPath -Force | Out-Null } Set-ItemProperty -Path $DenyIDPath -Name "1" -Value "PCI\CC_0C0A" -Type String Set-ItemProperty -Path $DenyIDPath -Name "2" -Value "PCI\CC_0C0010" -Type String Write-Host "[+] Device installation blocks for SBP-2 class, PCI\CC_0C0A, and PCI\CC_0C0010 enabled." -ForegroundColor Green # 5. Kernel DMA Protection (Block all external DMA) $KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection" if (-not (Test-Path $KDmaPath)) { New-Item -Path $KDmaPath -Force | Out-Null } Set-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord Write-Host "[+] Kernel DMA Protection DeviceEnumerationPolicy set to 0 (Block all)." -ForegroundColor Green Write-Host "DMA and physical security settings applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/configure-exploit-protection.md Exploit Protection (the successor to the Enhanced Mitigation Experience Toolkit, or EMET) provides a set of advanced memory and vulnerability mitigations. These mitigations protect both the operating system and applications from memory corruption, buffer overflows, execution redirection, and process hijack attempts. By enforcing system-wide mitigations: 1. Data Execution Prevention (DEP): Enforces non-executable memory pages, preventing attackers from executing shellcode injected into data-only memory regions (such as the stack or heap). 2. Address Space Layout Randomization (ASLR): Randomizes the locations where system components, executable code, and memory allocations are loaded. Enabling Mandatory ASLR (Force Relocate Images), Bottom-Up ASLR, and High Entropy ASLR makes memory structures unpredictable, thwarting return-oriented programming (ROP) exploits. 3. Control Flow Guard (CFG): Verifies control flow integrity for indirect call targets at compile time, preventing attackers from hijacking indirect jumps to point to arbitrary payloads. 4. Structured Exception Handler Overwrite Protection (SEHOP): Blocks exploits that overwrite Structured Exception Handlers (SEH) to gain control of execution paths during error handling. 5. Heap Termination on Corruption: Immediately terminates a process if corruption is detected in its heap. This blocks heap-based buffer overflow exploitation before execution control can be seized. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Generate the Reference XML Configuration File Before configuring the GPO, you must create a reference XML file containing the desired Exploit Protection mitigations: 1. On a reference workstation, open the Windows Security app. 2. Select App & browser control and click Exploit protection settings. 3. Under the System settings tab, configure the following: Control Flow Guard (CFG) : On by default Data Execution Prevention (DEP): On by default Force randomization for images (Mandatory ASLR) : On by default Randomize memory allocations (Bottom-up ASLR): On by default High-entropy ASLR : On by default Validate exception chains (SEHOP): On by default Validate heap integrity : On by default 4. Select the Program settings tab and configure application-specific overrides for Microsoft Office (`winword.exe`, `excel.exe`, etc.), Web Browsers, and PDF viewers to apply EAF, IAF, and ROP mitigations. 5. Scroll to the bottom of the page and click Export settings*. 6. Save the file as ExploitProtectionSettings.xml. 7. Copy this XML file to a location accessible by target endpoints, or distribute it to local target directories (e.g., C:\ProgramData\ExploitProtection\ExploitProtectionSettings.xml) via Group Policy Preferences (Files). Step 2: Configure the Group Policy Setting Open the Group Policy Management Console (gpmc.msc) on a management workstation. Create a new GPO or edit an existing one (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Exploit Guard\Exploit Protection Configure the following setting: Policy*: Use a common set of exploit protection settings Setting*: Enabled Options : Under the Path or Url* field, enter the full path to the XML file (e.g., C:\ProgramData\ExploitProtection\ExploitProtectionSettings.xml or a UNC share path). If utilizing Microsoft Security Guide templates: * Navigate to: Computer Configuration\Administrative Templates\MS Security Guide * Configure policies: Policy : `Enable Certificate Padding` -> Set to Enabled Policy : `Enable Structured Exception Handling Overwrite Protection (SEHOP)` -> Set to Enabled Lock down Exploit Protection settings against user tampering: * Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Security Center\App and Browser protection Configure policy: Prevent users from modifying settings -> Set to Enabled Link the GPO to the appropriate Organizational Unit (OU) containing the target client endpoints and member servers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the exploit protection profile locally on individual systems or standalone hosts. Download Script: Configure-ExploitProtection.ps1 # Configure-ExploitProtection.ps1 # Description: Generates the system-wide and application-specific Exploit Protection XML profile, applies it locally, and configures the policy registry keys. Write-Host "Applying Exploit Protection Profile..." -ForegroundColor Cyan # 1. Define the XML content including System and App settings $XmlContent = @" <?xml version="1.0" encoding="utf-8"?> <MitigationPolicy> <SystemConfig> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <SEHOP Enable="true" TelemetryOnly="false" /> <Heap TerminateOnError="true" /> </SystemConfig> <AppConfig Executable="WINWORD.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="EXCEL.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="POWERPNT.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="OUTLOOK.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="MSACCESS.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="MSPUB.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="VISIO.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="LYNC.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="AcroRd32.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="Acrobat.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="chrome.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> <AppConfig Executable="msedge.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> <AppConfig Executable="firefox.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> <AppConfig Executable="wscript.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="cscript.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="powershell.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> <AppConfig Executable="java.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> </AppConfig> <AppConfig Executable="javaw.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> </AppConfig> <AppConfig Executable="javaws.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> </AppConfig> </MitigationPolicy> "@ # 2. Create the target directory and write the XML file $TargetDir = "C:\ProgramData\ExploitProtection" if (-not (Test-Path $TargetDir)) { New-Item -Path $TargetDir -ItemType Directory -Force | Out-Null } $XmlPath = "$TargetDir\ExploitProtectionSettings.xml" Set-Content -Path $XmlPath -Value $XmlContent -Encoding UTF8 Write-Host "Exploit Protection XML profile written to $($XmlPath)" -ForegroundColor Gray # 3. Apply the settings locally using the cmdlet if (Get-Command Set-ProcessMitigation -ErrorAction SilentlyContinue) { Set-ProcessMitigation -PolicyFilePath $XmlPath Write-Host "[+] Exploit protection system settings applied locally." -ForegroundColor Green } else { Write-Warning "Set-ProcessMitigation cmdlet is not available. Please ensure you are running Windows 10/11 or Windows Server 2016+." } # 4. Configure policy registry keys to point to the XML file $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "ExploitProtectionSettings" -Value $XmlPath -Type String -Force Write-Host "[+] GPO policy registry values configured." -ForegroundColor Green # 5. Configure MS Security Guide mitigations: Certificate Padding check and SEHOP registry keys $WintrustPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" if (-not (Test-Path $WintrustPath)) { New-Item -Path $WintrustPath -Force | Out-Null } Set-ItemProperty -Path $WintrustPath -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force $WintrustWow64Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" if (-not (Test-Path $WintrustWow64Path)) { New-Item -Path $WintrustWow64Path -Force | Out-Null } Set-ItemProperty -Path $WintrustWow64Path -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force $SessionKernelPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" if (-not (Test-Path $SessionKernelPath)) { New-Item -Path $SessionKernelPath -Force | Out-Null } Set-ItemProperty -Path $SessionKernelPath -Name "DisableExceptionChainValidation" -Value 0 -Type DWord -Force Write-Host "[+] Certificate Padding check and SEHOP registry keys applied." -ForegroundColor Green # 6. Prevent users from modifying Exploit Protection settings in Windows Security Center $SecCenterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" if (-not (Test-Path $SecCenterPath)) { New-Item -Path $SecCenterPath -Force | Out-Null } Set-ItemProperty -Path $SecCenterPath -Name "DisallowExploitProtectionOverride" -Value 1 -Type DWord -Force Write-Host "[+] Exploit protection override lockdown applied." -ForegroundColor Green Write-Host "Exploit Protection Profile application completed successfully." -ForegroundColor Cyan To verify the settings have been applied: Download Script: Get-ExploitProtectionStatus.ps1 # Get-ExploitProtectionStatus.ps1 # Description: Audits the system-wide Exploit Protection settings against the recommended security baseline. Write-Host "Auditing system-wide Exploit Protection mitigations..." -ForegroundColor Cyan $BaselineFailed = $false $Mitigations = Get-ProcessMitigation -System # Helper function to evaluate and display status function Test-MitigationSetting { param( [string]$MitigationName, [string]$CurrentValue, [string]$ExpectedValue ) if ($CurrentValue -eq $ExpectedValue) { Write-Host " [PASS] $($MitigationName): $($CurrentValue)" -ForegroundColor Green } else { Write-Host " [FAIL] $($MitigationName): $($CurrentValue) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:BaselineFailed = $true } } Write-Host "`nSystem-wide Mitigations:" -ForegroundColor Gray # Audit DEP Test-MitigationSetting -MitigationName "DEP Enable" -CurrentValue $Mitigations.DEP.Enable -ExpectedValue "ON" Test-MitigationSetting -MitigationName "DEP EmulateAtlThunks" -CurrentValue $Mitigations.DEP.EmulateAtlThunks -ExpectedValue "OFF" # Audit ASLR Test-MitigationSetting -MitigationName "ASLR ForceRelocateImages" -CurrentValue $Mitigations.ASLR.ForceRelocateImages -ExpectedValue "ON" Test-MitigationSetting -MitigationName "ASLR BottomUp" -CurrentValue $Mitigations.ASLR.BottomUp -ExpectedValue "ON" Test-MitigationSetting -MitigationName "ASLR HighEntropy" -CurrentValue $Mitigations.ASLR.HighEntropy -ExpectedValue "ON" # Audit CFG Test-MitigationSetting -MitigationName "CFG Enable" -CurrentValue $Mitigations.CFG.Enable -ExpectedValue "ON" # Audit SEHOP Test-MitigationSetting -MitigationName "SEHOP Enable" -CurrentValue $Mitigations.SEHOP.Enable -ExpectedValue "ON" # Audit Heap Test-MitigationSetting -MitigationName "Heap TerminateOnError" -CurrentValue $Mitigations.Heap.TerminateOnError -ExpectedValue "ON" # Audit Registry Policy and XML Configuration Write-Host "`nRegistry Policy and XML Configuration:" -ForegroundColor Gray $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection" if (Test-Path $RegPath) { $SettingsValue = Get-ItemProperty -Path $RegPath -Name "ExploitProtectionSettings" -ErrorAction SilentlyContinue if ($SettingsValue -and $SettingsValue.ExploitProtectionSettings -ne "") { $XmlPath = $SettingsValue.ExploitProtectionSettings Write-Host " [PASS] Exploit Protection Policy registry key is configured." -ForegroundColor Green Write-Host " Path: $XmlPath" -ForegroundColor Gray if (Test-Path $XmlPath) { Write-Host " [PASS] Exploit Protection XML file exists." -ForegroundColor Green try { [xml]$xml = Get-Content -Path $XmlPath -Raw -ErrorAction Stop # Verify SystemConfig block if ($xml.MitigationPolicy.SystemConfig) { Write-Host " [PASS] XML contains SystemConfig block." -ForegroundColor Green } else { Write-Host " [FAIL] XML is missing SystemConfig block." -ForegroundColor Red $BaselineFailed = $true } # Verify major AppConfigs $ExpectedApps = @("WINWORD.EXE", "EXCEL.EXE", "chrome.exe", "msedge.exe", "AcroRd32.exe", "java.exe") $ConfiguredApps = $xml.MitigationPolicy.AppConfig | ForEach-Object { $_.Executable } foreach ($app in $ExpectedApps) { if ($ConfiguredApps -contains $app) { Write-Host " [PASS] XML contains application profile for: $app" -ForegroundColor Green } else { Write-Host " [FAIL] XML is missing application profile for: $app" -ForegroundColor Red $BaselineFailed = $true } } } catch { Write-Host " [FAIL] Failed to parse Exploit Protection XML. Error: $($_.Exception.Message)" -ForegroundColor Red $BaselineFailed = $true } } else { Write-Host " [FAIL] Exploit Protection XML file does not exist at specified path." -ForegroundColor Red $BaselineFailed = $true } } else { Write-Host " [FAIL] Exploit Protection Policy registry key is empty or missing." -ForegroundColor Red $BaselineFailed = $true } } else { Write-Host " [FAIL] Exploit Protection Policy registry path does not exist." -ForegroundColor Red $BaselineFailed = $true } # Audit MS Security Guide Registry Settings Write-Host "`nMS Security Guide Mitigations (Certificate Padding & SEHOP):" -ForegroundColor Gray function Test-MitigationRegistryValue ($path, $name, $expectedValue) { $val = Get-ItemProperty -Path $path -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } $color = "Red" if ($actual -eq $expectedValue) { $color = "Green" } else { $script:BaselineFailed = $true } Write-Host " - Registry Setting: $name | Actual: '$actual' (Expected: '$expectedValue')" -ForegroundColor $color } $WintrustPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" Test-MitigationRegistryValue $WintrustPath "EnableCertPaddingCheck" 1 $WintrustWow64Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" Test-MitigationRegistryValue $WintrustWow64Path "EnableCertPaddingCheck" 1 $SessionKernelPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" Test-MitigationRegistryValue $SessionKernelPath "DisableExceptionChainValidation" 0 $SecCenterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" Test-MitigationRegistryValue $SecCenterPath "DisallowExploitProtectionOverride" 1 Write-Host "" if ($BaselineFailed) { Write-Host "Auditing FAILED: One or more configurations do not match the secure baseline." -ForegroundColor Red exit 1 } else { Write-Host "Auditing PASSED: All configurations match the secure baseline." -ForegroundColor Green exit 0 } # Configure-ExploitProtection.ps1 # Description: Generates the system-wide and application-specific Exploit Protection XML profile, applies it locally, and configures the policy registry keys. Write-Host "Applying Exploit Protection Profile..." -ForegroundColor Cyan # 1. Define the XML content including System and App settings $XmlContent = @" <?xml version="1.0" encoding="utf-8"?> <MitigationPolicy> <SystemConfig> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <SEHOP Enable="true" TelemetryOnly="false" /> <Heap TerminateOnError="true" /> </SystemConfig> <AppConfig Executable="WINWORD.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="EXCEL.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="POWERPNT.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="OUTLOOK.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="MSACCESS.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="MSPUB.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="VISIO.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="LYNC.EXE"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="AcroRd32.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="Acrobat.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="chrome.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> <AppConfig Executable="msedge.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> <AppConfig Executable="firefox.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> <AppConfig Executable="wscript.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="cscript.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableExportAddressFilter="true" AuditEnableExportAddressFilter="false" EnableExportAddressFilterPlus="true" AuditEnableExportAddressFilterPlus="false" EnableImportAddressFilter="true" AuditEnableImportAddressFilter="false" EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> <ImageLoad BlockRemoteImageLoads="true" AuditBlockRemoteImageLoads="false" PreferSystem32="true" AuditPreferSystem32="false" /> </AppConfig> <AppConfig Executable="powershell.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> </AppConfig> <AppConfig Executable="java.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> </AppConfig> <AppConfig Executable="javaw.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> </AppConfig> <AppConfig Executable="javaws.exe"> <DEP Enable="true" EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" /> <ControlFlowGuard Enable="true" SuppressExports="false" /> <Payload EnableRopStackPivot="true" AuditEnableRopStackPivot="false" EnableRopCallerCheck="true" AuditEnableRopCallerCheck="false" EnableRopSimExec="true" AuditEnableRopSimExec="false" /> </AppConfig> </MitigationPolicy> "@ # 2. Create the target directory and write the XML file $TargetDir = "C:\ProgramData\ExploitProtection" if (-not (Test-Path $TargetDir)) { New-Item -Path $TargetDir -ItemType Directory -Force | Out-Null } $XmlPath = "$TargetDir\ExploitProtectionSettings.xml" Set-Content -Path $XmlPath -Value $XmlContent -Encoding UTF8 Write-Host "Exploit Protection XML profile written to $($XmlPath)" -ForegroundColor Gray # 3. Apply the settings locally using the cmdlet if (Get-Command Set-ProcessMitigation -ErrorAction SilentlyContinue) { Set-ProcessMitigation -PolicyFilePath $XmlPath Write-Host "[+] Exploit protection system settings applied locally." -ForegroundColor Green } else { Write-Warning "Set-ProcessMitigation cmdlet is not available. Please ensure you are running Windows 10/11 or Windows Server 2016+." } # 4. Configure policy registry keys to point to the XML file $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "ExploitProtectionSettings" -Value $XmlPath -Type String -Force Write-Host "[+] GPO policy registry values configured." -ForegroundColor Green # 5. Configure MS Security Guide mitigations: Certificate Padding check and SEHOP registry keys $WintrustPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\Wintrust\Config" if (-not (Test-Path $WintrustPath)) { New-Item -Path $WintrustPath -Force | Out-Null } Set-ItemProperty -Path $WintrustPath -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force $WintrustWow64Path = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" if (-not (Test-Path $WintrustWow64Path)) { New-Item -Path $WintrustWow64Path -Force | Out-Null } Set-ItemProperty -Path $WintrustWow64Path -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force $SessionKernelPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" if (-not (Test-Path $SessionKernelPath)) { New-Item -Path $SessionKernelPath -Force | Out-Null } Set-ItemProperty -Path $SessionKernelPath -Name "DisableExceptionChainValidation" -Value 0 -Type DWord -Force Write-Host "[+] Certificate Padding check and SEHOP registry keys applied." -ForegroundColor Green # 6. Prevent users from modifying Exploit Protection settings in Windows Security Center $SecCenterPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection" if (-not (Test-Path $SecCenterPath)) { New-Item -Path $SecCenterPath -Force | Out-Null } Set-ItemProperty -Path $SecCenterPath -Name "DisallowExploitProtectionOverride" -Value 1 -Type DWord -Force Write-Host "[+] Exploit protection override lockdown applied." -ForegroundColor Green Write-Host "Exploit Protection Profile application completed successfully." -ForegroundColor Cyan Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/disable-safe-mode-for-standard-users.md Malicious actors with standard user credentials can potentially bypass local security policies, local endpoint detection and response (EDR) agents, and group policy restrictions by booting the system into Safe Mode. In Safe Mode, many security agents and services do not load, creating an environment where local controls can be circumvented. By configuring SafeModeBlockNonAdmins = 1: 1. Prevent Credential Bypass: Standard users are blocked from logging in during Safe Mode, ensuring they cannot exploit the disabled security agents to execute unauthorized programs or extract system information. 2. Maintenance Integrity: Safe Mode remains accessible exclusively to system administrators for debugging and recovery, ensuring administrative capability is preserved while mitigating standard user risk. Option A: Group Policy Object (GPO) Configuration (Preferred) Because there is no native Administrative Template (ADMX) policy for this setting, it must be deployed using Group Policy Preferences (GPP) to configure the registry directly. Open the Group Policy Management Console (gpmc.msc) on a domain controller or management host. Create a new GPO or edit an existing one (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click in the right pane, select New > Registry Item, and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Value Name*: SafeModeBlockNonAdmins Value Type*: REG_DWORD Value Data*: 1 Link the GPO to the appropriate Organizational Unit (OU) containing the target client endpoints and member servers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally on standalone systems or during reference image build phases. Download Script: Configure-DisableSafeModeNonAdmins.ps1 # Configure-DisableSafeModeNonAdmins.ps1 # Description: Prevents standard users from logging into the system while in Safe Mode by setting SafeModeBlockNonAdmins to 1. $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "SafeModeBlockNonAdmins" $ValueData = 1 Write-Host "Applying hardening requirement: Restrict Safe Mode access to administrators..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-SafeModeNonAdminsStatus.ps1 # Get-SafeModeNonAdminsStatus.ps1 # Description: Checks the current configuration state of SafeModeBlockNonAdmins registry setting. $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "SafeModeBlockNonAdmins" Write-Host "Auditing hardening requirement: Restrict Safe Mode access to administrators..." -ForegroundColor Cyan if (Test-Path $RegPath) { $value = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $value -and $value.$ValueName -eq 1) { Write-Host "Audit Result: Compliant. Standard users are blocked from logging in during Safe Mode ($ValueName = 1)." -ForegroundColor Green exit 0 } } Write-Host "Audit Result: Non-Compliant. Standard users are allowed to log in during Safe Mode." -ForegroundColor Red exit 1 # Configure-DisableSafeModeNonAdmins.ps1 # Description: Prevents standard users from logging into the system while in Safe Mode by setting SafeModeBlockNonAdmins to 1. $RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "SafeModeBlockNonAdmins" $ValueData = 1 Write-Host "Applying hardening requirement: Restrict Safe Mode access to administrators..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/configure-windows-firewall.md Windows Defender Firewall is the primary host-based security control protecting endpoints from unauthorized incoming network connections and regulating outgoing network behaviors. A secure baseline requires enabling the firewall on all profiles, setting inbound connections to block by default, disabling notification prompts that can be bypassed by users, and implementing detailed auditing/logging to monitor network anomalies. Additionally: 1. Outbound LOLBins Blocking: Malicious actors frequently abuse built-in Windows administrative utilities (known as Living Off the Land Binaries, or LOLBins) to download malicious payloads, exfiltrate sensitive data, and communicate with external command-and-control (C2) servers. Blocking outbound network communication for binaries that have no legitimate business requirement to connect to external networks (such as mshta.exe, certutil.exe, bitsadmin.exe, regsvr32.exe, rundll32.exe, cscript.exe, wscript.exe, and hh.exe) significantly mitigates these threat vectors. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Configure Profile States and Logging Open the Group Policy Management Console (gpmc.msc) on a domain controller or management workstation. Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security Right-click Windows Defender Firewall with Advanced Security and select Properties. Configure the Domain Profile tab: Firewall state*: On (recommended) Inbound connections*: Block (default) Outbound connections*: Allow (default) Click Customize... under Settings*: Display a notification*: No Apply local firewall rules*: No Apply local connection security rules*: No Click Customize... under Logging*: Name*: %SystemRoot%\System32\logfiles\firewall\domainfw.log Size limit (KB)*: 16384 Log dropped packets*: Yes Log successful connections*: No Configure the Private Profile tab: Firewall state*: On (recommended) Inbound connections*: Block (default) Outbound connections*: Allow (default) Click Customize... under Settings*: Display a notification*: No Apply local firewall rules*: No Apply local connection security rules*: No Click Customize... under Logging*: Name*: %SystemRoot%\System32\logfiles\firewall\privatefw.log Size limit (KB)*: 16384 Log dropped packets*: Yes Log successful connections*: No Configure the Public Profile tab: Firewall state*: On (recommended) Inbound connections*: Block (default) Outbound connections*: Allow (default) Click Customize... under Settings*: Display a notification*: No Apply local firewall rules*: No Apply local connection security rules*: No Click Customize... under Logging*: Name*: %SystemRoot%\System32\logfiles\firewall\publicfw.log Size limit (KB)*: 16384 Log dropped packets*: Yes Log successful connections*: No 2. Create Outbound Rules for Known LOLBins Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Outbound Rules Create a new rule for each target LOLBin binary (e.g., mshta.exe, certutil.exe, bitsadmin.exe, regsvr32.exe, rundll32.exe, cscript.exe, wscript.exe, hh.exe, calc.exe, notepad.exe, conhost.exe, RunScriptHelper.exe): Right-click Outbound Rules and select New Rule... Rule Type*: Program Program*: Choose This program path and enter the path matching the binary (both x64 and x86 paths if applicable, e.g., %SystemRoot%\System32\mshta.exe and %SystemRoot%\SysWOW64\mshta.exe). Action*: Block the connection Profile*: Select Domain, Private, and Public. Name*: Specify a descriptive name (e.g., Hardening: Block Outbound mshta.exe (x64)). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to configure Windows Defender Firewall profiles, logging parameters, merge settings, and outbound LOLBins rules. Download Script: Configure-WindowsFirewall.ps1 # Configure-WindowsFirewall.ps1 # Description: Configures Windows Defender Firewall profiles (Domain, Private, Public) and blocks outbound traffic for known LOLBins. Write-Host "Configuring Windows Defender Firewall profiles..." -ForegroundColor Cyan # 1. Configure profiles $FWProfiles = @("Domain", "Private", "Public") foreach ($FWProfile in $FWProfiles) { $LogFile = "$env:windir\System32\logfiles\firewall\$($FWProfile.ToLower())fw.log" Set-NetFirewallProfile -Profile $FWProfile ` -Enabled True ` -DefaultInboundAction Block ` -DefaultOutboundAction Allow ` -NotifyOnListen False ` -AllowLocalPolicyMerge False ` -AllowLocalIPsecPolicyMerge False ` -LogFileName $LogFile ` -LogMaxSizeKilobytes 16384 ` -LogBlocked True ` -LogAllowed False | Out-Null Write-Host "[+] Profile '$FWProfile' configured with logging and defaults." -ForegroundColor Green } # 2. Block outbound traffic for known LOLBins $Lolbins = @( @{ Name = "mshta.exe (x64)"; Path = "%SystemRoot%\System32\mshta.exe" }, @{ Name = "mshta.exe (x86)"; Path = "%SystemRoot%\SysWOW64\mshta.exe" }, @{ Name = "certutil.exe (x64)"; Path = "%SystemRoot%\System32\certutil.exe" }, @{ Name = "certutil.exe (x86)"; Path = "%SystemRoot%\SysWOW64\certutil.exe" }, @{ Name = "bitsadmin.exe (x64)"; Path = "%SystemRoot%\System32\bitsadmin.exe" }, @{ Name = "bitsadmin.exe (x86)"; Path = "%SystemRoot%\SysWOW64\bitsadmin.exe" }, @{ Name = "regsvr32.exe (x64)"; Path = "%SystemRoot%\System32\regsvr32.exe" }, @{ Name = "regsvr32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\regsvr32.exe" }, @{ Name = "rundll32.exe (x64)"; Path = "%SystemRoot%\System32\rundll32.exe" }, @{ Name = "rundll32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\rundll32.exe" }, @{ Name = "cscript.exe (x64)"; Path = "%SystemRoot%\System32\cscript.exe" }, @{ Name = "cscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\cscript.exe" }, @{ Name = "wscript.exe (x64)"; Path = "%SystemRoot%\System32\wscript.exe" }, @{ Name = "wscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\wscript.exe" }, @{ Name = "hh.exe (x64)"; Path = "%SystemRoot%\hh.exe" }, @{ Name = "hh.exe (x86)"; Path = "%SystemRoot%\SysWOW64\hh.exe" }, @{ Name = "calc.exe (x64)"; Path = "%SystemRoot%\System32\calc.exe" }, @{ Name = "calc.exe (x86)"; Path = "%SystemRoot%\SysWOW64\calc.exe" }, @{ Name = "notepad.exe (x64)"; Path = "%SystemRoot%\System32\notepad.exe" }, @{ Name = "notepad.exe (x86)"; Path = "%SystemRoot%\SysWOW64\notepad.exe" }, @{ Name = "conhost.exe (x64)"; Path = "%SystemRoot%\System32\conhost.exe" }, @{ Name = "conhost.exe (x86)"; Path = "%SystemRoot%\SysWOW64\conhost.exe" }, @{ Name = "RunScriptHelper.exe (x64)"; Path = "%SystemRoot%\System32\RunScriptHelper.exe" }, @{ Name = "RunScriptHelper.exe (x86)"; Path = "%SystemRoot%\SysWOW64\RunScriptHelper.exe" } ) Write-Host "Configuring outbound firewall block rules for known LOLBins..." -ForegroundColor Cyan foreach ($Bin in $Lolbins) { $DisplayName = "Hardening: Block Outbound $($Bin.Name)" $Existing = Get-NetFirewallRule -DisplayName $DisplayName -ErrorAction SilentlyContinue if ($null -eq $Existing) { New-NetFirewallRule -DisplayName $DisplayName ` -Name $DisplayName ` -Direction Outbound ` -Action Block ` -Program $Bin.Path ` -Profile Any ` -Enabled True | Out-Null Write-Host "[+] Outbound block rule created for $($Bin.Name)." -ForegroundColor Green } else { Set-NetFirewallRule -DisplayName $DisplayName -Action Block -Enabled True | Out-Null Write-Host "[~] Outbound block rule for $($Bin.Name) already exists, updated state to Enabled/Block." -ForegroundColor Gray } } Write-Host "Firewall profiles and LOLBins outbound rules configured successfully." -ForegroundColor Green To verify the settings have been applied: Download Script: Get-WindowsFirewallStatus.ps1 # Get-WindowsFirewallStatus.ps1 # Description: Audits Windows Defender Firewall profile configurations and outbound block rules for known LOLBins. Write-Host "--- Auditing Windows Defender Firewall Configuration ---" -ForegroundColor Cyan $script:Vulnerable = $false # Helper function to audit firewall profiles function Test-FirewallProfile ($ProfileName, $ExpectMergeLocal, $ExpectMergeIPsec) { $FWProfile = Get-NetFirewallProfile -Profile $ProfileName -ErrorAction SilentlyContinue if ($null -eq $FWProfile) { Write-Host " - Profile '$ProfileName' NOT FOUND" -ForegroundColor Red $script:Vulnerable = $true return } $EnabledColor = if ($FWProfile.Enabled -eq $true) { "Green" } else { "Red" } $InboundColor = if ($FWProfile.DefaultInboundAction -eq "Block") { "Green" } else { "Red" } $OutboundColor = if ($FWProfile.DefaultOutboundAction -eq "Allow") { "Green" } else { "Red" } $NotifyColor = if ($FWProfile.NotifyOnListen -eq $false) { "Green" } else { "Red" } Write-Host " * Profile: $ProfileName" -ForegroundColor Gray Write-Host " - Enabled: $($FWProfile.Enabled) (Expected: True)" -ForegroundColor $EnabledColor Write-Host " - DefaultInboundAction: $($FWProfile.DefaultInboundAction) (Expected: Block)" -ForegroundColor $InboundColor Write-Host " - DefaultOutboundAction: $($FWProfile.DefaultOutboundAction) (Expected: Allow)" -ForegroundColor $OutboundColor Write-Host " - NotifyOnListen: $($FWProfile.NotifyOnListen) (Expected: False)" -ForegroundColor $NotifyColor # Check log configurations $LogPath = "$env:windir\System32\logfiles\firewall\$($ProfileName.ToLower())fw.log" $LogPathColor = if ($FWProfile.LogFileName -eq $LogPath) { "Green" } else { "Red" } $LogSizeColor = if ($FWProfile.LogMaxSizeKilobytes -ge 16384) { "Green" } else { "Red" } $LogBlockedColor = if ($FWProfile.LogBlocked -eq $true) { "Green" } else { "Red" } $LogAllowedColor = if ($FWProfile.LogAllowed -eq $false) { "Green" } else { "Red" } Write-Host " - LogFileName: $($FWProfile.LogFileName) (Expected: $LogPath)" -ForegroundColor $LogPathColor Write-Host " - LogMaxSizeKilobytes: $($FWProfile.LogMaxSizeKilobytes) (Expected: >= 16384)" -ForegroundColor $LogSizeColor Write-Host " - LogBlocked: $($FWProfile.LogBlocked) (Expected: True)" -ForegroundColor $LogBlockedColor Write-Host " - LogAllowed: $($FWProfile.LogAllowed) (Expected: False)" -ForegroundColor $LogAllowedColor if ($FWProfile.Enabled -ne $true -or $FWProfile.DefaultInboundAction -ne "Block" -or $FWProfile.NotifyOnListen -ne $false -or $FWProfile.LogFileName -ne $LogPath -or $FWProfile.LogMaxSizeKilobytes -lt 16384 -or $FWProfile.LogBlocked -ne $true -or $FWProfile.LogAllowed -ne $false) { $script:Vulnerable = $true } if ($null -ne $ExpectMergeLocal) { $MergeLocalColor = if ($FWProfile.AllowLocalPolicyMerge -eq $ExpectMergeLocal) { "Green" } else { "Red" } Write-Host " - AllowLocalPolicyMerge: $($FWProfile.AllowLocalPolicyMerge) (Expected: $ExpectMergeLocal)" -ForegroundColor $MergeLocalColor if ($FWProfile.AllowLocalPolicyMerge -ne $ExpectMergeLocal) { $script:Vulnerable = $true } } if ($null -ne $ExpectMergeIPsec) { $MergeIPsecColor = if ($FWProfile.AllowLocalIPsecPolicyMerge -eq $ExpectMergeIPsec) { "Green" } else { "Red" } Write-Host " - AllowLocalIPsecPolicyMerge: $($FWProfile.AllowLocalIPsecPolicyMerge) (Expected: $ExpectMergeIPsec)" -ForegroundColor $MergeIPsecColor if ($FWProfile.AllowLocalIPsecPolicyMerge -ne $ExpectMergeIPsec) { $script:Vulnerable = $true } } } Write-Host "Auditing profiles..." -ForegroundColor Gray Test-FirewallProfile -ProfileName "Domain" -ExpectMergeLocal $false -ExpectMergeIPsec $false Test-FirewallProfile -ProfileName "Private" -ExpectMergeLocal $false -ExpectMergeIPsec $false Test-FirewallProfile -ProfileName "Public" -ExpectMergeLocal $false -ExpectMergeIPsec $false # Audit outbound rules for known LOLBins $Lolbins = @( @{ Name = "mshta.exe (x64)"; Path = "%SystemRoot%\System32\mshta.exe" }, @{ Name = "mshta.exe (x86)"; Path = "%SystemRoot%\SysWOW64\mshta.exe" }, @{ Name = "certutil.exe (x64)"; Path = "%SystemRoot%\System32\certutil.exe" }, @{ Name = "certutil.exe (x86)"; Path = "%SystemRoot%\SysWOW64\certutil.exe" }, @{ Name = "bitsadmin.exe (x64)"; Path = "%SystemRoot%\System32\bitsadmin.exe" }, @{ Name = "bitsadmin.exe (x86)"; Path = "%SystemRoot%\SysWOW64\bitsadmin.exe" }, @{ Name = "regsvr32.exe (x64)"; Path = "%SystemRoot%\System32\regsvr32.exe" }, @{ Name = "regsvr32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\regsvr32.exe" }, @{ Name = "rundll32.exe (x64)"; Path = "%SystemRoot%\System32\rundll32.exe" }, @{ Name = "rundll32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\rundll32.exe" }, @{ Name = "cscript.exe (x64)"; Path = "%SystemRoot%\System32\cscript.exe" }, @{ Name = "cscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\cscript.exe" }, @{ Name = "wscript.exe (x64)"; Path = "%SystemRoot%\System32\wscript.exe" }, @{ Name = "wscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\wscript.exe" }, @{ Name = "hh.exe (x64)"; Path = "%SystemRoot%\hh.exe" }, @{ Name = "hh.exe (x86)"; Path = "%SystemRoot%\SysWOW64\hh.exe" }, @{ Name = "calc.exe (x64)"; Path = "%SystemRoot%\System32\calc.exe" }, @{ Name = "calc.exe (x86)"; Path = "%SystemRoot%\SysWOW64\calc.exe" }, @{ Name = "notepad.exe (x64)"; Path = "%SystemRoot%\System32\notepad.exe" }, @{ Name = "notepad.exe (x86)"; Path = "%SystemRoot%\SysWOW64\notepad.exe" }, @{ Name = "conhost.exe (x64)"; Path = "%SystemRoot%\System32\conhost.exe" }, @{ Name = "conhost.exe (x86)"; Path = "%SystemRoot%\SysWOW64\conhost.exe" }, @{ Name = "RunScriptHelper.exe (x64)"; Path = "%SystemRoot%\System32\RunScriptHelper.exe" }, @{ Name = "RunScriptHelper.exe (x86)"; Path = "%SystemRoot%\SysWOW64\RunScriptHelper.exe" } ) Write-Host "Auditing outbound firewall rules for known LOLBins..." -ForegroundColor Gray foreach ($Bin in $Lolbins) { $DisplayName = "Hardening: Block Outbound $($Bin.Name)" $Rule = Get-NetFirewallRule -DisplayName $DisplayName -ErrorAction SilentlyContinue $Color = "Red" if ($null -ne $Rule) { $ProgFilter = Get-NetFirewallApplicationFilter -AssociatedNetFirewallRule $Rule -ErrorAction SilentlyContinue $ProgPath = "None" if ($null -ne $ProgFilter) { $ProgPath = $ProgFilter.Program } if ($Rule.Enabled -eq $true -and $Rule.Direction -eq "Outbound" -and $Rule.Action -eq "Block" -and $ProgPath -eq $Bin.Path) { $Color = "Green" Write-Host " - Firewall Rule: $DisplayName | Enabled: True | Action: Block | Program: $ProgPath (Compliant)" -ForegroundColor $Color } else { $script:Vulnerable = $true Write-Host " - Firewall Rule: $DisplayName | Enabled: $($Rule.Enabled) | Action: $($Rule.Action) | Program: $ProgPath (Non-Compliant)" -ForegroundColor $Color } } else { $script:Vulnerable = $true Write-Host " - Firewall Rule: $DisplayName | NOT FOUND (Non-Compliant)" -ForegroundColor $Color } } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-WindowsFirewall.ps1 # Description: Configures Windows Defender Firewall profiles (Domain, Private, Public) and blocks outbound traffic for known LOLBins. Write-Host "Configuring Windows Defender Firewall profiles..." -ForegroundColor Cyan # 1. Configure profiles $FWProfiles = @("Domain", "Private", "Public") foreach ($FWProfile in $FWProfiles) { $LogFile = "$env:windir\System32\logfiles\firewall\$($FWProfile.ToLower())fw.log" Set-NetFirewallProfile -Profile $FWProfile ` -Enabled True ` -DefaultInboundAction Block ` -DefaultOutboundAction Allow ` -NotifyOnListen False ` -AllowLocalPolicyMerge False ` -AllowLocalIPsecPolicyMerge False ` -LogFileName $LogFile ` -LogMaxSizeKilobytes 16384 ` -LogBlocked True ` -LogAllowed False | Out-Null Write-Host "[+] Profile '$FWProfile' configured with logging and defaults." -ForegroundColor Green } # 2. Block outbound traffic for known LOLBins $Lolbins = @( @{ Name = "mshta.exe (x64)"; Path = "%SystemRoot%\System32\mshta.exe" }, @{ Name = "mshta.exe (x86)"; Path = "%SystemRoot%\SysWOW64\mshta.exe" }, @{ Name = "certutil.exe (x64)"; Path = "%SystemRoot%\System32\certutil.exe" }, @{ Name = "certutil.exe (x86)"; Path = "%SystemRoot%\SysWOW64\certutil.exe" }, @{ Name = "bitsadmin.exe (x64)"; Path = "%SystemRoot%\System32\bitsadmin.exe" }, @{ Name = "bitsadmin.exe (x86)"; Path = "%SystemRoot%\SysWOW64\bitsadmin.exe" }, @{ Name = "regsvr32.exe (x64)"; Path = "%SystemRoot%\System32\regsvr32.exe" }, @{ Name = "regsvr32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\regsvr32.exe" }, @{ Name = "rundll32.exe (x64)"; Path = "%SystemRoot%\System32\rundll32.exe" }, @{ Name = "rundll32.exe (x86)"; Path = "%SystemRoot%\SysWOW64\rundll32.exe" }, @{ Name = "cscript.exe (x64)"; Path = "%SystemRoot%\System32\cscript.exe" }, @{ Name = "cscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\cscript.exe" }, @{ Name = "wscript.exe (x64)"; Path = "%SystemRoot%\System32\wscript.exe" }, @{ Name = "wscript.exe (x86)"; Path = "%SystemRoot%\SysWOW64\wscript.exe" }, @{ Name = "hh.exe (x64)"; Path = "%SystemRoot%\hh.exe" }, @{ Name = "hh.exe (x86)"; Path = "%SystemRoot%\SysWOW64\hh.exe" }, @{ Name = "calc.exe (x64)"; Path = "%SystemRoot%\System32\calc.exe" }, @{ Name = "calc.exe (x86)"; Path = "%SystemRoot%\SysWOW64\calc.exe" }, @{ Name = "notepad.exe (x64)"; Path = "%SystemRoot%\System32\notepad.exe" }, @{ Name = "notepad.exe (x86)"; Path = "%SystemRoot%\SysWOW64\notepad.exe" }, @{ Name = "conhost.exe (x64)"; Path = "%SystemRoot%\System32\conhost.exe" }, @{ Name = "conhost.exe (x86)"; Path = "%SystemRoot%\SysWOW64\conhost.exe" }, @{ Name = "RunScriptHelper.exe (x64)"; Path = "%SystemRoot%\System32\RunScriptHelper.exe" }, @{ Name = "RunScriptHelper.exe (x86)"; Path = "%SystemRoot%\SysWOW64\RunScriptHelper.exe" } ) Write-Host "Configuring outbound firewall block rules for known LOLBins..." -ForegroundColor Cyan foreach ($Bin in $Lolbins) { $DisplayName = "Hardening: Block Outbound $($Bin.Name)" $Existing = Get-NetFirewallRule -DisplayName $DisplayName -ErrorAction SilentlyContinue if ($null -eq $Existing) { New-NetFirewallRule -DisplayName $DisplayName ` -Name $DisplayName ` -Direction Outbound ` -Action Block ` -Program $Bin.Path ` -Profile Any ` -Enabled True | Out-Null Write-Host "[+] Outbound block rule created for $($Bin.Name)." -ForegroundColor Green } else { Set-NetFirewallRule -DisplayName $DisplayName -Action Block -Enabled True | Out-Null Write-Host "[~] Outbound block rule for $($Bin.Name) already exists, updated state to Enabled/Block." -ForegroundColor Gray } } Write-Host "Firewall profiles and LOLBins outbound rules configured successfully." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise/Professional. File Path: 08-endpoints/enable-lsa-protection.md The Local Security Authority Subsystem Service (LSASS) process manages security policies, user authentication, and credential tokens on Windows systems. Attackers targeting workstations commonly attempt to extract plain-text credentials or NT hashes from LSASS memory using debugging tools (e.g., Mimikatz, Procdump). Enabling LSA Protection ensures that: 1. Protected Process Light (PPL): The LSASS process runs as a Protected Process Light (PPL). 2. Access Restriction: Only verified, digitally signed code can load into LSASS, and standard processes (even those running as local system/administrator) cannot read the memory space of LSASS or inject code into it. 3. Mitigating Dump Attacks: Credential harvesting tools cannot dump LSASS memory to disk or scrape keys from LSA memory blocks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO linked to the workstations Organizational Unit (OU) (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Local Security Authority Configure the setting: Policy*: Configures LSASS to run as a protected process Setting*: Enabled Configure LSA to run as a protected process*: Enabled with UEFI Lock Link the GPO to the target workstations Organizational Unit (OU). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the local registry key on the workstation to run LSASS as a protected process with UEFI Lock. Download Script: Configure-LsaProtection.ps1 # Configure-LsaProtection.ps1 # Description: Configures the RunAsPPL registry key to enable LSA Protection on workstations. Write-Host "Applying LSA Protection registry hardening..." -ForegroundColor Cyan $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "RunAsPPL" -Value 1 -Type DWord Write-Host "[+] LSA Protection (RunAsPPL) enabled in registry. (Reboot required)." -ForegroundColor Green To verify the local LSA Protection state: Download Script: Get-LsaProtectionStatus.ps1 # Get-LsaProtectionStatus.ps1 # Description: Checks the registry settings and running process state to verify LSA Protection is active. Write-Host "--- Auditing LSA Protection Status ---" -ForegroundColor Cyan $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" $RunAsPPL = (Get-ItemProperty -Path $LsaPath -Name "RunAsPPL" -ErrorAction SilentlyContinue).RunAsPPL if ($RunAsPPL -eq 1) { Write-Host " - LSA Protection (RunAsPPL): Enabled (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: LSA Protection (RunAsPPL) is not configured or disabled (Value: $($RunAsPPL))" -ForegroundColor Red } # Configure-LsaProtection.ps1 # Description: Configures the RunAsPPL registry key to enable LSA Protection on workstations. Write-Host "Applying LSA Protection registry hardening..." -ForegroundColor Cyan $LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "RunAsPPL" -Value 1 -Type DWord Write-Host "[+] LSA Protection (RunAsPPL) enabled in registry. (Reboot required)." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/configure-printing-and-spooler.md The Windows Print Spooler service (Spooler) has been the source of numerous high-severity vulnerabilities (such as the PrintNightmare family - CVE-2021-1675 and CVE-2021-34527). Attackers exploit the Print Spooler to coerce authentication or execute arbitrary code with SYSTEM privileges. To secure standard client endpoints and member servers, the primary defense is to completely disable the Print Spooler service. This eliminates the service's attack surface. As a secondary defense-in-depth, additional printer registry configurations (such as restricting driver installation to administrators, Redirection Guard, and RPC connection configurations) are enforced to ensure that even if the spooler service is temporarily running, the subsystem remains hardened. Remote Connections Block: By disabling remote client connections to the print spooler, standard client endpoints are prevented from acting as print servers. Outbound printing remains unaffected, but external hosts can no longer target the workstation's print spooler over the network. Redirection Guard: Enabling Redirection Guard prevents print spooler processing from being redirected via symbolic links or junction points, mitigating local privilege escalation vectors that abuse file system paths during printer driver mapping. RPC over TCP: Forcing both incoming and outgoing RPC connections to use TCP instead of legacy Named Pipes (which can be easily hijacked or relayed) reduces the attack surface. Forcing packet-level privacy and authentication protocols ensures printing traffic is encrypted and authenticated. Point and Print Restrictions: Restricting driver installation and update prompts to administrators prevents non-privileged users from installing malicious or unverified printer drivers. Option A: Group Policy Object (GPO) Configuration (Preferred) 1. Disable the Print Spooler Service Open the Group Policy Management Console (gpmc.msc). Edit the GPO applied to client endpoints (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Double-click Print Spooler. Check Define this policy setting and select Disabled. Click OK. 2. Configure Printers GPO Hardening (Secondary Defense) Navigate to: Computer Configuration\Policies\Administrative Templates\Printers Configure the following policies: Allow Print Spooler to accept client connections*: Set to Disabled Configure Redirection Guard*: Set to Enabled, select Redirection Guard Enabled Configure RPC connection settings*: Set to Enabled * Protocol to use for outgoing RPC connections: RPC over TCP * Use authentication for outgoing RPC connections: Default Configure RPC listener settings*: Set to Enabled * Protocols to allow for incoming RPC connections: RPC over TCP * Authentication protocol to use for incoming RPC connections: Negotiate (or higher) Configure RPC over TCP port*: Set to Enabled, set Port to 0 (dynamic port allocation) Configure RPC packet level privacy setting for incoming connections : Set to `Enabled` (Note: Requires SecGuide.admx template)* Manage processing of Queue-specific files*: Set to Enabled, select Limit Queue-specific files to Color profiles Point and Print Restrictions*: Set to Enabled * When installing drivers for a new connection: Show warning and elevation prompt * When updating drivers for an existing connection: Show warning and elevation prompt Limits print driver installation to Administrators*: Set to Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure registry keys for print spooler hardening. Download Script: Configure-PrintingAndSpooler.ps1 # Configure-PrintingAndSpooler.ps1 # Description: Disables the Print Spooler service and configures secondary print registry hardening parameters on standard endpoints. Write-Host "Applying Print Spooler security hardening..." -ForegroundColor Cyan # 1. Disable the Print Spooler Service if (Get-Service -Name "Spooler" -ErrorAction SilentlyContinue) { Set-Service -Name "Spooler" -StartupType Disabled -Confirm:$false Stop-Service -Name "Spooler" -Force -Confirm:$false Write-Host "[+] Print Spooler service has been stopped and disabled." -ForegroundColor Green } # 1. Base Printers Path Policies $PrintersPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" if (-not (Test-Path $PrintersPath)) { New-Item -Path $PrintersPath -Force | Out-Null } # Allow Print Spooler to accept client connections -> Disabled Set-ItemProperty -Path $PrintersPath -Name "RegisterSpoolerRemoteRpcEndPoint" -Value 2 -Type Dword Set-ItemProperty -Path $PrintersPath -Name "RegisterSpoolerRemoteSubsystem" -Value 0 -Type Dword # Configure Redirection Guard -> Enabled: Redirection Guard Enabled Set-ItemProperty -Path $PrintersPath -Name "RedirectionguardPolicy" -Value 1 -Type Dword # Manage processing of Queue-specific files -> Enabled: Limit Queue-specific files to Color profiles Set-ItemProperty -Path $PrintersPath -Name "CopyFilesPolicy" -Value 1 -Type Dword # 2. Printers RPC Connection and Listener Policies $PrintersRpcPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC" if (-not (Test-Path $PrintersRpcPath)) { New-Item -Path $PrintersRpcPath -Force | Out-Null } # Protocol to use for outgoing RPC connections -> RPC over TCP (0) Set-ItemProperty -Path $PrintersRpcPath -Name "RpcUseNamedPipeProtocol" -Value 0 -Type Dword # Use authentication for outgoing RPC connections -> Default (0) Set-ItemProperty -Path $PrintersRpcPath -Name "RpcAuthentication" -Value 0 -Type Dword # Protocols to allow for incoming RPC connections -> RPC over TCP (5) Set-ItemProperty -Path $PrintersRpcPath -Name "RpcProtocols" -Value 5 -Type Dword # Authentication protocol to use for incoming RPC connections -> Negotiate (0) Set-ItemProperty -Path $PrintersRpcPath -Name "ForceKerberosForRpc" -Value 0 -Type Dword # Configure RPC over TCP port -> 0 Set-ItemProperty -Path $PrintersRpcPath -Name "RpcTcpPort" -Value 0 -Type Dword # 3. System Print Control Privacy Setting $PrintControlPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Print" if (-not (Test-Path $PrintControlPath)) { New-Item -Path $PrintControlPath -Force | Out-Null } # Configure RPC packet level privacy setting for incoming connections -> Enabled Set-ItemProperty -Path $PrintControlPath -Name "RpcAuthnLevelPrivacyEnabled" -Value 1 -Type Dword # 4. Point and Print Restrictions $PointPrintPath = "HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" if (-not (Test-Path $PointPrintPath)) { New-Item -Path $PointPrintPath -Force | Out-Null } Set-ItemProperty -Path $PointPrintPath -Name "RestrictPointAndPrint" -Value 1 -Type Dword Set-ItemProperty -Path $PointPrintPath -Name "NoWarningNoElevationOnInstall" -Value 0 -Type Dword Set-ItemProperty -Path $PointPrintPath -Name "UpdatePromptSettings" -Value 0 -Type Dword Set-ItemProperty -Path $PointPrintPath -Name "RestrictDriverInstallationToAdministrators" -Value 1 -Type Dword Write-Host "[+] Print Spooler and Printer configurations hardened successfully." -ForegroundColor Green To verify the print spooler policy settings: Download Script: Get-PrintingAndSpoolerStatus.ps1 # Get-PrintingAndSpoolerStatus.ps1 # Description: Audits print spooler and printer security configurations on the local system. Write-Host "--- Auditing Printing and Spooler Hardening ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit Spooler Service Startup Type $Service = Get-Service -Name "Spooler" -ErrorAction SilentlyContinue if ($null -ne $Service) { $StartupType = (Get-CimInstance -ClassName Win32_Service -Filter "Name='Spooler'").StartMode $Color = if ($StartupType -eq "Disabled") { "Green" } else { "Red" } Write-Host " [-] Print Spooler Service Startup: $StartupType (Expected: Disabled)" -ForegroundColor $Color if ($StartupType -ne "Disabled") { $script:Vulnerable = $true } } else { Write-Host " [+] Print Spooler Service is not present on this machine." -ForegroundColor Green } # Helper function to audit registry properties function Test-RegistryValue { param( [string]$Path, [string]$Name, [object]$ExpectedValue ) if (Test-Path $Path) { $Val = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -ne $Val) { $Actual = $Val.$Name if ($Actual -eq $ExpectedValue) { Write-Host " - Path: $Path | Value: $Name | Current: $Actual (Expected: $ExpectedValue)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: Path: $Path | Value: $Name | Current: $Actual (Expected: $ExpectedValue)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: Path: $Path | Value: $Name (Expected: $ExpectedValue)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: Path: $Path (Expected: $Name = $ExpectedValue)" -ForegroundColor Red $script:Vulnerable = $true } } # Audit base printer settings $PrintersPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" Test-RegistryValue -Path $PrintersPath -Name "RegisterSpoolerRemoteRpcEndPoint" -ExpectedValue 2 Test-RegistryValue -Path $PrintersPath -Name "RegisterSpoolerRemoteSubsystem" -ExpectedValue 0 Test-RegistryValue -Path $PrintersPath -Name "RedirectionguardPolicy" -ExpectedValue 1 Test-RegistryValue -Path $PrintersPath -Name "CopyFilesPolicy" -ExpectedValue 1 # Audit RPC settings $PrintersRpcPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC" Test-RegistryValue -Path $PrintersRpcPath -Name "RpcUseNamedPipeProtocol" -ExpectedValue 0 Test-RegistryValue -Path $PrintersRpcPath -Name "RpcAuthentication" -ExpectedValue 0 Test-RegistryValue -Path $PrintersRpcPath -Name "RpcProtocols" -ExpectedValue 5 Test-RegistryValue -Path $PrintersRpcPath -Name "ForceKerberosForRpc" -ExpectedValue 0 Test-RegistryValue -Path $PrintersRpcPath -Name "RpcTcpPort" -ExpectedValue 0 # Audit Print Control $PrintControlPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Print" Test-RegistryValue -Path $PrintControlPath -Name "RpcAuthnLevelPrivacyEnabled" -ExpectedValue 1 # Audit Point and Print $PointPrintPath = "HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" Test-RegistryValue -Path $PointPrintPath -Name "RestrictPointAndPrint" -ExpectedValue 1 Test-RegistryValue -Path $PointPrintPath -Name "NoWarningNoElevationOnInstall" -ExpectedValue 0 Test-RegistryValue -Path $PointPrintPath -Name "UpdatePromptSettings" -ExpectedValue 0 Test-RegistryValue -Path $PointPrintPath -Name "RestrictDriverInstallationToAdministrators" -ExpectedValue 1 if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-PrintingAndSpooler.ps1 # Description: Disables the Print Spooler service and configures secondary print registry hardening parameters on standard endpoints. Write-Host "Applying Print Spooler security hardening..." -ForegroundColor Cyan # 1. Disable the Print Spooler Service if (Get-Service -Name "Spooler" -ErrorAction SilentlyContinue) { Set-Service -Name "Spooler" -StartupType Disabled -Confirm:$false Stop-Service -Name "Spooler" -Force -Confirm:$false Write-Host "[+] Print Spooler service has been stopped and disabled." -ForegroundColor Green } # 1. Base Printers Path Policies $PrintersPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" if (-not (Test-Path $PrintersPath)) { New-Item -Path $PrintersPath -Force | Out-Null } # Allow Print Spooler to accept client connections -> Disabled Set-ItemProperty -Path $PrintersPath -Name "RegisterSpoolerRemoteRpcEndPoint" -Value 2 -Type Dword Set-ItemProperty -Path $PrintersPath -Name "RegisterSpoolerRemoteSubsystem" -Value 0 -Type Dword # Configure Redirection Guard -> Enabled: Redirection Guard Enabled Set-ItemProperty -Path $PrintersPath -Name "RedirectionguardPolicy" -Value 1 -Type Dword # Manage processing of Queue-specific files -> Enabled: Limit Queue-specific files to Color profiles Set-ItemProperty -Path $PrintersPath -Name "CopyFilesPolicy" -Value 1 -Type Dword # 2. Printers RPC Connection and Listener Policies $PrintersRpcPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC" if (-not (Test-Path $PrintersRpcPath)) { New-Item -Path $PrintersRpcPath -Force | Out-Null } # Protocol to use for outgoing RPC connections -> RPC over TCP (0) Set-ItemProperty -Path $PrintersRpcPath -Name "RpcUseNamedPipeProtocol" -Value 0 -Type Dword # Use authentication for outgoing RPC connections -> Default (0) Set-ItemProperty -Path $PrintersRpcPath -Name "RpcAuthentication" -Value 0 -Type Dword # Protocols to allow for incoming RPC connections -> RPC over TCP (5) Set-ItemProperty -Path $PrintersRpcPath -Name "RpcProtocols" -Value 5 -Type Dword # Authentication protocol to use for incoming RPC connections -> Negotiate (0) Set-ItemProperty -Path $PrintersRpcPath -Name "ForceKerberosForRpc" -Value 0 -Type Dword # Configure RPC over TCP port -> 0 Set-ItemProperty -Path $PrintersRpcPath -Name "RpcTcpPort" -Value 0 -Type Dword # 3. System Print Control Privacy Setting $PrintControlPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Print" if (-not (Test-Path $PrintControlPath)) { New-Item -Path $PrintControlPath -Force | Out-Null } # Configure RPC packet level privacy setting for incoming connections -> Enabled Set-ItemProperty -Path $PrintControlPath -Name "RpcAuthnLevelPrivacyEnabled" -Value 1 -Type Dword # 4. Point and Print Restrictions $PointPrintPath = "HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" if (-not (Test-Path $PointPrintPath)) { New-Item -Path $PointPrintPath -Force | Out-Null } Set-ItemProperty -Path $PointPrintPath -Name "RestrictPointAndPrint" -Value 1 -Type Dword Set-ItemProperty -Path $PointPrintPath -Name "NoWarningNoElevationOnInstall" -Value 0 -Type Dword Set-ItemProperty -Path $PointPrintPath -Name "UpdatePromptSettings" -Value 0 -Type Dword Set-ItemProperty -Path $PointPrintPath -Name "RestrictDriverInstallationToAdministrators" -Value 1 -Type Dword Write-Host "[+] Print Spooler and Printer configurations hardened successfully." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 Enterprise/Professional (and above), Windows 11 Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/configure-applocker-policies.md Endpoints and general member servers are the most common entry points for malware, ransomware, and administrative account compromise. Standard users running with non-administrative accounts can download and execute malicious executables or scripts in writeable directories (like %TEMP% or %USERPROFILE%) to bypass traditional signature-based antivirus solutions. Enforcing strict application control via AppLocker on endpoints ensures that: 1. Malware Prevention: Standard users are blocked from executing unauthorized binaries and installers. 2. Defends Against AppLocker Bypasses: Abusing trusted, signed Microsoft binaries (such as msbuild.exe, installutil.exe, regasm.exe, regsvcs.exe, mshta.exe, regsvr32.exe, rundll32.exe) allows attackers to execute arbitrary code bypassing default AppLocker rules. This control blocks these "Living off the Land" binaries (LOLBins) and prevents execution from user-writeable paths under %WINDIR% (such as Tasks, Temp, tracing, spool\drivers\color, etc.). 3. Restricts Interpreted Codes: Block unauthorized execution of scripts (PowerShell, VBScript, Batch) from writeable locations. 4. Defense-in-Depth: Limits the lateral movement of adversaries who pivot from one compromised endpoint to another. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Create or edit the GPO linked to the workstations/member servers Organizational Unit (OU) (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Double-click Application Identity. Select Define this policy setting and configure the startup mode to Automatic. Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Application Control Policies\AppLocker Configure AppLocker Enforcement: Right-click AppLocker and select Properties*. On the Enforcement tab, check Configured* under: Executable rules -> Select Enforce rules (or Audit only* for testing) Windows Installer rules -> Select Enforce rules Script rules -> Select Enforce rules Packaged app rules -> Select Enforce rules Right-click Executable Rules and select Create Default Rules (this permits Windows files and program files). Delete the default rule allowing "Everyone" to run files in all locations, and replace it with a rule allowing only authorized administrative groups (e.g., Domain Admins, Local Administrators) to run binaries outside the default system locations. Per ANSSI R2 recommendation, do not create standalone Deny rules. Instead, configure the following path Exceptions on the default Allow rule for the Windows folder: Right-click the rule `(Default Rule) All files located in the Windows folder` and select Properties*. On the Exceptions* tab, add path exceptions for writeable directories under %WINDIR%: `%WINDIR%\Tasks\ `%WINDIR%\Temp\ `%WINDIR%\tracing\ `%WINDIR%\System32\spool\drivers\color\ `%WINDIR%\System32\Tasks\Microsoft\Windows\SyncCenter\ `%WINDIR%\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ On the same Exceptions* tab, add path exceptions for the following bypass binaries (LOLBins): `\msbuild.exe` `\installutil.exe` `\mshta.exe` `\regasm.exe` `\regsvcs.exe` `\regsvr32.exe` `\rundll32.exe` `\bginfo.exe` `\cdb.exe` `\cmstp.exe` `\control.exe` `\csi.exe` `\dfsvc.exe` `\dnx.exe` `\fsi.exe` `\ie4unit.exe` `\ieexec.exe` `\infdefaultinstall.exe` `\mavinject.exe` `\msdeploy.exe` `\msdt.exe` `\msxsl.exe` `\odbcconf.exe` `\presentationhost.exe` `\rcsi.exe` `\rsi.exe` `\runscripthelper.exe` `\te.exe` `\tracker.exe` `\xwizard.exe` Repeat the process for Script Rules by creating default rules and adding exceptions to the %WINDIR%\* Allow rule for script execution from user-writeable paths (such as %WINDIR%\Temp\* and %WINDIR%\Tasks\*). Disable NTVDM (16-bit application support) to prevent AppLocker bypasses via 16-bit binaries: * Navigate to: Computer Configuration\Administrative Templates\System\16-bit Application Compatibility Configure Prevent access to 16-bit applications to Enabled*. Link the GPO to the Endpoints Organizational Unit (OU). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the Application Identity service (AppIDSvc) and import the robust AppLocker policy locally. Download Script: Configure-EndpointAppLocker.ps1 # Configure-EndpointAppLocker.ps1 # Description: Configures the Application Identity service (AppIDSvc) to start automatically and imports a robust AppLocker XML policy. Write-Host "Applying AppLocker Identity service hardening..." -ForegroundColor Cyan # 1. Enable Application Identity service (AppIDSvc) $AppLockerService = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue if ($AppLockerService) { Set-Service -Name AppIDSvc -StartupType Automatic Start-Service -Name AppIDSvc -ErrorAction SilentlyContinue Write-Host "[+] Application Identity Service (AppIDSvc) set to Automatic and started." -ForegroundColor Green } else { Write-Warning "[-] Application Identity Service not found on this machine." } # 2. Configure local AppLocker policy XML content $AppLockerXml = @" <AppLockerPolicy Version="1"> <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e1e-453f-b3a5-bc4f4a38674d" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-6d8f-4ad9-acbc-467b78a7f7b4" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> <FilePathCondition Path="%WINDIR%\System32\spool\drivers\color\*" /> <FilePathCondition Path="%WINDIR%\System32\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="%WINDIR%\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="*\msbuild.exe" /> <FilePathCondition Path="*\installutil.exe" /> <FilePathCondition Path="*\mshta.exe" /> <FilePathCondition Path="*\regasm.exe" /> <FilePathCondition Path="*\regsvcs.exe" /> <FilePathCondition Path="*\regsvr32.exe" /> <FilePathCondition Path="*\rundll32.exe" /> <FilePathCondition Path="*\bginfo.exe" /> <FilePathCondition Path="*\cdb.exe" /> <FilePathCondition Path="*\cmstp.exe" /> <FilePathCondition Path="*\control.exe" /> <FilePathCondition Path="*\csi.exe" /> <FilePathCondition Path="*\dfsvc.exe" /> <FilePathCondition Path="*\dnx.exe" /> <FilePathCondition Path="*\fsi.exe" /> <FilePathCondition Path="*\ie4unit.exe" /> <FilePathCondition Path="*\ieexec.exe" /> <FilePathCondition Path="*\infdefaultinstall.exe" /> <FilePathCondition Path="*\mavinject.exe" /> <FilePathCondition Path="*\msdeploy.exe" /> <FilePathCondition Path="*\msdt.exe" /> <FilePathCondition Path="*\msxsl.exe" /> <FilePathCondition Path="*\odbcconf.exe" /> <FilePathCondition Path="*\presentationhost.exe" /> <FilePathCondition Path="*\rcsi.exe" /> <FilePathCondition Path="*\rsi.exe" /> <FilePathCondition Path="*\runscripthelper.exe" /> <FilePathCondition Path="*\te.exe" /> <FilePathCondition Path="*\tracker.exe" /> <FilePathCondition Path="*\xwizard.exe" /> </Exceptions> </FilePathRule> <FilePathRule Id="fd686d83-a829-4351-8ff4-27c1de5732e9" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePathRule Id="5b8fa8b3-3a5e-4c7a-9cb8-b223ff9db271" Name="(Default Rule) All Windows Installer files in Program Files" Description="Allows everyone to run Windows Installer files in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="6b8fa8b3-3a5e-4c7a-9cb8-b223ff9db272" Name="(Default Rule) All Windows Installer files in Windows" Description="Allows everyone to run Windows Installer files in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="7b8fa8b3-3a5e-4c7a-9cb8-b223ff9db273" Name="(Default Rule) All Windows Installer files" Description="Allows administrators to run all Windows Installer files." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Script" EnforcementMode="Enabled"> <FilePathRule Id="1c8fa8b3-3a5e-4c7a-9cb8-b223ff9db274" Name="(Default Rule) All scripts located in the Program Files folder" Description="Allows everyone to run scripts in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="2c8fa8b3-3a5e-4c7a-9cb8-b223ff9db275" Name="(Default Rule) All scripts located in the Windows folder" Description="Allows everyone to run scripts in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="3c8fa8b3-3a5e-4c7a-9cb8-b223ff9db276" Name="(Default Rule) All scripts" Description="Allows administrators to run all scripts." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="1d8fa8b3-3a5e-4c7a-9cb8-b223ff9db279" Name="(Default Rule) All signed packaged apps" Description="Allows everyone to run signed packaged apps." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> </AppLockerPolicy> "@ # Write the temporary XML and import it $TempPath = Join-Path -Path $env:TEMP -ChildPath "AppLockerEndpointPolicy.xml" $AppLockerXml | Out-File -FilePath $TempPath -Encoding UTF8 -Force # 3. Validate policy using Test-AppLockerPolicy before importing try { Import-Module AppLocker -ErrorAction Stop } catch { Write-Error "AppLocker module is not available on this system. Cannot configure or validate policy." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } $TestPaths = @( # Expected: Allowed "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe", # Expected: DeniedByDefault or ExplicitlyDenied (since it is an exception to an Allow rule) "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) $ValidationFailed = $false try { $TestResults = Test-AppLockerPolicy -XmlPolicy $TempPath -Path $TestPaths -User Everyone -ErrorAction Stop $ExpectedAllow = @( "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe" ) $ExpectedDeny = @( "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) foreach ($Result in $TestResults) { $Path = $Result.FilePath $Decision = $Result.PolicyDecision if ($ExpectedAllow -contains $Path) { if ($Decision -ne "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Allow for: $Path (got: $Decision)" $ValidationFailed = $true } } if ($ExpectedDeny -contains $Path) { if ($Decision -eq "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Deny/Not Allowed for: $Path (got: $Decision)" $ValidationFailed = $true } } } } catch { Write-Warning "Could not perform policy validation tests: $($_.Exception.Message)" $ValidationFailed = $true } if ($ValidationFailed) { Write-Error "AppLocker policy validation failed. Policy was NOT imported." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } Write-Host "[+] AppLocker policy validation passed. Proceeding with import." -ForegroundColor Green # 4. Import the validated AppLocker policy try { Set-AppLockerPolicy -XmlPolicy $TempPath -ErrorAction Stop Write-Host "[+] Local AppLocker policy imported and enforced successfully." -ForegroundColor Green } catch { Write-Error "Failed to import AppLocker policy: $($_.Exception.Message)" } finally { if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } } # 5. Disable NTVDM (16-bit compatibility) via Registry $NtvdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" if (-not (Test-Path $NtvdmPath)) { New-Item -Path $NtvdmPath -Force | Out-Null } Set-ItemProperty -Path $NtvdmPath -Name "Prevent16BitApp" -Value 1 -Type DWord Write-Host "[+] 16-bit NTVDM compatibility disabled in registry." -ForegroundColor Green To verify the AppLocker service status: Download Script: Test-EndpointAppLockerStatus.ps1 # Test-EndpointAppLockerStatus.ps1 # Description: Checks the current configuration and operational status of the Application Identity service. Write-Host "--- Auditing AppLocker Service Status ---" -ForegroundColor Cyan # 1. Audit service state $AppIDSvc = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue if ($AppIDSvc) { if ($AppIDSvc.Status -eq "Running" -and $AppIDSvc.StartType -eq "Automatic") { Write-Host " - AppLocker Service Status: Running | Startup: Automatic (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: AppLocker Service Status: $($AppIDSvc.Status) | Startup: $($AppIDSvc.StartType) (Should be Running/Automatic)" -ForegroundColor Red } } else { Write-Host " - VULNERABLE: Application Identity Service (AppIDSvc) is not installed." -ForegroundColor Red } # 2. Audit enforcement registry settings $SrpPath = "HKLM:\Software\Policies\Microsoft\Windows\SrpV2" $Collections = @("Exe", "Msi", "Script", "Appx") if (Test-Path $SrpPath) { foreach ($Col in $Collections) { $ColPath = "$SrpPath\$Col" if (Test-Path $ColPath) { $Val = Get-ItemProperty -Path $ColPath -Name "EnforcementMode" -ErrorAction SilentlyContinue if ($null -ne $Val) { $Mode = if ($Val.EnforcementMode -eq 1) { "Enforced" } else { "Audit Only" } $Color = if ($Val.EnforcementMode -eq 1) { "Green" } else { "Yellow" } Write-Host " - Collection $Col Enforcement: $Mode (Value: $($Val.EnforcementMode))" -ForegroundColor $Color } else { Write-Host " - Collection $Col Enforcement: NOT CONFIGURED" -ForegroundColor Red } } else { Write-Host " - Collection $Col Path: NOT FOUND" -ForegroundColor Red } } } else { Write-Host "[-] AppLocker registry base path (SrpV2) not found. Policy is not deployed." -ForegroundColor Red } # 3. Audit NTVDM Disable Status $NtvdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" if (Test-Path $NtvdmPath) { $AppCompatVal = Get-ItemProperty -Path $NtvdmPath -Name "Prevent16BitApp" -ErrorAction SilentlyContinue if ($null -ne $AppCompatVal -and $AppCompatVal.Prevent16BitApp -eq 1) { Write-Host " - NTVDM (16-bit AppCompat): Disabled (Secure)" -ForegroundColor Green } else { Write-Host " - NTVDM (16-bit AppCompat): Enabled or Not Configured (Expected: Disabled)" -ForegroundColor Yellow } } else { Write-Host " - NTVDM (16-bit AppCompat): Not Configured (Expected: Disabled)" -ForegroundColor Yellow } # Configure-EndpointAppLocker.ps1 # Description: Configures the Application Identity service (AppIDSvc) to start automatically and imports a robust AppLocker XML policy. Write-Host "Applying AppLocker Identity service hardening..." -ForegroundColor Cyan # 1. Enable Application Identity service (AppIDSvc) $AppLockerService = Get-Service -Name AppIDSvc -ErrorAction SilentlyContinue if ($AppLockerService) { Set-Service -Name AppIDSvc -StartupType Automatic Start-Service -Name AppIDSvc -ErrorAction SilentlyContinue Write-Host "[+] Application Identity Service (AppIDSvc) set to Automatic and started." -ForegroundColor Green } else { Write-Warning "[-] Application Identity Service not found on this machine." } # 2. Configure local AppLocker policy XML content $AppLockerXml = @" <AppLockerPolicy Version="1"> <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="921cc481-6e1e-453f-b3a5-bc4f4a38674d" Name="(Default Rule) All files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="a61c8b2c-6d8f-4ad9-acbc-467b78a7f7b4" Name="(Default Rule) All files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> <FilePathCondition Path="%WINDIR%\System32\spool\drivers\color\*" /> <FilePathCondition Path="%WINDIR%\System32\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="%WINDIR%\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\*" /> <FilePathCondition Path="*\msbuild.exe" /> <FilePathCondition Path="*\installutil.exe" /> <FilePathCondition Path="*\mshta.exe" /> <FilePathCondition Path="*\regasm.exe" /> <FilePathCondition Path="*\regsvcs.exe" /> <FilePathCondition Path="*\regsvr32.exe" /> <FilePathCondition Path="*\rundll32.exe" /> <FilePathCondition Path="*\bginfo.exe" /> <FilePathCondition Path="*\cdb.exe" /> <FilePathCondition Path="*\cmstp.exe" /> <FilePathCondition Path="*\control.exe" /> <FilePathCondition Path="*\csi.exe" /> <FilePathCondition Path="*\dfsvc.exe" /> <FilePathCondition Path="*\dnx.exe" /> <FilePathCondition Path="*\fsi.exe" /> <FilePathCondition Path="*\ie4unit.exe" /> <FilePathCondition Path="*\ieexec.exe" /> <FilePathCondition Path="*\infdefaultinstall.exe" /> <FilePathCondition Path="*\mavinject.exe" /> <FilePathCondition Path="*\msdeploy.exe" /> <FilePathCondition Path="*\msdt.exe" /> <FilePathCondition Path="*\msxsl.exe" /> <FilePathCondition Path="*\odbcconf.exe" /> <FilePathCondition Path="*\presentationhost.exe" /> <FilePathCondition Path="*\rcsi.exe" /> <FilePathCondition Path="*\rsi.exe" /> <FilePathCondition Path="*\runscripthelper.exe" /> <FilePathCondition Path="*\te.exe" /> <FilePathCondition Path="*\tracker.exe" /> <FilePathCondition Path="*\xwizard.exe" /> </Exceptions> </FilePathRule> <FilePathRule Id="fd686d83-a829-4351-8ff4-27c1de5732e9" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePathRule Id="5b8fa8b3-3a5e-4c7a-9cb8-b223ff9db271" Name="(Default Rule) All Windows Installer files in Program Files" Description="Allows everyone to run Windows Installer files in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="6b8fa8b3-3a5e-4c7a-9cb8-b223ff9db272" Name="(Default Rule) All Windows Installer files in Windows" Description="Allows everyone to run Windows Installer files in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="7b8fa8b3-3a5e-4c7a-9cb8-b223ff9db273" Name="(Default Rule) All Windows Installer files" Description="Allows administrators to run all Windows Installer files." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Script" EnforcementMode="Enabled"> <FilePathRule Id="1c8fa8b3-3a5e-4c7a-9cb8-b223ff9db274" Name="(Default Rule) All scripts located in the Program Files folder" Description="Allows everyone to run scripts in Program Files." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="2c8fa8b3-3a5e-4c7a-9cb8-b223ff9db275" Name="(Default Rule) All scripts located in the Windows folder" Description="Allows everyone to run scripts in Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\Temp\*" /> <FilePathCondition Path="%WINDIR%\Tasks\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="3c8fa8b3-3a5e-4c7a-9cb8-b223ff9db276" Name="(Default Rule) All scripts" Description="Allows administrators to run all scripts." UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="1d8fa8b3-3a5e-4c7a-9cb8-b223ff9db279" Name="(Default Rule) All signed packaged apps" Description="Allows everyone to run signed packaged apps." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> </AppLockerPolicy> "@ # Write the temporary XML and import it $TempPath = Join-Path -Path $env:TEMP -ChildPath "AppLockerEndpointPolicy.xml" $AppLockerXml | Out-File -FilePath $TempPath -Encoding UTF8 -Force # 3. Validate policy using Test-AppLockerPolicy before importing try { Import-Module AppLocker -ErrorAction Stop } catch { Write-Error "AppLocker module is not available on this system. Cannot configure or validate policy." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } $TestPaths = @( # Expected: Allowed "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe", # Expected: DeniedByDefault or ExplicitlyDenied (since it is an exception to an Allow rule) "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) $ValidationFailed = $false try { $TestResults = Test-AppLockerPolicy -XmlPolicy $TempPath -Path $TestPaths -User Everyone -ErrorAction Stop $ExpectedAllow = @( "$env:windir\System32\cmd.exe", "$env:windir\System32\WindowsPowerShell\v1.0\powershell.exe" ) $ExpectedDeny = @( "$env:USERPROFILE\Downloads\tool.exe", "$env:windir\Temp\malware.exe", "$env:windir\Tasks\evil.exe", "$env:windir\System32\msbuild.exe" ) foreach ($Result in $TestResults) { $Path = $Result.FilePath $Decision = $Result.PolicyDecision if ($ExpectedAllow -contains $Path) { if ($Decision -ne "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Allow for: $Path (got: $Decision)" $ValidationFailed = $true } } if ($ExpectedDeny -contains $Path) { if ($Decision -eq "Allowed") { Write-Warning "[VALIDATION FAIL] Expected Deny/Not Allowed for: $Path (got: $Decision)" $ValidationFailed = $true } } } } catch { Write-Warning "Could not perform policy validation tests: $($_.Exception.Message)" $ValidationFailed = $true } if ($ValidationFailed) { Write-Error "AppLocker policy validation failed. Policy was NOT imported." if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } return } Write-Host "[+] AppLocker policy validation passed. Proceeding with import." -ForegroundColor Green # 4. Import the validated AppLocker policy try { Set-AppLockerPolicy -XmlPolicy $TempPath -ErrorAction Stop Write-Host "[+] Local AppLocker policy imported and enforced successfully." -ForegroundColor Green } catch { Write-Error "Failed to import AppLocker policy: $($_.Exception.Message)" } finally { if (Test-Path $TempPath) { Remove-Item -Path $TempPath -Force } } # 5. Disable NTVDM (16-bit compatibility) via Registry $NtvdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat" if (-not (Test-Path $NtvdmPath)) { New-Item -Path $NtvdmPath -Force | Out-Null } Set-ItemProperty -Path $NtvdmPath -Name "Prevent16BitApp" -Value 1 -Type DWord Write-Host "[+] 16-bit NTVDM compatibility disabled in registry." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and domain member servers. (For Domain Controllers, refer to [REQ-DC-156](../02-domain-controllers/configure-elam.md); for Privileged Access Workstations, refer to [REQ-PAW-014](../07-paws/configure-elam.md)). Operating Systems: Windows 10 Enterprise, Windows 11 Enterprise, Windows Server 2016 (and above). File Path: 08-endpoints/configure-elam.md Standard enterprise endpoints and domain member servers represent the primary ingress point for adversaries seeking footholds inside an organization. Ensuring boot-level integrity prevents attackers from using persistence mechanisms that bypass user-mode security software. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the GPO applied to your standard endpoints and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Early Launch Antimalware In the right pane, double-click Boot-Start Driver Initialization Policy. Select Enabled. In the Choose the boot-start drivers that can be initialized dropdown, select: Good, unknown and bad but critical Click Apply, then OK. Link the GPO to the appropriate Endpoints and Member Servers Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the ELAM boot-start driver load policy on endpoints. Download Script: Configure-ElamPolicy.ps1 # Configure-ElamPolicy.ps1 # Description: Configures the Early Launch Antimalware (ELAM) boot-start driver load policy on the local system. Write-Host "Applying ELAM Boot-Start driver initialization policy..." -ForegroundColor Cyan $ElamPath = "HKLM:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch" if (-not (Test-Path $ElamPath)) { New-Item -Path $ElamPath -Force | Out-Null } Set-ItemProperty -Path $ElamPath -Name "DriverLoadPolicy" -Value 3 -Type DWord -ErrorAction Stop Write-Host "[+] ELAM Boot-Start driver initialization policy set to 'Good, unknown and bad but critical' (Value = 3)." -ForegroundColor Green # Configure-ElamPolicy.ps1 # Description: Configures the Early Launch Antimalware (ELAM) boot-start driver load policy on the local system. Write-Host "Applying ELAM Boot-Start driver initialization policy..." -ForegroundColor Cyan $ElamPath = "HKLM:\SYSTEM\CurrentControlSet\Policies\EarlyLaunch" if (-not (Test-Path $ElamPath)) { New-Item -Path $ElamPath -Force | Out-Null } Set-ItemProperty -Path $ElamPath -Name "DriverLoadPolicy" -Value 3 -Type DWord -ErrorAction Stop Write-Host "[+] ELAM Boot-Start driver initialization policy set to 'Good, unknown and bad but critical' (Value = 3)." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/configure-untrusted-font-blocking.md Font files (TrueType, OpenType, and others) are highly complex formats that require advanced parsing logic. Historically, font parsing in Windows was performed by the Graphics Device Interface (GDI) within the operating system kernel. Vulnerabilities in the kernel-mode font parser (such as buffer overflows or remote code execution) have been frequently exploited by threat actors to execute arbitrary code with kernel-level privileges. Enabling Untrusted Font Blocking limits the attack surface of the graphics subsystem: 1. Kernel Attack Surface Reduction: Restricting the system to only load trusted fonts installed in the %windir%\Fonts system directory prevents the processing of malicious, web-delivered, or embedded font files. 2. Mitigation of Document-Based Exploits: Prevents malicious font files embedded in Microsoft Office documents, PDFs, or web pages from triggering parsing vulnerabilities in the context of the current user. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on a domain controller or management host. Create a new GPO or edit an existing one (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Mitigation Options Configure the following setting: Policy*: Untrusted Font Blocking Setting*: Enabled Mitigation Options*: Block untrusted fonts and log events Link the GPO to the appropriate Organizational Unit (OU) containing the target client endpoints and member servers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally on standalone systems or during reference image build phases. Download Script: Configure-UntrustedFontBlocking.ps1 # Configure-UntrustedFontBlocking.ps1 # Description: Configures Untrusted Font Blocking mitigation to block untrusted fonts and log events. $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions" $ValueName = "MitigationOptions_FontBocking" $ValueData = "1000000000000" Write-Host "Applying hardening requirement: Configure Untrusted Font Blocking..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type String -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-UntrustedFontBlockingStatus.ps1 # Get-UntrustedFontBlockingStatus.ps1 # Description: Checks the current configuration state of Untrusted Font Blocking registry setting. $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions" $ValueName = "MitigationOptions_FontBocking" $ExpectedValue = "1000000000000" Write-Host "Auditing hardening requirement: Configure Untrusted Font Blocking..." -ForegroundColor Cyan if (Test-Path $RegPath) { $value = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $value -and $value.$ValueName -eq $ExpectedValue) { Write-Host "Audit Result: Compliant. Untrusted fonts are blocked and logged ($($ValueName) = $($ExpectedValue))." -ForegroundColor Green exit 0 } } Write-Host "Audit Result: Non-Compliant. Untrusted fonts are not configured to block and log." -ForegroundColor Red exit 1 # Configure-UntrustedFontBlocking.ps1 # Description: Configures Untrusted Font Blocking mitigation to block untrusted fonts and log events. $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions" $ValueName = "MitigationOptions_FontBocking" $ValueData = "1000000000000" Write-Host "Applying hardening requirement: Configure Untrusted Font Blocking..." -ForegroundColor Cyan if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type String -Force | Out-Null Write-Host "Hardening applied successfully." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations. (For Domain Controllers and Domain Member Servers, refer to [REQ-DC-029](../02-domain-controllers/configure-svchost-mitigation.md); for Privileged Access Workstations, refer to [REQ-PAW-017](../07-paws/configure-svchost-mitigation.md)). Operating Systems: Windows 10 (1903 and above), Windows 11 Enterprise/Professional. File Path: 08-endpoints/configure-svchost-mitigation.md The Service Host (svchost.exe) process is a fundamental Windows operating system binary designed to host one or more shared or isolated system services. Because svchost.exe instances execute with elevated privileges (such as NT AUTHORITY\SYSTEM, NT AUTHORITY\LOCAL SERVICE, or NT AUTHORITY\NETWORK SERVICE) and naturally maintain persistent execution across user sessions, they represent one of the primary targets for threat actors seeking privilege escalation, defense evasion, and persistence on client workstations. In client endpoint environments, workstations serve as the primary initial access vector for attackers through phishing attachments, malicious browser downloads, drive-by exploits, or compromised peripheral devices. Once a basic user-level foothold is achieved, adversaries frequently attempt to blend malicious activity into legitimate system traffic by targeting svchost.exe: 1. Process Injection & Hollowing (MITRE ATT&CK T1055, T1055.012): Attackers create a suspended svchost.exe process or inject malicious code into an existing service host instance (CreateRemoteThread, QueueUserAPC, SetThreadContext). This disguises command-and-control (C2) beaconing (e.g., Cobalt Strike, Sliver, Brute Ratel) under trusted system process names and bypasses basic endpoint security inspection. 2. Dynamic Code Execution & Reflective Loading: In-memory payloads and exploitation frameworks rely on allocating executable memory (PAGE_EXECUTE_READWRITE via VirtualAlloc or VirtualProtect) to dynamically decrypt, compile, or inject unmapped DLLs directly into process memory without touching disk. 3. Ghost Service DLL Hijacking & Malicious Service Registration (MITRE ATT&CK T1574.002): Attackers modify service registry keys to point ServiceDll to unsigned, arbitrary third-party DLLs. When the Service Control Manager starts the service, svchost.exe loads the unauthorized DLL with SYSTEM privileges. Enabling svchost.exe mitigation options instructs the Windows Service Control Manager (SCM, services.exe) to apply strict kernel-enforced process creation mitigation policies whenever a new svchost.exe instance is spawned: Microsoft-Only Binary Enforcement (`PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON`) : Enforces that every executable binary and Dynamic Link Library (DLL) loaded into the address space of any `svchost.exe` process must be digitally signed by a trusted Microsoft certificate (Windows Production Root, WHQL, or Microsoft Corporation). Any attempt by unsigned, self-signed, or third-party binaries to map into `svchost.exe` is immediately terminated by the Windows kernel with `STATUS_INVALID_IMAGE_HASH` (`0xC0000428`). Dynamic Code Execution Blocking (`PROCESS_CREATION_MITIGATION_POLICY_PROHIBIT_DYNAMIC_CODE_ALWAYS_ON`): Disallows the generation and execution of dynamic code within svchost.exe processes. This kernel mitigation blocks arbitrary memory page execution, preventing JIT compilation abuse, shellcode execution, and reflective DLL injection inside all system service containers. Service Host Splitting Synergies*: Since Windows 10 Version 1703, on workstations with more than 3.5 GB of RAM (SvcHostSplitThresholdInKB), Windows automatically isolates individual services into dedicated, standalone svchost.exe processes. When EnableSvchostMitigationPolicy is active, this per-service architecture ensures that every isolated service process receives independent, uncompromising mitigation enforcement. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on an administrative workstation or Domain Controller. Create a new GPO or edit an existing endpoint hardening GPO (e.g., GPO_Hardening_Tier2_Endpoints). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Service Control Manager Settings\Security Settings In the right-hand details pane, double-click Enable svchost.exe mitigation options. Select Enabled. Click Apply, then click OK. Link the GPO to the Organizational Unit (OU) containing your Tier 2 client workstations (e.g., OU=Workstations,DC=contoso,DC=com). After applying the policy, schedule or initiate a system restart on target endpoints to enforce the mitigation policy across all boot-level service host instances. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally during gold master image creation, automated Intune / MDM provisioning, or standalone testing. Download Script: Configure-SvchostMitigation.ps1 # Configure-SvchostMitigation.ps1 # Description: Configures svchost.exe mitigation options to enforce Microsoft-signed binaries and block dynamic code. [CmdletBinding()] param() $ErrorActionPreference = "Stop" Write-Host "Applying hardening requirement: Configure svchost.exe mitigation options..." -ForegroundColor Cyan # Verify minimum operating system build compatibility (Windows 10 1903 / Build 18362 or Windows Server 2022 / Build 20348) $osVersion = [System.Environment]::OSVersion.Version $osBuild = $osVersion.Build if ($osBuild -lt 18362) { Write-Warning "The operating system build ($($osBuild)) does not support EnableSvchostMitigationPolicy (requires Windows 10 1903+ or Windows Server 2022+)." exit 1 } $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig" $ValueName = "EnableSvchostMitigationPolicy" $ValueData = 1 try { if (-not (Test-Path -Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null Write-Host "Created registry key: $($RegPath)" -ForegroundColor Gray } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null # Validate written value $configuredValue = (Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction Stop).$ValueName if ($configuredValue -eq $ValueData) { Write-Host "Hardening applied successfully: $($ValueName) set to 1." -ForegroundColor Green Write-Host "Note: This policy applies to newly created svchost.exe instances. A full system restart is required to protect services initialized at system boot." -ForegroundColor Yellow exit 0 } else { throw "Failed to verify registry property value after write." } } catch { Write-Error "Error configuring svchost.exe mitigation options: $($_.Exception.Message)" exit 1 } To verify the setting has been applied: Download Script: Get-SvchostMitigationStatus.ps1 # Get-SvchostMitigationStatus.ps1 # Description: Audits the configuration state of svchost.exe mitigation options. [CmdletBinding()] param() $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig" $ValueName = "EnableSvchostMitigationPolicy" $ExpectedValue = 1 Write-Host "Auditing hardening requirement: Configure svchost.exe mitigation options..." -ForegroundColor Cyan $osVersion = [System.Environment]::OSVersion.Version $osBuild = $osVersion.Build if ($osBuild -lt 18362) { Write-Warning "Audit Result: Non-Applicable / Unsupported. OS build $($osBuild) precedes the introduction of svchost mitigation policy (requires Windows 10 1903+ or Windows Server 2022+)." exit 1 } if (Test-Path -Path $RegPath) { $item = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $item -and $item.$ValueName -eq $ExpectedValue) { Write-Host "Audit Result: Compliant. svchost.exe mitigation policy is enabled in registry ($($RegPath)\$($ValueName) = 1)." -ForegroundColor Green # Optional check for running svchost processes $svchostProcesses = Get-Process -Name "svchost" -ErrorAction SilentlyContinue if ($svchostProcesses) { Write-Host "Found $($svchostProcesses.Count) running svchost.exe process instances. Process mitigation flags are enforced dynamically at process spawn by the Service Control Manager." -ForegroundColor Gray } exit 0 } } Write-Host "Audit Result: Non-Compliant. svchost.exe mitigation options are disabled or not configured ($($RegPath)\$($ValueName))." -ForegroundColor Red exit 1 # Configure-SvchostMitigation.ps1 # Description: Configures svchost.exe mitigation options to enforce Microsoft-signed binaries and block dynamic code. [CmdletBinding()] param() $ErrorActionPreference = "Stop" Write-Host "Applying hardening requirement: Configure svchost.exe mitigation options..." -ForegroundColor Cyan # Verify minimum operating system build compatibility (Windows 10 1903 / Build 18362 or Windows Server 2022 / Build 20348) $osVersion = [System.Environment]::OSVersion.Version $osBuild = $osVersion.Build if ($osBuild -lt 18362) { Write-Warning "The operating system build ($($osBuild)) does not support EnableSvchostMitigationPolicy (requires Windows 10 1903+ or Windows Server 2022+)." exit 1 } $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SCMConfig" $ValueName = "EnableSvchostMitigationPolicy" $ValueData = 1 try { if (-not (Test-Path -Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null Write-Host "Created registry key: $($RegPath)" -ForegroundColor Gray } Set-ItemProperty -Path $RegPath -Name $ValueName -Value $ValueData -Type DWord -Force | Out-Null # Validate written value $configuredValue = (Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction Stop).$ValueName if ($configuredValue -eq $ValueData) { Write-Host "Hardening applied successfully: $($ValueName) set to 1." -ForegroundColor Green Write-Host "Note: This policy applies to newly created svchost.exe instances. A full system restart is required to protect services initialized at system boot." -ForegroundColor Yellow exit 0 } else { throw "Failed to verify registry property value after write." } } catch { Write-Error "Error configuring svchost.exe mitigation options: $($_.Exception.Message)" exit 1 } Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 11 (and above) Enterprise/Professional File Path: 08-endpoints/enable-kernel-shadow-stacks.md Kernel-mode Hardware-enforced Stack Protection uses CPU hardware features to protect the operating system kernel from memory corruption exploits, specifically Return-Oriented Programming (ROP) attacks. An adversary attempting privilege escalation or remote code execution often hijacks the control flow of kernel-mode components by overwriting return addresses on the stack. Intel Control-flow Enforcement Technology (CET) and AMD Shadow Stack technologies create a separate, hardware-secured copy of the call stack (the "shadow stack"). Before returning from a function, the CPU compares the return address on the standard stack with the address stored on the hardware-secured shadow stack. If the addresses do not match, the processor detects a control flow violation, terminates the process, or triggers a system crash to prevent execution of malicious payloads. Enforcing Kernel-mode Hardware-enforced Stack Protection provides hardware-backed control-flow integrity, neutralizing key vectors of kernel exploitation. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the appropriate endpoint GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the setting: Policy : `Turn On Virtualization Based Security` -> Set to Enabled Check Kernel-level shadow stacks -> Set to Enabled* (or set registry Enabled = 1) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the registry and activate Kernel-mode Hardware-enforced Stack Protection. Download Script: Enable-KernelShadowStacks.ps1 # Enable-KernelShadowStacks.ps1 # Description: Configures HKLM registry to enable Kernel-mode Hardware-enforced Stack Protection (Kernel Shadow Stacks). Write-Host "Enabling Kernel-mode Hardware-enforced Stack Protection..." -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "Enabled" -Value 1 -Type DWord Write-Host "[+] Registry setting for Kernel Shadow Stacks enabled. (Reboot required)." -ForegroundColor Green To audit the state of Kernel-mode Hardware-enforced Stack Protection: Download Script: Test-KernelShadowStacks.ps1 # Test-KernelShadowStacks.ps1 # Description: Audits the registry status of Kernel-mode Hardware-enforced Stack Protection (Kernel Shadow Stacks). Write-Host "--- Auditing Kernel-mode Hardware-enforced Stack Protection ---" -ForegroundColor Cyan $script:Vulnerable = $false $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" # Check registry value $val = Get-ItemProperty -Path $RegPath -Name "Enabled" -ErrorAction SilentlyContinue $actual = if ($val) { $val.Enabled } else { "" } if ($actual -eq 1) { Write-Host " - Registry Setting: KernelShadowStacks Enabled | Actual: '1' (Expected: '1')" -ForegroundColor Green } else { $script:Vulnerable = $true Write-Host " - Registry Setting: KernelShadowStacks Enabled | Actual: '$actual' (Expected: '1')" -ForegroundColor Red } # Verify VBS dependency is met try { $DG = Get-CimInstance -Namespace "Root\Microsoft\Windows\DeviceGuard" -ClassName "Win32_DeviceGuard" -ErrorAction Stop if ($DG.VirtualizationBasedSecurityStatus -eq 2) { Write-Host " - VBS Status: Running" -ForegroundColor Green } else { $script:Vulnerable = $true Write-Host " - VBS Status: Not Running (VBS is required for Kernel Shadow Stacks)" -ForegroundColor Red } } catch { $script:Vulnerable = $true Write-Host " - DeviceGuard WMI class query failed. VBS is likely disabled." -ForegroundColor Red } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green } # Enable-KernelShadowStacks.ps1 # Description: Configures HKLM registry to enable Kernel-mode Hardware-enforced Stack Protection (Kernel Shadow Stacks). Write-Host "Enabling Kernel-mode Hardware-enforced Stack Protection..." -ForegroundColor Cyan $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" if (-not (Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null } Set-ItemProperty -Path $RegPath -Name "Enabled" -Value 1 -Type DWord Write-Host "[+] Registry setting for Kernel Shadow Stacks enabled. (Reboot required)." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/disable-unused-features.md To minimize the attack surface of standard client endpoints and member servers, all unnecessary legacy protocols, optional features, and runtime engines must be disabled: PowerShell 2.0 Engine: Legacy PowerShell 2.0 does not support modern logging, transcription, or security monitoring mechanisms such as the Antimalware Scan Interface (AMSI). Attackers leverage "downgrade attacks" by executing PowerShell scripts using the -version 2.0 parameter to bypass script block logging and security tooling. Disabling the engine and its parent runtimes eliminates this bypass vector. .NET Framework 3.5: The .NET 3.5 Framework includes the runtime files for .NET 2.0 and 3.0. PowerShell 2.0 requires .NET 2.0/3.5 to run. Disabling .NET Framework 3.5 removes legacy runtime binaries that are susceptible to downgrade attacks and removes support for older, unpatched software. SMBv1 Protocol: The legacy SMBv1 protocol is cryptographically weak, lacks authentication integrity protection, and has been the target of catastrophic remote code execution attacks (such as EternalBlue). Leaving the SMBv1 driver active allows relaying and man-in-the-middle attacks. Internet Explorer 11: Internet Explorer contains obsolete MSHTML render engine components. Disabling this legacy browser reduces vulnerability to web-based code execution. Work Folders, XPS, DirectPlay, and Client Protocols: Services and tools such as Work Folders, XPS Viewer, DirectPlay, Telnet Client, TFTP Client, and Simple TCP/IP Services contain legacy network parsers and protocols that are completely unnecessary for a secure administrative system. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Disable PowerShell 2.0 Compatibility Policy Open the Group Policy Management Console (gpmc.msc) on a management host. Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows PowerShell Configure the following setting: Policy*: Turn on PowerShell 2.0 Compatibility Mode Setting*: Disabled Link the GPO to the Endpoints and Member Servers OUs. Step 2: Deploy Feature Disablement Startup Script Because Windows Optional Features are managed via DISM/Packages and lack direct GPO settings for feature removal, deploy the disablement script as a Computer Startup script: 1. In the same GPO, navigate to: Computer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown) 2. Double-click Startup, click the PowerShell Scripts tab. 3. Add the Disable-UnusedFeatures.ps1 script to execute on system startup. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally or run it as a startup script. Download Script: Disable-UnusedFeatures.ps1 # Disable-UnusedFeatures.ps1 # Description: Disables unused legacy features, .NET 3.5, and PowerShell 2.0 on the local system. Write-Host "Disabling unused legacy features and PowerShell 2.0..." -ForegroundColor Cyan # Check if running as administrator $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if (-not $isAdmin) { Write-Error "This script must be run as an Administrator." exit 1 } # Feature lists $DismFeatures = @( "MicrosoftWindowsPowerShellV2", "MicrosoftWindowsPowerShellV2Root", "NetFx3", # .NET Framework 3.5 "SMB1Protocol", # SMBv1 Client "Internet-Explorer-Optional-amd64", # Internet Explorer 11 "WorkFolders-Client", # Work Folders Client "Xps-Viewer-Dependency", # XPS Viewer "DirectPlay", # DirectPlay "TelnetClient", # Telnet Client "TFTP", # TFTP Client "SimpleTCP" # Simple TCP/IP Services ) $ServerFeatures = @( "PowerShell-V2", "NET-Framework-Core", "FS-SMB1", "Internet-Explorer-Optional-amd64", "WorkFolders-Client", "Xps-Viewer-Dependency", "DirectPlay", "Telnet-Client", "TFTP-Client", "Simple-TCPIP" ) if (Get-Command Get-WindowsFeature -ErrorAction SilentlyContinue) { # Windows Server path foreach ($FeatName in $ServerFeatures) { $Feat = Get-WindowsFeature -Name $FeatName -ErrorAction SilentlyContinue if ($null -ne $Feat) { if ($Feat.Installed) { Write-Host "[*] Removing Server feature: $FeatName..." -ForegroundColor Yellow Uninstall-WindowsFeature -Name $FeatName -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Feature '$FeatName' uninstalled." -ForegroundColor Green } else { Write-Host "[~] Feature '$FeatName' is already uninstalled." -ForegroundColor Gray } } else { # Try DISM fallback $DismFeat = Get-WindowsOptionalFeature -Online -FeatureName $FeatName -ErrorAction SilentlyContinue if ($null -ne $DismFeat) { if ($DismFeat.State -eq "Enabled" -or $DismFeat.State -eq "EnabledPendingRestart") { Write-Host "[*] Disabling optional feature: $FeatName..." -ForegroundColor Yellow Disable-WindowsOptionalFeature -Online -FeatureName $FeatName -NoRestart -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Feature '$FeatName' disabled." -ForegroundColor Green } else { Write-Host "[~] Feature '$FeatName' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Feature '$FeatName' is not present in the system." -ForegroundColor Gray } } } } else { # Windows Client path foreach ($Feature in $DismFeatures) { $State = Get-WindowsOptionalFeature -Online -FeatureName $Feature -ErrorAction SilentlyContinue if ($null -ne $State) { if ($State.State -eq "Enabled" -or $State.State -eq "EnabledPendingRestart") { Write-Host "[*] Disabling feature: $Feature..." -ForegroundColor Yellow Disable-WindowsOptionalFeature -Online -FeatureName $Feature -NoRestart -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Feature '$Feature' has been disabled." -ForegroundColor Green } else { Write-Host "[~] Feature '$Feature' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Feature '$Feature' is not present in this Windows image." -ForegroundColor Gray } } } Write-Host "Optional features configuration completed." -ForegroundColor Green To verify the state of unused features: Download Script: Get-UnusedFeaturesStatus.ps1 # Get-UnusedFeaturesStatus.ps1 # Description: Audits the installation state of unused legacy features on the local system. Write-Host "--- Auditing Unused Windows Features ---" -ForegroundColor Cyan # Check if running as administrator $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if (-not $isAdmin) { Write-Error "This script must be run as an Administrator." exit 1 } $script:Vulnerable = $false $DismFeatures = @( "MicrosoftWindowsPowerShellV2", "MicrosoftWindowsPowerShellV2Root", "NetFx3", # .NET Framework 3.5 "SMB1Protocol", # SMBv1 Client "Internet-Explorer-Optional-amd64", # Internet Explorer 11 "WorkFolders-Client", # Work Folders Client "Xps-Viewer-Dependency", # XPS Viewer "DirectPlay", # DirectPlay "TelnetClient", # Telnet Client "TFTP", # TFTP Client "SimpleTCP" # Simple TCP/IP Services ) $ServerFeatures = @( "PowerShell-V2", "NET-Framework-Core", "FS-SMB1", "Internet-Explorer-Optional-amd64", "WorkFolders-Client", "Xps-Viewer-Dependency", "DirectPlay", "Telnet-Client", "TFTP-Client", "Simple-TCPIP" ) if (Get-Command Get-WindowsFeature -ErrorAction SilentlyContinue) { # Windows Server path foreach ($FeatName in $ServerFeatures) { $Feat = Get-WindowsFeature -Name $FeatName -ErrorAction SilentlyContinue if ($null -ne $Feat) { $Color = if ($Feat.Installed -eq $false) { "Green" } else { "Red" } Write-Host " - Feature: $FeatName | Installed: $($Feat.Installed) (Expected: False)" -ForegroundColor $Color if ($Feat.Installed) { $script:Vulnerable = $true } } else { # Try DISM fallback $DismFeat = Get-WindowsOptionalFeature -Online -FeatureName $FeatName -ErrorAction SilentlyContinue if ($null -ne $DismFeat) { $IsEnabled = ($DismFeat.State -eq "Enabled" -or $DismFeat.State -eq "EnabledPendingRestart") $Color = if (-not $IsEnabled) { "Green" } else { "Red" } Write-Host " - Feature: $FeatName (DISM) | State: $($DismFeat.State) (Expected: Disabled)" -ForegroundColor $Color if ($IsEnabled) { $script:Vulnerable = $true } } else { Write-Host " - Feature: $FeatName | Not Present (Compliant)" -ForegroundColor Green } } } } else { # Windows Client path foreach ($Feature in $DismFeatures) { $State = Get-WindowsOptionalFeature -Online -FeatureName $Feature -ErrorAction SilentlyContinue if ($null -ne $State) { $IsEnabled = ($State.State -eq "Enabled" -or $State.State -eq "EnabledPendingRestart") $Color = if (-not $IsEnabled) { "Green" } else { "Red" } Write-Host " - Feature: $Feature | State: $($State.State) (Expected: Disabled)" -ForegroundColor $Color if ($IsEnabled) { $script:Vulnerable = $true } } else { Write-Host " - Feature: $Feature | Not Present (Compliant)" -ForegroundColor Green } } } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Disable-UnusedFeatures.ps1 # Description: Disables unused legacy features, .NET 3.5, and PowerShell 2.0 on the local system. Write-Host "Disabling unused legacy features and PowerShell 2.0..." -ForegroundColor Cyan # Check if running as administrator $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) if (-not $isAdmin) { Write-Error "This script must be run as an Administrator." exit 1 } # Feature lists $DismFeatures = @( "MicrosoftWindowsPowerShellV2", "MicrosoftWindowsPowerShellV2Root", "NetFx3", # .NET Framework 3.5 "SMB1Protocol", # SMBv1 Client "Internet-Explorer-Optional-amd64", # Internet Explorer 11 "WorkFolders-Client", # Work Folders Client "Xps-Viewer-Dependency", # XPS Viewer "DirectPlay", # DirectPlay "TelnetClient", # Telnet Client "TFTP", # TFTP Client "SimpleTCP" # Simple TCP/IP Services ) $ServerFeatures = @( "PowerShell-V2", "NET-Framework-Core", "FS-SMB1", "Internet-Explorer-Optional-amd64", "WorkFolders-Client", "Xps-Viewer-Dependency", "DirectPlay", "Telnet-Client", "TFTP-Client", "Simple-TCPIP" ) if (Get-Command Get-WindowsFeature -ErrorAction SilentlyContinue) { # Windows Server path foreach ($FeatName in $ServerFeatures) { $Feat = Get-WindowsFeature -Name $FeatName -ErrorAction SilentlyContinue if ($null -ne $Feat) { if ($Feat.Installed) { Write-Host "[*] Removing Server feature: $FeatName..." -ForegroundColor Yellow Uninstall-WindowsFeature -Name $FeatName -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Feature '$FeatName' uninstalled." -ForegroundColor Green } else { Write-Host "[~] Feature '$FeatName' is already uninstalled." -ForegroundColor Gray } } else { # Try DISM fallback $DismFeat = Get-WindowsOptionalFeature -Online -FeatureName $FeatName -ErrorAction SilentlyContinue if ($null -ne $DismFeat) { if ($DismFeat.State -eq "Enabled" -or $DismFeat.State -eq "EnabledPendingRestart") { Write-Host "[*] Disabling optional feature: $FeatName..." -ForegroundColor Yellow Disable-WindowsOptionalFeature -Online -FeatureName $FeatName -NoRestart -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Feature '$FeatName' disabled." -ForegroundColor Green } else { Write-Host "[~] Feature '$FeatName' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Feature '$FeatName' is not present in the system." -ForegroundColor Gray } } } } else { # Windows Client path foreach ($Feature in $DismFeatures) { $State = Get-WindowsOptionalFeature -Online -FeatureName $Feature -ErrorAction SilentlyContinue if ($null -ne $State) { if ($State.State -eq "Enabled" -or $State.State -eq "EnabledPendingRestart") { Write-Host "[*] Disabling feature: $Feature..." -ForegroundColor Yellow Disable-WindowsOptionalFeature -Online -FeatureName $Feature -NoRestart -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Feature '$Feature' has been disabled." -ForegroundColor Green } else { Write-Host "[~] Feature '$Feature' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Feature '$Feature' is not present in this Windows image." -ForegroundColor Gray } } } Write-Host "Optional features configuration completed." -ForegroundColor Green Target Scope: Applicable Systems: Member Workstations (Endpoints) Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/configure-office-security.md Malicious documents (e.g., weaponized Word, Excel, or PowerPoint files) containing embedded VBA macros are a prevalent initial access and execution vector. Similarly, embedding malicious OLE packages inside Outlook items (such as RTF-formatted emails) allows attackers to trigger script execution or execute arbitrary packages via packager.dll when an administrator or standard user opens or previews the email. Hardening these settings ensures: 1. Internet Macro Blocking: VBA macros in files downloaded from the Internet or untrusted external attachments are blocked from executing, regardless of user consent. 2. Macro Code Signing: Any locally run macros are restricted to trusted, digitally signed code, preventing the execution of ad-hoc unverified user scripts. 3. OLE Package Disablement: Restricting Outlook OLE package activation (ShowOLEPackageObj = 0) blocks the execution of dangerous embedded objects in email messages. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Enforce Macro Security in ADMX Templates Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO. Navigate to: User Configuration\Policies\Administrative Templates\Microsoft Office 2016\Security Settings\Trust Center Set the following policies: Policy : `VBA Macro Notification Settings` -> Enabled with option set to Disable all except digitally signed macros For each application (Word, Excel, PowerPoint, Access), navigate to: User Configuration\Policies\Administrative Templates\[Application] 2016\[Application] Options\Security\Trust Center Set the policy: Policy : `Block macros from running in Office files from the Internet` -> Enabled Step 2: Disable Outlook OLE Packages Navigate to: User Configuration\Policies\Administrative Templates\Microsoft Outlook 2016\Security Configure the setting: Policy : `Do not allow OLE package execution` -> Enabled Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the current user registry hives to enforce macro blocking and OLE package restrictions. Download Script: Configure-OfficeSecurity.ps1 # Configure-OfficeSecurity.ps1 # Description: Configures registry settings under the HKCU hive to restrict VBA macros and block Outlook OLE package execution. Write-Host "Applying Microsoft Office security and OLE restrictions..." -ForegroundColor Cyan # Helper to configure User Registry DWORD values function Set-UserRegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$Path, [string]$Name, [int]$Value ) if ($PSCmdlet.ShouldProcess($Path, "Set registry DWORD value $Name to $Value")) { $FullRegistryPath = "HKCU:\$Path" if (-not (Test-Path $FullRegistryPath)) { New-Item -Path $FullRegistryPath -Force | Out-Null } Set-ItemProperty -Path $FullRegistryPath -Name $Name -Value $Value -Type DWord -Force } } # 1. Enforce macro signing policy (common) Set-UserRegDWord "software\policies\microsoft\office\16.0\common\security" "vbawarnings" 3 Write-Host "[+] Digital signing for Office macros enforced." -ForegroundColor Green # 2. Block macros from the Internet for key Office applications $Apps = @("excel", "word", "powerpoint", "access", "visio") foreach ($App in $Apps) { Set-UserRegDWord "software\policies\microsoft\office\16.0\$App\security" "blockcontentexecutionfrominternet" 1 } Write-Host "[+] VBA macro blocks from Internet applied to Office applications." -ForegroundColor Green # 3. Disable OLE Package execution in Outlook (Policies and Preferences branches) Set-UserRegDWord "software\policies\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 Set-UserRegDWord "software\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 Write-Host "[+] Outlook OLE Package execution blocked." -ForegroundColor Green To verify the current Office security settings: Download Script: Get-OfficeSecurityStatus.ps1 # Get-OfficeSecurityStatus.ps1 # Description: Audits Microsoft Office macro settings and Outlook OLE package restrictions. Write-Host "--- Auditing Microsoft Office Security Baseline ---" -ForegroundColor Cyan $script:Vulnerable = $false # Helper to audit registry values under HKCU function Test-UserRegistryValue ($Path, $Name, $ExpectedValue) { $FullRegistryPath = "HKCU:\$Path" $Val = Get-ItemProperty -Path $FullRegistryPath -Name $Name -ErrorAction SilentlyContinue $Actual = if ($val) { $val.$Name } else { "" } $Color = "Red" if ($Actual -eq $ExpectedValue) { $Color = "Green" } else { $script:Vulnerable = $true } Write-Host " - User Registry: $Name | Actual: '$Actual' (Expected: '$ExpectedValue')" -ForegroundColor $Color } # 1. Audit macro signing warning Test-UserRegistryValue "software\policies\microsoft\office\16.0\common\security" "vbawarnings" 3 # 2. Audit macro Internet blocks $Apps = @("excel", "word", "powerpoint", "access", "visio") foreach ($App in $Apps) { Test-UserRegistryValue "software\policies\microsoft\office\16.0\$App\security" "blockcontentexecutionfrominternet" 1 } # 3. Audit Outlook OLE package block Test-UserRegistryValue "software\policies\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green } # Configure-OfficeSecurity.ps1 # Description: Configures registry settings under the HKCU hive to restrict VBA macros and block Outlook OLE package execution. Write-Host "Applying Microsoft Office security and OLE restrictions..." -ForegroundColor Cyan # Helper to configure User Registry DWORD values function Set-UserRegDWord { [CmdletBinding(SupportsShouldProcess)] param ( [string]$Path, [string]$Name, [int]$Value ) if ($PSCmdlet.ShouldProcess($Path, "Set registry DWORD value $Name to $Value")) { $FullRegistryPath = "HKCU:\$Path" if (-not (Test-Path $FullRegistryPath)) { New-Item -Path $FullRegistryPath -Force | Out-Null } Set-ItemProperty -Path $FullRegistryPath -Name $Name -Value $Value -Type DWord -Force } } # 1. Enforce macro signing policy (common) Set-UserRegDWord "software\policies\microsoft\office\16.0\common\security" "vbawarnings" 3 Write-Host "[+] Digital signing for Office macros enforced." -ForegroundColor Green # 2. Block macros from the Internet for key Office applications $Apps = @("excel", "word", "powerpoint", "access", "visio") foreach ($App in $Apps) { Set-UserRegDWord "software\policies\microsoft\office\16.0\$App\security" "blockcontentexecutionfrominternet" 1 } Write-Host "[+] VBA macro blocks from Internet applied to Office applications." -ForegroundColor Green # 3. Disable OLE Package execution in Outlook (Policies and Preferences branches) Set-UserRegDWord "software\policies\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 Set-UserRegDWord "software\microsoft\office\16.0\outlook\security" "ShowOLEPackageObj" 0 Write-Host "[+] Outlook OLE Package execution blocked." -ForegroundColor Green Target Scope: Applicable Systems: Member Workstations (Endpoints - Tier 2 Client Workstations and Laptops). (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-034](../07-paws/disable-windows-script-host.md); for Tier 0 Domain Controllers and Member Servers, refer to [REQ-DC-159](../02-domain-controllers/disable-windows-script-host.md)). Operating Systems: Windows 10 Enterprise (1809+), Windows 11 Enterprise (all supported builds). File Path: 08-endpoints/disable-windows-script-host.md Windows Script Host (WSH), encompassing the wscript.exe (graphical) and cscript.exe (command-line) host engines, executes legacy scripting languages including VBScript (vbscript.dll) and JScript (jscript.dll). In client endpoint environments, WSH is one of the most heavily abused Living-off-the-Land Binaries (LOLBins / LOLBAS) leveraged by adversaries for initial access, defense evasion, and payload execution (MITRE ATT&CK T1059.005, T1059.007, T1218): Initial Access via Phishing and Drive-By Downloads: Threat actors routinely deliver weaponized script files (such as .vbs, .js, .wsf, .hta) disguised as business invoices, delivery notifications, or archived attachments inside ZIP/ISO files. When an unsuspecting user double-clicks such a file, Windows Explorer automatically invokes wscript.exe or mshta.exe, running malicious code directly in the user's security context without prompting. Attack Surface Reduction: Disabling WSH globally via the Enabled = 0 registry parameter completely blocks wscript.exe and cscript.exe from executing any VBScript or JScript files system-wide, producing an immediate termination notice if an execution attempt is made. 64-Bit and 32-Bit WOW6432Node Coverage: On 64-bit Windows architectures, 32-bit applications and sub-processes invoke the 32-bit scripting host located in %SystemRoot%\SysWOW64\wscript.exe. Applying the Enabled = 0 and TrustPolicy = 2 registry values to both the native 64-bit hive (HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings) and the 32-bit registry hive (HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings) guarantees that 32-bit sub-processes cannot be weaponized as an evasion tactic. TrustPolicy Hardening: Setting TrustPolicy = 2 enforces script restriction policies to disallow untrusted or unsigned scripts, providing defense-in-depth even if individual components attempt to execute outside the primary WSH engine. Defense-in-Depth File Association Remapping: Setting default file associations for legacy script extensions (.vbs, .vbe, .js, .jse, .wsf, .wsh, .hta) to txtfile (notepad.exe) ensures that if a script file is double-clicked in Windows Explorer, it opens harmlessly in Notepad for plain-text inspection rather than executing code. Option A: Group Policy Object (GPO) Configuration (Preferred) Step 1: Disable WSH via GPO Computer Preferences Open the Group Policy Management Console (gpmc.msc). Edit the Endpoint GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a new Registry Item for the native 64-bit hive: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: Enabled Value Type*: REG_DWORD Value Data*: 0 Create a second Registry Item for TrustPolicy: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: TrustPolicy Value Type*: REG_DWORD Value Data*: 2 Create a third Registry Item for 32-bit WOW64 disablement: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings Value Name*: Enabled Value Type*: REG_DWORD Value Data*: 0 Create a fourth Registry Item for 32-bit WOW64 TrustPolicy: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings Value Name*: TrustPolicy Value Type*: REG_DWORD Value Data*: 2 Step 2: Disable WSH in User Configuration Preferences Navigate to: User Configuration\Preferences\Windows Settings\Registry Create a new Registry Item: Action*: Update Hive*: HKEY_CURRENT_USER Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: Enabled Value Type*: REG_DWORD Value Data*: 0 Create a second Registry Item: Action*: Update Hive*: HKEY_CURRENT_USER Key Path*: SOFTWARE\Microsoft\Windows Script Host\Settings Value Name*: TrustPolicy Value Type*: REG_DWORD Value Data*: 2 Step 3: Remap Script File Extensions to Notepad Navigate to: User Configuration\Preferences\Control Panel Settings\Folder Options Right-click and select New -> Open With: File Extension*: vbs Associated Program*: %SystemRoot%\System32\notepad.exe Set as default*: Check Repeat for the remaining extensions: vbe, js, jse, wsf, wsh, and hta. Alternatively, configure system-wide registry preferences under HKLM\SOFTWARE\Classes\.<ext> setting the default string value to txtfile. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Configure the local registry settings to disable WSH and remap associations. Download Script: Disable-Wsh.ps1 # Disable-Wsh.ps1 # Description: Disables Windows Script Host globally across 64-bit and 32-bit registry hives, enforces TrustPolicy, and remaps script file associations to Notepad. Write-Host "Applying Windows Script Host and file association hardening..." -ForegroundColor Cyan # 1. Disable WSH globally in 64-bit HKLM $RegistryHklm = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHklm)) { New-Item -Path $RegistryHklm -Force | Out-Null } Set-ItemProperty -Path $RegistryHklm -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHklm -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM." -ForegroundColor Green # 2. Disable WSH in WOW6432Node on 64-bit systems if ([Environment]::Is64BitOperatingSystem) { $RegistryWow64 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryWow64)) { New-Item -Path $RegistryWow64 -Force | Out-Null } Set-ItemProperty -Path $RegistryWow64 -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryWow64 -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM WOW6432Node." -ForegroundColor Green } # 3. Disable WSH in current user HKCU hive $RegistryHkcu = "HKCU:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHkcu)) { New-Item -Path $RegistryHkcu -Force | Out-Null } Set-ItemProperty -Path $RegistryHkcu -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHkcu -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH disabled in current user HKCU hive." -ForegroundColor Green # 4. Remap script file extensions to notepad $Extensions = @("vbs", "vbe", "js", "jse", "wsf", "wsh", "hta") foreach ($Ext in $Extensions) { $ProgIdPath = "HKLM:\SOFTWARE\Classes\.$Ext" # Update Class Association to Notepad if (-not (Test-Path $ProgIdPath)) { New-Item -Path $ProgIdPath -Force | Out-Null } Set-ItemProperty -Path $ProgIdPath -Name "" -Value "txtfile" -Type String -Force Write-Host " Mapped .$Ext extension to txtfile handler." -ForegroundColor Gray } Write-Host "[+] Script file extension handlers mapped to Notepad." -ForegroundColor Green To verify the WSH configuration state: Download Script: Get-WshStatus.ps1 # Get-WshStatus.ps1 # Description: Audits Windows Script Host registry state across 64-bit and 32-bit hives and script file extension association handlers. Write-Host "--- Auditing Windows Script Host Hardening ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit WSH Registry settings in 64-bit HKLM $RegistryHklm = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (Test-Path $RegistryHklm) { $ValHklm = (Get-ItemProperty -Path $RegistryHklm -Name "Enabled" -ErrorAction SilentlyContinue).Enabled if ($ValHklm -eq 0) { Write-Host " - HKLM WSH Enabled: 0 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: HKLM WSH is enabled or not configured (Value: '$($ValHklm)')" -ForegroundColor Red $script:Vulnerable = $true } $TrustHklm = (Get-ItemProperty -Path $RegistryHklm -Name "TrustPolicy" -ErrorAction SilentlyContinue).TrustPolicy if ($TrustHklm -eq 2) { Write-Host " - HKLM WSH TrustPolicy: 2 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: HKLM WSH TrustPolicy is not set to 2 (Value: '$($TrustHklm)')" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: HKLM WSH settings key is missing (Expected: Enabled = 0, TrustPolicy = 2)" -ForegroundColor Red $script:Vulnerable = $true } # 2. Audit WSH Registry settings in WOW6432Node on 64-bit systems if ([Environment]::Is64BitOperatingSystem) { $RegistryWow64 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" if (Test-Path $RegistryWow64) { $ValWow64 = (Get-ItemProperty -Path $RegistryWow64 -Name "Enabled" -ErrorAction SilentlyContinue).Enabled if ($ValWow64 -eq 0) { Write-Host " - WOW6432Node WSH Enabled: 0 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: WOW6432Node WSH is enabled or not configured (Value: '$($ValWow64)')" -ForegroundColor Red $script:Vulnerable = $true } $TrustWow64 = (Get-ItemProperty -Path $RegistryWow64 -Name "TrustPolicy" -ErrorAction SilentlyContinue).TrustPolicy if ($TrustWow64 -eq 2) { Write-Host " - WOW6432Node WSH TrustPolicy: 2 (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: WOW6432Node WSH TrustPolicy is not set to 2 (Value: '$($TrustWow64)')" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: WOW6432Node WSH settings key is missing (Expected: Enabled = 0, TrustPolicy = 2)" -ForegroundColor Red $script:Vulnerable = $true } } # 3. Audit file associations $Extensions = @("vbs", "vbe", "js", "jse", "wsf", "wsh", "hta") foreach ($Ext in $Extensions) { $ProgIdPath = "HKLM:\SOFTWARE\Classes\.$Ext" if (Test-Path $ProgIdPath) { $Handler = (Get-ItemProperty -Path $ProgIdPath -Name "" -ErrorAction SilentlyContinue)."" if ($Handler -eq "txtfile" -or $Handler -match "notepad") { Write-Host " - Extension .$Ext Handler: $Handler (Secure)" -ForegroundColor Green } else { Write-Host " - VULNERABLE: Extension .$Ext Handler is '$($Handler)' (Expected: txtfile/notepad)" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " - VULNERABLE: Extension .$Ext Class Registry key not found." -ForegroundColor Red $script:Vulnerable = $true } } if ($script:Vulnerable) { Write-Host "[-] Audit Result: VULNERABLE - Windows Script Host hardening controls do not meet baseline requirements." -ForegroundColor Red } else { Write-Host "[+] Audit Result: SECURE - Windows Script Host hardening controls are fully compliant." -ForegroundColor Green } # Disable-Wsh.ps1 # Description: Disables Windows Script Host globally across 64-bit and 32-bit registry hives, enforces TrustPolicy, and remaps script file associations to Notepad. Write-Host "Applying Windows Script Host and file association hardening..." -ForegroundColor Cyan # 1. Disable WSH globally in 64-bit HKLM $RegistryHklm = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHklm)) { New-Item -Path $RegistryHklm -Force | Out-Null } Set-ItemProperty -Path $RegistryHklm -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHklm -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM." -ForegroundColor Green # 2. Disable WSH in WOW6432Node on 64-bit systems if ([Environment]::Is64BitOperatingSystem) { $RegistryWow64 = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryWow64)) { New-Item -Path $RegistryWow64 -Force | Out-Null } Set-ItemProperty -Path $RegistryWow64 -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryWow64 -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH globally disabled and TrustPolicy enforced in HKLM WOW6432Node." -ForegroundColor Green } # 3. Disable WSH in current user HKCU hive $RegistryHkcu = "HKCU:\SOFTWARE\Microsoft\Windows Script Host\Settings" if (-not (Test-Path $RegistryHkcu)) { New-Item -Path $RegistryHkcu -Force | Out-Null } Set-ItemProperty -Path $RegistryHkcu -Name "Enabled" -Value 0 -Type DWord -Force Set-ItemProperty -Path $RegistryHkcu -Name "TrustPolicy" -Value 2 -Type DWord -Force Write-Host "[+] WSH disabled in current user HKCU hive." -ForegroundColor Green # 4. Remap script file extensions to notepad $Extensions = @("vbs", "vbe", "js", "jse", "wsf", "wsh", "hta") foreach ($Ext in $Extensions) { $ProgIdPath = "HKLM:\SOFTWARE\Classes\.$Ext" # Update Class Association to Notepad if (-not (Test-Path $ProgIdPath)) { New-Item -Path $ProgIdPath -Force | Out-Null } Set-ItemProperty -Path $ProgIdPath -Name "" -Value "txtfile" -Type String -Force Write-Host " Mapped .$Ext extension to txtfile handler." -ForegroundColor Gray } Write-Host "[+] Script file extension handlers mapped to Notepad." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/configure-secure-boot-revocations.md A vulnerability in the Windows Boot Manager allows an attacker with physical access or local administrative rights to bypass UEFI Secure Boot and execute unsigned code during the boot process (BlackLotus bootkit). To fully mitigate this threat (CVE-2023-24932), Windows update revocations must be applied to the UEFI variables (DBX list) and code integrity SVN policies must be updated. This is managed via the AvailableUpdates registry key, which instructs the OS boot manager to write the revocation variables to firmware. According to the latest Microsoft guidelines, the recommended trigger value for enterprise deployments to apply all security updates (including the new Windows UEFI CA 2023 certificates and boot manager updates) is `0x5944` (hex) / `22852` (decimal). As the OS processes this bitmask, the value is cleared incrementally, ending up at `0x4000` (hex) / `16384` (decimal) upon successful completion. Option A: Group Policy Object (GPO) Configuration (Preferred) To configure the update triggers for the DBX and Code Integrity boot manager revocations, define Registry GPO Preferences inside the endpoints GPO: Open the Group Policy Management Console (gpmc.msc). Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Create a registry item to deploy the AvailableUpdates DWORD under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot. Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Secureboot Value Name*: AvailableUpdates Value Type*: REG_DWORD Value Data*: 22852 (Decimal) or 5944 (Hex) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the BlackLotus mitigation update trigger: Download Script: Set-SecureBootRevocations.ps1 # Set-SecureBootRevocations.ps1 # Description: Triggers Secure Boot DBX and Code Integrity revocation updates for BlackLotus mitigation. Write-Host "--- Configuring BlackLotus Secure Boot Mitigations ---" -ForegroundColor Cyan $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } # Trigger updates (0x5944 = 22852) Set-ItemProperty -Path $Path -Name "AvailableUpdates" -Value 22852 -Type DWord -Force | Out-Null Write-Host "[+] BlackLotus DBX and 2023 CA revocation updates configured in registry. A system reboot is required." -ForegroundColor Green Audit Script Run the following script to check the status of Secure Boot revocations on the local machine: Download Script: Audit-SecureBootRevocations.ps1 # Audit-SecureBootRevocations.ps1 # Description: Queries UEFI Secure Boot parameters and audits BlackLotus mitigation registry settings. Write-Host "--- Auditing BlackLotus Mitigations ---" -ForegroundColor Cyan $script:NonCompliant = $false # 1. Audit AvailableUpdates registry key $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot" if (Test-Path $Path) { $Val = Get-ItemProperty -Path $Path -Name "AvailableUpdates" -ErrorAction SilentlyContinue $UpdateVal = if ($Val) { $Val.AvailableUpdates } else { 0 } # Check if configured (>= 0x4000 / 16384) if ($UpdateVal -ge 16384) { Write-Host " - BlackLotus Revocation Updates (AvailableUpdates): $UpdateVal (Compliant)" -ForegroundColor Green } else { Write-Host " - BlackLotus Revocation Updates (AvailableUpdates): $UpdateVal (Non-Compliant - DBX/SVN revocations not triggered)" -ForegroundColor Red $script:NonCompliant = $true } } else { Write-Host " - BlackLotus Revocation Updates: Registry path not found (Non-Compliant)" -ForegroundColor Red $script:NonCompliant = $true } # 2. Audit UEFICA2023Status (if present) $ServicingPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" if (Test-Path $ServicingPath) { $ServVal = Get-ItemProperty -Path $ServicingPath -Name "UEFICA2023Status" -ErrorAction SilentlyContinue if ($ServVal) { $Status = $ServVal.UEFICA2023Status $Color = if ($Status -eq "Updated") { "Green" } else { "Yellow" } Write-Host " - UEFI CA 2023 Update Status: $Status" -ForegroundColor $Color } } if ($script:NonCompliant) { exit 1 } # Set-SecureBootRevocations.ps1 # Description: Triggers Secure Boot DBX and Code Integrity revocation updates for BlackLotus mitigation. Write-Host "--- Configuring BlackLotus Secure Boot Mitigations ---" -ForegroundColor Cyan $Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } # Trigger updates (0x5944 = 22852) Set-ItemProperty -Path $Path -Name "AvailableUpdates" -Value 22852 -Type DWord -Force | Out-Null Write-Host "[+] BlackLotus DBX and 2023 CA revocation updates configured in registry. A system reboot is required." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations Operating Systems: Windows 10, Windows 11 (Enterprise and Professional editions) File Path: 08-endpoints/enable-wdac-driver-blocklist.md Attackers frequently employ "Bring Your Own Vulnerable Driver" (BYOVD) attacks to bypass Windows kernel protections on standard endpoints. In a BYOVD attack, an adversary with administrative privileges installs a legitimate, cryptographically signed third-party driver that contains a known, exploitable vulnerability. The attacker then exploits this vulnerability to execute arbitrary code with kernel privileges, allowing them to disable security agents, dump LSASS memory, or tamper with system integrity. Enforcing the Microsoft Vulnerable Driver Blocklist via Windows Defender Application Control (WDAC) prevents known vulnerable or malicious drivers from loading in kernel space. By restricting the WDAC policy to Kernel Mode Code Integrity (KMCI) only (omitting user-mode enforcement), the control shields the system kernel from driver-based exploits on endpoint hosts without introducing administrative overhead or blocking standard user-mode applications. Option A: Group Policy Object (GPO) Configuration (Preferred) To enforce the driver blocklist across all endpoints, you can deploy the Microsoft recommended block rules as a custom WDAC policy. Download the Microsoft recommended driver block rules XML from the official Microsoft documentation. Edit the XML to ensure it operates in Audit Mode first, then convert the XML configuration into a binary format: `powershell ConvertFrom-CIPolicy -XmlFilePath "C:\WDAC\DriverBlocklist.xml" -BinaryFilePath "C:\WDAC\SIPolicy.p7b" Copy the compiled SIPolicy.p7b file to a secure local path on all target endpoints (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b) or a share. Open the Group Policy Management Console (gpmc.msc) on a domain management host. Create or edit a GPO linked to the workstations OU (e.g., GPO_Hardening_Workstations). Navigate to: Computer Configuration\Administrative Templates\System\Device Guard Configure the following setting: Policy*: Deploy Windows Defender Application Control Setting*: Enabled Code Integrity Policy File Path*: Enter the local or network path to the policy file (e.g., C:\Windows\System32\CodeIntegrity\SIPolicy.p7b). To ensure the built-in system driver blocklist is active on modern builds, configure the following registry setting via Group Policy Preferences: Path*: Computer Configuration\Preferences\Windows Settings\Registry Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\CI\Config Value Name*: VulnerableDriverBlocklistEnable Value Type*: REG_DWORD Value Data*: 1 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following scripts locally to enable the Vulnerable Driver Blocklist registry key and ensure proper configuration. Configure-DriverBlocklist.ps1 Download Script: Configure-DriverBlocklist.ps1 # Configure-DriverBlocklist.ps1 # Description: Enables the Microsoft Vulnerable Driver Blocklist in the registry and validates VBS/HVCI settings. Write-Host "Applying hardening requirement: Enable WDAC Driver Blocklist..." -ForegroundColor Cyan # 1. Configure the registry settings to enable the blocklist $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" $ValueName = "VulnerableDriverBlocklistEnable" if (-not (Test-Path $RegPath)) { Write-Host "[+] Creating registry path: $RegPath" -ForegroundColor Gray New-Item -Path $RegPath -Force | Out-Null } Write-Host "[+] Setting registry value: $ValueName = 1" -ForegroundColor Gray Set-ItemProperty -Path $RegPath -Name $ValueName -Value 1 -Type DWord -ErrorAction Stop # 2. Validate VBS / HVCI Configuration $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Pre-requisite Check: Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] Warning: Memory Integrity (HVCI) is disabled. The blocklist requires HVCI for hypervisor enforcement." -ForegroundColor Yellow } } else { Write-Host "[!] Warning: Memory Integrity scenario configuration not found. Check VBS settings." -ForegroundColor Yellow } Write-Host "[+] Configuration applied successfully. A reboot is required to activate the blocklist." -ForegroundColor Green To verify the setting has been applied: Get-DriverBlocklistStatus.ps1 Download Script: Get-DriverBlocklistStatus.ps1 # Get-DriverBlocklistStatus.ps1 # Description: Audits the configuration of the Microsoft Vulnerable Driver Blocklist and HVCI state. Write-Host "--- Auditing Vulnerable Driver Blocklist ---" -ForegroundColor Cyan $Vulnerable = $false # 1. Check registry value $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" $ValueName = "VulnerableDriverBlocklistEnable" if (Test-Path $RegPath) { $RegValue = Get-ItemProperty -Path $RegPath -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $RegValue -and $RegValue.$ValueName -eq 1) { Write-Host "[+] Vulnerable Driver Blocklist is enabled in the registry." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Vulnerable Driver Blocklist is disabled or not set in the registry." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: Code Integrity Config registry key does not exist." -ForegroundColor Red $Vulnerable = $true } # 2. Check HVCI Status $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Memory Integrity (HVCI) is disabled in the registry." -ForegroundColor Red $Vulnerable = $true } } else { Write-Host "[!] VULNERABLE: Memory Integrity scenario registry path does not exist." -ForegroundColor Red $Vulnerable = $true } # 3. Final Verdict if ($Vulnerable) { Write-Host "`n[!] Verification FAILED: The Vulnerable Driver Blocklist is not fully secured." -ForegroundColor Red } else { Write-Host "`n[+] Verification PASSED: The Vulnerable Driver Blocklist and HVCI are correctly configured." -ForegroundColor Green } # Configure-DriverBlocklist.ps1 # Description: Enables the Microsoft Vulnerable Driver Blocklist in the registry and validates VBS/HVCI settings. Write-Host "Applying hardening requirement: Enable WDAC Driver Blocklist..." -ForegroundColor Cyan # 1. Configure the registry settings to enable the blocklist $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" $ValueName = "VulnerableDriverBlocklistEnable" if (-not (Test-Path $RegPath)) { Write-Host "[+] Creating registry path: $RegPath" -ForegroundColor Gray New-Item -Path $RegPath -Force | Out-Null } Write-Host "[+] Setting registry value: $ValueName = 1" -ForegroundColor Gray Set-ItemProperty -Path $RegPath -Name $ValueName -Value 1 -Type DWord -ErrorAction Stop # 2. Validate VBS / HVCI Configuration $ScenariosPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" if (Test-Path $ScenariosPath) { $HvciStatus = Get-ItemProperty -Path $ScenariosPath -Name "Enabled" -ErrorAction SilentlyContinue if ($null -ne $HvciStatus -and $HvciStatus.Enabled -eq 1) { Write-Host "[+] Pre-requisite Check: Memory Integrity (HVCI) is enabled." -ForegroundColor Green } else { Write-Host "[!] Warning: Memory Integrity (HVCI) is disabled. The blocklist requires HVCI for hypervisor enforcement." -ForegroundColor Yellow } } else { Write-Host "[!] Warning: Memory Integrity scenario configuration not found. Check VBS settings." -ForegroundColor Yellow } Write-Host "[+] Configuration applied successfully. A reboot is required to activate the blocklist." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-password-policy.md Establishing a hardened password baseline across enterprise client workstations and member servers protects against password guessing, automated spray campaigns, and offline cryptanalysis: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the Default Domain Policy or target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy Configure the following settings: Enforce password history*: Set to 24 passwords remembered Maximum password age*: Set to 0 days (never expire) Minimum password age*: Set to 1 day Minimum password length*: Set to 14 characters Password must meet complexity requirements*: Set to Enabled Store passwords using reversible encryption*: Set to Disabled Relax minimum password length limits*: Set to Enabled Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure: Interactive logon: Prompt user to change password before expiration*: Set to 14 days Link the GPO to the target Organizational Units and force replication. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountPasswordPolicy.ps1 # Configure-EndAccountPasswordPolicy.ps1 # Description: Configures Endpoint password policy (14 char minimum, relaxed limits, no expiration) via SecEdit. Write-Host "Configuring Endpoint password policy..." -ForegroundColor Cyan # 1. Configure PasswordExpiryWarning via Registry $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path $WinlogonPath)) { New-Item -Path $WinlogonPath -Force | Out-Null } Set-ItemProperty -Path $WinlogonPath -Name "PasswordExpiryWarning" -Value 14 -Type DWord -Force # 2. Configure SecEdit System Access password parameters $SecTempDir = Join-Path $env:TEMP "EndpointPasswordSecTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "end_password.cfg" $DbFile = Join-Path $SecTempDir "end_password.sdb" $LogFile = Join-Path $SecTempDir "end_password.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export current security template." } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[System Access\]") { $ConfigText += "`r`n[System Access]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InSystemAccess = $false $PwdSettings = @{ "MinimumPasswordLength" = 14 "PasswordComplexity" = 1 "PasswordHistorySize" = 24 "MaxPasswordAge" = 0 "MinPasswordAge" = 1 "ClearTextPassword" = 0 "RelaxMinPasswordLengthLimits" = 1 } foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "System Access") { $InSystemAccess = $true } else { $InSystemAccess = $false } } if ($InSystemAccess) { $IsManaged = $false foreach ($Key in $PwdSettings.Keys) { if ($Line -match "^\s*$($Key)\s*=") { $IsManaged = $true break } } if (-not $IsManaged) { $NewLines += $Line } } else { $NewLines += $Line } } $FinalLines = @() foreach ($Line in $NewLines) { $FinalLines += $Line if ($Line -eq "[System Access]") { foreach ($Key in $PwdSettings.Keys) { $Val = $PwdSettings[$Key] $FinalLines += "$($Key) = $($Val)" } } } $FinalLines -join "`r`n" | Out-File -FilePath $CfgFile -Encoding ascii -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas SECURITYPOLICY /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to apply SecEdit password policy." } Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue Write-Host "Endpoint password policy applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountPasswordPolicyStatus.ps1 # Get-EndAccountPasswordPolicyStatus.ps1 # Description: Audits Endpoint password policy parameters via SecEdit and registry queries. Write-Host "--- Auditing Endpoint Password Policy ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit Registry Setting $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path $WinlogonPath)) { Write-Host " [!] MISSING KEY: $WinlogonPath" -ForegroundColor Red $script:Vulnerable = $true } else { $WarnVal = (Get-ItemProperty -Path $WinlogonPath -Name "PasswordExpiryWarning" -ErrorAction SilentlyContinue).PasswordExpiryWarning if ($null -eq $WarnVal -or $WarnVal -lt 5 -or $WarnVal -gt 14) { Write-Host " [!] VULNERABLE: PasswordExpiryWarning is set to '$WarnVal' (Expected: 5-14)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] PasswordExpiryWarning: $WarnVal (Secure)" -ForegroundColor Green } } # 2. Audit SecEdit Settings $SecTempDir = Join-Path $env:TEMP "EndpointPasswordAuditTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "end_password_audit.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigContent = Get-Content -Path $CfgFile -Raw Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue $ExpectedSettings = @{ "MinimumPasswordLength" = 14 "PasswordComplexity" = 1 "PasswordHistorySize" = 24 "MaxPasswordAge" = 0 "MinPasswordAge" = 1 "ClearTextPassword" = 0 "RelaxMinPasswordLengthLimits" = 1 } foreach ($Key in $ExpectedSettings.Keys) { $Expected = $ExpectedSettings[$Key] if ($ConfigContent -match "(?m)^\s*$($Key)\s*=\s*(.*)\s*$") { $Actual = $Matches[1].Trim() } else { $Actual = "" } if ($Actual -ne [string]$Expected) { Write-Host " [!] VULNERABLE: $($Key) = '$Actual' (Expected: '$Expected')" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Key): $Actual (Secure)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the active local password policy settings using net accounts: cmd net accounts Confirm that Minimum password length indicates 14, Length of password history maintained is 24, and Maximum password age (days) indicates Unlimited (value 0). Verify the password expiration warning registry value: cmd reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v PasswordExpiryWarning Confirm that PasswordExpiryWarning is set to 0xe (Decimal 14). Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-lockout-policy.md Configuring a balanced, resilient account lockout baseline across enterprise client workstations and member servers defends against automated password guessing and password spraying while minimizing business interruption from user typos: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the Default Domain Policy or the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy Configure the following settings: Account lockout threshold*: Set to 10 invalid logon attempts Reset account lockout counter after*: Set to 15 minutes Account lockout duration*: Set to 15 minutes Allow Administrator account lockout*: Set to Enabled Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure: Interactive logon: Machine account lockout threshold*: Set to 10 Link the GPO to the appropriate workstation and server Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountLockoutPolicy.ps1 # Configure-EndAccountLockoutPolicy.ps1 # Description: Configures account lockout parameters and Administrator lockout protection on Endpoints via SecEdit. Write-Host "Configuring Endpoint account lockout policy..." -ForegroundColor Cyan # 1. Configure MaxDevicePasswordFailedAttempts via Registry $SystemPolicyPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path $SystemPolicyPath)) { New-Item -Path $SystemPolicyPath -Force | Out-Null } Set-ItemProperty -Path $SystemPolicyPath -Name "MaxDevicePasswordFailedAttempts" -Value 10 -Type DWord -Force # 2. Configure SecEdit System Access lockout parameters $SecTempDir = Join-Path $env:TEMP "EndpointLockoutSecTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "end_lockout.cfg" $DbFile = Join-Path $SecTempDir "end_lockout.sdb" $LogFile = Join-Path $SecTempDir "end_lockout.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export current security template." } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[System Access\]") { $ConfigText += "`r`n[System Access]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InSystemAccess = $false $LockoutSettings = @{ "LockoutBadCount" = 10 "ResetLockoutCount" = 15 "LockoutDuration" = 15 "AllowAdministratorLockout" = 1 } foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "System Access") { $InSystemAccess = $true } else { $InSystemAccess = $false } } if ($InSystemAccess) { $IsManaged = $false foreach ($Key in $LockoutSettings.Keys) { if ($Line -match "^\s*$($Key)\s*=") { $IsManaged = $true break } } if (-not $IsManaged) { $NewLines += $Line } } else { $NewLines += $Line } } $FinalLines = @() foreach ($Line in $NewLines) { $FinalLines += $Line if ($Line -eq "[System Access]") { foreach ($Key in $LockoutSettings.Keys) { $Val = $LockoutSettings[$Key] $FinalLines += "$($Key) = $($Val)" } } } $FinalLines -join "`r`n" | Out-File -FilePath $CfgFile -Encoding ascii -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas SECURITYPOLICY /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to apply SecEdit lockout policy." } Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue Write-Host "Endpoint lockout policy applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountLockoutPolicyStatus.ps1 # Get-EndAccountLockoutPolicyStatus.ps1 # Description: Audits account lockout policy parameters on Endpoints via SecEdit. Write-Host "--- Auditing Endpoint Account Lockout Policy ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit Registry Setting $SystemPolicyPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $MaxDeviceVal = (Get-ItemProperty -Path $SystemPolicyPath -Name "MaxDevicePasswordFailedAttempts" -ErrorAction SilentlyContinue).MaxDevicePasswordFailedAttempts if ($null -eq $MaxDeviceVal -or $MaxDeviceVal -gt 10 -or $MaxDeviceVal -eq 0) { Write-Host " [!] VULNERABLE: MaxDevicePasswordFailedAttempts is set to '$MaxDeviceVal' (Expected: 10 or fewer, but not 0)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] MaxDevicePasswordFailedAttempts: $MaxDeviceVal (Secure)" -ForegroundColor Green } # 2. Audit SecEdit Settings $SecTempDir = Join-Path $env:TEMP "EndpointLockoutAuditTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "end_lockout_audit.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigContent = Get-Content -Path $CfgFile -Raw Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue $ExpectedSettings = @{ "LockoutBadCount" = 10 "ResetLockoutCount" = 15 "LockoutDuration" = 15 "AllowAdministratorLockout" = 1 } foreach ($Key in $ExpectedSettings.Keys) { $Expected = $ExpectedSettings[$Key] if ($ConfigContent -match "(?m)^\s*$($Key)\s*=\s*(.*)\s*$") { $Actual = $Matches[1].Trim() } else { $Actual = "" } if ($Actual -ne [string]$Expected) { Write-Host " [!] VULNERABLE: $($Key) = '$Actual' (Expected: '$Expected')" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Key): $Actual (Secure)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied account lockout policies using net accounts: cmd net accounts Confirm that Lockout threshold indicates 10, Lockout duration (minutes) is 15, and Lockout observation window (minutes) is 15. Verify the machine account lockout threshold registry value: cmd reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v MaxDevicePasswordFailedAttempts Confirm that MaxDevicePasswordFailedAttempts returns 0xa (Decimal 10). Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-kerberos-policy.md Kerberos authentication tokens underpin enterprise access across Active Directory environments. Establishing bounded ticket lifetimes and clock synchronization rules restricts ticket reuse, session hijacking, and replay attacks: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the Default Domain Policy (or target GPO linked to workstations/servers). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Kerberos Policy Configure the following settings: Enforce user logon restrictions*: Set to Enabled Maximum lifetime for service ticket*: Set to 600 minutes Maximum lifetime for user ticket*: Set to 10 hours Maximum lifetime for user ticket renewal*: Set to 7 days Maximum tolerance for computer clock synchronization*: Set to 5 minutes Link the GPO and force policy application via gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountKerberosPolicy.ps1 # Configure-EndAccountKerberosPolicy.ps1 # Description: Configures Kerberos ticket lifetimes, renewal limits, and client validation on Endpoints via SecEdit. Write-Host "Configuring Endpoint Kerberos policy..." -ForegroundColor Cyan $SecTempDir = Join-Path $env:TEMP "EndpointKerberosSecTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "end_kerberos.cfg" $DbFile = Join-Path $SecTempDir "end_kerberos.sdb" $LogFile = Join-Path $SecTempDir "end_kerberos.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export current security template." } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Kerberos Policy\]") { $ConfigText += "`r`n[Kerberos Policy]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InKerb = $false $KerbSettings = @{ "MaxServiceTicketAge" = 600 "MaxTicketAge" = 10 "MaxRenewAge" = 7 "MaxClockSkew" = 5 "TicketValidateClient" = 1 } foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Kerberos Policy") { $InKerb = $true } else { $InKerb = $false } } if ($InKerb) { $IsManaged = $false foreach ($Key in $KerbSettings.Keys) { if ($Line -match "^\s*$($Key)\s*=") { $IsManaged = $true break } } if (-not $IsManaged) { $NewLines += $Line } } else { $NewLines += $Line } } $FinalLines = @() foreach ($Line in $NewLines) { $FinalLines += $Line if ($Line -eq "[Kerberos Policy]") { foreach ($Key in $KerbSettings.Keys) { $Val = $KerbSettings[$Key] $FinalLines += "$($Key) = $($Val)" } } } $FinalLines -join "`r`n" | Out-File -FilePath $CfgFile -Encoding ascii -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas SECURITYPOLICY /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to apply SecEdit Kerberos policy." } Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue Write-Host "Endpoint Kerberos policy applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountKerberosPolicyStatus.ps1 # Get-EndAccountKerberosPolicyStatus.ps1 # Description: Audits Kerberos ticket policy parameters on Endpoints via SecEdit. Write-Host "--- Auditing Endpoint Kerberos Policy ---" -ForegroundColor Cyan $script:Vulnerable = $false $SecTempDir = Join-Path $env:TEMP "EndpointKerberosAuditTemplate" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "end_kerberos_audit.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigContent = Get-Content -Path $CfgFile -Raw Remove-Item -Path $SecTempDir -Recurse -Force -ErrorAction SilentlyContinue $ExpectedSettings = @{ "MaxServiceTicketAge" = 600 "MaxTicketAge" = 10 "MaxRenewAge" = 7 "MaxClockSkew" = 5 "TicketValidateClient" = 1 } foreach ($Key in $ExpectedSettings.Keys) { $Expected = $ExpectedSettings[$Key] if ($ConfigContent -match "(?m)^\s*$($Key)\s*=\s*(.*)\s*$") { $Actual = $Matches[1].Trim() } else { $Actual = "" } if ($Actual -ne [string]$Expected) { Write-Host " [!] VULNERABLE: $($Key) = '$Actual' (Expected: '$Expected')" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Key): $Actual (Secure)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify current Kerberos tickets on the client using klist: cmd klist Verify that active ticket lifetimes conform to the 10-hour boundary. To check local domain time synchronization status: cmd w32tm /query /status Confirm that the time source is a valid Domain Controller and local clock offset is within acceptable limits (< 1 second). Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-smart-card-removal.md In enterprise environments deploying physical smart cards, PIV/CAC badges, or FIDO2 cryptographic tokens for endpoint authentication, removing the physical token must immediately transition the host to a secure state. Hardening smart card removal behavior protects against unauthorized physical console access: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Double-click Interactive logon: Smart card removal behavior. Check Define this policy setting and select Lock Workstation (value 1). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate the Smart Card Removal Policy service (SCPolicySvc), set startup to Automatic, and start the service. Link the GPO to the appropriate workstation and server Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountSmartCardRemoval.ps1 # Configure-EndAccountSmartCardRemoval.ps1 # Description: Configures Smart Card removal behavior to Lock Workstation and enables SCPolicySvc on Endpoints. Write-Host "Configuring Endpoint Smart Card removal behavior..." -ForegroundColor Cyan # 1. Configure Winlogon ScRemoveOption $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path $WinlogonPath)) { New-Item -Path $WinlogonPath -Force | Out-Null } Set-ItemProperty -Path $WinlogonPath -Name "ScRemoveOption" -Value "1" -Type String -Force # 2. Ensure Smart Card Removal Policy service is configured for Automatic start $ServiceName = "SCPolicySvc" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { Set-Service -Name $ServiceName -StartupType Automatic if ($Service.Status -ne "Running") { Start-Service -Name $ServiceName -ErrorAction SilentlyContinue } } Write-Host "Smart card removal behavior set to Lock Workstation ('1') and service configured." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountSmartCardRemovalStatus.ps1 # Get-EndAccountSmartCardRemovalStatus.ps1 # Description: Audits Smart Card removal behavior and service status on Endpoints. Write-Host "--- Auditing Endpoint Smart Card Removal Behavior ---" -ForegroundColor Cyan $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path $WinlogonPath)) { Write-Host " [!] MISSING KEY: $WinlogonPath" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } $Val = (Get-ItemProperty -Path $WinlogonPath -Name "ScRemoveOption" -ErrorAction SilentlyContinue).ScRemoveOption if ($Val -eq "1") { Write-Host " [+] ScRemoveOption is set to '$Val' (Lock Workstation - Secure)." -ForegroundColor Green Write-Output "Compliant" exit 0 } else { Write-Host " [!] VULNERABLE: ScRemoveOption is set to '$Val' (Expected: '1')" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } Option C: Manual Verification Verify the applied registry setting via command prompt: cmd reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ScRemoveOption Confirm that ScRemoveOption is REG_SZ with value "1". Verify the Smart Card Removal Policy service state: cmd sc query SCPolicySvc Confirm that STATE is RUNNING and START_TYPE is AUTO_START. Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-cached-logons.md When domain users authenticate against Windows workstations, the operating system can cache authentication verifiers locally to permit subsequent logons if an Active Directory Domain Controller is unreachable. Hardening this mechanism limits local credential exposure and renders offline attacks computationally unfeasible: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO (e.g., GPO_Hardening_Endpoints_Desktops). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Double-click Interactive logon: Number of previous logons to cache (in case domain controller is not available). Check Define this policy setting and set the cache value to 0 logons (or 2 for a dedicated roaming laptops OU). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click Registry, select New -> Registry Item: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SECURITY\Cache Value name*: NL$IterationCount Value type*: REG_DWORD Value data*: 1954 (Decimal) Link the GPO to the appropriate workstation Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountCachedLogons.ps1 # Configure-EndAccountCachedLogons.ps1 # Description: Disables cached domain logons and fortifies PBKDF2 iteration count on Endpoints. Write-Host "Configuring Endpoint cached logon restrictions and PBKDF2 iterations..." -ForegroundColor Cyan # 1. Disable cached logons count $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path $WinlogonPath)) { New-Item -Path $WinlogonPath -Force | Out-Null } Set-ItemProperty -Path $WinlogonPath -Name "CachedLogonsCount" -Value 0 -Type DWord -Force # 2. Configure PBKDF2 Iteration Count $CachePath = "HKLM:\SECURITY\Cache" if (-not (Test-Path $CachePath)) { New-Item -Path $CachePath -Force | Out-Null } Set-ItemProperty -Path $CachePath -Name "NL`$IterationCount" -Value 1954 -Type DWord -Force Write-Host "Cached logons count disabled (0) and PBKDF2 iteration count configured (1954)." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountCachedLogonsStatus.ps1 # Get-EndAccountCachedLogonsStatus.ps1 # Description: Audits cached logons count and PBKDF2 iteration count on Endpoints. Write-Host "--- Auditing Endpoint Cached Logons and PBKDF2 Settings ---" -ForegroundColor Cyan $script:Vulnerable = $false # 1. Audit CachedLogonsCount $WinlogonPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" if (-not (Test-Path $WinlogonPath)) { Write-Host " [!] MISSING KEY: $WinlogonPath" -ForegroundColor Red $script:Vulnerable = $true } else { $CacheCount = (Get-ItemProperty -Path $WinlogonPath -Name "CachedLogonsCount" -ErrorAction SilentlyContinue).CachedLogonsCount if ($CacheCount -ne 0) { Write-Host " [!] VULNERABLE: CachedLogonsCount is '$CacheCount' (Expected: 0)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] CachedLogonsCount: 0 (Secure - Cache Disabled)" -ForegroundColor Green } } # 2. Audit NL$IterationCount $CachePath = "HKLM:\SECURITY\Cache" if (-not (Test-Path $CachePath)) { Write-Host " [!] MISSING KEY: $CachePath" -ForegroundColor Red $script:Vulnerable = $true } else { $IterCount = (Get-ItemProperty -Path $CachePath -Name "NL`$IterationCount" -ErrorAction SilentlyContinue)."NL`$IterationCount" if ($IterCount -ne 1954) { Write-Host " [!] VULNERABLE: NL`$IterationCount is '$IterCount' (Expected: 1954)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] NL`$IterationCount: 1954 (Secure - ~2M PBKDF2 Iterations)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied registry configuration using command line queries: cmd reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CachedLogonsCount Confirm that CachedLogonsCount returns 0x0. To inspect the SECURITY\Cache key (using elevated command prompt via psexec -s cmd.exe): cmd reg query "HKLM\SECURITY\Cache" /v NL$IterationCount Confirm that NL$IterationCount returns 0x7a2 (Decimal 1954). Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-local-blank-passwords.md Local accounts represent an attractive target for initial access and lateral movement across enterprise workstations. Restricting blank password usage, purging insecure LAN Manager hashes, and enforcing the Classic network authentication model hardens the local SAM perimeter across endpoints: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Accounts: Limit local account use of blank passwords to console logon only*: Set to Enabled Network security: Do not store LAN Manager hash value on next password change*: Set to Enabled Network access: Sharing and security model for local accounts*: Set to Classic - local users authenticate as themselves Link the GPO to the appropriate workstation and member server Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountLocalBlankPasswords.ps1 # Configure-EndAccountLocalBlankPasswords.ps1 # Description: Enforces blank password restrictions, purges LM hashes, and sets Classic sharing on Endpoints. Write-Host "Configuring Endpoint local account and blank password restrictions..." -ForegroundColor Cyan $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path -Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "LimitBlankPasswordUse" -Value 1 -Type DWord -Force Set-ItemProperty -Path $LsaPath -Name "NoLMHash" -Value 1 -Type DWord -Force Set-ItemProperty -Path $LsaPath -Name "ForceNetworkLogon" -Value 0 -Type DWord -Force Write-Host "Local account and blank password restrictions applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountLocalBlankPasswordsStatus.ps1 # Get-EndAccountLocalBlankPasswordsStatus.ps1 # Description: Audits local account restrictions, LM hash generation, and sharing model on Endpoints. Write-Host "--- Auditing Endpoint Local Account and Blank Password Restrictions ---" -ForegroundColor Cyan $script:Vulnerable = $false $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" function Test-RegVal ($Name, $Expected) { if (-not (Test-Path -Path $LsaPath)) { Write-Host " [!] MISSING KEY: $LsaPath" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $LsaPath -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $LsaPath (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal "LimitBlankPasswordUse" 1 Test-RegVal "NoLMHash" 1 Test-RegVal "ForceNetworkLogon" 0 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied registry settings using command prompt queries: cmd reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v NoLMHash reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v ForceNetworkLogon Confirm that LimitBlankPasswordUse is 0x1, NoLMHash is 0x1, and ForceNetworkLogon is 0x0. Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-ntlm-security.md Legacy authentication protocols such as LAN Manager (LM) and NTLMv1 represent major vectors for credential interception, offline password recovery, and adversary-in-the-middle relay attacks across corporate networks. Hardening NTLM authentication parameters across endpoints enforces modern cryptographic session controls: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Network security: LAN Manager authentication level*: Set to Send NTLMv2 response only. Refuse LM & NTLM (value 5) Network security: Minimum session security for NTLM SSP based (including secure RPC) clients*: Check both Require NTLMv2 session security and Require 128-bit encryption (value 537395200) Network security: Minimum session security for NTLM SSP based (including secure RPC) servers*: Check both Require NTLMv2 session security and Require 128-bit encryption (value 537395200) Network security: Allow LocalSystem NULL session fallback*: Set to Disabled (value 0) Link the GPO to the appropriate workstation and member server Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountNtlmSecurity.ps1 # Configure-EndAccountNtlmSecurity.ps1 # Description: Enforces NTLMv2-only authentication, 128-bit session security, and blocks NULL session fallback on Endpoints. Write-Host "Configuring Endpoint NTLM and LAN Manager authentication security..." -ForegroundColor Cyan $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "LmCompatibilityLevel" -Value 5 -Type DWord -Force $MsvPath = "HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0" if (-not (Test-Path $MsvPath)) { New-Item -Path $MsvPath -Force | Out-Null } Set-ItemProperty -Path $MsvPath -Name "NTLMMinClientSec" -Value 537395200 -Type DWord -Force Set-ItemProperty -Path $MsvPath -Name "NTLMMinServerSec" -Value 537395200 -Type DWord -Force Set-ItemProperty -Path $MsvPath -Name "allownullsessionfallback" -Value 0 -Type DWord -Force Write-Host "NTLM and LAN Manager authentication security applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountNtlmSecurityStatus.ps1 # Get-EndAccountNtlmSecurityStatus.ps1 # Description: Audits NTLM authentication levels, session security, and NULL session fallback on Endpoints. Write-Host "--- Auditing Endpoint NTLM and LAN Manager Security ---" -ForegroundColor Cyan $script:Vulnerable = $false $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $MsvPath = "HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0" function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal $LsaPath "LmCompatibilityLevel" 5 Test-RegVal $MsvPath "NTLMMinClientSec" 537395200 Test-RegVal $MsvPath "NTLMMinServerSec" 537395200 Test-RegVal $MsvPath "allownullsessionfallback" 0 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied NTLM settings using command prompt queries: cmd reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel reg query "HKLM\System\CurrentControlSet\Control\Lsa\MSV1_0" /v NTLMMinClientSec reg query "HKLM\System\CurrentControlSet\Control\Lsa\MSV1_0" /v NTLMMinServerSec reg query "HKLM\System\CurrentControlSet\Control\Lsa\MSV1_0" /v allownullsessionfallback Confirm that LmCompatibilityLevel is 0x5, NTLMMinClientSec and NTLMMinServerSec are 0x20080000 (Decimal 537395200), and allownullsessionfallback is 0x0. Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-wdigest-credentials.md The Local Security Authority Subsystem Service (LSASS) holds authentication tokens and session security contexts for logged-on users. Historically, the WDigest provider retained cleartext passwords in memory, exposing enterprise networks to devastating credential theft: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click Registry, select New -> Registry Item: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest Value name*: UseLogonCredential Value type*: REG_DWORD Value data*: 0 (Decimal) Click Apply, then OK. Link the GPO to the appropriate workstation and member server Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountWdigestCredentials.ps1 # Configure-EndAccountWdigestCredentials.ps1 # Description: Disables WDigest plaintext credential caching in LSASS memory on Endpoints. Write-Host "Disabling WDigest plaintext credential caching on Endpoints..." -ForegroundColor Cyan $WDigestPath = "HKLM:\System\CurrentControlSet\Control\SecurityProviders\WDigest" if (-not (Test-Path $WDigestPath)) { New-Item -Path $WDigestPath -Force | Out-Null } Set-ItemProperty -Path $WDigestPath -Name "UseLogonCredential" -Value 0 -Type DWord -Force Write-Host "WDigest credential caching disabled successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountWdigestCredentialsStatus.ps1 # Get-EndAccountWdigestCredentialsStatus.ps1 # Description: Audits WDigest plaintext credential caching status on Endpoints. Write-Host "--- Auditing Endpoint WDigest Credential Caching ---" -ForegroundColor Cyan $WDigestPath = "HKLM:\System\CurrentControlSet\Control\SecurityProviders\WDigest" if (-not (Test-Path $WDigestPath)) { Write-Host " [!] MISSING KEY: $WDigestPath" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } $Val = (Get-ItemProperty -Path $WDigestPath -Name "UseLogonCredential" -ErrorAction SilentlyContinue).UseLogonCredential if ($null -ne $Val -and $Val -eq 0) { Write-Host " [+] UseLogonCredential is set to 0 (Disabled - Secure)." -ForegroundColor Green Write-Output "Compliant" exit 0 } else { Write-Host " [!] VULNERABLE: UseLogonCredential is '$Val' (Expected: 0)" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } Option C: Manual Verification Verify the applied WDigest setting via command prompt: cmd reg query "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v UseLogonCredential Confirm that UseLogonCredential is of type REG_DWORD with value 0x0. Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-hello-pin.md Deploying Windows Hello for Business (WHfB) across enterprise workstations transitions the environment from vulnerable password-based authentication to hardware-bound asymmetric cryptographic keys. However, strict policy constraints must be enforced to prevent weak PIN choices and insecure fallback mechanisms: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations (e.g., GPO_Hardening_Endpoints). Configure System Logon policies: * Navigate to: Computer Configuration\Policies\Administrative Templates\System\Logon Double-click Turn on convenience PIN sign-in and set to Disabled*. Configure PIN Complexity policies: * Navigate to: Computer Configuration\Policies\Administrative Templates\System\PIN Complexity Double-click Minimum PIN length , set to Enabled*, and enter 6. Configure Windows Hello for Business policies: * Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Hello for Business Double-click Use a hardware security device and set to Enabled*. Double-click Use convenience PIN sign-in and set to Disabled*. Double-click Allow Microsoft accounts to be optional and set to Enabled*. Link the GPO to the appropriate workstation Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountHelloPin.ps1 # Configure-EndAccountHelloPin.ps1 # Description: Hardens Windows Hello for Business, disables convenience PINs, and mandates TPM hardware backing on Endpoints. Write-Host "Configuring Endpoint Windows Hello for Business and PIN policies..." -ForegroundColor Cyan # 1. System Logon PIN Policy $SysPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" if (-not (Test-Path $SysPath)) { New-Item -Path $SysPath -Force | Out-Null } Set-ItemProperty -Path $SysPath -Name "AllowDomainPINLogon" -Value 0 -Type DWord -Force # 2. PIN Complexity $PinPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity" if (-not (Test-Path $PinPath)) { New-Item -Path $PinPath -Force | Out-Null } Set-ItemProperty -Path $PinPath -Name "MinimumPINLength" -Value 6 -Type DWord -Force # 3. Hardware Security Device $PfwPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" if (-not (Test-Path $PfwPath)) { New-Item -Path $PfwPath -Force | Out-Null } Set-ItemProperty -Path $PfwPath -Name "RequireSecurityDevice" -Value 1 -Type DWord -Force $TpmPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\ExcludeSecurityDevices" if (-not (Test-Path $TpmPath)) { New-Item -Path $TpmPath -Force | Out-Null } Set-ItemProperty -Path $TpmPath -Name "TPM12" -Value 0 -Type DWord -Force # 4. MSA Optional $SysPolPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path $SysPolPath)) { New-Item -Path $SysPolPath -Force | Out-Null } Set-ItemProperty -Path $SysPolPath -Name "MSAOptional" -Value 1 -Type DWord -Force Write-Host "Windows Hello and PIN policies applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountHelloPinStatus.ps1 # Get-EndAccountHelloPinStatus.ps1 # Description: Audits Windows Hello for Business, PIN complexity, and TPM enforcement status on Endpoints. Write-Host "--- Auditing Endpoint Windows Hello and PIN Policies ---" -ForegroundColor Cyan $script:Vulnerable = $false function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" "AllowDomainPINLogon" 0 Test-RegVal "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity" "MinimumPINLength" 6 Test-RegVal "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" "RequireSecurityDevice" 1 Test-RegVal "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork\ExcludeSecurityDevices" "TPM12" 0 Test-RegVal "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "MSAOptional" 1 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied policies using command line queries: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowDomainPINLogon reg query "HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\PINComplexity" /v MinimumPINLength reg query "HKLM\SOFTWARE\Policies\Microsoft\PassportForWork" /v RequireSecurityDevice reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v MSAOptional Confirm that AllowDomainPINLogon is 0x0, MinimumPINLength is 0x6, RequireSecurityDevice is 0x1, and MSAOptional is 0x1. Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-block-msa.md Allowing users to attach consumer Microsoft Accounts (such as @outlook.com, @hotmail.com, or @live.com) to enterprise-managed client workstations bypasses corporate identity perimeters and exposes organizational data to unauthorized external storage: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Microsoft Account Double-click Block all consumer Microsoft account user authentication. Set the policy to Enabled. Click Apply, then OK. Link the GPO to the target workstation Organizational Units (OUs). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountBlockMsa.ps1 # Configure-EndAccountBlockMsa.ps1 # Description: Blocks consumer Microsoft account user authentication on Endpoints. Write-Host "Blocking consumer Microsoft account user authentication on Endpoints..." -ForegroundColor Cyan $MsaPath = "HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount" if (-not (Test-Path -Path $MsaPath)) { New-Item -Path $MsaPath -Force | Out-Null } Set-ItemProperty -Path $MsaPath -Name "DisableUserAuth" -Value 1 -Type DWord -Force Write-Host "Consumer Microsoft account user authentication blocked successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountBlockMsaStatus.ps1 # Get-EndAccountBlockMsaStatus.ps1 # Description: Audits consumer Microsoft account blocking status on Endpoints. Write-Host "--- Auditing Endpoint Consumer Microsoft Account Restrictions ---" -ForegroundColor Cyan $MsaPath = "HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftAccount" if (-not (Test-Path -Path $MsaPath)) { Write-Host " [!] MISSING KEY: $MsaPath" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } $Val = (Get-ItemProperty -Path $MsaPath -Name "DisableUserAuth" -ErrorAction SilentlyContinue).DisableUserAuth if ($null -ne $Val -and $Val -eq 1) { Write-Host " [+] DisableUserAuth is set to 1 (Enabled - Secure)." -ForegroundColor Green Write-Output "Compliant" exit 0 } else { Write-Host " [!] VULNERABLE: DisableUserAuth is '$Val' (Expected: 1)" -ForegroundColor Red Write-Output "Non-Compliant" exit 1 } Option C: Manual Verification Verify the applied policy via command prompt using reg query: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftAccount" /v DisableUserAuth Confirm that DisableUserAuth exists with a value of 0x1. Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-secure-channel.md The Netlogon secure channel provides the core trust link between enterprise workstations, member servers, and Active Directory Domain Controllers for user authentication, group enumeration, and secure channel key rotation. Hardening this channel prevents cryptographic downgrade, spoofing, and machine account persistence: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Domain member: Digitally encrypt or sign secure channel data (always)*: Set to Enabled Domain member: Digitally encrypt secure channel data (when possible)*: Set to Enabled Domain member: Digitally sign secure channel data (when possible)*: Set to Enabled Domain member: Disable machine account password changes*: Set to Disabled Domain member: Maximum machine account password age*: Set to 30 days Domain member: Require strong (Windows 2000 or later) session key*: Set to Enabled Link the GPO to the appropriate workstation and member server Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountSecureChannel.ps1 # Configure-EndAccountSecureChannel.ps1 # Description: Configures Netlogon secure channel signing, sealing, strong keys, and password rotation on Endpoints. Write-Host "Configuring Endpoint Domain Member Secure Channel settings..." -ForegroundColor Cyan $NetlogonPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" if (-not (Test-Path -Path $NetlogonPath)) { New-Item -Path $NetlogonPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonPath -Name "RequireSignOrSeal" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "SealSecureChannel" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "SignSecureChannel" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "DisablePasswordChange" -Value 0 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "MaximumPasswordAge" -Value 30 -Type DWord -Force Set-ItemProperty -Path $NetlogonPath -Name "RequireStrongKey" -Value 1 -Type DWord -Force Write-Host "Domain Member Secure Channel settings applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountSecureChannelStatus.ps1 # Get-EndAccountSecureChannelStatus.ps1 # Description: Audits Netlogon secure channel parameters on Endpoints. Write-Host "--- Auditing Endpoint Domain Member Secure Channel Settings ---" -ForegroundColor Cyan $script:Vulnerable = $false $NetlogonPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal $NetlogonPath "RequireSignOrSeal" 1 Test-RegVal $NetlogonPath "SealSecureChannel" 1 Test-RegVal $NetlogonPath "SignSecureChannel" 1 Test-RegVal $NetlogonPath "DisablePasswordChange" 0 Test-RegVal $NetlogonPath "MaximumPasswordAge" 30 Test-RegVal $NetlogonPath "RequireStrongKey" 1 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the active secure channel trust relationship using nltest: cmd nltest /sc_query:%USERDNSDOMAIN% nltest /sc_verify:%USERDNSDOMAIN% Confirm that the status returns NTRR_SUCCESS (or 0x0). Verify the applied registry configuration using reg query: cmd reg query "HKLM\System\CurrentControlSet\Services\Netlogon\Parameters" /v RequireSignOrSeal reg query "HKLM\System\CurrentControlSet\Services\Netlogon\Parameters" /v RequireStrongKey reg query "HKLM\System\CurrentControlSet\Services\Netlogon\Parameters" /v MaximumPasswordAge Confirm that RequireSignOrSeal is 0x1, RequireStrongKey is 0x1, and MaximumPasswordAge is 0x1e (Decimal 30). Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-smb-security.md The Server Message Block (SMB) protocol is integral to enterprise file sharing, administrative automation, and printer sharing. Hardening SMB client and server parameters protects against cleartext credential theft, resource exhaustion from dormant sessions, and anonymous file access: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Microsoft network client: Send unencrypted password to third-party SMB servers*: Set to Disabled Microsoft network server: Amount of idle time required before suspending session*: Set to 15 minutes Microsoft network server: Disconnect clients when logon hours expire*: Set to Enabled Network security: Force logoff when logon hours expire*: Set to Enabled Network access: Shares that can be accessed anonymously*: Set to None (leave field completely empty) Link the GPO to the appropriate workstation and member server Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountSmbSecurity.ps1 # Configure-EndAccountSmbSecurity.ps1 # Description: Configures SMB client and server security options (plaintext block, auto-disconnect, logon hours) on Endpoints. Write-Host "Configuring Endpoint SMB client and server security options..." -ForegroundColor Cyan # 1. LanmanWorkstation: Block plaintext passwords $WorkstationPath = "HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" if (-not (Test-Path -Path $WorkstationPath)) { New-Item -Path $WorkstationPath -Force | Out-Null } Set-ItemProperty -Path $WorkstationPath -Name "EnablePlainTextPassword" -Value 0 -Type DWord -Force # 2. LanmanServer: AutoDisconnect, EnableForcedLogoff, NullSessionShares $ServerPath = "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" if (-not (Test-Path -Path $ServerPath)) { New-Item -Path $ServerPath -Force | Out-Null } Set-ItemProperty -Path $ServerPath -Name "AutoDisconnect" -Value 15 -Type DWord -Force Set-ItemProperty -Path $ServerPath -Name "EnableForcedLogoff" -Value 1 -Type DWord -Force Set-ItemProperty -Path $ServerPath -Name "NullSessionShares" -Value @() -Type MultiString -Force # 3. Netlogon: ForceLogoffWhenHourExpire $NetlogonPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" if (-not (Test-Path -Path $NetlogonPath)) { New-Item -Path $NetlogonPath -Force | Out-Null } Set-ItemProperty -Path $NetlogonPath -Name "ForceLogoffWhenHourExpire" -Value 1 -Type DWord -Force Write-Host "SMB client and server security options applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountSmbSecurityStatus.ps1 # Get-EndAccountSmbSecurityStatus.ps1 # Description: Audits SMB client and server security options on Endpoints. Write-Host "--- Auditing Endpoint SMB Client and Server Security Options ---" -ForegroundColor Cyan $script:Vulnerable = $false $WorkstationPath = "HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" $ServerPath = "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" $NetlogonPath = "HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters" function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal $WorkstationPath "EnablePlainTextPassword" 0 Test-RegVal $ServerPath "AutoDisconnect" 15 Test-RegVal $ServerPath "EnableForcedLogoff" 1 Test-RegVal $NetlogonPath "ForceLogoffWhenHourExpire" 1 # Audit NullSessionShares if (Test-Path -Path $ServerPath) { $NullShares = (Get-ItemProperty -Path $ServerPath -Name "NullSessionShares" -ErrorAction SilentlyContinue).NullSessionShares if ($null -ne $NullShares -and $NullShares.Count -gt 0 -and ($NullShares -join "") -ne "") { Write-Host " [!] VULNERABLE: NullSessionShares contains: $($NullShares -join ', ')" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] NullSessionShares: Empty (Secure)" -ForegroundColor Green } } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied SMB settings using command prompt queries: cmd reg query "HKLM\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v EnablePlainTextPassword reg query "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoDisconnect reg query "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v EnableForcedLogoff reg query "HKLM\System\CurrentControlSet\Services\Netlogon\Parameters" /v ForceLogoffWhenHourExpire reg query "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v NullSessionShares Confirm that EnablePlainTextPassword is 0x0, AutoDisconnect is 0xf (Decimal 15), EnableForcedLogoff is 0x1, ForceLogoffWhenHourExpire is 0x1, and NullSessionShares is empty. Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-anonymous-restrictions.md Restricting unauthenticated network reconnaissance protects local SAM databases, user account identifiers, and shared directory paths across enterprise endpoints and member servers: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Network access: Do not allow anonymous enumeration of SAM accounts*: Set to Enabled Network access: Do not allow anonymous enumeration of SAM accounts and shares*: Set to Enabled Network access: Allow anonymous SID/Name translation*: Set to Disabled Network security: Allow PKU2U authentication requests to this computer to use online identities*: Set to Disabled System objects: Require case insensitivity for non-Windows subsystems*: Set to Enabled Link the GPO to the appropriate workstation and server Organizational Units (OUs). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountAnonymousRestrictions.ps1 # Configure-EndAccountAnonymousRestrictions.ps1 # Description: Hardens anonymous access, SAM enumeration, PKU2U, and subsystem object naming on Endpoints. Write-Host "Configuring Endpoint anonymous access and enumeration restrictions..." -ForegroundColor Cyan $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" if (-not (Test-Path -Path $LsaPath)) { New-Item -Path $LsaPath -Force | Out-Null } Set-ItemProperty -Path $LsaPath -Name "RestrictAnonymousSAM" -Value 1 -Type DWord -Force Set-ItemProperty -Path $LsaPath -Name "RestrictAnonymous" -Value 1 -Type DWord -Force Set-ItemProperty -Path $LsaPath -Name "ObaseCaseInsensitive" -Value 1 -Type DWord -Force $KerbPath = "HKLM:\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters" if (-not (Test-Path $KerbPath)) { New-Item -Path $KerbPath -Force | Out-Null } Set-ItemProperty -Path $KerbPath -Name "AllowPKU2U" -Value 0 -Type DWord -Force Write-Host "Anonymous access and enumeration restrictions applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountAnonymousRestrictionsStatus.ps1 # Get-EndAccountAnonymousRestrictionsStatus.ps1 # Description: Audits Endpoint anonymous enumeration, PKU2U, and subsystem object security configuration. Write-Host "--- Auditing Endpoint Anonymous Access and Enumeration Restrictions ---" -ForegroundColor Cyan $script:Vulnerable = $false $LsaPath = "HKLM:\System\CurrentControlSet\Control\Lsa" $KerbPath = "HKLM:\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters" function Test-RegVal ($Path, $Name, $Expected) { if (-not (Test-Path -Path $Path)) { Write-Host " [!] MISSING KEY: $Path" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $Path (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name under $Path is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal $LsaPath "RestrictAnonymousSAM" 1 Test-RegVal $LsaPath "RestrictAnonymous" 1 Test-RegVal $LsaPath "ObaseCaseInsensitive" 1 Test-RegVal $KerbPath "AllowPKU2U" 0 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied registry settings using reg query: cmd reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v RestrictAnonymousSAM reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v RestrictAnonymous reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v ObaseCaseInsensitive reg query "HKLM\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters" /v AllowPKU2U Confirm that each key exists and the values match: RestrictAnonymousSAM = 0x1, RestrictAnonymous = 0x1, ObaseCaseInsensitive = 0x1, and AllowPKU2U = 0x0. Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Professional (all builds), Windows Server 2016 (and above). File Path: 08-endpoints/account-policy/configure-end-account-interactive-logon.md Interactive logon configurations govern how users authenticate at the physical console or remote desktop interface. Hardening these parameters across client endpoints and member servers defends against credential phishing, shoulder surfing, and intentional system crash exploits: Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following policies: Interactive logon: Do not require CTRL+ALT+DEL*: Set to Disabled (value 0) Interactive logon: Don't display last signed-in*: Set to Enabled (value 1) Audit: Shut down system immediately if unable to log security audits*: Set to Disabled (value 0) Link the GPO to the appropriate workstation and server Organizational Units. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAccountInteractiveLogon.ps1 # Configure-EndAccountInteractiveLogon.ps1 # Description: Configures interactive logon security options (SAS requirement, hide last user, audit stability) on Endpoints. Write-Host "Configuring Endpoint interactive logon security options..." -ForegroundColor Cyan $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" if (-not (Test-Path -Path $SystemPath)) { New-Item -Path $SystemPath -Force | Out-Null } Set-ItemProperty -Path $SystemPath -Name "DisableCAD" -Value 0 -Type DWord -Force Set-ItemProperty -Path $SystemPath -Name "DontDisplayLastUserName" -Value 1 -Type DWord -Force Set-ItemProperty -Path $SystemPath -Name "CrashOnAuditFail" -Value 0 -Type DWord -Force Write-Host "Interactive logon security options applied successfully." -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAccountInteractiveLogonStatus.ps1 # Get-EndAccountInteractiveLogonStatus.ps1 # Description: Audits interactive logon security options on Endpoints. Write-Host "--- Auditing Endpoint Interactive Logon Security Options ---" -ForegroundColor Cyan $script:Vulnerable = $false $SystemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" function Test-RegVal ($Name, $Expected) { if (-not (Test-Path -Path $SystemPath)) { Write-Host " [!] MISSING KEY: $SystemPath" -ForegroundColor Red $script:Vulnerable = $true return } $Prop = Get-ItemProperty -Path $SystemPath -Name $Name -ErrorAction SilentlyContinue if ($null -eq $Prop -or $null -eq $Prop.$Name) { Write-Host " [!] MISSING VALUE: $Name under $SystemPath (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true return } $Val = $Prop.$Name if ($Val -ne $Expected) { Write-Host " [!] VULNERABLE: $Name is '$Val' (Expected: $Expected)" -ForegroundColor Red $script:Vulnerable = $true } else { Write-Host " [+] $($Name): $Val (Secure)" -ForegroundColor Green } } Test-RegVal "DisableCAD" 0 Test-RegVal "DontDisplayLastUserName" 1 Test-RegVal "CrashOnAuditFail" 0 if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } Option C: Manual Verification Verify the applied registry configuration using command line queries: cmd reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCAD reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DontDisplayLastUserName reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v CrashOnAuditFail Confirm that DisableCAD is 0x0, DontDisplayLastUserName is 0x1, and CrashOnAuditFail is 0x0. Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10, Windows 11 File Path: 08-endpoints/enable-kerberos-armoring.md Active Directory environments relying on standard Kerberos authentication are susceptible to offline brute-force, dictionary attacks, and credential harvesting. During standard Kerberos pre-authentication, the client sends an Authentication Service Request (AS-REQ) containing timestamp data encrypted with the user's password hash. Attackers monitoring network traffic can intercept these timestamps, or execute AS-REP roasting against accounts that do not require Kerberos pre-authentication (DONT_REQ_PREAUTH), conducting offline hash cracking to recover cleartext credentials. Kerberos Armoring, also known as Flexible Authentication Secure Tunneling (FAST - RFC 6113), mitigates this vulnerability by establishing an encrypted channel between the client workstation and the Key Distribution Center (KDC) on the Domain Controller. This tunnel is encrypted using the computer account's credential (or machine certificate), protecting pre-authentication messages (AS-REQ and AS-REP) from eavesdropping, offline dictionary attacks, and message tampering. On standard Tier 2 client workstations, Kerberos Armoring is configured for opportunistic negotiation (RequireFast = 0). This instructs the Windows Kerberos security provider to request armored exchanges whenever communicating with FAST-capable Domain Controllers, while maintaining backward compatibility with legacy resource servers, external forest trusts, and non-Windows Kerberos realms that do not yet support RFC 6113 FAST. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc) on an administrative workstation. Edit the workstation hardening GPO applied to standard clients (e.g., GPO_Hardening_Workstations_Tier2). Navigate to: Computer Configuration\Policies\Administrative Templates\System\Kerberos Configure the following settings: Policy : `Kerberos client support for claims, compound authentication and Kerberos armoring` -> Enabled Policy : `Support device authentication using certificate` -> Enabled* (Select Automatic in options) Policy : `Fail authentication requests when Kerberos armoring is not available` -> Disabled* (or Not Configured) Link the GPO to the appropriate Tier 2 Workstations Organizational Units (OUs). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Use this method to apply the setting locally (for testing, non-domain scenarios, or standalone client deployment) or if the control is not manageable via standard GPO interfaces. Download Script: Configure-EndKerberosArmoring.ps1 # Configure-EndKerberosArmoring.ps1 # Description: Configures client-side Kerberos Armoring (FAST) and certificate device authentication on Tier 2 client endpoints. Write-Host "Applying hardening requirement: Enable Kerberos Armoring on Tier 2 Endpoints..." -ForegroundColor Cyan $ClientRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" if (-not (Test-Path $ClientRegPath)) { New-Item -Path $ClientRegPath -Force | Out-Null } # 1. Enable Kerberos client support for claims and armoring Set-ItemProperty -Path $ClientRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord # 2. Support device authentication using certificate (Automatic) Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitEnabled" -Value 1 -Type DWord Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitBehavior" -Value 0 -Type DWord # 3. Ensure RequireFast is set to 0 (Opportunistic negotiation for general client workstations) Set-ItemProperty -Path $ClientRegPath -Name "RequireFast" -Value 0 -Type DWord Write-Host "Client endpoint Kerberos Armoring configured successfully." -ForegroundColor Green To verify the setting has been applied: Download Script: Get-EndKerberosArmoringStatus.ps1 # Get-EndKerberosArmoringStatus.ps1 # Description: Audits client-side Kerberos Armoring configuration on Tier 2 endpoints. Write-Host "--- Auditing Endpoint Kerberos Armoring Configuration ---" -ForegroundColor Cyan $ClientRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" $Vulnerable = $false $ClientValue = Get-ItemProperty -Path $ClientRegPath -Name "EnableCbacAndArmor" -ErrorAction SilentlyContinue $DevicePKInit = Get-ItemProperty -Path $ClientRegPath -Name "DevicePKInitEnabled" -ErrorAction SilentlyContinue $DeviceBehavior = Get-ItemProperty -Path $ClientRegPath -Name "DevicePKInitBehavior" -ErrorAction SilentlyContinue $RequireFast = Get-ItemProperty -Path $ClientRegPath -Name "RequireFast" -ErrorAction SilentlyContinue # 1. Audit Client-side support for claims and armoring if ($null -ne $ClientValue -and $ClientValue.EnableCbacAndArmor -eq 1) { Write-Host "[+] Client-side Kerberos Armoring is ENABLED (EnableCbacAndArmor = 1)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Client-side Kerberos Armoring is DISABLED or missing." -ForegroundColor Red $Vulnerable = $true } # 2. Audit Certificate device authentication if ($null -ne $DevicePKInit -and $DevicePKInit.DevicePKInitEnabled -eq 1 -and $null -ne $DeviceBehavior -and $DeviceBehavior.DevicePKInitBehavior -eq 0) { Write-Host "[+] Certificate device authentication is ENABLED: Automatic." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Certificate device authentication is not compliant or not configured." -ForegroundColor Red $Vulnerable = $true } # 3. Audit RequireFast (for endpoints, 0 or absent is acceptable for opportunistic FAST) if ($null -eq $RequireFast -or $RequireFast.RequireFast -eq 0) { Write-Host "[+] Kerberos Armoring mode is configured for opportunistic negotiation (RequireFast = 0)." -ForegroundColor Green } else { Write-Host "[-] Information: RequireFast is set to $($RequireFast.RequireFast)." -ForegroundColor Yellow } if ($Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndKerberosArmoring.ps1 # Description: Configures client-side Kerberos Armoring (FAST) and certificate device authentication on Tier 2 client endpoints. Write-Host "Applying hardening requirement: Enable Kerberos Armoring on Tier 2 Endpoints..." -ForegroundColor Cyan $ClientRegPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" if (-not (Test-Path $ClientRegPath)) { New-Item -Path $ClientRegPath -Force | Out-Null } # 1. Enable Kerberos client support for claims and armoring Set-ItemProperty -Path $ClientRegPath -Name "EnableCbacAndArmor" -Value 1 -Type DWord # 2. Support device authentication using certificate (Automatic) Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitEnabled" -Value 1 -Type DWord Set-ItemProperty -Path $ClientRegPath -Name "DevicePKInitBehavior" -Value 0 -Type DWord # 3. Ensure RequireFast is set to 0 (Opportunistic negotiation for general client workstations) Set-ItemProperty -Path $ClientRegPath -Name "RequireFast" -Value 0 -Type DWord Write-Host "Client endpoint Kerberos Armoring configured successfully." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-168](../../07-paws/admin-templates/configure-paw-at-smbv1.md); for Domain Controllers, refer to [REQ-DC-016](../../02-domain-controllers/disable-smbv1.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-smbv1.md Server Message Block version 1 (SMBv1) is a legacy file and print sharing protocol designed in the early 1980s that suffers from severe architectural design flaws, obsolete cryptographic mechanisms, and extensive vulnerabilities exploited in widespread cyberattacks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Lanman Workstation Configure SMB v1 client driver: Set to Enabled Set Driver state drop-down to: Disable driver (recommended) Navigate to: Computer Configuration\Policies\Administrative Templates\Network\Lanman Server Configure SMB v1 server: Set to Disabled Link the GPO to the appropriate Organizational Unit (OU) and verify policy replication across endpoints using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtSmbv1.ps1 #Configure-EndAtSmbv1.ps1 # Description: Configures Administrative Templates: Disable SMBv1 Protocol Components. Write-Host "Configuring Administrative Templates: Disable SMBv1 Protocol Components..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" -Name "Start" -Value 4 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "SMB1" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable SMBv1 Protocol Components applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtSmbv1Status.ps1 #Get-EndAtSmbv1Status.ps1 # Description: Audits Administrative Templates: Disable SMBv1 Protocol Components. Write-Host "--- Auditing Administrative Templates: Disable SMBv1 Protocol Components ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" $ValueName = "Start" $ExpectedValue = 4 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" $ValueName = "SMB1" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-169](../../07-paws/admin-templates/configure-paw-at-netbt-nodetype.md); for Domain Controllers, refer to [REQ-DC-017](../../02-domain-controllers/harden-network-parameters.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-netbt-nodetype.md NetBIOS over TCP/IP (NetBT, defined in RFC 1001/1002) is a legacy name resolution and session transport protocol that relies heavily on unauthenticated IP broadcasts over UDP port 137. In modern enterprise environments, NetBT introduces significant attack vectors that can be weaponized for credential theft and denial of service. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Network\TCPIP Settings\Parameters NetBT NodeType configuration: Set to Enabled Set NetBT NodeType drop-down to: P-node (recommended) Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtNetbtNodetype.ps1 #Configure-EndAtNetbtNodetype.ps1 # Description: Configures Administrative Templates: Configure NetBT Node Type and Name Release. Write-Host "Configuring Administrative Templates: Configure NetBT Node Type and Name Release..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" -Name "NodeType" -Value 2 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" -Name "NoNameReleaseOnDemand" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Configure NetBT Node Type and Name Release applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtNetbtNodetypeStatus.ps1 #Get-EndAtNetbtNodetypeStatus.ps1 # Description: Audits Administrative Templates: Configure NetBT Node Type and Name Release. Write-Host "--- Auditing Administrative Templates: Configure NetBT Node Type and Name Release ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" $ValueName = "NodeType" $ExpectedValue = 2 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" $ValueName = "NoNameReleaseOnDemand" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-170](../../07-paws/admin-templates/configure-paw-at-mss-ip-source-routing.md); for Domain Controllers, refer to [REQ-DC-018](../../02-domain-controllers/harden-network-parameters.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-mss-ip-source-routing.md The Internet Protocol suite (IPv4 RFC 791 and IPv6 RFC 2460/8200) contains legacy diagnostic and routing mechanisms that allow packet senders and adjacent network nodes to manipulate routing decisions. In hostile or untrusted network environments, these capabilities introduce critical exposure to packet spoofing, firewall evasion, and adversary-in-the-middle attacks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options MSS: (DisableIPSourceRouting IPv6) IP source routing protection level: Set to Enabled Select drop-down value: Highest protection, source routing is completely disabled Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options MSS: (DisableIPSourceRouting) IP source routing protection level: Set to Enabled Select drop-down value: Highest protection, source routing is completely disabled Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify replication using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtMssIpSourceRouting.ps1 #Configure-EndAtMssIpSourceRouting.ps1 # Description: Configures Administrative Templates: MSS IP Source Routing and ICMP Redirects. Write-Host "Configuring Administrative Templates: MSS IP Source Routing and ICMP Redirects..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" -Name "DisableIPSourceRouting" -Value 2 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "DisableIPSourceRouting" -Value 2 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "EnableICMPRedirect" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: MSS IP Source Routing and ICMP Redirects applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtMssIpSourceRoutingStatus.ps1 #Get-EndAtMssIpSourceRoutingStatus.ps1 # Description: Audits Administrative Templates: MSS IP Source Routing and ICMP Redirects. Write-Host "--- Auditing Administrative Templates: MSS IP Source Routing and ICMP Redirects ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" $ValueName = "DisableIPSourceRouting" $ExpectedValue = 2 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" $ValueName = "DisableIPSourceRouting" $ExpectedValue = 2 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" $ValueName = "EnableICMPRedirect" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-mss-system-protections.md The Microsoft Solutions for Security (MSS) baseline settings provide low-level kernel, session manager, and authentication subsystem protections. These settings address fundamental Windows operating system security behaviors, including DLL search-order resolution, automatic logon credential storage, physical console lockout latency, and security event log capacity alerting. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options Configure the following MSS policies (imported via Secedit or Microsoft Security Compliance Toolkit): MSS: (AutoAdminLogon) Enable Automatic Logon*: Set to Disabled MSS: (SafeDllSearchMode) Enable Safe DLL search mode*: Set to Enabled MSS: (ScreenSaverGracePeriod) The time in seconds before the screen saver grace period expires*: Set to Enabled: 5 or fewer seconds MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning*: Set to Enabled: 90% or less Click Apply, then click OK for each policy. Link the GPO to the appropriate Organizational Unit (OU) and verify replication across all domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtMssSystemProtections.ps1 #Configure-EndAtMssSystemProtections.ps1 # Description: Configures Administrative Templates: MSS System and Session Security Protections. Write-Host "Configuring Administrative Templates: MSS System and Session Security Protections..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "AutoAdminLogon" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name "ScreenSaverGracePeriod" -Value 5 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "SafeDllSearchMode" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security" -Name "WarningLevel" -Value 90 -Type DWord -Force Write-Host "[+] Administrative Templates: MSS System and Session Security Protections applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtMssSystemProtectionsStatus.ps1 #Get-EndAtMssSystemProtectionsStatus.ps1 # Description: Audits Administrative Templates: MSS System and Session Security Protections. Write-Host "--- Auditing Administrative Templates: MSS System and Session Security Protections ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" $ValueName = "AutoAdminLogon" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" $ValueName = "ScreenSaverGracePeriod" $ExpectedValue = 5 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" $ValueName = "SafeDllSearchMode" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\Security" $ValueName = "WarningLevel" $ExpectedValue = 90 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ScreenSaverGracePeriod reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode reg query "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security" /v WarningLevel Expected output: text AutoAdminLogon REG_SZ 0 ScreenSaverGracePeriod REG_DWORD 0x5 SafeDllSearchMode REG_DWORD 0x1 WarningLevel REG_DWORD 0x5a Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-device-metadata.md When physical or virtual peripherals—such as USB security tokens, smart card readers, external storage media, printers, or network adapters—are connected to a Windows system, the Device Setup Manager (DSM) initiates automated queries to Microsoft Windows Metadata and Internet Services (WMIS). These services deliver OEM-branded device icons, detailed model descriptions, and companion application links displayed in the "Devices and Printers" interface. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Device Installation Double-click Prevent device metadata retrieval from the Internet. Select Enabled. Click Apply, then click OK. Link the GPO to the appropriate Organizational Unit (OU) and verify policy replication across domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtDeviceMetadata.ps1 #Configure-EndAtDeviceMetadata.ps1 # Description: Configures Administrative Templates: Prevent Device Metadata Retrieval from Network. Write-Host "Configuring Administrative Templates: Prevent Device Metadata Retrieval from Network..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" -Name "PreventDeviceMetadataFromNetwork" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Prevent Device Metadata Retrieval from Network applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtDeviceMetadataStatus.ps1 #Get-EndAtDeviceMetadataStatus.ps1 # Description: Audits Administrative Templates: Prevent Device Metadata Retrieval from Network. Write-Host "--- Auditing Administrative Templates: Prevent Device Metadata Retrieval from Network ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" $ValueName = "PreventDeviceMetadataFromNetwork" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Device Metadata" /v PreventDeviceMetadataFromNetwork Expected output: text PreventDeviceMetadataFromNetwork REG_DWORD 0x1 Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-gp-processing.md The Windows Group Policy service (gpsvc) manages operating system and security configurations through Client-Side Extensions (CSEs). To minimize network overhead and processing latency, the default Windows Group Policy engine implements an optimization check: during periodic background refresh cycles (every 90 minutes with a randomized 30-minute delta), CSEs compare the local GPO version with the Active Directory SYSVOL version. If the GPO version has not incremented, the CSE skips applying settings. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Group Policy Double-click Configure registry policy processing: Set to Enabled*. Check Process even if the Group Policy objects have not changed*. Uncheck Do not apply during periodic background processing*. Double-click Configure security policy processing: Set to Enabled*. Check Process even if the Group Policy objects have not changed*. Uncheck Do not apply during periodic background processing*. Click Apply, then click OK for both policies. Link the GPO to the appropriate Organizational Unit (OU) and verify policy replication across all domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtGpProcessing.ps1 #Configure-EndAtGpProcessing.ps1 # Description: Configures Administrative Templates: Enforce Group Policy Background Processing. Write-Host "Configuring Administrative Templates: Enforce Group Policy Background Processing..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" -Name "NoBackgroundPolicy" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" -Name "NoGPOListChanges" -Value 0 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" -Name "NoBackgroundPolicy" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" -Name "NoGPOListChanges" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Enforce Group Policy Background Processing applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtGpProcessingStatus.ps1 #Get-EndAtGpProcessingStatus.ps1 # Description: Audits Administrative Templates: Enforce Group Policy Background Processing. Write-Host "--- Auditing Administrative Templates: Enforce Group Policy Background Processing ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" $ValueName = "NoBackgroundPolicy" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" $ValueName = "NoGPOListChanges" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" $ValueName = "NoBackgroundPolicy" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" $ValueName = "NoGPOListChanges" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" /s reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" /s Verify that NoBackgroundPolicy and NoGPOListChanges are present and set to 0x0. Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-cross-device-experiences.md The Windows Connected Devices Platform (CDP, also known internally as Project Rome) facilitates device-to-device communication, application activity roaming, session continuation ("Continue on PC"), and cross-device clipboard sharing across Windows, iOS, and Android devices. While convenient for consumer multi-device environments, CDP introduces severe security and data-governance vulnerabilities within corporate enterprise networks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Cross-Device Experiences Double-click Continue experiences on this device. Select Disabled. Click Apply, then click OK. Link the GPO to the appropriate Organizational Unit (OU) and verify policy replication across domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtCrossDeviceExperiences.ps1 #Configure-EndAtCrossDeviceExperiences.ps1 # Description: Configures Administrative Templates: Disable Cross-Device Experiences. Write-Host "Configuring Administrative Templates: Disable Cross-Device Experiences..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableCdp" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Cross-Device Experiences applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtCrossDeviceExperiencesStatus.ps1 #Get-EndAtCrossDeviceExperiencesStatus.ps1 # Description: Audits Administrative Templates: Disable Cross-Device Experiences. Write-Host "--- Auditing Administrative Templates: Disable Cross-Device Experiences ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "EnableCdp" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableCdp Expected output: text EnableCdp REG_DWORD 0x0 Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-175](../../07-paws/admin-templates/configure-paw-at-internet-communication.md); for Domain Controllers, refer to [REQ-DC-027](../../02-domain-controllers/configure-telemetry-privacy.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-internet-communication.md The Windows operating system includes several legacy features designed to download supplemental drivers, wizard components, and third-party web provider templates over unauthenticated internet connections. In enterprise environments, these automated internet interactions expose endpoints to remote code execution and data exfiltration. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Internet Communication Management\Internet Communication settings Turn off downloading of print drivers over HTTP: Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\System\Internet Communication Management\Internet Communication settings Turn off Internet download for Web publishing and online ordering wizards: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtInternetCommunication.ps1 #Configure-EndAtInternetCommunication.ps1 # Description: Configures Administrative Templates: Restrict Internet Communication and Web Downloads. Write-Host "Configuring Administrative Templates: Restrict Internet Communication and Web Downloads..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" -Name "DisableWebPnPDownload" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoWebServices" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Restrict Internet Communication and Web Downloads applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtInternetCommunicationStatus.ps1 #Get-EndAtInternetCommunicationStatus.ps1 # Description: Audits Administrative Templates: Restrict Internet Communication and Web Downloads. Write-Host "--- Auditing Administrative Templates: Restrict Internet Communication and Web Downloads ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" $ValueName = "DisableWebPnPDownload" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" $ValueName = "NoWebServices" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-176](../../07-paws/admin-templates/configure-paw-at-lsa-custom-ssps.md); for complementary LSA Protection, refer to [REQ-END-007](../../08-endpoints/enable-lsa-protection.md)). Operating Systems: Windows 10 (1903 and above) Enterprise/Professional, Windows 11 Enterprise/Pro, Windows Server 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-lsa-custom-ssps.md The Local Security Authority Subsystem Service (lsass.exe) is the central authentication authority in the Windows operating system, responsible for credential validation, token creation, and interactive logons. Security Support Providers (SSPs) and Authentication Packages (APs) execute as dynamic link libraries (DLLs) directly inside the lsass.exe memory space. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Local Security Authority Allow Custom SSPs and APs to be loaded into LSASS: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtLsaCustomSsps.ps1 #Configure-EndAtLsaCustomSsps.ps1 # Description: Configures Administrative Templates: Block Custom SSPs and APs from Loading into LSASS. Write-Host "Configuring Administrative Templates: Block Custom SSPs and APs from Loading into LSASS..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "AllowCustomSSPsAPs" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Block Custom SSPs and APs from Loading into LSASS applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtLsaCustomSspsStatus.ps1 #Get-EndAtLsaCustomSspsStatus.ps1 # Description: Audits Administrative Templates: Block Custom SSPs and APs from Loading into LSASS. Write-Host "--- Auditing Administrative Templates: Block Custom SSPs and APs from Loading into LSASS ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "AllowCustomSSPsAPs" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-177](../../07-paws/admin-templates/configure-paw-at-logon-display-options.md); for Domain Controllers, refer to [REQ-DC-024](../../02-domain-controllers/configure-security-options.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-logon-display-options.md The Windows logon desktop and lock screen represent the physical perimeter of the operating system. In unhardened configurations, the logon interface exposes critical internal network information, leaks corporate usernames, presents weak authentication alternatives, and permits unauthorized network reconfigurations without authentication. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Logon Block user from showing account details on sign-in: Set to Enabled Do not display network selection UI: Set to Enabled Do not enumerate connected users on domain-joined computers: Set to Enabled Turn off app notifications on the lock screen: Set to Enabled Turn off picture password sign-in: Set to Enabled Turn on convenience PIN sign-in: Set to Disabled Prevent the use of security questions for local accounts: Set to Enabled Configure the transmission of the user's password in the content of MPR notifications sent by winlogon: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtLogonDisplayOptions.ps1 #Configure-EndAtLogonDisplayOptions.ps1 # Description: Configures Administrative Templates: Logon Display and Credential Restrictions. Write-Host "Configuring Administrative Templates: Logon Display and Credential Restrictions..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "BlockUserFromShowingAccountDetailsOnSignin" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "DontDisplayNetworkSelectionUI" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "DontEnumerateConnectedUsers" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "DisableLockScreenAppNotifications" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "BlockDomainPicturePassword" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "AllowDomainPINLogon" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "NoLocalPasswordResetQuestions" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableMPR" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Logon Display and Credential Restrictions applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtLogonDisplayOptionsStatus.ps1 #Get-EndAtLogonDisplayOptionsStatus.ps1 # Description: Audits Administrative Templates: Logon Display and Credential Restrictions. Write-Host "--- Auditing Administrative Templates: Logon Display and Credential Restrictions ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "BlockUserFromShowingAccountDetailsOnSignin" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "DontDisplayNetworkSelectionUI" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "DontEnumerateConnectedUsers" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "DisableLockScreenAppNotifications" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "BlockDomainPicturePassword" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "AllowDomainPINLogon" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" $ValueName = "NoLocalPasswordResetQuestions" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "EnableMPR" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-power-connected-standby.md Modern Standby (S0 Low Power Idle) replaced legacy ACPI S3 (Suspend-to-RAM) sleep states in modern enterprise laptops and convertibles. When "Connected Standby" is permitted, the operating system maintains active Wi-Fi, cellular, and Ethernet network adapters while the display is powered off and the system is suspended. This architecture enables background applications to process incoming push notifications, sync mailboxes, and maintain persistent cloud sockets while unattended. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Power Management\Sleep Settings Double-click Allow network connectivity during connected-standby (on battery): Set to Disabled*. Double-click Allow network connectivity during connected-standby (plugged in): Set to Disabled*. Click Apply, then click OK for both policies. Link the GPO to the appropriate Organizational Unit (OU) and verify policy replication across all domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtPowerConnectedStandby.ps1 #Configure-EndAtPowerConnectedStandby.ps1 # Description: Configures Administrative Templates: Disable Connected Standby Network Connectivity. Write-Host "Configuring Administrative Templates: Disable Connected Standby Network Connectivity..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" -Name "DCSettingIndex" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" -Name "ACSettingIndex" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Connected Standby Network Connectivity applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtPowerConnectedStandbyStatus.ps1 #Get-EndAtPowerConnectedStandbyStatus.ps1 # Description: Audits Administrative Templates: Disable Connected Standby Network Connectivity. Write-Host "--- Auditing Administrative Templates: Disable Connected Standby Network Connectivity ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" $ValueName = "DCSettingIndex" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" $ValueName = "ACSettingIndex" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9" /s Expected output: text DCSettingIndex REG_DWORD 0x0 ACSettingIndex REG_DWORD 0x0 Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-remote-assistance.md Windows Remote Assistance (msra.exe) allows support personnel to view or remotely control an active user's desktop session across a network. Remote Assistance supports two primary connection modes: solicited (where an end user creates an encrypted invitation ticket) and unsolicited (where an external operator or administrator initiates an uninvited connection to the target workstation via "Offer Remote Assistance"). Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Administrative Templates\System\Remote Assistance Double-click Configure Offer Remote Assistance. Select Disabled. Click Apply, then click OK. Link the GPO to the appropriate Organizational Unit (OU) and verify policy replication across all domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtRemoteAssistance.ps1 #Configure-EndAtRemoteAssistance.ps1 # Description: Configures Administrative Templates: Disable Remote Assistance. Write-Host "Configuring Administrative Templates: Disable Remote Assistance..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name "fAllowUnsolicited" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Remote Assistance applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtRemoteAssistanceStatus.ps1 #Get-EndAtRemoteAssistanceStatus.ps1 # Description: Audits Administrative Templates: Disable Remote Assistance. Write-Host "--- Auditing Administrative Templates: Disable Remote Assistance ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" $ValueName = "fAllowUnsolicited" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fAllowUnsolicited Expected output: text fAllowUnsolicited REG_DWORD 0x0 Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-180](../../07-paws/admin-templates/configure-paw-at-rpc-endpoint-mapper-auth.md); for Domain Controllers, refer to [REQ-DC-018](../../02-domain-controllers/harden-network-parameters.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-rpc-endpoint-mapper-auth.md The Remote Procedure Call (RPC) subsystem is fundamental to Windows inter-process communication and remote management. The RPC Endpoint Mapper service (epmapper, listening on TCP port 135) maintains a dynamic database of RPC servers and maps interface UUIDs to dynamic high-range TCP listening ports (ports 49152–65535). Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Remote Procedure Call Enable RPC Endpoint Mapper Client Authentication: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtRpcEndpointMapperAuth.ps1 #Configure-EndAtRpcEndpointMapperAuth.ps1 # Description: Configures Administrative Templates: Enable RPC Endpoint Mapper Client Authentication. Write-Host "Configuring Administrative Templates: Enable RPC Endpoint Mapper Client Authentication..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" -Name "EnableAuthEpResolution" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Enable RPC Endpoint Mapper Client Authentication applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtRpcEndpointMapperAuthStatus.ps1 #Get-EndAtRpcEndpointMapperAuthStatus.ps1 # Description: Audits Administrative Templates: Enable RPC Endpoint Mapper Client Authentication. Write-Host "--- Auditing Administrative Templates: Enable RPC Endpoint Mapper Client Authentication ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" $ValueName = "EnableAuthEpResolution" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-181](../../07-paws/admin-templates/configure-paw-at-w32time-ntp-client.md); for Domain Controllers, refer to [REQ-DC-020](../../02-domain-controllers/configure-pdc-time-sync.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-w32time-ntp-client.md The Windows Time Service (W32Time) is a core architectural component of Windows security, providing synchronization across domain members, member servers, and directory nodes. Precise timekeeping is mandatory for protocol operation, cryptographic authentication, and forensic integrity. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\System\Windows Time Service\Time Providers Enable Windows NTP Client: Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\System\Windows Time Service\Time Providers Enable Windows NTP Server: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtW32timeNtpClient.ps1 #Configure-EndAtW32timeNtpClient.ps1 # Description: Configures Administrative Templates: Configure Windows Time Service NTP Client and Server. Write-Host "Configuring Administrative Templates: Configure Windows Time Service NTP Client and Server..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" -Name "Enabled" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpServer")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpServer" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpServer" -Name "Enabled" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Configure Windows Time Service NTP Client and Server applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtW32timeNtpClientStatus.ps1 #Get-EndAtW32timeNtpClientStatus.ps1 # Description: Audits Administrative Templates: Configure Windows Time Service NTP Client and Server. Write-Host "--- Auditing Administrative Templates: Configure Windows Time Service NTP Client and Server ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" $ValueName = "Enabled" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpServer" $ValueName = "Enabled" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-182](../../07-paws/admin-templates/configure-paw-at-appx-deployment-restrictions.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-appx-deployment-restrictions.md Modern Windows application packaging architectures (AppX and MSIX) allow software components to be registered and executed within user profile spaces. In unhardened environments, default deployment behaviors allow standard unprivileged users to install modern packaged applications without administrative oversight or UAC elevation. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\App Package Deployment Not allow per-user unsigned packages to install by default (requires explicitly allow per install): Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\App Package Deployment Prevent non-admin users from installing packaged Windows apps: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtAppxDeploymentRestrictions.ps1 #Configure-EndAtAppxDeploymentRestrictions.ps1 # Description: Configures Administrative Templates: App Package Deployment Restrictions. Write-Host "Configuring Administrative Templates: App Package Deployment Restrictions..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" -Name "DisablePerUserUnsignedPackagesByDefault" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" -Name "BlockNonAdminUserInstall" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: App Package Deployment Restrictions applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtAppxDeploymentRestrictionsStatus.ps1 #Get-EndAtAppxDeploymentRestrictionsStatus.ps1 # Description: Audits Administrative Templates: App Package Deployment Restrictions. Write-Host "--- Auditing Administrative Templates: App Package Deployment Restrictions ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" $ValueName = "DisablePerUserUnsignedPackagesByDefault" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Appx" $ValueName = "BlockNonAdminUserInstall" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-183](../../07-paws/admin-templates/configure-paw-at-biometrics-anti-spoofing.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro. File Path: 08-endpoints/admin-templates/configure-end-at-biometrics-anti-spoofing.md Windows Hello facial recognition provides convenient, passwordless authentication using biometric verification. However, basic facial recognition systems that analyze only two-dimensional visible spectrum images are vulnerable to presentation attacks and physical spoofing. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Biometrics\Facial Features Configure enhanced anti-spoofing: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtBiometricsAntiSpoofing.ps1 #Configure-EndAtBiometricsAntiSpoofing.ps1 # Description: Configures Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing. Write-Host "Configuring Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures" -Name "EnhancedAntiSpoofing" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtBiometricsAntiSpoofingStatus.ps1 #Get-EndAtBiometricsAntiSpoofingStatus.ps1 # Description: Audits Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing. Write-Host "--- Auditing Administrative Templates: Configure Biometrics Enhanced Anti-Spoofing ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Biometrics\FacialFeatures" $ValueName = "EnhancedAntiSpoofing" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-cloud-consumer-content.md Modern editions of Windows integrate consumer-focused features into the desktop shell and operating system menus. These features display dynamic promotional cards, suggestions for Microsoft consumer cloud services (such as personal OneDrive, Microsoft 365 consumer subscriptions, and personal Microsoft Accounts), and personalized application recommendations directly within core UI components like the Start Menu, Settings app, File Explorer, and Lock Screen. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Administrative Templates\Windows Components\Cloud Content Double-click Turn off cloud consumer account state content. Select Enabled. Click Apply, then click OK. Link the GPO to the appropriate Organizational Unit (OU) and initiate policy replication across all Domain Controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtCloudConsumerContent.ps1 #Configure-EndAtCloudConsumerContent.ps1 # Description: Configures Administrative Templates: Disable Cloud Consumer Account State Content. Write-Host "Configuring Administrative Templates: Disable Cloud Consumer Account State Content..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" -Name "DisableConsumerAccountStateContent" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Cloud Consumer Account State Content applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtCloudConsumerContentStatus.ps1 #Get-EndAtCloudConsumerContentStatus.ps1 # Description: Audits Administrative Templates: Disable Cloud Consumer Account State Content. Write-Host "--- Auditing Administrative Templates: Disable Cloud Consumer Account State Content ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" $ValueName = "DisableConsumerAccountStateContent" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableConsumerAccountStateContent Expected output: text DisableConsumerAccountStateContent REG_DWORD 0x1 Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-185](../../07-paws/admin-templates/configure-paw-at-connect-pin-pairing.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro. File Path: 08-endpoints/admin-templates/configure-end-at-connect-pin-pairing.md The Windows Connect application enables endpoints to function as wireless display receivers using the Miracast standard over Wi-Fi Direct (IEEE 802.11 P2P). While useful for collaborative screen projection in meeting rooms, unauthenticated wireless display pairing introduces severe physical perimeter attack vectors. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Connect Require pin for pairing: Set to Enabled Select drop-down value: First Time (or Always for high-security areas) Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtConnectPinPairing.ps1 #Configure-EndAtConnectPinPairing.ps1 # Description: Configures Administrative Templates: Require PIN for Connect Wireless Pairing. Write-Host "Configuring Administrative Templates: Require PIN for Connect Wireless Pairing..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect" -Name "RequirePinForPairing" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Require PIN for Connect Wireless Pairing applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtConnectPinPairingStatus.ps1 #Get-EndAtConnectPinPairingStatus.ps1 # Description: Audits Administrative Templates: Require PIN for Connect Wireless Pairing. Write-Host "--- Auditing Administrative Templates: Require PIN for Connect Wireless Pairing ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect" $ValueName = "RequirePinForPairing" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-186](../../07-paws/admin-templates/configure-paw-at-credui-protections.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-credui-protections.md The Windows Credential User Interface (CredUI) handles password collection dialogs and User Account Control (UAC) elevation prompts. In default configurations, CredUI exposes cleartext credentials on screen and leaks local administrative usernames to unprivileged operators. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Credential User Interface Do not display the password reveal button: Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Credential User Interface Enumerate administrator accounts on elevation: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtCreduiProtections.ps1 #Configure-EndAtCreduiProtections.ps1 # Description: Configures Administrative Templates: Credential User Interface Security Protections. Write-Host "Configuring Administrative Templates: Credential User Interface Security Protections..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredUI")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredUI" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredUI" -Name "DisablePasswordReveal" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Name "EnumerateAdministrators" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Credential User Interface Security Protections applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtCreduiProtectionsStatus.ps1 #Get-EndAtCreduiProtectionsStatus.ps1 # Description: Audits Administrative Templates: Credential User Interface Security Protections. Write-Host "--- Auditing Administrative Templates: Credential User Interface Security Protections ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CredUI" $ValueName = "DisablePasswordReveal" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" $ValueName = "EnumerateAdministrators" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-data-collection-preview-builds.md The Windows Diagnostic Data Collection infrastructure collects system health, performance metrics, crash dumps, and telemetry data for transmission to Microsoft cloud services. Concurrently, the Windows Insider Program allows systems to receive pre-release operating system builds. In managed enterprise environments, unrestricted diagnostic data collection and preview builds introduce serious data leakage and operational stability risks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Administrative Templates\Windows Components\Data Collection and Preview Builds Configure the following policies: Disable OneSettings Downloads*: Set to Enabled Do not show feedback notifications*: Set to Enabled Enable OneSettings Auditing*: Set to Enabled Limit Diagnostic Log Collection*: Set to Enabled Limit Dump Collection*: Set to Enabled Toggle user control over Insider builds*: Set to Disabled Click Apply, then click OK for each policy. Link the GPO to the appropriate Organizational Unit (OU) and verify policy replication across all domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtDataCollectionPreviewBuilds.ps1 #Configure-EndAtDataCollectionPreviewBuilds.ps1 # Description: Configures Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions. Write-Host "Configuring Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "DisableOneSettingsDownloads" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "DoNotShowFeedbackNotifications" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "EnableOneSettingsAuditing" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "LimitDiagnosticLogCollection" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "LimitDumpCollection" -Value 1 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" -Name "AllowBuildPreview" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtDataCollectionPreviewBuildsStatus.ps1 #Get-EndAtDataCollectionPreviewBuildsStatus.ps1 # Description: Audits Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions. Write-Host "--- Auditing Administrative Templates: Diagnostic Data Collection and Preview Builds Restrictions ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "DisableOneSettingsDownloads" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "DoNotShowFeedbackNotifications" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "EnableOneSettingsAuditing" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "LimitDiagnosticLogCollection" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" $ValueName = "LimitDumpCollection" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" $ValueName = "AllowBuildPreview" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /s reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\PreviewBuilds" /v AllowBuildPreview Verify the expected DWORD values: text DisableOneSettingsDownloads REG_DWORD 0x1 DoNotShowFeedbackNotifications REG_DWORD 0x1 EnableOneSettingsAuditing REG_DWORD 0x1 LimitDiagnosticLogCollection REG_DWORD 0x1 LimitDumpCollection REG_DWORD 0x1 AllowBuildPreview REG_DWORD 0x0 Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-188](../../07-paws/admin-templates/configure-paw-at-app-installer-controls.md)). Operating Systems: Windows 10 (1709 and above) Enterprise/Professional, Windows 11 Enterprise/Pro, Windows Server 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-app-installer-controls.md The Windows App Installer (AppInstaller.exe) provides deployment capabilities for MSIX, AppX, and .appinstaller manifest packages. In default client configurations, App Installer registers the ms-appinstaller:// uniform resource identifier (URI) scheme, allowing web pages to directly trigger package installation. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\App Installer Enable App Installer ms-appinstaller protocol: Set to Disabled Enable App Installer Experimental Features: Set to Disabled Enable App Installer Hash Override: Set to Disabled Enable App Installer Local Archive Malware Scan Override: Set to Disabled Enable App Installer Microsoft Store Source Certificate Validation Bypass: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtAppInstallerControls.ps1 #Configure-EndAtAppInstallerControls.ps1 # Description: Configures Administrative Templates: App Installer Protocol and Execution Controls. Write-Host "Configuring Administrative Templates: App Installer Protocol and Execution Controls..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableExperimentalFeatures" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableHashOverride" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableLocalArchiveMalwareScanOverride" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableBypassCertificatePinningForMicrosoftStore" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" -Name "EnableMSAppInstallerProtocol" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: App Installer Protocol and Execution Controls applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtAppInstallerControlsStatus.ps1 #Get-EndAtAppInstallerControlsStatus.ps1 # Description: Audits Administrative Templates: App Installer Protocol and Execution Controls. Write-Host "--- Auditing Administrative Templates: App Installer Protocol and Execution Controls ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableExperimentalFeatures" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableHashOverride" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableLocalArchiveMalwareScanOverride" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableBypassCertificatePinningForMicrosoftStore" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppInstaller" $ValueName = "EnableMSAppInstallerProtocol" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-event-log-sizes.md Default Windows event log capacities (typically 20 MB) rollover within hours during normal workstation activity, and can be completely overwritten within minutes during active security incidents, brute-force attempts, or high-volume administrative operations. In hardened environments enforcing comprehensive audit policies (such as Process Creation with command-line arguments [Event ID 4688], PowerShell Script Block Logging [Event ID 4104], and detailed logon/logoff auditing), workstations typically generate between 100 MB and 300+ MB of security telemetry daily. A legacy 192 MB Security log preserves only 12 to 48 hours of telemetry, creating severe risks for endpoints operating off-network (remote users, field devices) where real-time Windows Event Forwarding (WEF) or SIEM shipping may be delayed. Expanding the Security log to 1 GB (1,048,576 KB), System and Application logs to 128 MB (131,072 KB), and Setup log to 32 MB (32,768 KB) provides a resilient 7-to-14-day on-box forensic retention buffer. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Application Specify the maximum log file size (KB): Set to Enabled (131072 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Security Specify the maximum log file size (KB): Set to Enabled (1048576 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Setup Specify the maximum log file size (KB): Set to Enabled (32768 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\System Specify the maximum log file size (KB): Set to Enabled (131072 KB) Control Event Log behavior when the log file reaches its maximum size: Set to Disabled Link the GPO to the appropriate Organizational Unit (OU) and verify replication across all domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtEventLogSizes.ps1 #Configure-EndAtEventLogSizes.ps1 # Description: Configures Administrative Templates: Event Log Maximum File Sizes and Retention Policies. Write-Host "Configuring Administrative Templates: Event Log Maximum File Sizes and Retention Policies..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" -Name "MaxSize" -Value 131072 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" -Name "MaxSize" -Value 1048576 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" -Name "MaxSize" -Value 32768 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Name "Retention" -Value "0" -Type String -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" -Name "MaxSize" -Value 131072 -Type DWord -Force Write-Host "[+] Administrative Templates: Event Log Maximum File Sizes and Retention Policies applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtEventLogSizesStatus.ps1 #Get-EndAtEventLogSizesStatus.ps1 # Description: Audits Administrative Templates: Event Log Maximum File Sizes and Retention Policies. Write-Host "--- Auditing Administrative Templates: Event Log Maximum File Sizes and Retention Policies ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application" $ValueName = "MaxSize" $ExpectedValue = 131072 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security" $ValueName = "MaxSize" $ExpectedValue = 1048576 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup" $ValueName = "MaxSize" $ExpectedValue = 32768 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" $ValueName = "Retention" $ExpectedValue = "0" if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System" $ValueName = "MaxSize" $ExpectedValue = 131072 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied log configurations via command line using wevtutil: cmd wevtutil gl Application wevtutil gl Security wevtutil gl Setup wevtutil gl System Verify that maxSize reflects the configured byte values (1073741824 bytes for Security, 134217728 bytes for System/Application, 33554432 bytes for Setup) and retention is set to false. Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-190](../../07-paws/admin-templates/configure-paw-at-file-explorer-motw.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-file-explorer-motw.md The Windows Attachment Manager and File Explorer utilize the Mark of the Web (MotW) as a core security boundary. MotW is implemented as an NTFS Alternate Data Stream (ADS) named Zone.Identifier appended to files downloaded from the internet or untrusted network zones. Maintaining strict MotW integrity and enforcing shell protocol protected mode are essential defenses against initial-access malware campaigns. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\File Explorer Do not apply the Mark of the Web tag to files copied from insecure sources: Set to Disabled (Ensures MotW is applied) Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\File Explorer Turn off shell protocol protected mode: Set to Disabled (Ensures Protected Mode is enforced) Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtFileExplorerMotw.ps1 #Configure-EndAtFileExplorerMotw.ps1 # Description: Configures Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security. Write-Host "Configuring Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "DisableMotWOnInsecurePathCopy" -Value 0 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "PreXPSP2ShellProtocolBehavior" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtFileExplorerMotwStatus.ps1 #Get-EndAtFileExplorerMotwStatus.ps1 # Description: Audits Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security. Write-Host "--- Auditing Administrative Templates: File Explorer Mark of the Web and Shell Protocol Security ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" $ValueName = "DisableMotWOnInsecurePathCopy" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" $ValueName = "PreXPSP2ShellProtocolBehavior" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-191](../../07-paws/admin-templates/configure-paw-at-internet-explorer-retirement.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-internet-explorer-retirement.md Internet Explorer 11 reached official end-of-life and retirement on modern Windows platforms. The standalone browser executable (iexplore.exe) lacks contemporary exploit mitigations, process sandboxing, and memory safety defenses, making it a persistent vector for zero-day exploitation and drive-by malware execution. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer Disable Internet Explorer 11 as a standalone browser: Set to Enabled Select drop-down value: Always Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Feeds Prevent downloading of enclosures: Set to Enabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Feeds Turn on Basic feed authentication over HTTP: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtInternetExplorerRetirement.ps1 #Configure-EndAtInternetExplorerRetirement.ps1 # Description: Configures Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls. Write-Host "Configuring Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Main")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Main" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Main" -Name "NotifyDisableIEOptions" -Value 0 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" -Name "DisableEnclosureDownload" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" -Name "AllowBasicAuthInClear" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtInternetExplorerRetirementStatus.ps1 #Get-EndAtInternetExplorerRetirementStatus.ps1 # Description: Audits Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls. Write-Host "--- Auditing Administrative Templates: Internet Explorer 11 and Web Feeds Retirement Controls ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Main" $ValueName = "NotifyDisableIEOptions" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" $ValueName = "DisableEnclosureDownload" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" $ValueName = "AllowBasicAuthInClear" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-search-cortana-restrictions.md The Windows Search and Cortana infrastructure provides desktop indexing, voice recognition, and location-aware query capabilities. In enterprise environments, unconstrained search and voice assistant features introduce severe data leakage, physical authentication bypass, and cryptographic exposure risks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Administrative Templates\Windows Components\Search Configure the following policies: Allow Cortana*: Set to Disabled Allow Cortana above lock screen*: Set to Disabled Allow indexing of encrypted files*: Set to Disabled Allow search and Cortana to use location*: Set to Disabled Click Apply, then click OK for each policy. Link the GPO to the target Organizational Unit (OU) and verify replication across all domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtSearchCortanaRestrictions.ps1 #Configure-EndAtSearchCortanaRestrictions.ps1 # Description: Configures Administrative Templates: Windows Search and Cortana Privacy Restrictions. Write-Host "Configuring Administrative Templates: Windows Search and Cortana Privacy Restrictions..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Name "AllowCortana" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Name "AllowCortanaAboveLock" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Name "AllowIndexingEncryptedStoresOrItems" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Name "AllowSearchToUseLocation" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Windows Search and Cortana Privacy Restrictions applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtSearchCortanaRestrictionsStatus.ps1 #Get-EndAtSearchCortanaRestrictionsStatus.ps1 # Description: Audits Administrative Templates: Windows Search and Cortana Privacy Restrictions. Write-Host "--- Auditing Administrative Templates: Windows Search and Cortana Privacy Restrictions ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" $ValueName = "AllowCortana" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" $ValueName = "AllowCortanaAboveLock" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" $ValueName = "AllowIndexingEncryptedStoresOrItems" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search" $ValueName = "AllowSearchToUseLocation" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /s Ensure all four values are present and set to 0x0: text AllowCortana REG_DWORD 0x0 AllowCortanaAboveLock REG_DWORD 0x0 AllowIndexingEncryptedStoresOrItems REG_DWORD 0x0 AllowSearchToUseLocation REG_DWORD 0x0 Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-194](../../07-paws/admin-templates/configure-paw-at-windows-store-restrictions.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-windows-store-restrictions.md Modern Windows installations incorporate numerous built-in packaged applications, runtime frameworks, and system extensions (such as Windows Terminal, App Installer, HEVC/VP9 codecs, and Edge WebView2 components) that are serviced through the Microsoft Store infrastructure. Managing store update behaviors is essential to ensure critical vulnerability patching while preventing unmanaged operating system upgrades. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Store Turn off Automatic Download and Install of updates: Set to Disabled (Ensures updates are downloaded automatically) Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Store Turn off the offer to update to the latest version of Windows: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtWindowsStoreRestrictions.ps1 #Configure-EndAtWindowsStoreRestrictions.ps1 # Description: Configures Administrative Templates: Windows Store Updates and OS Upgrade Restrictions. Write-Host "Configuring Administrative Templates: Windows Store Updates and OS Upgrade Restrictions..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" -Name "AutoDownload" -Value 4 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" -Name "DisableOSUpgrade" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Windows Store Updates and OS Upgrade Restrictions applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtWindowsStoreRestrictionsStatus.ps1 #Get-EndAtWindowsStoreRestrictionsStatus.ps1 # Description: Audits Administrative Templates: Windows Store Updates and OS Upgrade Restrictions. Write-Host "--- Auditing Administrative Templates: Windows Store Updates and OS Upgrade Restrictions ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" $ValueName = "AutoDownload" $ExpectedValue = 4 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore" $ValueName = "DisableOSUpgrade" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-windows-widgets-dsh.md Windows Widgets (in Windows 11) and the earlier News and Interests feature (in Windows 10) integrate dynamic cloud-delivered content directly into the Windows desktop taskbar. The feature relies on the Desktop Shell Host (widgets.exe) and the Microsoft Edge WebView2 runtime to continuously retrieve and display news feeds, weather reports, sports scores, stock tickers, and third-party sponsored advertisements. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: `text Computer Configuration\Policies\Administrative Templates\Windows Components\Widgets Double-click Allow widgets. Select Disabled. Click Apply, then click OK. Link the GPO to the appropriate Organizational Unit (OU) and verify policy replication across all domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtWindowsWidgetsDsh.ps1 #Configure-EndAtWindowsWidgetsDsh.ps1 # Description: Configures Administrative Templates: Disable Windows Widgets and News Feed. Write-Host "Configuring Administrative Templates: Disable Windows Widgets and News Feed..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Dsh")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Dsh" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Dsh" -Name "AllowNewsAndInterests" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Windows Widgets and News Feed applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtWindowsWidgetsDshStatus.ps1 #Get-EndAtWindowsWidgetsDshStatus.ps1 # Description: Audits Administrative Templates: Disable Windows Widgets and News Feed. Write-Host "--- Auditing Administrative Templates: Disable Windows Widgets and News Feed ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Dsh" $ValueName = "AllowNewsAndInterests" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy setting via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v AllowNewsAndInterests Expected output: text AllowNewsAndInterests REG_DWORD 0x0 Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-196](../../07-paws/admin-templates/configure-paw-at-automatic-restart-signon.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/admin-templates/configure-end-at-automatic-restart-signon.md Automatic Restart Sign-On (ARSO) is a Windows convenience feature designed to streamline post-update maintenance. When an automated Windows Update requires a reboot, ARSO captures the interactive user's credentials, encrypts them via the Local Security Authority (LSA) and Data Protection API (DPAPI), and stages them across the reboot sequence. Upon restart, Winlogon automatically decrypts the credentials, logs the user on in the background, instantiates the user profile, and locks the console. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Logon Options Sign-in and lock last interactive user automatically after a restart: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtAutomaticRestartSignon.ps1 #Configure-EndAtAutomaticRestartSignon.ps1 # Description: Configures Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO). Write-Host "Configuring Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO)..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "DisableAutomaticRestartSignOn" -Value 1 -Type DWord -Force Write-Host "[+] Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO) applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtAutomaticRestartSignonStatus.ps1 #Get-EndAtAutomaticRestartSignonStatus.ps1 # Description: Audits Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO). Write-Host "--- Auditing Administrative Templates: Disable Windows Automatic Restart Sign-On (ARSO) ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" $ValueName = "DisableAutomaticRestartSignOn" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-197](../../07-paws/admin-templates/configure-paw-at-windows-sandbox-isolation.md)). Operating Systems: Windows 10 (1903 and above) Enterprise/Professional, Windows 11 Enterprise/Pro. File Path: 08-endpoints/admin-templates/configure-end-at-windows-sandbox-isolation.md Windows Sandbox provides a disposable, containerized desktop environment based on Hyper-V virtualization technology. While designed for the isolated execution of untrusted applications and triage of suspicious documents, default sandbox configurations permit bidirectional clipboard synchronization and shared network access, introducing significant breach risks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Sandbox Allow clipboard sharing with Windows Sandbox: Set to Disabled Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Sandbox Allow networking in Windows Sandbox: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtWindowsSandboxIsolation.ps1 #Configure-EndAtWindowsSandboxIsolation.ps1 # Description: Configures Administrative Templates: Windows Sandbox Clipboard and Network Isolation. Write-Host "Configuring Administrative Templates: Windows Sandbox Clipboard and Network Isolation..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" -Name "AllowClipboardRedirection" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" -Name "AllowNetworking" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Windows Sandbox Clipboard and Network Isolation applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtWindowsSandboxIsolationStatus.ps1 #Get-EndAtWindowsSandboxIsolationStatus.ps1 # Description: Audits Administrative Templates: Windows Sandbox Clipboard and Network Isolation. Write-Host "--- Auditing Administrative Templates: Windows Sandbox Clipboard and Network Isolation ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" $ValueName = "AllowClipboardRedirection" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sandbox" $ValueName = "AllowNetworking" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/admin-templates/configure-end-at-windows-update-policies.md Windows Update is the primary defense mechanism against known Common Vulnerabilities and Exposures (CVEs), remote code execution exploits, and privilege escalation vulnerabilities. In unhardened environments, default update policies allow users to pause updates, postpone reboots, or enroll in experimental preview builds, directly exposing the enterprise network to preventable exploitation. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update Remove access to 'Pause updates' feature: Set to Enabled Manage preview builds: Set to Disabled Select when Preview Builds and Feature Updates are received: Set to Enabled, select Semi-Annual Channel, and set deferral to 180 days Select when Quality Updates are received: Set to Enabled, set deferral to 0 days Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Manage end user experience Configure Automatic Updates: Set to Enabled, select option 4 - Auto download and schedule the install, set scheduled install day to 0 - Every day, and configure a suitable maintenance hour (e.g., 03:00) No auto-restart with logged on users for scheduled automatic updates installations: Set to Disabled Link the GPO to the appropriate Organizational Unit (OU) and verify policy replication across all domain controllers. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the administrative template registry values: Download Script: Configure-EndAtWindowsUpdatePolicies.ps1 #Configure-EndAtWindowsUpdatePolicies.ps1 # Description: Configures Administrative Templates: Windows Update Deferral and Automatic Installation Policies. Write-Host "Configuring Administrative Templates: Windows Update Deferral and Automatic Installation Policies..." -ForegroundColor Cyan if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "SetDisablePauseUXAccess" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "ManagePreviewBuildsPolicyValue" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "DeferFeatureUpdates" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "DeferFeatureUpdatesPeriodInDays" -Value 180 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "DeferQualityUpdates" -Value 1 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "DeferQualityUpdatesPeriodInDays" -Value 0 -Type DWord -Force if (-not (Test-Path -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoRebootWithLoggedOnUsers" -Value 0 -Type DWord -Force Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "ScheduledInstallDay" -Value 0 -Type DWord -Force Write-Host "[+] Administrative Templates: Windows Update Deferral and Automatic Installation Policies applied successfully." -ForegroundColor Green To verify the configuration: Download Script: Get-EndAtWindowsUpdatePoliciesStatus.ps1 #Get-EndAtWindowsUpdatePoliciesStatus.ps1 # Description: Audits Administrative Templates: Windows Update Deferral and Automatic Installation Policies. Write-Host "--- Auditing Administrative Templates: Windows Update Deferral and Automatic Installation Policies ---" -ForegroundColor Cyan $script:Vulnerable = $false $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "SetDisablePauseUXAccess" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "ManagePreviewBuildsPolicyValue" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "DeferFeatureUpdates" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "DeferFeatureUpdatesPeriodInDays" $ExpectedValue = 180 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "DeferQualityUpdates" $ExpectedValue = 1 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" $ValueName = "DeferQualityUpdatesPeriodInDays" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $ValueName = "NoAutoRebootWithLoggedOnUsers" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } $TargetKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" $ValueName = "ScheduledInstallDay" $ExpectedValue = 0 if (Test-Path -Path $TargetKey) { $Prop = Get-ItemProperty -Path $TargetKey -Name $ValueName -ErrorAction SilentlyContinue if ($null -ne $Prop) { $Actual = $Prop.$ValueName if ($Actual -eq $ExpectedValue) { Write-Host " [+] $ValueName = $($Actual) (Secure)" -ForegroundColor Green } else { Write-Host " [!] MISMATCH: $ValueName = $($Actual) (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING VALUE: $ValueName (Expected: $($ExpectedValue))" -ForegroundColor Red $script:Vulnerable = $true } } else { Write-Host " [!] MISSING KEY: $TargetKey" -ForegroundColor Red $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } Option C: Manual Verification Verify the applied policy settings via administrative command prompt: cmd reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /s Verify that all configured values match the defined baseline. Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/disable-real-time-monitoring-and-behavior-monitoring-override.md Real-time scanning, behavior monitoring, and script checking are the core dynamic defense mechanisms of Windows Defender. Disabling or bypassing these controls allows malicious scripts, file-based attacks, and unauthorized in-memory activities to execute undetected. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Real-time Protection Set 'Turn off real-time protection' to 'Disabled' Set 'Turn on behavior monitoring' to 'Enabled' Set 'Scan all downloaded files and attachments' to 'Enabled' Set 'Turn on script scanning' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderRtp.ps1 # Configure-DefenderRtp.ps1 Set-MpPreference -DisableRealtimeMonitoring $false Set-MpPreference -DisableBehaviorMonitoring $false Set-MpPreference -DisableIOAVProtection $false Set-MpPreference -DisableScriptScanning $false To audit the hardening status: Download Script: Get-DefenderRtpStatus.ps1 # Get-DefenderRtpStatus.ps1 $Pref = Get-MpPreference if ($Pref.DisableRealtimeMonitoring -eq $false -and $Pref.DisableBehaviorMonitoring -eq $false -and $Pref.DisableIOAVProtection -eq $false -and $Pref.DisableScriptScanning -eq $false) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderRtp.ps1 Set-MpPreference -DisableRealtimeMonitoring $false Set-MpPreference -DisableBehaviorMonitoring $false Set-MpPreference -DisableIOAVProtection $false Set-MpPreference -DisableScriptScanning $false Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-potentially-unwanted-applications-pua-protection.md Potentially Unwanted Applications (PUA) include adware, torrent clients, cryptominers, and system optimizers that increase risk and resource consumption. Forcing PUA blocking stops standard vectors of shadow IT and unauthorized utility tool execution. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus Set 'Configure detection for potentially unwanted applications' to 'Enabled' Select 'Block' in the options dropdown list Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderPUA.ps1 # Configure-DefenderPUA.ps1 Set-MpPreference -PUAProtection 1 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "PUAProtection" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderPUAStatus.ps1 # Get-DefenderPUAStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "PUAProtection" -ErrorAction SilentlyContinue if ($Pref.PUAProtection -eq 1 -or ($Reg -and $Reg.PUAProtection -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderPUA.ps1 Set-MpPreference -PUAProtection 1 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "PUAProtection" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/prevent-local-list-merging-and-exclusions-configuration.md If local administrators or compromised administrative accounts can modify Defender exclusions or merge local lists, they can authorize malicious folders or tools. Restricting list configuration to central GPOs ensures consistent security enforcement. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus Set 'Configure local administrator merge behavior for lists' to 'Disabled' Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Exclusions Set 'Prevent users from configuring exclusions' to 'Enabled' Set 'Control whether or not exclusions are visible to Local Admins' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderLocalExclusions.ps1 # Configure-DefenderLocalExclusions.ps1 Set-MpPreference -DisableLocalAdminMerge $true Set-MpPreference -DisableExclusionRestriction $false $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableLocalAdminMerge" -Value 1 -Type DWord -Force Set-ItemProperty -Path $Path -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableLocalAdminConfiguration" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderLocalExclusionsStatus.ps1 # Get-DefenderLocalExclusionsStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableLocalAdminMerge" -ErrorAction SilentlyContinue $RegHide = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "HideExclusionsFromLocalAdmins" -ErrorAction SilentlyContinue $RegConfig = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" -Name "DisableLocalAdminConfiguration" -ErrorAction SilentlyContinue if (($Pref.DisableLocalAdminMerge -eq $true -or ($Reg -and $Reg.DisableLocalAdminMerge -eq 1)) -and ($RegHide -and $RegHide.HideExclusionsFromLocalAdmins -eq 1) -and ($RegConfig -and $RegConfig.DisableLocalAdminConfiguration -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderLocalExclusions.ps1 Set-MpPreference -DisableLocalAdminMerge $true Set-MpPreference -DisableExclusionRestriction $false $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableLocalAdminMerge" -Value 1 -Type DWord -Force Set-ItemProperty -Path $Path -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableLocalAdminConfiguration" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-auto-exclusions-configuration.md Auto Exclusions automatically configure exclusions for known safe system folders or server roles to reduce performance overhead. Enforcing that auto exclusions are not disabled ensures server performance stability and proper system scanning. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Exclusions Set 'Turn off Auto Exclusions' to 'Disabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderAutoExclusions.ps1 # Configure-DefenderAutoExclusions.ps1 $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableAutoExclusions" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderAutoExclusionsStatus.ps1 # Get-DefenderAutoExclusionsStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" -Name "DisableAutoExclusions" -ErrorAction SilentlyContinue if ($Reg -and $Reg.DisableAutoExclusions -eq 0) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderAutoExclusions.ps1 $ExclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" if (-not (Test-Path $ExclPath)) { New-Item -Path $ExclPath -Force | Out-Null } Set-ItemProperty -Path $ExclPath -Name "DisableAutoExclusions" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/prevent-maps-local-setting-override.md Preventing local overrides of Microsoft Active Protection Service (MAPS) reporting ensures that endpoints consistently report telemetry and signature feedback to cloud resources, preserving centralized protective visibility. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\MAPS Set 'Configure local setting override for reporting to Microsoft MAPS' to 'Disabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderMapsOverride.ps1 # Configure-DefenderMapsOverride.ps1 $SpynetPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" if (-not (Test-Path $SpynetPath)) { New-Item -Path $SpynetPath -Force | Out-Null } Set-ItemProperty -Path $SpynetPath -Name "LocalSettingOverrideSpynetReporting" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderMapsOverrideStatus.ps1 # Get-DefenderMapsOverrideStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" -Name "LocalSettingOverrideSpynetReporting" -ErrorAction SilentlyContinue if ($Reg -and $Reg.LocalSettingOverrideSpynetReporting -eq 0) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderMapsOverride.ps1 $SpynetPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" if (-not (Test-Path $SpynetPath)) { New-Item -Path $SpynetPath -Force | Out-Null } Set-ItemProperty -Path $SpynetPath -Name "LocalSettingOverrideSpynetReporting" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/enable-edr-in-block-mode.md Endpoint Detection and Response (EDR) in Block Mode allows Defender to take remediation actions on malicious artifacts detected by Microsoft Defender for Endpoint even if another non-Microsoft antivirus is primary. This establishes secondary defensive block capabilities. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Features Set 'Enable EDR in block mode' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderEdrBlockMode.ps1 # Configure-DefenderEdrBlockMode.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } Set-ItemProperty -Path $FeaturesPath -Name "PassiveRemediation" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderEdrBlockModeStatus.ps1 # Get-DefenderEdrBlockModeStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features" -Name "PassiveRemediation" -ErrorAction SilentlyContinue if ($Reg -and $Reg.PassiveRemediation -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderEdrBlockMode.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } Set-ItemProperty -Path $FeaturesPath -Name "PassiveRemediation" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/allow-network-protection-on-windows-server.md Network Protection blocks processes from accessing malicious domains, phishing sites, and host IP ranges. Allowing Network Protection on Windows Server ensures that member servers running server workloads possess the same IP filter protections as client platforms. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Network Protection Set 'This setting controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderNetworkProtectionServer.ps1 # Configure-DefenderNetworkProtectionServer.ps1 $NetProtPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" if (-not (Test-Path $NetProtPath)) { New-Item -Path $NetProtPath -Force | Out-Null } Set-ItemProperty -Path $NetProtPath -Name "AllowNetworkProtectionOnWinServer" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderNetworkProtectionServerStatus.ps1 # Get-DefenderNetworkProtectionServerStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" -Name "AllowNetworkProtectionOnWinServer" -ErrorAction SilentlyContinue if ($Reg -and $Reg.AllowNetworkProtectionOnWinServer -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderNetworkProtectionServer.ps1 $NetProtPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection" if (-not (Test-Path $NetProtPath)) { New-Item -Path $NetProtPath -Force | Out-Null } Set-ItemProperty -Path $NetProtPath -Name "AllowNetworkProtectionOnWinServer" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/enable-file-hash-computation.md Computing cryptographic file hashes allows Defender to pass hashes of scanned files to cloud and SIEM endpoints. This enables precise IOC matches, file tracking, and correlation with threat intelligence repositories. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\MpEngine Set 'Enable file hash computation feature' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderFileHash.ps1 # Configure-DefenderFileHash.ps1 Set-MpPreference -EnableFileHashComputation $true $MpEnginePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" if (-not (Test-Path $MpEnginePath)) { New-Item -Path $MpEnginePath -Force | Out-Null } Set-ItemProperty -Path $MpEnginePath -Name "EnableFileHashComputation" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderFileHashStatus.ps1 # Get-DefenderFileHashStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" -Name "EnableFileHashComputation" -ErrorAction SilentlyContinue if ($Pref.EnableFileHashComputation -eq $true -or ($Reg -and $Reg.EnableFileHashComputation -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderFileHash.ps1 Set-MpPreference -EnableFileHashComputation $true $MpEnginePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" if (-not (Test-Path $MpEnginePath)) { New-Item -Path $MpEnginePath -Force | Out-Null } Set-ItemProperty -Path $MpEnginePath -Name "EnableFileHashComputation" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-network-inspection-system-nis-settings.md The Network Inspection System (NIS) inspects network traffic patterns for known exploits. Converting warning verdicts to block enforces inline blocking of zero-day exploits, while allowing async inspection prevents performance overhead from slowing local network interfaces. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Network Inspection System Set 'Convert warn verdict to block' to 'Enabled' Set 'Turn on asynchronous inspection' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderNis.ps1 # Configure-DefenderNis.ps1 $NisPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" if (-not (Test-Path $NisPath)) { New-Item -Path $NisPath -Force | Out-Null } Set-ItemProperty -Path $NisPath -Name "EnableConvertWarnToBlock" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NisPath -Name "AllowSwitchToAsyncInspection" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderNisStatus.ps1 # Get-DefenderNisStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" -Name "EnableConvertWarnToBlock" -ErrorAction SilentlyContinue $RegAsync = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" -Name "AllowSwitchToAsyncInspection" -ErrorAction SilentlyContinue if (($Reg -and $Reg.EnableConvertWarnToBlock -eq 1) -and ($RegAsync -and $RegAsync.AllowSwitchToAsyncInspection -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderNis.ps1 $NisPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\NIS" if (-not (Test-Path $NisPath)) { New-Item -Path $NisPath -Force | Out-Null } Set-ItemProperty -Path $NisPath -Name "EnableConvertWarnToBlock" -Value 1 -Type DWord -Force Set-ItemProperty -Path $NisPath -Name "AllowSwitchToAsyncInspection" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-oobe-real-time-protection-and-security-intelligence.md Enabling real-time protection and intelligence updates during the Out-of-Box Experience (OOBE) ensures that the system is fully updated and protected before the initial administrative user signs in or connects to enterprise network nodes. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Real-time Protection Set 'Configure real-time protection and Security Intelligence Updates during OOBE' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderOobeRtp.ps1 # Configure-DefenderOobeRtp.ps1 $RtpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" if (-not (Test-Path $RtpPath)) { New-Item -Path $RtpPath -Force | Out-Null } Set-ItemProperty -Path $RtpPath -Name "OobeEnableRtpAndSigUpdate" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderOobeRtpStatus.ps1 # Get-DefenderOobeRtpStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "OobeEnableRtpAndSigUpdate" -ErrorAction SilentlyContinue if ($Reg -and $Reg.OobeEnableRtpAndSigUpdate -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderOobeRtp.ps1 $RtpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" if (-not (Test-Path $RtpPath)) { New-Item -Path $RtpPath -Force | Out-Null } Set-ItemProperty -Path $RtpPath -Name "OobeEnableRtpAndSigUpdate" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/enable-dynamic-signature-dropped-event-reporting.md Enabling this log report generation triggers explicit events when a dynamic scan ruleset signature is dropped. This ensures SIEM integrations can immediately log changes in the local threat signatures dataset. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Reporting Set 'Configure whether to report Dynamic Signature dropped events' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderDynamicReporting.ps1 # Configure-DefenderDynamicReporting.ps1 $RepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" if (-not (Test-Path $RepPath)) { New-Item -Path $RepPath -Force | Out-Null } Set-ItemProperty -Path $RepPath -Name "EnableDynamicSignatureDroppedEventReporting" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderDynamicReportingStatus.ps1 # Get-DefenderDynamicReportingStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" -Name "EnableDynamicSignatureDroppedEventReporting" -ErrorAction SilentlyContinue if ($Reg -and $Reg.EnableDynamicSignatureDroppedEventReporting -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderDynamicReporting.ps1 $RepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" if (-not (Test-Path $RepPath)) { New-Item -Path $RepPath -Force | Out-Null } Set-ItemProperty -Path $RepPath -Name "EnableDynamicSignatureDroppedEventReporting" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-quick-scan-and-scanning-exclusions.md Malware frequently tries to establish persistence in excluded directories or inside packed/compressed executables. Forcing quick scans to include excluded files and ensuring packed file structures are recursively scanned prevents malware evasion. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Scan Set 'Scan excluded files and directories during quick scans' to 'Enabled' Set 'Turn off scanning of packed executables' to 'Disabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderQuickScan.ps1 # Configure-DefenderQuickScan.ps1 Set-MpPreference -DisablePackedExeScanning $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "QuickScanIncludeExclusions" -Value 1 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisablePackedExeScanning" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderQuickScanStatus.ps1 # Get-DefenderQuickScanStatus.ps1 $Pref = Get-MpPreference $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "QuickScanIncludeExclusions" -ErrorAction SilentlyContinue $RegPack = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DisablePackedExeScanning" -ErrorAction SilentlyContinue if (($Pref.DisablePackedExeScanning -eq $false -or ($RegPack -and $RegPack.DisablePackedExeScanning -eq 0)) -and ($Reg -and $Reg.QuickScanIncludeExclusions -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderQuickScan.ps1 Set-MpPreference -DisablePackedExeScanning $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "QuickScanIncludeExclusions" -Value 1 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisablePackedExeScanning" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-scheduled-scan-parameters.md Ensuring daily scheduled scans, enabling heuristics for behavioral anomaly detection, scan mail attachments, and forcing a catchup scan after at most 7 days ensures system integrity is continually validated. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Scan Set 'Specify the day of the week to run a scheduled scan' to 'Enabled' (Select 'Every day' or '0') Set 'Turn on e-mail scanning' to 'Enabled' Set 'Turn on heuristics' to 'Enabled' Set 'Trigger a quick scan after X days without any scans' to 'Enabled' (7 days) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderScheduledScan.ps1 # Configure-DefenderScheduledScan.ps1 Set-MpPreference -DisableEmailScanning $false Set-MpPreference -DisableHeuristics $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "ScheduleDay" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableEmailScanning" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableHeuristics" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DaysWithoutCatchupQuickScan" -Value 7 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderScheduledScanStatus.ps1 # Get-DefenderScheduledScanStatus.ps1 $Pref = Get-MpPreference $RegDays = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name "DaysWithoutCatchupQuickScan" -ErrorAction SilentlyContinue if ($Pref.DisableEmailScanning -eq $false -and $Pref.DisableHeuristics -eq $false -and ($RegDays -and $RegDays.DaysWithoutCatchupQuickScan -eq 7)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderScheduledScan.ps1 Set-MpPreference -DisableEmailScanning $false Set-MpPreference -DisableHeuristics $false $ScanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" if (-not (Test-Path $ScanPath)) { New-Item -Path $ScanPath -Force | Out-Null } Set-ItemProperty -Path $ScanPath -Name "ScheduleDay" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableEmailScanning" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DisableHeuristics" -Value 0 -Type DWord -Force Set-ItemProperty -Path $ScanPath -Name "DaysWithoutCatchupQuickScan" -Value 7 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-security-intelligence-update-schedule.md Antivirus signatures must remain fresh to block the latest published threats. Mandating daily checks for updates and marking signatures older than 7 days as out-of-date ensures continuous defense parity. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Security Intelligence Updates Set 'Define the number of days before spyware security intelligence is considered out of date' to 'Enabled' (7 days) Set 'Define the number of days before virus security intelligence is considered out of date' to 'Enabled' (7 days) Set 'Specify the day of the week to check for security intelligence updates' to 'Enabled' (Every day or 0) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderUpdateSchedule.ps1 # Configure-DefenderUpdateSchedule.ps1 $SigPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" if (-not (Test-Path $SigPath)) { New-Item -Path $SigPath -Force | Out-Null } Set-ItemProperty -Path $SigPath -Name "ASSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "AVSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "ScheduleDay" -Value 0 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderUpdateScheduleStatus.ps1 # Get-DefenderUpdateScheduleStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "ASSignatureDue" -ErrorAction SilentlyContinue $RegAV = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "AVSignatureDue" -ErrorAction SilentlyContinue $RegDay = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" -Name "ScheduleDay" -ErrorAction SilentlyContinue if (($Reg -and $Reg.ASSignatureDue -eq 7) -and ($RegAV -and $RegAV.AVSignatureDue -eq 7) -and ($RegDay -and $RegDay.ScheduleDay -eq 0)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderUpdateSchedule.ps1 $SigPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" if (-not (Test-Path $SigPath)) { New-Item -Path $SigPath -Force | Out-Null } Set-ItemProperty -Path $SigPath -Name "ASSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "AVSignatureDue" -Value 7 -Type DWord -Force Set-ItemProperty -Path $SigPath -Name "ScheduleDay" -Value 0 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-threat-severity-default-quarantine-actions.md By default, Defender may prompt users or take actions (like clean/ignore) that leave malware remnants on the filesystem. Configuring default quarantine actions for all severities (low, medium, high, severe) ensures automated containment. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Threats Set 'Specify threat alert levels at which default action should not be taken when detected' to 'Enabled' Click 'Show...' and enter threat levels (1 -> 2, 2 -> 2, 4 -> 2, 5 -> 2) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderThreatActions.ps1 # Configure-DefenderThreatActions.ps1 $ThreatsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats" if (-not (Test-Path $ThreatsPath)) { New-Item -Path $ThreatsPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsPath -Name "Threats_ThreatSeverityDefaultAction" -Value 1 -Type DWord -Force $ThreatsSevPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" if (-not (Test-Path $ThreatsSevPath)) { New-Item -Path $ThreatsSevPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsSevPath -Name "1" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "2" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "4" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "5" -Value 2 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderThreatActionsStatus.ps1 # Get-DefenderThreatActionsStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats" -Name "Threats_ThreatSeverityDefaultAction" -ErrorAction SilentlyContinue $RegSev = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" -ErrorAction SilentlyContinue if (($Reg -and $Reg.Threats_ThreatSeverityDefaultAction -eq 1) -and ($RegSev -and $RegSev.1 -eq 2 -and $RegSev.2 -eq 2 -and $RegSev.4 -eq 2 -and $RegSev.5 -eq 2)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderThreatActions.ps1 $ThreatsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats" if (-not (Test-Path $ThreatsPath)) { New-Item -Path $ThreatsPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsPath -Name "Threats_ThreatSeverityDefaultAction" -Value 1 -Type DWord -Force $ThreatsSevPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction" if (-not (Test-Path $ThreatsSevPath)) { New-Item -Path $ThreatsSevPath -Force | Out-Null } Set-ItemProperty -Path $ThreatsSevPath -Name "1" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "2" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "4" -Value 2 -Type DWord -Force Set-ItemProperty -Path $ThreatsSevPath -Name "5" -Value 2 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-family-options-ui-lockdown.md Locking down non-essential components of the Windows Security Center interface prevents users from tampering with parental or diagnostic UI controls on enterprise assets. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Security\Family options Set 'Hide the Family options area' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderFamilyLockdown.ps1 # Configure-DefenderFamilyLockdown.ps1 $FamilyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" if (-not (Test-Path $FamilyPath)) { New-Item -Path $FamilyPath -Force | Out-Null } Set-ItemProperty -Path $FamilyPath -Name "UILockdown" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderFamilyLockdownStatus.ps1 # Get-DefenderFamilyLockdownStatus.ps1 $Reg = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" -Name "UILockdown" -ErrorAction SilentlyContinue if ($Reg -and $Reg.UILockdown -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderFamilyLockdown.ps1 $FamilyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Family options" if (-not (Test-Path $FamilyPath)) { New-Item -Path $FamilyPath -Force | Out-Null } Set-ItemProperty -Path $FamilyPath -Name "UILockdown" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-tamper-protection.md Tamper Protection prevents local administrators or compromised system accounts from disabling Windows Defender services, real-time scanning, or modifying active exclusions locally. This blocks a primary malware persistence vector. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Security\Tamper Protection Set 'Protect Windows Security settings from tampering' to 'Enabled' (Block or On depending on ADMX version) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderTamperProtection.ps1 # Configure-DefenderTamperProtection.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } try { Set-ItemProperty -Path $FeaturesPath -Name "TamperProtection" -Value 5 -Type DWord -ErrorAction Stop -Force } catch { Write-Warning "Registry blocked. Tamper Protection registry key is normally protected by TrustedInstaller. Ensure GPO setting is applied." } To audit the hardening status: Download Script: Get-DefenderTamperProtectionStatus.ps1 # Get-DefenderTamperProtectionStatus.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" $TamperVal = Get-ItemProperty -Path $FeaturesPath -Name "TamperProtection" -ErrorAction SilentlyContinue if ($TamperVal -and $TamperVal.TamperProtection -eq 5) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderTamperProtection.ps1 $FeaturesPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" if (-not (Test-Path $FeaturesPath)) { New-Item -Path $FeaturesPath -Force | Out-Null } try { Set-ItemProperty -Path $FeaturesPath -Name "TamperProtection" -Value 5 -Type DWord -ErrorAction Stop -Force } catch { Write-Warning "Registry blocked. Tamper Protection registry key is normally protected by TrustedInstaller. Ensure GPO setting is applied." } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-sandbox-execution-environment.md Forcing the Windows Defender scanning service (MsMpEng.exe) to run in a restricted AppContainer sandbox prevents privilege escalation. If an attacker exploits a parsing vulnerability in the engine, the compromise is contained inside the sandbox. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Preferences\Windows Settings\Environment Right-click and select New -> Environment Variable Configure Action: Update, Type: System, Name: MP_FORCE_USE_SANDBOX, Value: 1 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderSandbox.ps1 # Configure-DefenderSandbox.ps1 $EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" if (-not (Test-Path $EnvPath)) { New-Item -Path $EnvPath -Force | Out-Null } Set-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-DefenderSandboxStatus.ps1 # Get-DefenderSandboxStatus.ps1 $EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" $SandboxVar = Get-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -ErrorAction SilentlyContinue if ($SandboxVar -and $SandboxVar.MP_FORCE_USE_SANDBOX -eq "1") { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderSandbox.ps1 $EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" if (-not (Test-Path $EnvPath)) { New-Item -Path $EnvPath -Force | Out-Null } Set-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-amsi-authenticode-signature-verification.md Enforcing signature checks on registered Antimalware Scan Interface (AMSI) providers blocks attackers from registering unsigned rogue AMSI provider DLLs to bypass script analysis. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Preferences\Windows Settings\Registry Right-click and select New -> Registry Item Configure Action: Update, Hive: HKEY_LOCAL_MACHINE, Key Path: SOFTWARE\Microsoft\AMSI, Value Name: FeatureBits, Value Type: REG_DWORD, Value Data: 2 Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderAmsiSignature.ps1 # Configure-DefenderAmsiSignature.ps1 $AmsiPath = "HKLM:\SOFTWARE\Microsoft\AMSI" if (-not (Test-Path $AmsiPath)) { New-Item -Path $AmsiPath -Force | Out-Null } Set-ItemProperty -Path $AmsiPath -Name "FeatureBits" -Value 2 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderAmsiSignatureStatus.ps1 # Get-DefenderAmsiSignatureStatus.ps1 $AmsiPath = "HKLM:\SOFTWARE\Microsoft\AMSI" if (Test-Path $AmsiPath) { $AmsiBits = Get-ItemProperty -Path $AmsiPath -Name "FeatureBits" -ErrorAction SilentlyContinue if ($AmsiBits -and $AmsiBits.FeatureBits -eq 2) { Write-Output "Compliant" exit 0 } } Write-Output "Non-Compliant" exit 1 # Configure-DefenderAmsiSignature.ps1 $AmsiPath = "HKLM:\SOFTWARE\Microsoft\AMSI" if (-not (Test-Path $AmsiPath)) { New-Item -Path $AmsiPath -Force | Out-Null } Set-ItemProperty -Path $AmsiPath -Name "FeatureBits" -Value 2 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-file-explorer-smartscreen.md Windows Defender SmartScreen protects users from running unrecognized or potentially malicious applications downloaded from the internet. Configuring the level to 'Block' prevents users from bypassing security warnings. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\File Explorer Set 'Configure Windows Defender SmartScreen' to 'Enabled' Select 'Require approval from an administrator before running unrecognized software' under Options Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderSmartScreen.ps1 # Configure-DefenderSmartScreen.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "EnableSmartScreen" -Value 1 -Type DWord -Force Set-ItemProperty -Path $Path -Name "ShellSmartScreenLevel" -Value "Block" -Type String -Force To audit the hardening status: Download Script: Get-DefenderSmartScreenStatus.ps1 # Get-DefenderSmartScreenStatus.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" if (Test-Path $Path) { $Enable = Get-ItemProperty -Path $Path -Name "EnableSmartScreen" -ErrorAction SilentlyContinue $Level = Get-ItemProperty -Path $Path -Name "ShellSmartScreenLevel" -ErrorAction SilentlyContinue if ($Enable -and $Enable.EnableSmartScreen -eq 1 -and $Level -and $Level.ShellSmartScreenLevel -eq "Block") { Write-Output "Compliant" exit 0 } } Write-Output "Non-Compliant" exit 1 # Configure-DefenderSmartScreen.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "EnableSmartScreen" -Value 1 -Type DWord -Force Set-ItemProperty -Path $Path -Name "ShellSmartScreenLevel" -Value "Block" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/disable-onedrive-file-sync.md Preventing OneDrive files from syncing automatically protects endpoints against automated synchronization of encrypted files during a ransomware event, and prevents unauthorized data exfiltration. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\OneDrive Set 'Prevent the usage of OneDrive for file storage' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableOneDriveSync.ps1 # Configure-DisableOneDriveSync.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableFileSyncNGSC" -Value 1 -Type DWord -Force To audit the hardening status: Download Script: Get-DisableOneDriveSyncStatus.ps1 # Get-DisableOneDriveSyncStatus.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" $Reg = Get-ItemProperty -Path $Path -Name "DisableFileSyncNGSC" -ErrorAction SilentlyContinue if ($Reg -and $Reg.DisableFileSyncNGSC -eq 1) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DisableOneDriveSync.ps1 $Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "DisableFileSyncNGSC" -Value 1 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/enforce-antivirus-scan-on-opening-attachments.md Forcing the Attachment Manager to notify the registered antivirus product when a user opens files downloaded from the web or email clients prevents initial access vectors. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: User Configuration\Administrative Templates\Windows Components\Attachment Manager Set 'Notify antivirus programs when opening attachments' to 'Enabled' Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DefenderAttachmentScan.ps1 # Configure-DefenderAttachmentScan.ps1 $Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "ScanWithAntiVirus" -Value 3 -Type DWord -Force To audit the hardening status: Download Script: Get-DefenderAttachmentScanStatus.ps1 # Get-DefenderAttachmentScanStatus.ps1 $Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" $Reg = Get-ItemProperty -Path $Path -Name "ScanWithAntiVirus" -ErrorAction SilentlyContinue if ($Reg -and $Reg.ScanWithAntiVirus -eq 3) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-DefenderAttachmentScan.ps1 $Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null } Set-ItemProperty -Path $Path -Name "ScanWithAntiVirus" -Value 3 -Type DWord -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/configure-remote-encryption-protection.md Remote Encryption Protection actively detects and terminates network ransomware attempting to encrypt files over SMB shares. Enforcing Block mode terminates the malicious remote process or connection attempting rapid or unauthorized file encryption over network shares, halting lateral encryption attacks from unmanaged or compromised domain assets. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Defender Antivirus\Remediation\Behavioral Network Blocks\Brute Force Protection Double-click Configure Remote Encryption Protection Mode. Set the policy to Enabled, and select Block (value 2) in the dropdown options. Link the GPO to the appropriate Organizational Unit and verify replication. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the Remote Encryption Protection registry value: Download Script: Configure-RemoteEncryptionProtection.ps1 # Configure-RemoteEncryptionProtection.ps1 # Description: Configures Microsoft Defender Remote Encryption Protection in Block mode. Write-Host "Configuring Microsoft Defender Remote Encryption Protection..." -ForegroundColor Cyan $KeyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection" if (-not (Test-Path -Path $KeyPath)) { New-Item -Path $KeyPath -Force | Out-Null } Set-ItemProperty -Path $KeyPath -Name "BruteForceProtectionConfiguredState" -Value 2 -Type DWord -Force Write-Host "[+] Remote Encryption Protection applied successfully (Block mode)." -ForegroundColor Green To audit the hardening status: Download Script: Get-RemoteEncryptionProtectionStatus.ps1 # Get-RemoteEncryptionProtectionStatus.ps1 # Description: Audits Microsoft Defender Remote Encryption Protection configuration status. $KeyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection" $Reg = Get-ItemProperty -Path $KeyPath -Name "BruteForceProtectionConfiguredState" -ErrorAction SilentlyContinue if ($Reg -and $Reg.BruteForceProtectionConfiguredState -eq 2) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-RemoteEncryptionProtection.ps1 # Description: Configures Microsoft Defender Remote Encryption Protection in Block mode. Write-Host "Configuring Microsoft Defender Remote Encryption Protection..." -ForegroundColor Cyan $KeyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Brute Force Protection" if (-not (Test-Path -Path $KeyPath)) { New-Item -Path $KeyPath -Force | Out-Null } Set-ItemProperty -Path $KeyPath -Name "BruteForceProtectionConfiguredState" -Value 2 -Type DWord -Force Write-Host "[+] Remote Encryption Protection applied successfully (Block mode)." -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-vulnerable-signed-drivers.md Prevents an application from writing a vulnerable signed driver to disk. Attackers use Bring Your Own Vulnerable Driver (BYOVD) techniques to bypass Windows kernel protections by loading legitimate, signed third-party drivers that contain known vulnerabilities, allowing them to disable security agents and gain kernel-level privileges. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 56a863a9-875e-4185-98a7-b882c64b5ce5 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrVulnerableDrivers.ps1 # Configure-AsrVulnerableDrivers.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "56a863a9-875e-4185-98a7-b882c64b5ce5" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrVulnerableDriversStatus.ps1 # Get-AsrVulnerableDriversStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "56a863a9-875e-4185-98a7-b882c64b5ce5" -ErrorAction SilentlyContinue if ($Value -and ($Value."56a863a9-875e-4185-98a7-b882c64b5ce5" -eq "1" -or $Value."56a863a9-875e-4185-98a7-b882c64b5ce5" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrVulnerableDrivers.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "56a863a9-875e-4185-98a7-b882c64b5ce5" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-adobe-reader-child-processes.md Prevents Adobe Reader from launching any child processes. Malicious PDF documents frequently attempt to exploit application vulnerabilities or trick users into executing embedded links, which spawns command shells (cmd.exe, powershell.exe) or scripting hosts (wscript.exe) to download and launch secondary malware payloads. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrAdobeChild.ps1 # Configure-AsrAdobeChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrAdobeChildStatus.ps1 # Get-AsrAdobeChildStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -ErrorAction SilentlyContinue if ($Value -and ($Value."7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -eq "1" -or $Value."7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrAdobeChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-office-child-processes.md Blocks Microsoft Office applications (Word, Excel, PowerPoint) from creating child processes. This prevents malicious files containing embedded VBA macros or exploiting unpatched vulnerabilities (such as CVE-2021-40444) from launching scripting environments or system commands to download and execute code. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID d4f940ab-401b-4efc-aadc-ad5f3c50688a as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrOfficeChild.ps1 # Configure-AsrOfficeChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d4f940ab-401b-4efc-aadc-ad5f3c50688a" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrOfficeChildStatus.ps1 # Get-AsrOfficeChildStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "d4f940ab-401b-4efc-aadc-ad5f3c50688a" -ErrorAction SilentlyContinue if ($Value -and ($Value."d4f940ab-401b-4efc-aadc-ad5f3c50688a" -eq "1" -or $Value."d4f940ab-401b-4efc-aadc-ad5f3c50688a" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrOfficeChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d4f940ab-401b-4efc-aadc-ad5f3c50688a" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-lsass-credential-stealing.md Blocks attempts to open or dump the memory of the Local Security Authority Subsystem Service (lsass.exe). Attackers dump LSASS memory using tools like Mimikatz or Task Manager to extract plaintext credentials, Kerberos tickets, or NTLM password hashes from system memory for lateral movement. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrLsassDump.ps1 # Configure-AsrLsassDump.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrLsassDumpStatus.ps1 # Get-AsrLsassDumpStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -ErrorAction SilentlyContinue if ($Value -and ($Value."9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -eq "1" -or $Value."9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrLsassDump.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-email-executable-content.md Prevents executable files (such as .exe, .com, .scr, .vbs, .js, or .pif) from launching directly from email clients (like Outlook) or webmail accessed via browser sessions. This stops phishing attacks where users accidentally launch malicious attachments or download payloads directly from web-based email links. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrEmailExecutable.ps1 # Configure-AsrEmailExecutable.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrEmailExecutableStatus.ps1 # Get-AsrEmailExecutableStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -ErrorAction SilentlyContinue if ($Value -and ($Value."be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -eq "1" -or $Value."be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrEmailExecutable.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-low-prevalence-executable-files.md Blocks execution of unrecognized, newly compiled, or low-prevalence executable files. This provides initial protection against zero-day malware campaigns and targeted custom payloads that have not yet established reputation telemetry in the Microsoft Cloud Protection network. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrLowPrevalence.ps1 # Configure-AsrLowPrevalence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "01443614-cd74-433a-b99e-2ecdc07bfc25" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrLowPrevalenceStatus.ps1 # Get-AsrLowPrevalenceStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "01443614-cd74-433a-b99e-2ecdc07bfc25" -ErrorAction SilentlyContinue if ($Value -and ($Value."01443614-cd74-433a-b99e-2ecdc07bfc25" -eq "1" -or $Value."01443614-cd74-433a-b99e-2ecdc07bfc25" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrLowPrevalence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "01443614-cd74-433a-b99e-2ecdc07bfc25" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-obfuscated-scripts.md Blocks execution of obfuscated or encrypted scripts (such as PowerShell, VBScript, or JavaScript). Threat actors obfuscate their scripts using base64 encoding, custom string manipulation, or encryption to hide the intent of their code and bypass static file scanning and network detection engines. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 5beb7efe-fd9a-4556-801d-275e5ffc04cc as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrObfuscatedScripts.ps1 # Configure-AsrObfuscatedScripts.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "5beb7efe-fd9a-4556-801d-275e5ffc04cc" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrObfuscatedScriptsStatus.ps1 # Get-AsrObfuscatedScriptsStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "5beb7efe-fd9a-4556-801d-275e5ffc04cc" -ErrorAction SilentlyContinue if ($Value -and ($Value."5beb7efe-fd9a-4556-801d-275e5ffc04cc" -eq "1" -or $Value."5beb7efe-fd9a-4556-801d-275e5ffc04cc" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrObfuscatedScripts.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "5beb7efe-fd9a-4556-801d-275e5ffc04cc" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-script-launching-downloaded-content.md Prevents JavaScript or VBScript running locally from launching executable binaries that were downloaded from the internet. Attackers use malicious scripts inside documents or web browsers to download payloads (like ransomware or trojans) to the disk and launch them using local script engines. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID d3e037e1-3eb8-44c8-a917-57927947596d as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrScriptLaunchExe.ps1 # Configure-AsrScriptLaunchExe.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d3e037e1-3eb8-44c8-a917-57927947596d" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrScriptLaunchExeStatus.ps1 # Get-AsrScriptLaunchExeStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "d3e037e1-3eb8-44c8-a917-57927947596d" -ErrorAction SilentlyContinue if ($Value -and ($Value."d3e037e1-3eb8-44c8-a917-57927947596d" -eq "1" -or $Value."d3e037e1-3eb8-44c8-a917-57927947596d" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrScriptLaunchExe.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d3e037e1-3eb8-44c8-a917-57927947596d" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-office-executable-content-creation.md Prevents Microsoft Office applications (Word, Excel, PowerPoint) from creating or writing executable files (e.g., .exe, .dll, .scr) to the local filesystem. Malicious documents often attempt to drop payloads directly into the local temp folders or AppData directories before executing them. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 3b576869-a4ec-4529-8536-b80a7769e899 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrOfficeWriteExe.ps1 # Configure-AsrOfficeWriteExe.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "3b576869-a4ec-4529-8536-b80a7769e899" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrOfficeWriteExeStatus.ps1 # Get-AsrOfficeWriteExeStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "3b576869-a4ec-4529-8536-b80a7769e899" -ErrorAction SilentlyContinue if ($Value -and ($Value."3b576869-a4ec-4529-8536-b80a7769e899" -eq "1" -or $Value."3b576869-a4ec-4529-8536-b80a7769e899" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrOfficeWriteExe.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "3b576869-a4ec-4529-8536-b80a7769e899" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-office-code-injection.md Blocks Microsoft Office applications from writing code or injecting threads directly into external processes. Threat actors use code injection (such as process hollowing or remote thread creation) inside Office macros to hide execution under clean, trusted system binaries like explorer.exe or svchost.exe. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrOfficeInjection.ps1 # Configure-AsrOfficeInjection.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrOfficeInjectionStatus.ps1 # Get-AsrOfficeInjectionStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -ErrorAction SilentlyContinue if ($Value -and ($Value."75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -eq "1" -or $Value."75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrOfficeInjection.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-office-communication-child-processes.md Blocks Microsoft Outlook or other Office communication applications (e.g., Teams, Skype) from creating child processes. This prevents malware payloads delivered through emails, chats, or calendar invites from spawning command-line utilities or scripting environments. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 26190899-1602-49e8-8b27-eb1d0a1ce869 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrOutlookChild.ps1 # Configure-AsrOutlookChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "26190899-1602-49e8-8b27-eb1d0a1ce869" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrOutlookChildStatus.ps1 # Get-AsrOutlookChildStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "26190899-1602-49e8-8b27-eb1d0a1ce869" -ErrorAction SilentlyContinue if ($Value -and ($Value."26190899-1602-49e8-8b27-eb1d0a1ce869" -eq "1" -or $Value."26190899-1602-49e8-8b27-eb1d0a1ce869" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrOutlookChild.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "26190899-1602-49e8-8b27-eb1d0a1ce869" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-wmi-event-subscription-persistence.md Blocks threat actors from achieving system persistence by registering permanent Windows Management Instrumentation (WMI) event subscriptions. WMI event subscriptions allow attackers to automatically launch malicious payloads when system triggers occur (like system boot or user logon) without using traditional startup registry keys. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID e6db77e5-3df2-4cf1-b95a-636979351e5b as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrWmiPersistence.ps1 # Configure-AsrWmiPersistence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "e6db77e5-3df2-4cf1-b95a-636979351e5b" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrWmiPersistenceStatus.ps1 # Get-AsrWmiPersistenceStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "e6db77e5-3df2-4cf1-b95a-636979351e5b" -ErrorAction SilentlyContinue if ($Value -and ($Value."e6db77e5-3df2-4cf1-b95a-636979351e5b" -eq "1" -or $Value."e6db77e5-3df2-4cf1-b95a-636979351e5b" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrWmiPersistence.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "e6db77e5-3df2-4cf1-b95a-636979351e5b" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-psexec-wmi-process-creations.md Blocks processes created via WMI commands or PSExec remote execution utilities. This directly stops lateral movement attacks where compromised accounts or threat actors attempt to start commands, backdoors, or credential dumpers remotely across domain-joined servers and workstations. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID d1e49aac-8f56-4280-b9ba-993a6d77406c as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrPsexecWmi.ps1 # Configure-AsrPsexecWmi.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d1e49aac-8f56-4280-b9ba-993a6d77406c" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrPsexecWmiStatus.ps1 # Get-AsrPsexecWmiStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "d1e49aac-8f56-4280-b9ba-993a6d77406c" -ErrorAction SilentlyContinue if ($Value -and ($Value."d1e49aac-8f56-4280-b9ba-993a6d77406c" -eq "1" -or $Value."d1e49aac-8f56-4280-b9ba-993a6d77406c" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrPsexecWmi.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "d1e49aac-8f56-4280-b9ba-993a6d77406c" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-unsigned-processes-running-from-usb.md Blocks the execution of unsigned or untrusted processes on removable storage devices (USB drives, external SSDs). This stops physical access vectors, rogue USB drops, and automated worm propagation techniques from running unauthorized installers or scripts. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrUsbUnsigned.ps1 # Configure-AsrUsbUnsigned.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrUsbUnsignedStatus.ps1 # Get-AsrUsbUnsignedStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -ErrorAction SilentlyContinue if ($Value -and ($Value."b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -eq "1" -or $Value."b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrUsbUnsigned.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/block-win32-api-calls-from-office-macros.md Blocks VBA macros inside Microsoft Office documents from invoking Win32 API calls. Malicious documents use macros to call kernel memory functions (such as VirtualAlloc, WriteProcessMemory, or CreateThread) to load and execute shellcode in memory without dropping files to disk, bypassing file scanners. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrOfficeWin32Calls.ps1 # Configure-AsrOfficeWin32Calls.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrOfficeWin32CallsStatus.ps1 # Get-AsrOfficeWin32CallsStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -ErrorAction SilentlyContinue if ($Value -and ($Value."92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -eq "1" -or $Value."92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrOfficeWin32Calls.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 (and above) Enterprise/Professional, Windows Server 2016 (and above). File Path: 08-endpoints/defender/asr/use-advanced-protection-against-ransomware.md Enables advanced behavioral heuristics and cloud analytics checks on files that attempt to modify multiple user files, detect signature-less encryption behavior, and block rapid write activity to prevent ransomware from encrypting system and user documents. Option A: Group Policy Object (GPO) Configuration (Preferred) Navigate to: Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction Set 'Configure Attack Surface Reduction rules' to 'Enabled' Click 'Show...' and add the rule GUID c1db55ab-c21a-4637-bb3f-a12568109d35 as Value Name, with Value set to 1 (Block). Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-AsrRansomware.ps1 # Configure-AsrRansomware.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "c1db55ab-c21a-4637-bb3f-a12568109d35" -Value "1" -Type String -Force To audit the hardening status: Download Script: Get-AsrRansomwareStatus.ps1 # Get-AsrRansomwareStatus.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" $Value = Get-ItemProperty -Path $AsrRulesPath -Name "c1db55ab-c21a-4637-bb3f-a12568109d35" -ErrorAction SilentlyContinue if ($Value -and ($Value."c1db55ab-c21a-4637-bb3f-a12568109d35" -eq "1" -or $Value."c1db55ab-c21a-4637-bb3f-a12568109d35" -eq 1)) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-AsrRansomware.ps1 $AsrRulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" if (-not (Test-Path $AsrRulesPath)) { New-Item -Path $AsrRulesPath -Force | Out-Null } Set-ItemProperty -Path $AsrRulesPath -Name "c1db55ab-c21a-4637-bb3f-a12568109d35" -Value "1" -Type String -Force Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-092](../../07-paws/user-rights/configure-ura-setrustedcredmanaccessprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-setrustedcredmanaccessprivilege.md The SeTrustedCredManAccessPrivilege allows a process to access the Windows Credential Manager as a trusted caller via internal Credential Manager APIs. The Credential Manager securely stores user domain credentials, web passwords, and certificate secrets used for network authentication. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Access Credential Manager as a trusted caller`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeTrustedCredManAccessPrivilege.ps1 # Configure-UraSeTrustedCredManAccessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setrustedcredmanaccessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setrustedcredmanaccessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTrustedCredManAccessPrivilege\s*=") { $NewLines += "SeTrustedCredManAccessPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTrustedCredManAccessPrivilege = ") } else { $NewLines += "SeTrustedCredManAccessPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeTrustedCredManAccessPrivilegeStatus.ps1 # Get-UraSeTrustedCredManAccessPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_setrustedcredmanaccessprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeTrustedCredManAccessPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeTrustedCredManAccessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setrustedcredmanaccessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setrustedcredmanaccessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTrustedCredManAccessPrivilege\s*=") { $NewLines += "SeTrustedCredManAccessPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTrustedCredManAccessPrivilege = ") } else { $NewLines += "SeTrustedCredManAccessPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-093](../../07-paws/user-rights/configure-ura-senetworklogonright.md)). (For Domain Controllers, refer to [REQ-DC-104](../../02-domain-controllers/user-rights/configure-ura-senetworklogonright.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-senetworklogonright.md The SeNetworkLogonRight determines which security principals are permitted to authenticate and establish network logon sessions (Logon Type 3) across the network over protocols like SMB, RPC, WMI, WinRM, and LDAP. Network logons authenticate users without creating an interactive desktop shell, enabling file share access, remote management, and inter-system synchronization. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Access this computer from the network`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators), *S-1-5-32-555 (Remote Desktop Users). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeNetworkLogonRight.ps1 # Configure-UraSeNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_senetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_senetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeNetworkLogonRight\s*=") { $NewLines += "SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-32-555" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-32-555") } else { $NewLines += "SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-32-555" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeNetworkLogonRightStatus.ps1 # Get-UraSeNetworkLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_senetworklogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeNetworkLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544,*S-1-5-32-555" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_senetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_senetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeNetworkLogonRight\s*=") { $NewLines += "SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-32-555" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-32-555") } else { $NewLines += "SeNetworkLogonRight = *S-1-5-32-544,*S-1-5-32-555" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-094](../../07-paws/user-rights/configure-ura-setcbprivilege.md)). (For Domain Controllers, refer to [REQ-DC-105](../../02-domain-controllers/user-rights/configure-ura-setcbprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-setcbprivilege.md The SeTcbPrivilege identifies its holder as part of the Trusted Computer Base (TCB)—the core inner ring of the operating system. A process possessing this privilege can register as a trusted logon process with the Local Security Authority via LsaRegisterLogonProcess and invoke LsaLogonUser to create an arbitrary, fully authenticated access token for any user without knowing the user's password or requiring credentials. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Act as part of the operating system`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeTcbPrivilege.ps1 # Configure-UraSeTcbPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setcbprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setcbprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTcbPrivilege\s*=") { $NewLines += "SeTcbPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTcbPrivilege = ") } else { $NewLines += "SeTcbPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeTcbPrivilegeStatus.ps1 # Get-UraSeTcbPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_setcbprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeTcbPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeTcbPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setcbprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setcbprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTcbPrivilege\s*=") { $NewLines += "SeTcbPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTcbPrivilege = ") } else { $NewLines += "SeTcbPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-095](../../07-paws/user-rights/configure-ura-seinteractivelogonright.md)). (For Domain Controllers, refer to [REQ-DC-108](../../02-domain-controllers/user-rights/configure-ura-seinteractivelogonright.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-seinteractivelogonright.md The SeInteractiveLogonRight determines which security principals are permitted to start an interactive logon session (Logon Type 2) at the physical keyboard, display, or virtual machine console. An interactive logon spawns a graphical user shell (explorer.exe) and interactive desktop session. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Allow log on locally`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators), *S-1-5-32-545 (Users). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeInteractiveLogonRight.ps1 # Configure-UraSeInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeInteractiveLogonRight\s*=") { $NewLines += "SeInteractiveLogonRight = *S-1-5-32-544,*S-1-5-32-545" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeInteractiveLogonRight = *S-1-5-32-544,*S-1-5-32-545") } else { $NewLines += "SeInteractiveLogonRight = *S-1-5-32-544,*S-1-5-32-545" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeInteractiveLogonRightStatus.ps1 # Get-UraSeInteractiveLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seinteractivelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeInteractiveLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544,*S-1-5-32-545" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_seinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeInteractiveLogonRight\s*=") { $NewLines += "SeInteractiveLogonRight = *S-1-5-32-544,*S-1-5-32-545" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeInteractiveLogonRight = *S-1-5-32-544,*S-1-5-32-545") } else { $NewLines += "SeInteractiveLogonRight = *S-1-5-32-544,*S-1-5-32-545" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-096](../../07-paws/user-rights/configure-ura-sebackupprivilege.md)). (For Domain Controllers, refer to [REQ-DC-110](../../02-domain-controllers/user-rights/configure-ura-sebackupprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-sebackupprivilege.md The SeBackupPrivilege grants the caller the capability to bypass all read-access security controls (Discretionary Access Control Lists - DACLs) across the entire NTFS filesystem and Windows Registry. When an application opens a file handle specifying the FILE_FLAG_BACKUP_SEMANTICS flag in Win32 CreateFile calls, the Windows kernel I/O manager and Object Manager explicitly bypass standard security descriptor evaluation. This design allows legitimate backup utilities to archive files without requiring explicit read permissions on every individual object. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Back up files and directories`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeBackupPrivilege.ps1 # Configure-UraSeBackupPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sebackupprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sebackupprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeBackupPrivilege\s*=") { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeBackupPrivilege = *S-1-5-32-544") } else { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeBackupPrivilegeStatus.ps1 # Get-UraSeBackupPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sebackupprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeBackupPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeBackupPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sebackupprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sebackupprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeBackupPrivilege\s*=") { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeBackupPrivilege = *S-1-5-32-544") } else { $NewLines += "SeBackupPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Domain Controllers, refer to [REQ-DC-112](../../02-domain-controllers/user-rights/configure-ura-sesystemtimeprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-sesystemtimeprivilege.md The SeSystemtimePrivilege allows a security principal to adjust the internal hardware clock and system time of the computer via Win32 APIs SetSystemTime or SetLocalTime. Accurate time synchronization is foundational to the Windows distributed security architecture. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Change the system time`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators), *S-1-5-19 (LocalService). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeSystemtimePrivilege.ps1 # Configure-UraSeSystemtimePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemtimeprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemtimeprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemtimePrivilege\s*=") { $NewLines += "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19") } else { $NewLines += "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeSystemtimePrivilegeStatus.ps1 # Get-UraSeSystemtimePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesystemtimeprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSystemtimePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544,*S-1-5-19" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeSystemtimePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemtimeprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemtimeprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemtimePrivilege\s*=") { $NewLines += "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19") } else { $NewLines += "SeSystemtimePrivilege = *S-1-5-32-544,*S-1-5-19" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-setimezoneprivilege.md The SeTimeZonePrivilege controls the capability to change the system local time zone setting via SetTimeZoneInformation. While changing the time zone does not alter the underlying UTC hardware clock, it alters the local display time and timestamp calculations across the operating system. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Change the time zone`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators), *S-1-5-19 (LocalService), *S-1-5-32-545 (Users). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeTimeZonePrivilege.ps1 # Configure-UraSeTimeZonePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setimezoneprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setimezoneprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTimeZonePrivilege\s*=") { $NewLines += "SeTimeZonePrivilege = *S-1-5-32-544,*S-1-5-19,*S-1-5-32-545" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTimeZonePrivilege = *S-1-5-32-544,*S-1-5-19,*S-1-5-32-545") } else { $NewLines += "SeTimeZonePrivilege = *S-1-5-32-544,*S-1-5-19,*S-1-5-32-545" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeTimeZonePrivilegeStatus.ps1 # Get-UraSeTimeZonePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_setimezoneprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeTimeZonePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544,*S-1-5-19,*S-1-5-32-545" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeTimeZonePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setimezoneprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setimezoneprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTimeZonePrivilege\s*=") { $NewLines += "SeTimeZonePrivilege = *S-1-5-32-544,*S-1-5-19,*S-1-5-32-545" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTimeZonePrivilege = *S-1-5-32-544,*S-1-5-19,*S-1-5-32-545") } else { $NewLines += "SeTimeZonePrivilege = *S-1-5-32-544,*S-1-5-19,*S-1-5-32-545" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-097](../../07-paws/user-rights/configure-ura-secreatepagefileprivilege.md)). (For Domain Controllers, refer to [REQ-DC-113](../../02-domain-controllers/user-rights/configure-ura-secreatepagefileprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-secreatepagefileprivilege.md The SeCreatePagefilePrivilege allows a process to create, delete, and modify the parameters and allocation sizes of system paging files (pagefile.sys) via the NtCreatePagingFile API. The Windows virtual memory manager uses paging files as secondary backing storage for memory pages that are not backed by files. Paging files contain sensitive plaintext data, including process heap allocations, cached authentication tokens, cryptographic keys, and unencrypted file contents. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create a pagefile`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeCreatePagefilePrivilege.ps1 # Configure-UraSeCreatePagefilePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepagefileprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepagefileprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePagefilePrivilege\s*=") { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePagefilePrivilege = *S-1-5-32-544") } else { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeCreatePagefilePrivilegeStatus.ps1 # Get-UraSeCreatePagefilePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatepagefileprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreatePagefilePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeCreatePagefilePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepagefileprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepagefileprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePagefilePrivilege\s*=") { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePagefilePrivilege = *S-1-5-32-544") } else { $NewLines += "SeCreatePagefilePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-098](../../07-paws/user-rights/configure-ura-secreatetokenprivilege.md)). (For Domain Controllers, refer to [REQ-DC-114](../../02-domain-controllers/user-rights/configure-ura-secreatetokenprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-secreatetokenprivilege.md The SeCreateTokenPrivilege allows a process to invoke the native API NtCreateToken to forge an arbitrary Windows primary or impersonation access token from scratch. An access token defines an entity's complete security context, including User SID, Group SIDs, Privileges, Default DACL, Token Type, and Mandatory Integrity Level. Normally, tokens are manufactured exclusively by the Local Security Authority Subsystem Service (lsass.exe) following successful authentication. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create a token object`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeCreateTokenPrivilege.ps1 # Configure-UraSeCreateTokenPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatetokenprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatetokenprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateTokenPrivilege\s*=") { $NewLines += "SeCreateTokenPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateTokenPrivilege = ") } else { $NewLines += "SeCreateTokenPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeCreateTokenPrivilegeStatus.ps1 # Get-UraSeCreateTokenPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatetokenprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreateTokenPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeCreateTokenPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatetokenprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatetokenprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateTokenPrivilege\s*=") { $NewLines += "SeCreateTokenPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateTokenPrivilege = ") } else { $NewLines += "SeCreateTokenPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-099](../../07-paws/user-rights/configure-ura-secreateglobalprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-secreateglobalprivilege.md The SeCreateGlobalPrivilege allows a process to create named kernel and user objects (such as named pipes, shared memory sections, mutexes, and events) in the \BaseNamedObjects global namespace accessible across all terminal services sessions and interactive logon sessions. In terminal services and multi-user Windows environments, each interactive session is isolated into a private namespace (\Sessions\X\BaseNamedObjects). The global namespace is reserved for system services that must communicate across session boundaries. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create global objects`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-19 (LocalService), *S-1-5-20 (NetworkService), *S-1-5-32-544 (Administrators), *S-1-5-6 (Service). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeCreateGlobalPrivilege.ps1 # Configure-UraSeCreateGlobalPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreateglobalprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreateglobalprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateGlobalPrivilege\s*=") { $NewLines += "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6") } else { $NewLines += "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeCreateGlobalPrivilegeStatus.ps1 # Get-UraSeCreateGlobalPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreateglobalprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreateGlobalPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeCreateGlobalPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreateglobalprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreateglobalprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateGlobalPrivilege\s*=") { $NewLines += "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6") } else { $NewLines += "SeCreateGlobalPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-100](../../07-paws/user-rights/configure-ura-secreatepermanentprivilege.md)). (For Domain Controllers, refer to [REQ-DC-115](../../02-domain-controllers/user-rights/configure-ura-secreatepermanentprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-secreatepermanentprivilege.md The SeCreatePermanentPrivilege allows a process to create permanent object directory objects in the Windows Object Manager namespace (\DirectoryObject) via APIs like NtCreateDirectoryObject. Unlike standard kernel objects which are automatically destroyed when their last handle is closed, permanent objects persist in the object manager namespace across process terminations until explicitly unlinked or until system reboot. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create permanent shared objects`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeCreatePermanentPrivilege.ps1 # Configure-UraSeCreatePermanentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepermanentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepermanentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePermanentPrivilege\s*=") { $NewLines += "SeCreatePermanentPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePermanentPrivilege = ") } else { $NewLines += "SeCreatePermanentPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeCreatePermanentPrivilegeStatus.ps1 # Get-UraSeCreatePermanentPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatepermanentprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreatePermanentPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeCreatePermanentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatepermanentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatepermanentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreatePermanentPrivilege\s*=") { $NewLines += "SeCreatePermanentPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreatePermanentPrivilege = ") } else { $NewLines += "SeCreatePermanentPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-secreatesymboliclinkprivilege.md The SeCreateSymbolicLinkPrivilege controls the ability to create filesystem symbolic links (symlinks) via CreateSymbolicLink or mklink. Symbolic links are filesystem pointers that transparently redirect file and directory access to alternate target paths. While useful for software development and container workflows, unconstrained symbolic link creation represents one of the most common primitives for Local Privilege Escalation (LPE) in Windows. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Create symbolic links`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeCreateSymbolicLinkPrivilege.ps1 # Configure-UraSeCreateSymbolicLinkPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatesymboliclinkprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatesymboliclinkprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateSymbolicLinkPrivilege\s*=") { $NewLines += "SeCreateSymbolicLinkPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateSymbolicLinkPrivilege = *S-1-5-32-544") } else { $NewLines += "SeCreateSymbolicLinkPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeCreateSymbolicLinkPrivilegeStatus.ps1 # Get-UraSeCreateSymbolicLinkPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_secreatesymboliclinkprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeCreateSymbolicLinkPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeCreateSymbolicLinkPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_secreatesymboliclinkprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_secreatesymboliclinkprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeCreateSymbolicLinkPrivilege\s*=") { $NewLines += "SeCreateSymbolicLinkPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeCreateSymbolicLinkPrivilege = *S-1-5-32-544") } else { $NewLines += "SeCreateSymbolicLinkPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-101](../../07-paws/user-rights/configure-ura-sedebugprivilege.md)). (For Domain Controllers, refer to [REQ-DC-116](../../02-domain-controllers/user-rights/configure-ura-sedebugprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-sedebugprivilege.md The SeDebugPrivilege allows a process to attach a debugger to any running process on the system, completely overriding the target process security descriptor and Discretionary Access Control List (DACL). When enabled, calls to OpenProcess with permissions such as PROCESS_ALL_ACCESS or PROCESS_VM_READ succeed even against processes owned by other users or NT AUTHORITY\SYSTEM. This privilege is intended strictly for kernel/application developers debugging live processes. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Debug programs`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeDebugPrivilege.ps1 # Configure-UraSeDebugPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedebugprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedebugprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDebugPrivilege\s*=") { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDebugPrivilege = *S-1-5-32-544") } else { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeDebugPrivilegeStatus.ps1 # Get-UraSeDebugPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedebugprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDebugPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeDebugPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedebugprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedebugprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDebugPrivilege\s*=") { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDebugPrivilege = *S-1-5-32-544") } else { $NewLines += "SeDebugPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-102](../../07-paws/user-rights/configure-ura-seenabledelegationprivilege.md)). (For Domain Controllers, refer to [REQ-DC-122](../../02-domain-controllers/user-rights/configure-ura-seenabledelegationprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-seenabledelegationprivilege.md The SeEnableDelegationPrivilege allows a security principal to modify the userAccountControl attribute on Active Directory user and computer objects to enable Kerberos Delegation flags: (1) TRUSTED_FOR_DELEGATION (Unconstrained Delegation); (2) TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (Constrained Delegation with Protocol Transition / S4U2Self). Kerberos delegation permits a service to impersonate an authenticated user to access back-end resources on their behalf. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Enable computer and user accounts to be trusted for delegation`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeEnableDelegationPrivilege.ps1 # Configure-UraSeEnableDelegationPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seenabledelegationprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seenabledelegationprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeEnableDelegationPrivilege\s*=") { $NewLines += "SeEnableDelegationPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeEnableDelegationPrivilege = ") } else { $NewLines += "SeEnableDelegationPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeEnableDelegationPrivilegeStatus.ps1 # Get-UraSeEnableDelegationPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seenabledelegationprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeEnableDelegationPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeEnableDelegationPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seenabledelegationprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seenabledelegationprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeEnableDelegationPrivilege\s*=") { $NewLines += "SeEnableDelegationPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeEnableDelegationPrivilege = ") } else { $NewLines += "SeEnableDelegationPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-103](../../07-paws/user-rights/configure-ura-seremoteshutdownprivilege.md)). (For Domain Controllers, refer to [REQ-DC-123](../../02-domain-controllers/user-rights/configure-ura-seremoteshutdownprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-seremoteshutdownprivilege.md The SeRemoteShutdownPrivilege allows a user authenticating over the network to invoke remote system shutdown and reboot APIs (such as InitiateSystemShutdownEx or shutdown.exe /m \\computer). This function is exposed over named pipe \PIPE\InitShutdown and RPC interface winreg/shutdown. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Force shutdown from a remote system`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeRemoteShutdownPrivilege.ps1 # Configure-UraSeRemoteShutdownPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seremoteshutdownprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seremoteshutdownprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRemoteShutdownPrivilege\s*=") { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRemoteShutdownPrivilege = *S-1-5-32-544") } else { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeRemoteShutdownPrivilegeStatus.ps1 # Get-UraSeRemoteShutdownPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seremoteshutdownprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeRemoteShutdownPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeRemoteShutdownPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seremoteshutdownprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seremoteshutdownprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRemoteShutdownPrivilege\s*=") { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRemoteShutdownPrivilege = *S-1-5-32-544") } else { $NewLines += "SeRemoteShutdownPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-104](../../07-paws/user-rights/configure-ura-seimpersonateprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-seimpersonateprivilege.md The SeImpersonatePrivilege grants a program the ability to impersonate a client that has connected to its local RPC interfaces, named pipes, or COM servers via ImpersonateNamedPipeClient, CoImpersonateClient, or RpcImpersonateClient. Impersonation allows a server process to temporarily run in the security context of the calling client to verify access permissions. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Impersonate a client after authentication`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-19 (LocalService), *S-1-5-20 (NetworkService), *S-1-5-32-544 (Administrators), *S-1-5-6 (Service). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeImpersonatePrivilege.ps1 # Configure-UraSeImpersonatePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seimpersonateprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seimpersonateprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeImpersonatePrivilege\s*=") { $NewLines += "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6") } else { $NewLines += "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeImpersonatePrivilegeStatus.ps1 # Get-UraSeImpersonatePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seimpersonateprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeImpersonatePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeImpersonatePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seimpersonateprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seimpersonateprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeImpersonatePrivilege\s*=") { $NewLines += "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6") } else { $NewLines += "SeImpersonatePrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-seincreasebasepriorityprivilege.md The SeIncreaseBasePriorityPrivilege allows a process to raise the execution priority class of a process or thread via SetPriorityClass to REALTIME_PRIORITY_CLASS. The Windows kernel thread scheduler gives realtime priority threads preemption authority over virtually all other system threads, including device driver deferred procedure calls (DPCs) and operating system subsystem threads. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Increase scheduling priority`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators), *S-1-5-90-0 (Window Manager Group). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeIncreaseBasePriorityPrivilege.ps1 # Configure-UraSeIncreaseBasePriorityPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seincreasebasepriorityprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seincreasebasepriorityprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeIncreaseBasePriorityPrivilege\s*=") { $NewLines += "SeIncreaseBasePriorityPrivilege = *S-1-5-32-544,*S-1-5-90-0" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeIncreaseBasePriorityPrivilege = *S-1-5-32-544,*S-1-5-90-0") } else { $NewLines += "SeIncreaseBasePriorityPrivilege = *S-1-5-32-544,*S-1-5-90-0" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeIncreaseBasePriorityPrivilegeStatus.ps1 # Get-UraSeIncreaseBasePriorityPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seincreasebasepriorityprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeIncreaseBasePriorityPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544,*S-1-5-90-0" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeIncreaseBasePriorityPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seincreasebasepriorityprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seincreasebasepriorityprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeIncreaseBasePriorityPrivilege\s*=") { $NewLines += "SeIncreaseBasePriorityPrivilege = *S-1-5-32-544,*S-1-5-90-0" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeIncreaseBasePriorityPrivilege = *S-1-5-32-544,*S-1-5-90-0") } else { $NewLines += "SeIncreaseBasePriorityPrivilege = *S-1-5-32-544,*S-1-5-90-0" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-105](../../07-paws/user-rights/configure-ura-seloaddriverprivilege.md)). (For Domain Controllers, refer to [REQ-DC-125](../../02-domain-controllers/user-rights/configure-ura-seloaddriverprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-seloaddriverprivilege.md The SeLoadDriverPrivilege allows a process to dynamically load and unload kernel-mode device drivers (.sys files) via NtLoadDriver or the Service Control Manager (CreateService with SERVICE_KERNEL_DRIVER). Kernel-mode drivers execute in Ring 0 with unrestricted hardware access, full kernel memory read/write permissions, and the ability to execute any CPU instruction. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Load and unload device drivers`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeLoadDriverPrivilege.ps1 # Configure-UraSeLoadDriverPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seloaddriverprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seloaddriverprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLoadDriverPrivilege\s*=") { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLoadDriverPrivilege = *S-1-5-32-544") } else { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeLoadDriverPrivilegeStatus.ps1 # Get-UraSeLoadDriverPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seloaddriverprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeLoadDriverPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeLoadDriverPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seloaddriverprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seloaddriverprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLoadDriverPrivilege\s*=") { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLoadDriverPrivilege = *S-1-5-32-544") } else { $NewLines += "SeLoadDriverPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-106](../../07-paws/user-rights/configure-ura-selockmemoryprivilege.md)). (For Domain Controllers, refer to [REQ-DC-126](../../02-domain-controllers/user-rights/configure-ura-selockmemoryprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-selockmemoryprivilege.md The SeLockMemoryPrivilege allows a process to lock physical memory pages in RAM using APIs such as VirtualLock and Address Windowing Extensions (AWE) via AllocateUserPhysicalPages. Locking pages prevents the Windows virtual memory manager from paging data out to disk in pagefile.sys, ensuring high-performance memory retention. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Lock pages in memory`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeLockMemoryPrivilege.ps1 # Configure-UraSeLockMemoryPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_selockmemoryprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_selockmemoryprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLockMemoryPrivilege\s*=") { $NewLines += "SeLockMemoryPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLockMemoryPrivilege = ") } else { $NewLines += "SeLockMemoryPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeLockMemoryPrivilegeStatus.ps1 # Get-UraSeLockMemoryPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_selockmemoryprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeLockMemoryPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeLockMemoryPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_selockmemoryprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_selockmemoryprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeLockMemoryPrivilege\s*=") { $NewLines += "SeLockMemoryPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeLockMemoryPrivilege = ") } else { $NewLines += "SeLockMemoryPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-107](../../07-paws/user-rights/configure-ura-sesecurityprivilege.md)). (For Domain Controllers, refer to [REQ-DC-129](../../02-domain-controllers/user-rights/configure-ura-sesecurityprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-sesecurityprivilege.md The SeSecurityPrivilege controls access to the Windows Security Event Log (Security.evtx) and governs the ability to view, configure, and clear the security log, as well as specify object auditing options (System Access Control Lists - SACLs) on files, registry keys, and directory objects via ACCESS_SYSTEM_SECURITY. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Manage auditing and security log`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeSecurityPrivilege.ps1 # Configure-UraSeSecurityPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesecurityprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesecurityprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSecurityPrivilege\s*=") { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSecurityPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeSecurityPrivilegeStatus.ps1 # Get-UraSeSecurityPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesecurityprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSecurityPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeSecurityPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesecurityprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesecurityprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSecurityPrivilege\s*=") { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSecurityPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSecurityPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-108](../../07-paws/user-rights/configure-ura-sesystemenvironmentprivilege.md)). (For Domain Controllers, refer to [REQ-DC-130](../../02-domain-controllers/user-rights/configure-ura-sesystemenvironmentprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-sesystemenvironmentprivilege.md The SeSystemEnvironmentPrivilege allows a process to query and modify Non-Volatile RAM (NVRAM) firmware environment variables via Win32 APIs GetFirmwareEnvironmentVariable and SetFirmwareEnvironmentVariable. NVRAM variables govern UEFI boot sequences, Secure Boot policies, boot configuration data (BCD) handoffs, and hardware configuration flags. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Modify firmware environment values`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeSystemEnvironmentPrivilege.ps1 # Configure-UraSeSystemEnvironmentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemenvironmentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemenvironmentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemEnvironmentPrivilege\s*=") { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemEnvironmentPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeSystemEnvironmentPrivilegeStatus.ps1 # Get-UraSeSystemEnvironmentPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesystemenvironmentprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSystemEnvironmentPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeSystemEnvironmentPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemenvironmentprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemenvironmentprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemEnvironmentPrivilege\s*=") { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemEnvironmentPrivilege = *S-1-5-32-544") } else { $NewLines += "SeSystemEnvironmentPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-109](../../07-paws/user-rights/configure-ura-semanagevolumeprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-semanagevolumeprivilege.md The SeManageVolumePrivilege allows a process to perform low-level disk and volume maintenance tasks, including running defragmentation tools, modifying volume quotas, and invoking the SetFileValidData Win32 API. The SetFileValidData function allows a caller to extend the valid data length of an allocated file without zeroing out the intervening disk clusters. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Perform volume maintenance tasks`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeManageVolumePrivilege.ps1 # Configure-UraSeManageVolumePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_semanagevolumeprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_semanagevolumeprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeManageVolumePrivilege\s*=") { $NewLines += "SeManageVolumePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeManageVolumePrivilege = *S-1-5-32-544") } else { $NewLines += "SeManageVolumePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeManageVolumePrivilegeStatus.ps1 # Get-UraSeManageVolumePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_semanagevolumeprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeManageVolumePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeManageVolumePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_semanagevolumeprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_semanagevolumeprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeManageVolumePrivilege\s*=") { $NewLines += "SeManageVolumePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeManageVolumePrivilege = *S-1-5-32-544") } else { $NewLines += "SeManageVolumePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-110](../../07-paws/user-rights/configure-ura-seprofilesingleprocessprivilege.md)). (For Domain Controllers, refer to [REQ-DC-131](../../02-domain-controllers/user-rights/configure-ura-seprofilesingleprocessprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-seprofilesingleprocessprivilege.md The SeProfileSingleProcessPrivilege allows a process to monitor and profile the performance and execution metrics of non-system processes using Windows performance sampling APIs. Profiling tools monitor instruction execution rates, thread context switches, memory cache behavior, and execution sampling. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Profile single process`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeProfileSingleProcessPrivilege.ps1 # Configure-UraSeProfileSingleProcessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seprofilesingleprocessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seprofilesingleprocessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeProfileSingleProcessPrivilege\s*=") { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeProfileSingleProcessPrivilege = *S-1-5-32-544") } else { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeProfileSingleProcessPrivilegeStatus.ps1 # Get-UraSeProfileSingleProcessPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seprofilesingleprocessprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeProfileSingleProcessPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeProfileSingleProcessPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seprofilesingleprocessprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seprofilesingleprocessprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeProfileSingleProcessPrivilege\s*=") { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeProfileSingleProcessPrivilege = *S-1-5-32-544") } else { $NewLines += "SeProfileSingleProcessPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-sesystemprofileprivilege.md The SeSystemProfilePrivilege allows a process to use performance monitoring tools to sample and profile operating system-wide and kernel-level performance via Windows tracing APIs and hardware performance counters. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Profile system performance`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators), *S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420 (WdiServiceHost). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeSystemProfilePrivilege.ps1 # Configure-UraSeSystemProfilePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemprofileprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemprofileprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemProfilePrivilege\s*=") { $NewLines += "SeSystemProfilePrivilege = *S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemProfilePrivilege = *S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420") } else { $NewLines += "SeSystemProfilePrivilege = *S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeSystemProfilePrivilegeStatus.ps1 # Get-UraSeSystemProfilePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sesystemprofileprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeSystemProfilePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeSystemProfilePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sesystemprofileprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_sesystemprofileprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeSystemProfilePrivilege\s*=") { $NewLines += "SeSystemProfilePrivilege = *S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeSystemProfilePrivilege = *S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420") } else { $NewLines += "SeSystemProfilePrivilege = *S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-seassignprimarytokenprivilege.md The SeAssignPrimaryTokenPrivilege allows a process to assign a primary security access token to a newly initialized process via APIs such as CreateProcessAsUser or SetInformationJobObject. In the Windows NT security architecture, every process runs under a primary token that defines its user SID, group memberships, privileges, and Mandatory Integrity Control (MIC) level. Under normal conditions, child processes automatically inherit a duplicate of the parent process primary token. When a process holds SeAssignPrimaryTokenPrivilege, it can substitute an arbitrary primary token obtained from another session, service, or authentication handshake, effectively launching programs under the security context of any arbitrary user or the local SYSTEM account. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Replace a process-level token`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-19 (LocalService), *S-1-5-20 (NetworkService). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeAssignPrimaryTokenPrivilege.ps1 # Configure-UraSeAssignPrimaryTokenPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seassignprimarytokenprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seassignprimarytokenprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeAssignPrimaryTokenPrivilege\s*=") { $NewLines += "SeAssignPrimaryTokenPrivilege = *S-1-5-19,*S-1-5-20" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeAssignPrimaryTokenPrivilege = *S-1-5-19,*S-1-5-20") } else { $NewLines += "SeAssignPrimaryTokenPrivilege = *S-1-5-19,*S-1-5-20" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeAssignPrimaryTokenPrivilegeStatus.ps1 # Get-UraSeAssignPrimaryTokenPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_seassignprimarytokenprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeAssignPrimaryTokenPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-19,*S-1-5-20" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeAssignPrimaryTokenPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_seassignprimarytokenprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_seassignprimarytokenprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeAssignPrimaryTokenPrivilege\s*=") { $NewLines += "SeAssignPrimaryTokenPrivilege = *S-1-5-19,*S-1-5-20" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeAssignPrimaryTokenPrivilege = *S-1-5-19,*S-1-5-20") } else { $NewLines += "SeAssignPrimaryTokenPrivilege = *S-1-5-19,*S-1-5-20" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-111](../../07-paws/user-rights/configure-ura-serestoreprivilege.md)). (For Domain Controllers, refer to [REQ-DC-132](../../02-domain-controllers/user-rights/configure-ura-serestoreprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-serestoreprivilege.md The SeRestorePrivilege grants the caller the capability to bypass all write-access security controls (DACLs) across the entire NTFS filesystem and Windows Registry. When a process opens a file or registry key handle specifying FILE_FLAG_BACKUP_SEMANTICS in Win32 APIs, the kernel explicitly bypasses standard security descriptor DACL checks, allowing the process to write to, overwrite, or delete any file or key on the system. In addition, this privilege grants the ability to set any valid user or group SID as the owner of an object. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Restore files and directories`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeRestorePrivilege.ps1 # Configure-UraSeRestorePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_serestoreprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_serestoreprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRestorePrivilege\s*=") { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRestorePrivilege = *S-1-5-32-544") } else { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeRestorePrivilegeStatus.ps1 # Get-UraSeRestorePrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_serestoreprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeRestorePrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeRestorePrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_serestoreprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_serestoreprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRestorePrivilege\s*=") { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRestorePrivilege = *S-1-5-32-544") } else { $NewLines += "SeRestorePrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-112](../../07-paws/user-rights/configure-ura-setakeownershipprivilege.md)). (For Domain Controllers, refer to [REQ-DC-135](../../02-domain-controllers/user-rights/configure-ura-setakeownershipprivilege.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-setakeownershipprivilege.md The SeTakeOwnershipPrivilege allows a user to take ownership of any securable object in the operating system (files, directories, registry keys, Active Directory objects, printers, services) by writing the caller's SID into the object security descriptor owner field via SetNamedSecurityInfo or SetSecurityInfo. The Windows security model grants the owner of an object implicit WRITE_DAC authority. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Take ownership of files or other objects`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-32-544 (Administrators). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeTakeOwnershipPrivilege.ps1 # Configure-UraSeTakeOwnershipPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setakeownershipprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setakeownershipprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTakeOwnershipPrivilege\s*=") { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTakeOwnershipPrivilege = *S-1-5-32-544") } else { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeTakeOwnershipPrivilegeStatus.ps1 # Get-UraSeTakeOwnershipPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_setakeownershipprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeTakeOwnershipPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-32-544" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeTakeOwnershipPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_setakeownershipprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_setakeownershipprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeTakeOwnershipPrivilege\s*=") { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeTakeOwnershipPrivilege = *S-1-5-32-544") } else { $NewLines += "SeTakeOwnershipPrivilege = *S-1-5-32-544" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-serelabelprivilege.md The SeRelabelPrivilege controls the ability to modify the Mandatory Integrity Control (MIC) label of securable objects via SetKernelObjectSecurity or SetNamedSecurityInfo. Windows Mandatory Integrity Control defines four primary integrity levels: Low, Medium, High, and System. MIC enforces 'No Write Up' rules, preventing a process running at a lower integrity level from writing to or modifying objects at a higher integrity level. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Modify an object label`. Select the Define these policy settings check box. Click Add User or Group... and ensure the principal list is empty (or remove all assigned accounts/groups so that no principals are configured). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeRelabelPrivilege.ps1 # Configure-UraSeRelabelPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_serelabelprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_serelabelprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRelabelPrivilege\s*=") { $NewLines += "SeRelabelPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRelabelPrivilege = ") } else { $NewLines += "SeRelabelPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeRelabelPrivilegeStatus.ps1 # Get-UraSeRelabelPrivilegeStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_serelabelprivilege.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeRelabelPrivilege\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeRelabelPrivilege.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_serelabelprivilege.cfg" $DbFile = Join-Path $SecTempDir "secedit_serelabelprivilege.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeRelabelPrivilege\s*=") { $NewLines += "SeRelabelPrivilege = " $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeRelabelPrivilege = ") } else { $NewLines += "SeRelabelPrivilege = " } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-113](../../07-paws/user-rights/configure-ura-sedenynetworklogonright.md)). (For Domain Controllers, refer to [REQ-DC-117](../../02-domain-controllers/user-rights/configure-ura-sedenynetworklogonright.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-sedenynetworklogonright.md The SeDenyNetworkLogonRight explicitly prevents specified security principals from authenticating over network protocols (SMB, RPC, WMI, WinRM, LDAP, etc. - Logon Type 3). Network logons represent the primary highway for lateral movement and remote compromise in Active Directory environments. Enforcing an explicit deny stops network authentication regardless of share-level or NTFS-level permissions. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Deny access to this computer from the network`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-113 (Local Account), *S-1-5-114 (Local Account and member of Administrators group). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeDenyNetworkLogonRight.ps1 # Configure-UraSeDenyNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenynetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenynetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyNetworkLogonRight\s*=") { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114") } else { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeDenyNetworkLogonRightStatus.ps1 # Get-UraSeDenyNetworkLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedenynetworklogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDenyNetworkLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-113,*S-1-5-114" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeDenyNetworkLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenynetworklogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenynetworklogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyNetworkLogonRight\s*=") { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114") } else { $NewLines += "SeDenyNetworkLogonRight = *S-1-5-113,*S-1-5-114" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-114](../../07-paws/user-rights/configure-ura-sedenyremoteinteractivelogonright.md)). (For Domain Controllers, refer to [REQ-DC-121](../../02-domain-controllers/user-rights/configure-ura-sedenyremoteinteractivelogonright.md)). Operating Systems: Windows 10 Enterprise/Professional (1809 and above), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-rights/configure-ura-sedenyremoteinteractivelogonright.md The SeDenyRemoteInteractiveLogonRight explicitly denies designated accounts the ability to establish Remote Desktop Protocol (RDP) sessions (Logon Type 10) on the target system. RDP exposes a full graphical interactive session over TCP port 3389, providing an attacker with interactive desktop capabilities and loading user credentials into memory. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Navigate to the targeted GPO linked to Tier 2 systems (e.g., GPO_Hardening_Endpoints). In the console tree, browse to: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment Open the policy `Deny log on through Remote Desktop Services`. Select the Define these policy settings check box. Configure the security principal allocation to: *S-1-5-113 (Local Account), *S-1-5-114 (Local Account and member of Administrators group). Click Apply and OK. Apply and verify policy enforcement across target hosts using gpupdate /force and inspect with secedit /export /cfg C:\Windows\Temp\sec_audit.cfg. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-UraSeDenyRemoteInteractiveLogonRight.ps1 # Configure-UraSeDenyRemoteInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyremoteinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyremoteinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyRemoteInteractiveLogonRight\s*=") { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114") } else { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue To audit the hardening status: Download Script: Get-UraSeDenyRemoteInteractiveLogonRightStatus.ps1 # Get-UraSeDenyRemoteInteractiveLogonRightStatus.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_audit_sedenyremoteinteractivelogonright.cfg" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Write-Output "Non-Compliant" exit 1 } $ConfigText = Get-Content -Path $CfgFile -Raw Remove-Item -Path $CfgFile -ErrorAction SilentlyContinue $Match = $ConfigText -match "(?mi)^\s*SeDenyRemoteInteractiveLogonRight\s*=\s*(.*)$" $CurrentValue = "" if ($Match) { $CurrentValue = $Matches[1].Trim() } $Expected = "*S-1-5-113,*S-1-5-114" if ($CurrentValue -eq $Expected) { Write-Output "Compliant" exit 0 } else { Write-Output "Non-Compliant" exit 1 } # Configure-UraSeDenyRemoteInteractiveLogonRight.ps1 $SecTempDir = Join-Path $env:TEMP "SecurityTemplates" if (-not (Test-Path $SecTempDir)) { New-Item -Path $SecTempDir -ItemType Directory -Force | Out-Null } $CfgFile = Join-Path $SecTempDir "ura_sedenyremoteinteractivelogonright.cfg" $DbFile = Join-Path $SecTempDir "secedit_sedenyremoteinteractivelogonright.sdb" $LogFile = Join-Path $SecTempDir "secedit.log" $Process = Start-Process secedit -ArgumentList "/export /cfg `"$CfgFile`"" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -ne 0) { Throw "Failed to export security template" } $ConfigText = Get-Content -Path $CfgFile -Raw if ($ConfigText -notmatch "\[Privilege Rights\]") { $ConfigText += "`r`n[Privilege Rights]`r`n" } $Lines = $ConfigText -split "`r?`n" $NewLines = @() $InPriv = $false $KeyAdded = $false foreach ($Line in $Lines) { if ($Line -match "^\[(.*)\]$") { if ($Matches[1] -eq "Privilege Rights") { $InPriv = $true } else { $InPriv = $false } } if ($InPriv -and $Line -match "^\s*SeDenyRemoteInteractiveLogonRight\s*=") { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114" $KeyAdded = $true } else { $NewLines += $Line } } if (-not $KeyAdded) { # Find Privilege Rights section index and insert it right after $Idx = $NewLines.IndexOf("[Privilege Rights]") if ($Idx -ge 0) { $NewLines.Insert($Idx + 1, "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114") } else { $NewLines += "SeDenyRemoteInteractiveLogonRight = *S-1-5-113,*S-1-5-114" } } $NewLines | Set-Content -Path $CfgFile -Force $Proc = Start-Process secedit -ArgumentList "/configure /db `"$DbFile`" /cfg `"$CfgFile`" /areas USER_RIGHTS /log `"$LogFile`"" -Wait -NoNewWindow -PassThru if ($Proc.ExitCode -ne 0) { Throw "Failed to configure secedit user rights" } Remove-Item -Path $CfgFile, $DbFile -ErrorAction SilentlyContinue Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-115](../../07-paws/user-profile/configure-up-toast-notifications.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-toast-notifications.md Modern desktop applications, productivity suites (Microsoft Teams, Outlook), communication channels, and identity tools routinely utilize Windows Push Notifications to display pop-up "toast" notification banners on the screen. By default, Windows allows applications to surface these notification banners "above the lock screen," presenting a major physical data leakage and credential compromise vulnerability. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: User Configuration \ Administrative Templates \ Start Menu and Taskbar \ Notifications Double-click Turn off toast notifications on the lock screen and set it to Enabled. (Optional Defense-in-Depth) Navigate to: Computer Configuration \ Administrative Templates \ System \ Logon Set Turn off app notifications on the lock screen to Enabled*. Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable toast notifications on the lock screen: Download Script: Configure-Uptoastnotifications.ps1 # Configure-Uptoastnotifications.ps1 Write-Host "Applying User Profile restriction: toast-notifications..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "NoToastApplicationNotificationOnLockScreen" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } To audit the hardening status: Download Script: Get-UptoastnotificationsStatus.ps1 # Get-UptoastnotificationsStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Uptoastnotifications.ps1 Write-Host "Applying User Profile restriction: toast-notifications..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" "NoToastApplicationNotificationOnLockScreen" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "NoToastApplicationNotificationOnLockScreen" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-116](../../07-paws/user-profile/configure-up-spotlight-consumer.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-spotlight-consumer.md Windows consumer experiences and Windows Spotlight are cloud-integrated features designed to deliver targeted application suggestions, promotional tiles, interactive lock screen imagery, and tips to consumer endpoints. In an enterprise Active Directory domain, these features introduce significant threat surfaces, outbound network connections, and unapproved software provisioning. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Cloud Content Turn off Microsoft consumer experiences: Set to Enabled Navigate to: User Configuration \ Administrative Templates \ Windows Components \ Cloud Content Do not show third-party suggestions in Windows spotlight: Set to Enabled Configure Windows spotlight on lock screen: Set to Disabled Turn off Windows spotlight on desktop: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure Spotlight and Consumer Features restrictions: Download Script: Configure-Upspotlightconsumer.ps1 # Configure-Upspotlightconsumer.ps1 Write-Host "Applying User Profile restriction: spotlight-consumer..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableThirdPartySuggestions" "1" "DWord" Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "ConfigureWindowsSpotlight" "2" "DWord" Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableSpotlightCollectionOnDesktop" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableWindowsConsumerFeatures" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "DisableThirdPartySuggestions" -Value "1" -Type DWord -Force Set-ItemProperty -Path $DefaultKey -Name "ConfigureWindowsSpotlight" -Value "2" -Type DWord -Force Set-ItemProperty -Path $DefaultKey -Name "DisableSpotlightCollectionOnDesktop" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } To audit the hardening status: Download Script: Get-UpspotlightconsumerStatus.ps1 # Get-UpspotlightconsumerStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableThirdPartySuggestions" "1" Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "ConfigureWindowsSpotlight" "2" Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableSpotlightCollectionOnDesktop" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableWindowsConsumerFeatures" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Upspotlightconsumer.ps1 Write-Host "Applying User Profile restriction: spotlight-consumer..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableThirdPartySuggestions" "1" "DWord" Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "ConfigureWindowsSpotlight" "2" "DWord" Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\CloudContent" "DisableSpotlightCollectionOnDesktop" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableWindowsConsumerFeatures" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\CloudContent" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "DisableThirdPartySuggestions" -Value "1" -Type DWord -Force Set-ItemProperty -Path $DefaultKey -Name "ConfigureWindowsSpotlight" -Value "2" -Type DWord -Force Set-ItemProperty -Path $DefaultKey -Name "DisableSpotlightCollectionOnDesktop" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-117](../../07-paws/user-profile/configure-up-windows-copilot.md)). Operating Systems: Windows 11 Enterprise/Pro (all supported builds), Windows 10 Enterprise (where Copilot components are backported). File Path: 08-endpoints/user-profile/configure-up-windows-copilot.md Windows Copilot is an artificial intelligence assistant deeply integrated into the Windows 11 desktop shell, Edge browser runtime, and search experience. Copilot utilizes cloud-hosted large language models (LLMs) to synthesize user requests, summarize screen contents, and assist with desktop workflows. In an enterprise environment, unconstrained deployment of generative AI interfaces introduces critical data loss prevention (DLP), regulatory compliance, and credential exposure hazards. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: User Configuration \ Administrative Templates \ Windows Components \ Windows Copilot Turn off Windows Copilot: Set to Enabled Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Copilot Turn off Windows Copilot: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable Windows Copilot: Download Script: Configure-Upwindowscopilot.ps1 # Configure-Upwindowscopilot.ps1 Write-Host "Applying User Profile restriction: windows-copilot..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\WindowsCopilot" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "TurnOffWindowsCopilot" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } To audit the hardening status: Download Script: Get-UpwindowscopilotStatus.ps1 # Get-UpwindowscopilotStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Upwindowscopilot.ps1 Write-Host "Applying User Profile restriction: windows-copilot..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot" "TurnOffWindowsCopilot" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Policies\Microsoft\Windows\WindowsCopilot" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "TurnOffWindowsCopilot" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-118](../../07-paws/user-profile/configure-up-inplace-sharing.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-inplace-sharing.md In modern versions of Windows, File Explorer incorporates the "In-Place Sharing" framework (also known as the Share Flyout or Share Charm). This mechanism provides users with a persistent "Share" button on the Explorer ribbon and context menu, allowing files to be directly broadcasted or transmitted to third-party applications, personal email accounts, social media platforms, or nearby devices via Nearby Sharing (Bluetooth and Wi-Fi Direct). Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: User Configuration \ Administrative Templates \ Windows Components \ File Explorer Turn off in-place sharing: Set to Enabled Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ File Explorer Turn off in-place sharing: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable in-place sharing: Download Script: Configure-Upinplacesharing.ps1 # Configure-Upinplacesharing.ps1 Write-Host "Applying User Profile restriction: inplace-sharing..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "NoInplaceSharing" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } To audit the hardening status: Download Script: Get-UpinplacesharingStatus.ps1 # Get-UpinplacesharingStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKCU:" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Upinplacesharing.ps1 Write-Host "Applying User Profile restriction: inplace-sharing..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKCU:" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoInplaceSharing" "1" "DWord" # Apply to Default User profile for new sessions $DefaultHivePath = "C:\Users\Default\NTUSER.DAT" if (Test-Path $DefaultHivePath) { reg load HKU\DefaultUser $DefaultHivePath | Out-Null $DefaultKey = "Registry::HKU\DefaultUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" if (-not (Test-Path $DefaultKey)) { New-Item -Path $DefaultKey -Force | Out-Null } Set-ItemProperty -Path $DefaultKey -Name "NoInplaceSharing" -Value "1" -Type DWord -Force [GC]::Collect() [GC]::WaitForPendingFinalizers() reg unload HKU\DefaultUser | Out-Null } Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-119](../../07-paws/user-profile/configure-up-runas-suppression.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-runas-suppression.md In default Windows configurations, holding the Shift key while right-clicking an executable (.exe), command file (.cmd), batch script (.bat), or Microsoft Management Console file (.msc) exposes the "Run as different user" shell context menu command verb (runasuser). This feature encourages an anti-pattern that directly violates enterprise credential hygiene and exposes high-privilege credentials to theft on standard workstations. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Create four Registry Items with the following parameters: Action*: Update Hive*: HKEY_LOCAL_MACHINE Value Name*: SuppressionPolicy Value Type*: REG_DWORD Value Data*: 4096 Key Paths*: * SOFTWARE\Classes\batfile\shell\runasuser * SOFTWARE\Classes\cmdfile\shell\runasuser * SOFTWARE\Classes\exefile\shell\runasuser * SOFTWARE\Classes\mscfile\shell\runasuser Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure Shell RunAs User suppression: Download Script: Configure-Uprunassuppression.ps1 # Configure-Uprunassuppression.ps1 Write-Host "Applying User Profile restriction: runas-suppression..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Classes\batfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\cmdfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\exefile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\mscfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" To audit the hardening status: Download Script: Get-UprunassuppressionStatus.ps1 # Get-UprunassuppressionStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Classes\batfile\shell\runasuser" "SuppressionPolicy" "4096" Test-RegValue "HKLM:" "SOFTWARE\Classes\cmdfile\shell\runasuser" "SuppressionPolicy" "4096" Test-RegValue "HKLM:" "SOFTWARE\Classes\exefile\shell\runasuser" "SuppressionPolicy" "4096" Test-RegValue "HKLM:" "SOFTWARE\Classes\mscfile\shell\runasuser" "SuppressionPolicy" "4096" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Uprunassuppression.ps1 Write-Host "Applying User Profile restriction: runas-suppression..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Classes\batfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\cmdfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\exefile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Classes\mscfile\shell\runasuser" "SuppressionPolicy" "4096" "DWord" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-120](../../07-paws/user-profile/configure-up-personalization-privacy.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-personalization-privacy.md Windows personalization and input learning features enhance the consumer user experience by providing voice activation, dynamic lock screen slideshows, camera access, and predictive typing. In an enterprise security environment, these unauthenticated and telemetry-driven features introduce physical reconnaissance vulnerabilities, memory corruption attack surfaces, and persistent keystroke data collection. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration \ Administrative Templates \ Control Panel \ Personalization Prevent enabling lock screen camera: Set to Enabled Prevent enabling lock screen slide show: Set to Enabled Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ App Privacy Let Windows apps activate with voice above lock: Set to Enabled In the drop-down menu, select: Force Deny Navigate to: Computer Configuration \ Administrative Templates \ Control Panel \ Regional and Language Options \ Handwriting personalization Turn off automatic learning: Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Personalization and Privacy restrictions: Download Script: Configure-Uppersonalizationprivacy.ps1 # Configure-Uppersonalizationprivacy.ps1 Write-Host "Applying User Profile restriction: personalization-privacy..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenCamera" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenSlideshow" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" "LetAppsActivateWithVoiceAboveLock" "2" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\InputPersonalization" "AllowInputPersonalization" "0" "DWord" To audit the hardening status: Download Script: Get-UppersonalizationprivacyStatus.ps1 # Get-UppersonalizationprivacyStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenCamera" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenSlideshow" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" "LetAppsActivateWithVoiceAboveLock" "2" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\InputPersonalization" "AllowInputPersonalization" "0" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Uppersonalizationprivacy.ps1 Write-Host "Applying User Profile restriction: personalization-privacy..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenCamera" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Personalization" "NoLockScreenSlideshow" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" "LetAppsActivateWithVoiceAboveLock" "2" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\InputPersonalization" "AllowInputPersonalization" "0" "DWord" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to reciprocal baseline [REQ-PAW-121](../../07-paws/user-profile/configure-up-gp-processing.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-gp-processing.md Group Policy processing in Windows relies on Client-Side Extensions (CSEs). Each CSE is registered under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions with a unique GUID. The GUID {35378EAC-683F-11D2-A89A-00C04FBBCFA2} represents the primary Registry Client-Side Extension (gptext.dll), which is responsible for applying Administrative Templates (.admx/.adml policies) and direct registry modifications defined across applied Group Policy Objects. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Administrative Templates \ System \ Group Policy Double-click Configure Registry policy processing and configure: Select Enabled Check Process even if the Group Policy objects have not changed Ensure Do not apply during periodic background processing is unchecked Link the GPO to the appropriate Organizational Unit and verify policy propagation using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the Registry CSE processing behaviors: Download Script: Configure-Upgpprocessing.ps1 # Configure-Upgpprocessing.ps1 Write-Host "Applying User Profile restriction: gp-processing..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoBackgroundPolicy" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoGPOListChanges" "0" "DWord" To audit the hardening status: Download Script: Get-UpgpprocessingStatus.ps1 # Get-UpgpprocessingStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoBackgroundPolicy" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoGPOListChanges" "0" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Upgpprocessing.ps1 Write-Host "Applying User Profile restriction: gp-processing..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoBackgroundPolicy" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" "NoGPOListChanges" "0" "DWord" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to reciprocal baseline [REQ-PAW-122](../../07-paws/user-profile/configure-up-telemetry-inventory.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-telemetry-inventory.md Modern Windows operating systems include background diagnostic, telemetry, and inventory scanning subsystems designed to evaluate system health, application compatibility, and user experience telemetry. These subsystems are driven primarily by the Connected User Experiences and Telemetry service (DiagTrack) and the Microsoft Compatibility Appraiser scheduled task (CompatTelRunner.exe). While helpful in consumer environments, uncontrolled inventory collection and extensive diagnostic data uploads introduce distinct operational and security risks in hardened enterprise deployments. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Application Compatibility Double-click Turn off Inventory Collector -> Select Enabled*. Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Data Collection and Preview Builds Double-click Allow Diagnostic Data (or Allow Telemetry ) -> Select Enabled , and choose Send required diagnostic data (or 1 - Basic*). Double-click Limit Enhanced diagnostic data to the minimum required by Windows Analytics -> Select Enabled*. Link the GPO to the target Organizational Unit and enforce policy application with gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce inventory and telemetry restrictions: Download Script: Configure-Uptelemetryinventory.ps1 # Configure-Uptelemetryinventory.ps1 Write-Host "Applying User Profile restriction: telemetry-inventory..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppCompat" "DisableInventory" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "AllowTelemetry" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "LimitEnhancedDiagnosticDataWindowsAnalytics" "1" "DWord" To audit the hardening status: Download Script: Get-UptelemetryinventoryStatus.ps1 # Get-UptelemetryinventoryStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppCompat" "DisableInventory" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "AllowTelemetry" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "LimitEnhancedDiagnosticDataWindowsAnalytics" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Uptelemetryinventory.ps1 Write-Host "Applying User Profile restriction: telemetry-inventory..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\AppCompat" "DisableInventory" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "AllowTelemetry" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\DataCollection" "LimitEnhancedDiagnosticDataWindowsAnalytics" "1" "DWord" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-123](../../07-paws/user-profile/configure-up-explorer-security.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-explorer-security.md Windows File Explorer (explorer.exe) is the primary interactive user shell and file management environment in Windows. Because Explorer regularly parses untrusted file metadata, extracts icon caches, hosts third-party shell preview handlers, and processes custom URL protocol schemes, it represents a prime target for memory corruption exploits and arbitrary command execution. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ File Explorer Configure the following policies: Turn off Data Execution Prevention for Explorer : Set to Disabled Turn off heap termination on corruption : Set to Disabled Shell Protocol Protected Mode : Set to Enabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Explorer security and memory protections: Download Script: Configure-Upexplorersecurity.ps1 # Configure-Upexplorersecurity.ps1 Write-Host "Applying User Profile restriction: explorer-security..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoDataExecutionPrevention" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoHeapTerminationOnCorruption" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "PreXPSP2ShellProtocolBehavior" "0" "DWord" To audit the hardening status: Download Script: Get-UpexplorersecurityStatus.ps1 # Get-UpexplorersecurityStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoDataExecutionPrevention" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoHeapTerminationOnCorruption" "0" Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "PreXPSP2ShellProtocolBehavior" "0" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Upexplorersecurity.ps1 Write-Host "Applying User Profile restriction: explorer-security..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoDataExecutionPrevention" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Explorer" "NoHeapTerminationOnCorruption" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" "PreXPSP2ShellProtocolBehavior" "0" "DWord" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to reciprocal baseline [REQ-PAW-124](../../07-paws/user-profile/configure-up-ie-security.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-ie-security.md Although modern versions of Windows 10 and Windows 11 have retired the standalone Internet Explorer 11 browser in favor of Microsoft Edge (Chromium), core legacy components of the Trident engine (mshtml.dll), the Windows Internet API (wininet.dll), URLMon, and the Windows RSS Platform (msfeeds.dll, msfeedssync.exe) remain deeply embedded in the operating system. These legacy subsystems are maintained for backward compatibility with legacy COM automation, WebBrowser controls, and internal enterprise tools. Because these legacy components remain active in the background, they represent a persistent attack surface if left unconfigured. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Internet Explorer Double-click Disable Internet Explorer 11 as a standalone browser -> Set to Enabled , and select Always*. Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ RSS Feeds Double-click Prevent downloading of enclosures -> Set to Enabled*. Double-click Turn on Basic feed authentication over HTTP -> Set to Disabled*. Link the GPO to the target Organizational Unit and enforce policy application with gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure Internet Explorer and RSS feed security restrictions: Download Script: Configure-Upiesecurity.ps1 # Configure-Upiesecurity.ps1 Write-Host "Applying User Profile restriction: ie-security..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Main" "NotifyDisableIEOptions" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "DisableEnclosureDownload" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "AllowBasicAuthInClear" "0" "DWord" To audit the hardening status: Download Script: Get-UpiesecurityStatus.ps1 # Get-UpiesecurityStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Main" "NotifyDisableIEOptions" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "DisableEnclosureDownload" "1" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "AllowBasicAuthInClear" "0" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Upiesecurity.ps1 Write-Host "Applying User Profile restriction: ie-security..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Main" "NotifyDisableIEOptions" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "DisableEnclosureDownload" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" "AllowBasicAuthInClear" "0" "DWord" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-125](../../07-paws/user-profile/configure-up-logon-banners.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-logon-banners.md Interactive logon configurations govern the initial security boundary when an operator or user accesses the Windows console. Two critical security parameters are enforced: disabling Automatic Restart Sign-On (ARSO) to protect credentials in memory across reboots, and enforcing legally binding pre-logon warning banners to establish authorization boundaries and consent to monitoring. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Security Options Interactive logon: Message text for users attempting to log on: Enter organizational warning text (e.g., You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS, you consent to routine monitoring.) Interactive logon: Message title for users attempting to log on: Enter warning title (e.g., US Department of Defense Warning Statement) Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Logon Options Sign-in and lock last interactive user automatically after a restart or cold boot: Set to Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure Interactive Logon warning banners and disable ARSO: Download Script: Configure-Uplogonbanners.ps1 # Configure-Uplogonbanners.ps1 Write-Host "Applying User Profile restriction: logon-banners..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "DisableAutomaticRestartSignOn" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeText" "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS, you consent to routine monitoring." "String" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeCaption" "US Department of Defense Warning Statement" "String" To audit the hardening status: Download Script: Get-UplogonbannersStatus.ps1 # Get-UplogonbannersStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "DisableAutomaticRestartSignOn" "1" Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeText" "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS, you consent to routine monitoring." Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeCaption" "US Department of Defense Warning Statement" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Uplogonbanners.ps1 Write-Host "Applying User Profile restriction: logon-banners..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "DisableAutomaticRestartSignOn" "1" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeText" "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS, you consent to routine monitoring." "String" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "LegalNoticeCaption" "US Department of Defense Warning Statement" "String" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-126](../../07-paws/user-profile/configure-up-inactivity-timeout.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-inactivity-timeout.md In enterprise environments, authorized employees and operators frequently leave workstations unattended—to attend meetings, take breaks, or collaborate elsewhere in the facility. If a workstation remains unlocked while unattended, any individual with physical access to the machine can interact with the active user's session, execute unauthorized commands, exfiltrate sensitive files, or install persistence mechanisms without needing to authenticate. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Security Options Double-click Interactive logon: Machine inactivity limit and configure: Check Define this policy setting Set The machine will be locked after*: 900 seconds Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce the machine inactivity timeout limit: Download Script: Configure-Upinactivitytimeout.ps1 # Configure-Upinactivitytimeout.ps1 Write-Host "Applying User Profile restriction: inactivity-timeout..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "InactivityTimeoutSecs" "900" "DWord" To audit the hardening status: Download Script: Get-UpinactivitytimeoutStatus.ps1 # Get-UpinactivitytimeoutStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "InactivityTimeoutSecs" "900" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Upinactivitytimeout.ps1 Write-Host "Applying User Profile restriction: inactivity-timeout..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" "InactivityTimeoutSecs" "900" "DWord" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-127](../../07-paws/user-profile/configure-up-installer-hardening.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-installer-hardening.md Windows Installer (msiexec.exe) executes as a privileged Windows service (NT AUTHORITY\SYSTEM) to manage the installation, repair, and removal of software packages across the operating system. Misconfigurations in Windows Installer policies introduce some of the most critical, well-known Local Privilege Escalation (LPE) vulnerabilities in the Windows operating system. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Configure the following policies: Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Installer Always install with elevated privileges: Set to Disabled Allow user control over installs: Set to Disabled Navigate to: User Configuration \ Administrative Templates \ Windows Components \ Windows Installer Always install with elevated privileges: Set to Disabled Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Add Registry Item: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer\DisableCoInstallers = 1 (DWord) Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the Windows Installer hardening settings: Download Script: Configure-Upinstallerhardening.ps1 # Configure-Upinstallerhardening.ps1 Write-Host "Applying User Profile restriction: installer-hardening..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "EnableUserControl" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "AlwaysInstallElevated" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "SafeForScripting" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer" "DisableCoInstallers" "1" "DWord" To audit the hardening status: Download Script: Get-UpinstallerhardeningStatus.ps1 # Get-UpinstallerhardeningStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "EnableUserControl" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "AlwaysInstallElevated" "0" Test-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "SafeForScripting" "0" Test-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer" "DisableCoInstallers" "1" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Upinstallerhardening.ps1 Write-Host "Applying User Profile restriction: installer-hardening..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "EnableUserControl" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "AlwaysInstallElevated" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Policies\Microsoft\Windows\Installer" "SafeForScripting" "0" "DWord" Set-RegValue "HKLM:" "SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer" "DisableCoInstallers" "1" "DWord" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-128](../../07-paws/user-profile/configure-up-seclogon-service.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-up-seclogon-service.md The Secondary Logon service (seclogon.dll, executed within svchost.exe) provides the runtime infrastructure that enables the CreateProcessWithLogonW and CreateProcessWithTokenW Win32 APIs, powering the native Windows runas.exe utility and interactive "Run as different user" GUI options. While designed to facilitate administrative convenience, the Secondary Logon service introduces severe local privilege escalation risks and undermines enterprise credential tiering hygiene. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Windows Settings \ Security Settings \ System Services Double-click Secondary Logon and configure: Check Define this policy setting Select Disabled Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable the Secondary Logon service: Download Script: Configure-Upseclogonservice.ps1 # Configure-Upseclogonservice.ps1 Write-Host "Applying User Profile restriction: seclogon-service..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SYSTEM\CurrentControlSet\Services\seclogon" "Start" "4" "DWord" To audit the hardening status: Download Script: Get-UpseclogonserviceStatus.ps1 # Get-UpseclogonserviceStatus.ps1 $script:Vulnerable = $false function Test-RegValue { param ( [string]$hive, [string]$keyPath, [string]$name, [string]$expected ) $fullPath = "$hive\$keyPath" $val = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue $actual = if ($val) { $val.$name } else { "" } if ($actual -ne $expected) { $script:Vulnerable = $true } } Test-RegValue "HKLM:" "SYSTEM\CurrentControlSet\Services\seclogon" "Start" "4" if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-Upseclogonservice.ps1 Write-Host "Applying User Profile restriction: seclogon-service..." -ForegroundColor Cyan function Set-RegValue { [CmdletBinding(SupportsShouldProcess)] param ( [string]$hive, [string]$keyPath, [string]$name, [string]$value, [string]$type ) if ($PSCmdlet.ShouldProcess("$hive\$keyPath", "Set registry value $name to $value")) { $fullPath = "$hive\$keyPath" $parent = Split-Path -Path $fullPath if (-not (Test-Path $parent)) { New-Item -Path $parent -Force | Out-Null } if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null } Set-ItemProperty -Path $fullPath -Name $name -Value $value -Type $type -Force } } Set-RegValue "HKLM:" "SYSTEM\CurrentControlSet\Services\seclogon" "Start" "4" "DWord" Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-140](../../07-paws/user-profile/configure-paw-up-sehop.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-sehop.md Structured Exception Handling (SEH) is a core Win32 application mechanism designed to manage runtime hardware and software exceptions. However, 32-bit Win32 and WOW64 processes maintain SEH records directly on the thread's stack, creating a classic attack vector for stack buffer overflows where adversaries hijack exception dispatching to execute arbitrary shellcode. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager\kernel Value Name*: DisableExceptionChainValidation Value Type*: REG_DWORD Value Data*: 0 Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Note: Enforcing DisableExceptionChainValidation requires a system restart to take effect on the kernel exception dispatcher. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce SEHOP exception chain validation: Download Script: Configure-EndAuditSehop.ps1 # Configure-EndAuditSehop.ps1 Write-Host "Enforcing System Mitigation control: sehop..." -ForegroundColor Cyan # Set Registry value: DisableExceptionChainValidation if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Name "DisableExceptionChainValidation" -Value 0 -Type DWord -Force Write-Host " Enforced DisableExceptionChainValidation = 0" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditSehopStatus.ps1 # Get-EndAuditSehopStatus.ps1 $script:Vulnerable = $false # Audit Registry value: DisableExceptionChainValidation $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Name "DisableExceptionChainValidation" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.DisableExceptionChainValidation -ne 0) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditSehop.ps1 Write-Host "Enforcing System Mitigation control: sehop..." -ForegroundColor Cyan # Set Registry value: DisableExceptionChainValidation if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" -Name "DisableExceptionChainValidation" -Value 0 -Type DWord -Force Write-Host " Enforced DisableExceptionChainValidation = 0" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-141](../../07-paws/user-profile/configure-paw-up-protection-mode.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-protection-mode.md Securing the Windows system root and core system directories against unauthorized modification is essential to preventing Local Privilege Escalation (LPE) and DLL planting attacks. The ProtectionMode registry setting configures the Windows Session Manager (smss.exe) to enforce hardened security descriptors across critical system directories and Object Manager namespaces during operating system initialization. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager Value Name*: ProtectionMode Value Type*: REG_DWORD Value Data*: 1 Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Note: Enforcing ProtectionMode requires a computer restart to apply to the Session Manager during initial boot. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Directory Protection Mode: Download Script: Configure-EndAuditProtectionmode.ps1 # Configure-EndAuditProtectionmode.ps1 Write-Host "Enforcing System Mitigation control: protection-mode..." -ForegroundColor Cyan # Set Registry value: ProtectionMode if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "ProtectionMode" -Value 1 -Type DWord -Force Write-Host " Enforced ProtectionMode = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditProtectionmodeStatus.ps1 # Get-EndAuditProtectionmodeStatus.ps1 $script:Vulnerable = $false # Audit Registry value: ProtectionMode $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "ProtectionMode" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.ProtectionMode -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditProtectionmode.ps1 Write-Host "Enforcing System Mitigation control: protection-mode..." -ForegroundColor Cyan # Set Registry value: ProtectionMode if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "ProtectionMode" -Value 1 -Type DWord -Force Write-Host " Enforced ProtectionMode = 1" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-142](../../07-paws/user-profile/configure-paw-up-aslr-relocation.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-aslr-relocation.md Address Space Layout Randomization (ASLR) is a foundational defense against memory corruption vulnerabilities. By randomizing the memory locations of program headers, code segments, stacks, heaps, and libraries, ASLR ensures that an adversary cannot reliably predict target memory addresses when attempting to hijack execution flow. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management Value Name*: MoveImages Value Type*: REG_DWORD Value Data*: 4294967295 (Decimal) or 0xFFFFFFFF (Hexadecimal) Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Note: Enforcing MoveImages requires a computer restart to apply to core operating system kernel processes. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce system-wide ASLR image relocation: Download Script: Configure-EndAuditAslrrelocation.ps1 # Configure-EndAuditAslrrelocation.ps1 Write-Host "Enforcing System Mitigation control: aslr-relocation..." -ForegroundColor Cyan # Set Registry value: MoveImages if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "MoveImages" -Value 4294967295 -Type DWord -Force Write-Host " Enforced MoveImages = 4294967295" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditAslrrelocationStatus.ps1 # Get-EndAuditAslrrelocationStatus.ps1 $script:Vulnerable = $false # Audit Registry value: MoveImages $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "MoveImages" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.MoveImages -ne 4294967295) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditAslrrelocation.ps1 Write-Host "Enforcing System Mitigation control: aslr-relocation..." -ForegroundColor Cyan # Set Registry value: MoveImages if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "MoveImages" -Value 4294967295 -Type DWord -Force Write-Host " Enforced MoveImages = 4294967295" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-143](../../07-paws/user-profile/configure-paw-up-speculative-mitigations.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-speculative-mitigations.md Transient execution vulnerabilities (such as Spectre, Meltdown, Foreshadow/L1TF, and Microarchitectural Data Sampling / MDS) break architectural isolation boundaries by exploiting CPU speculative execution and out-of-order execution optimizations. Hardware cache side-channel attacks allow unprivileged user-mode processes to reconstruct secret memory contents from kernel address space and adjacent processes. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management Value Name*: FeatureSettingsOverride Value Type*: REG_DWORD Value Data*: 72 Create a second Registry Item: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management Value Name*: FeatureSettingsOverrideMask Value Type*: REG_DWORD Value Data*: 3 Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Note: A computer restart is required for the Windows kernel to initialize speculative CPU execution mitigations. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce speculative execution mitigations: Download Script: Configure-EndAuditSpeculativemitigations.ps1 # Configure-EndAuditSpeculativemitigations.ps1 Write-Host "Enforcing System Mitigation control: speculative-mitigations..." -ForegroundColor Cyan # Set Registry value: FeatureSettingsOverride if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverride" -Value 72 -Type DWord -Force Write-Host " Enforced FeatureSettingsOverride = 72" -ForegroundColor Green # Set Registry value: FeatureSettingsOverrideMask if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverrideMask" -Value 3 -Type DWord -Force Write-Host " Enforced FeatureSettingsOverrideMask = 3" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditSpeculativemitigationsStatus.ps1 # Get-EndAuditSpeculativemitigationsStatus.ps1 $script:Vulnerable = $false # Audit Registry value: FeatureSettingsOverride $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverride" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.FeatureSettingsOverride -ne 72) { $script:Vulnerable = $true } # Audit Registry value: FeatureSettingsOverrideMask $RegVal = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverrideMask" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.FeatureSettingsOverrideMask -ne 3) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditSpeculativemitigations.ps1 Write-Host "Enforcing System Mitigation control: speculative-mitigations..." -ForegroundColor Cyan # Set Registry value: FeatureSettingsOverride if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverride" -Value 72 -Type DWord -Force Write-Host " Enforced FeatureSettingsOverride = 72" -ForegroundColor Green # Set Registry value: FeatureSettingsOverrideMask if (-not (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management")) { New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "FeatureSettingsOverrideMask" -Value 3 -Type DWord -Force Write-Host " Enforced FeatureSettingsOverrideMask = 3" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-144](../../07-paws/user-profile/configure-paw-up-cert-padding.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-cert-padding.md Digital signature verification (Authenticode) is the foundational trust boundary used by Windows Defender Application Control (WDAC), AppLocker, Antivirus engines, and the operating system loader to establish software provenance and integrity. A fundamental design loophole in legacy Authenticode validation allows adversaries to tamper with signed binaries without invalidating their digital signature unless strict certificate padding validation is enforced. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item (Native 64-bit) and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: Software\Microsoft\Cryptography\Wintrust\Config Value Name*: EnableCertPaddingCheck Value Type*: REG_DWORD Value Data*: 1 Right-click Registry -> New -> Registry Item (WOW64 32-bit) and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config Value Name*: EnableCertPaddingCheck Value Type*: REG_DWORD Value Data*: 1 Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Authenticode certificate padding validation: Download Script: Configure-EndAuditCertpadding.ps1 # Configure-EndAuditCertpadding.ps1 Write-Host "Enforcing System Mitigation control: cert-padding..." -ForegroundColor Cyan # Set Registry value: EnableCertPaddingCheck if (-not (Test-Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config")) { New-Item -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force Write-Host " Enforced EnableCertPaddingCheck = 1" -ForegroundColor Green # Set Registry value: EnableCertPaddingCheck if (-not (Test-Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config")) { New-Item -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force Write-Host " Enforced EnableCertPaddingCheck = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditCertpaddingStatus.ps1 # Get-EndAuditCertpaddingStatus.ps1 $script:Vulnerable = $false # Audit Registry value: EnableCertPaddingCheck $RegVal = Get-ItemProperty -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.EnableCertPaddingCheck -ne 1) { $script:Vulnerable = $true } # Audit Registry value: EnableCertPaddingCheck $RegVal = Get-ItemProperty -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.EnableCertPaddingCheck -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditCertpadding.ps1 Write-Host "Enforcing System Mitigation control: cert-padding..." -ForegroundColor Cyan # Set Registry value: EnableCertPaddingCheck if (-not (Test-Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config")) { New-Item -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force Write-Host " Enforced EnableCertPaddingCheck = 1" -ForegroundColor Green # Set Registry value: EnableCertPaddingCheck if (-not (Test-Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config")) { New-Item -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" -Name "EnableCertPaddingCheck" -Value 1 -Type DWord -Force Write-Host " Enforced EnableCertPaddingCheck = 1" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-145](../../07-paws/user-profile/configure-paw-up-lock-batch-files.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-lock-batch-files.md The Windows Command Processor (cmd.exe) is widely utilized for system administration, software installation routines, and scheduled maintenance tasks. By default, cmd.exe executes batch files (.bat and .cmd) using a streaming file read approach rather than caching the entire script in memory or acquiring a persistent file lock. This design exposes systems to Time-of-Check to Time-of-Use (TOCTOU) race conditions and dynamic script manipulation attacks. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Command Processor Value Name*: LockBatchFilesWhenInUse Value Type*: REG_DWORD Value Data*: 1 Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Command Processor batch file locking: Download Script: Configure-EndAuditLockbatchfiles.ps1 # Configure-EndAuditLockbatchfiles.ps1 Write-Host "Enforcing System Mitigation control: lock-batch-files..." -ForegroundColor Cyan # Set Registry value: LockBatchFilesWhenInUse if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Command Processor")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Name "LockBatchFilesWhenInUse" -Value 1 -Type DWord -Force Write-Host " Enforced LockBatchFilesWhenInUse = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditLockbatchfilesStatus.ps1 # Get-EndAuditLockbatchfilesStatus.ps1 $script:Vulnerable = $false # Audit Registry value: LockBatchFilesWhenInUse $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Name "LockBatchFilesWhenInUse" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.LockBatchFilesWhenInUse -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditLockbatchfiles.ps1 Write-Host "Enforcing System Mitigation control: lock-batch-files..." -ForegroundColor Cyan # Set Registry value: LockBatchFilesWhenInUse if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Command Processor")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Command Processor" -Name "LockBatchFilesWhenInUse" -Value 1 -Type DWord -Force Write-Host " Enforced LockBatchFilesWhenInUse = 1" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-146](../../07-paws/user-profile/configure-paw-up-ttd-recording.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-ttd-recording.md Time-Travel Debugging (TTD) is an advanced diagnostic framework embedded in Microsoft development and troubleshooting tooling (such as WinDbg Preview and Windows Diagnostic Infrastructure). TTD works by recording a complete, instruction-by-instruction execution history of a process into a high-fidelity trace file (.run), which can then be replayed forwards and backwards in time. In an enterprise environment, unconstrained TTD recording represents a severe data exfiltration and credential theft vulnerability. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\TTD Value Name*: RecordingPolicy Value Type*: REG_DWORD Value Data*: 2 Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable Time-Travel Debugging recording: Download Script: Configure-EndAuditTtdrecording.ps1 # Configure-EndAuditTtdrecording.ps1 Write-Host "Enforcing System Mitigation control: ttd-recording..." -ForegroundColor Cyan # Set Registry value: RecordingPolicy if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\TTD")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Name "RecordingPolicy" -Value 2 -Type DWord -Force Write-Host " Enforced RecordingPolicy = 2" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditTtdrecordingStatus.ps1 # Get-EndAuditTtdrecordingStatus.ps1 $script:Vulnerable = $false # Audit Registry value: RecordingPolicy $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Name "RecordingPolicy" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.RecordingPolicy -ne 2) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditTtdrecording.ps1 Write-Host "Enforcing System Mitigation control: ttd-recording..." -ForegroundColor Cyan # Set Registry value: RecordingPolicy if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\TTD")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\TTD" -Name "RecordingPolicy" -Value 2 -Type DWord -Force Write-Host " Enforced RecordingPolicy = 2" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-147](../../07-paws/user-profile/configure-paw-up-protected-roots.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-protected-roots.md The Windows CryptoAPI Trusted Root Certification Authorities store (Root) defines the ultimate trust anchors for TLS/SSL communication, Kerberos PKINIT authentication, code signing, and digital identity verification. If an adversary, malicious script, or unauthorized third-party software can inject a rogue Certificate Authority (CA) into the trusted root store, the cryptographic integrity of all network communication and software trust models is completely undermined. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots Value Name*: Flags Value Type*: REG_DWORD Value Data*: 1 Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce Protected Roots certificate restrictions: Download Script: Configure-EndAuditProtectedroots.ps1 # Configure-EndAuditProtectedroots.ps1 Write-Host "Enforcing System Mitigation control: protected-roots..." -ForegroundColor Cyan # Set Registry value: Flags if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Name "Flags" -Value 1 -Type DWord -Force Write-Host " Enforced Flags = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditProtectedrootsStatus.ps1 # Get-EndAuditProtectedrootsStatus.ps1 $script:Vulnerable = $false # Audit Registry value: Flags $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Name "Flags" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.Flags -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditProtectedroots.ps1 Write-Host "Enforcing System Mitigation control: protected-roots..." -ForegroundColor Cyan # Set Registry value: Flags if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" -Name "Flags" -Value 1 -Type DWord -Force Write-Host " Enforced Flags = 1" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-148](../../07-paws/user-profile/configure-paw-up-appinit-dlls.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-appinit-dlls.md AppInit_DLLs is a legacy Windows application infrastructure mechanism dating back to Windows NT. It allows system administrators and software vendors to specify a list of dynamic-link libraries (DLLs) that are automatically loaded into the virtual address space of every user-mode process that links against User32.dll. Because nearly all interactive Win32 desktop applications, Windows system binaries, and management utilities load User32.dll, this mechanism represents a pervasive, high-risk attack surface for persistence, privilege escalation, and stealthy code injection. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Value Name*: LoadAppInit_DLLs Value Type*: REG_DWORD Value Data*: 0 Create a secondary Registry Item to clear the DLL list: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Value Name*: AppInit_DLLs Value Type*: REG_SZ Value Data*: "" Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to configure the AppInit DLL lockdown registry settings: Download Script: Configure-EndAuditAppinitdlls.ps1 # Configure-EndAuditAppinitdlls.ps1 Write-Host "Enforcing System Mitigation control: appinit-dlls..." -ForegroundColor Cyan # Set Registry value: LoadAppInit_DLLs if (-not (Test-Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows")) { New-Item -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Name "LoadAppInit_DLLs" -Value 0 -Type DWord -Force Write-Host " Enforced LoadAppInit_DLLs = 0" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditAppinitdllsStatus.ps1 # Get-EndAuditAppinitdllsStatus.ps1 $script:Vulnerable = $false # Audit Registry value: LoadAppInit_DLLs $RegVal = Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Name "LoadAppInit_DLLs" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.LoadAppInit_DLLs -ne 0) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditAppinitdlls.ps1 Write-Host "Enforcing System Mitigation control: appinit-dlls..." -ForegroundColor Cyan # Set Registry value: LoadAppInit_DLLs if (-not (Test-Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows")) { New-Item -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Windows" -Name "LoadAppInit_DLLs" -Value 0 -Type DWord -Force Write-Host " Enforced LoadAppInit_DLLs = 0" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-149](../../07-paws/user-profile/configure-paw-up-attachment-zone.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-attachment-zone.md Mark-of-the-Web (MOTW) is a vital Windows defensive mechanism that tags files downloaded from the Internet or untrusted external zones with contextual provenance metadata. When a file is received via a web browser, email client (e.g., Microsoft Outlook), or chat application, the Windows Attachment Manager (IAttachmentExecute API) writes an NTFS Alternate Data Stream (ADS) named Zone.Identifier to the downloaded file. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: User Configuration \ Administrative Templates \ Windows Components \ Attachment Manager (Optionally also navigate to `Computer Configuration \ Administrative Templates \ Windows Components \ Attachment Manager`) Configure the policy: Policy : `Do not preserve zone information in file attachments` -> Set to Disabled (Note: Setting this policy to Disabled enforces SaveZoneInformation = 2, ensuring zone information is preserved). Alternatively, configure the registry value via Group Policy Preferences: * Navigate to: Computer Configuration \ Preferences \ Windows Settings \ Registry Right-click Registry -> New -> Registry Item* and configure: Action*: Update Hive*: HKEY_LOCAL_MACHINE Key Path*: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments Value Name*: SaveZoneInformation Value Type*: REG_DWORD Value Data*: 2 Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to enforce the preservation of attachment zone information: Download Script: Configure-EndAuditAttachmentzone.ps1 # Configure-EndAuditAttachmentzone.ps1 Write-Host "Enforcing System Mitigation control: attachment-zone..." -ForegroundColor Cyan # Set Registry value: SaveZoneInformation if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "SaveZoneInformation" -Value 2 -Type DWord -Force Write-Host " Enforced SaveZoneInformation = 2" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditAttachmentzoneStatus.ps1 # Get-EndAuditAttachmentzoneStatus.ps1 $script:Vulnerable = $false # Audit Registry value: SaveZoneInformation $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "SaveZoneInformation" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.SaveZoneInformation -ne 2) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditAttachmentzone.ps1 Write-Host "Enforcing System Mitigation control: attachment-zone..." -ForegroundColor Cyan # Set Registry value: SaveZoneInformation if (-not (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments")) { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -Name "SaveZoneInformation" -Value 2 -Type DWord -Force Write-Host " Enforced SaveZoneInformation = 2" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-150](../../07-paws/user-profile/configure-paw-up-game-dvr.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-game-dvr.md Windows Game Recording and Broadcasting (Game DVR) is a consumer-oriented multimedia subsystem built into Windows 10 and 11. Designed to capture gaming clips, broadcast live gameplay, and maintain background rolling video buffers, the Game DVR subsystem introduces severe information disclosure risks, unmonitored desktop recording pathways, and unnecessary system resource utilization on enterprise workstations. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Game Recording and Broadcasting Double-click Enables or disables Windows Game Recording and Broadcasting and set it to Disabled. (Note: Setting this policy to Disabled enforces AllowGameDVR = 0). Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to disable Windows Game DVR: Download Script: Configure-EndAuditGamedvr.ps1 # Configure-EndAuditGamedvr.ps1 Write-Host "Enforcing System Mitigation control: game-dvr..." -ForegroundColor Cyan # Set Registry value: AllowGameDVR if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Value 0 -Type DWord -Force Write-Host " Enforced AllowGameDVR = 0" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditGamedvrStatus.ps1 # Get-EndAuditGamedvrStatus.ps1 $script:Vulnerable = $false # Audit Registry value: AllowGameDVR $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.AllowGameDVR -ne 0) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditGamedvr.ps1 Write-Host "Enforcing System Mitigation control: game-dvr..." -ForegroundColor Cyan # Set Registry value: AllowGameDVR if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Value 0 -Type DWord -Force Write-Host " Enforced AllowGameDVR = 0" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations and Member Servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-151](../../07-paws/user-profile/configure-paw-up-ink-workspace.md)). Operating Systems: Windows 10 Enterprise/Professional (all supported builds), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/user-profile/configure-end-up-ink-workspace.md The Windows Ink Workspace provides digital pen and stylus input capabilities, offering productivity tools such as Sticky Notes, Whiteboard, and Snip & Sketch on touch-enabled devices and laptops. When unconstrained, Windows allows the Ink Workspace to be invoked while the device is locked—typically by clicking the shortcut button on an active digital stylus or tapping the lock screen icon. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit or create the target GPO linked to workstations and member servers (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ Windows Ink Workspace Double-click Allow Windows Ink Workspace and configure: Select Enabled In the Options drop-down menu, select: On, but disallow access above lock Link the GPO to the appropriate Organizational Unit and verify policy enforcement using gpupdate /force. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Run the following script locally to restrict Windows Ink Workspace access above the lock screen: Download Script: Configure-EndAuditInkworkspace.ps1 # Configure-EndAuditInkworkspace.ps1 Write-Host "Enforcing System Mitigation control: ink-workspace..." -ForegroundColor Cyan # Set Registry value: AllowWindowsInkWorkspace if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Name "AllowWindowsInkWorkspace" -Value 1 -Type DWord -Force Write-Host " Enforced AllowWindowsInkWorkspace = 1" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditInkworkspaceStatus.ps1 # Get-EndAuditInkworkspaceStatus.ps1 $script:Vulnerable = $false # Audit Registry value: AllowWindowsInkWorkspace $RegVal = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Name "AllowWindowsInkWorkspace" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.AllowWindowsInkWorkspace -ne 1) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditInkworkspace.ps1 Write-Host "Enforcing System Mitigation control: ink-workspace..." -ForegroundColor Cyan # Set Registry value: AllowWindowsInkWorkspace if (-not (Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Force | Out-Null } Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Name "AllowWindowsInkWorkspace" -Value 1 -Type DWord -Force Write-Host " Enforced AllowWindowsInkWorkspace = 1" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-037](../../07-paws/services/disable-browser.md); for Domain Controllers, refer to [REQ-DC-016](../../02-domain-controllers/disable-smbv1.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-browser.md The Computer Browser service (Browser, driven by the legacy kernel driver bowser.sys) maintains an inventory of domains, workgroups, and network servers across local network segments using unauthenticated NetBIOS over TCP/IP (NetBT) broadcast frames and Server Message Block version 1 (SMBv1) protocol datagrams. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Computer Browser (Browser), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableBrowser.ps1 # Configure-DisableBrowser.ps1 # Description: Disables the unnecessary Computer Browser (Browser) service. Write-Host "Applying hardening requirement: Disable Computer Browser service..." -ForegroundColor Cyan $ServiceName = "Browser" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-BrowserStatus.ps1 # Get-BrowserStatus.ps1 # Description: Audits the startup configuration of Computer Browser (Browser) service. Write-Host "--- Auditing Computer Browser (Browser) Service ---" -ForegroundColor Cyan $ServiceName = "Browser" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableBrowser.ps1 # Description: Disables the unnecessary Computer Browser (Browser) service. Write-Host "Applying hardening requirement: Disable Computer Browser service..." -ForegroundColor Cyan $ServiceName = "Browser" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-038](../../07-paws/services/disable-irmon.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-irmon.md The Infrared Monitor Service (irmon, hosted within svchost.exe via irmon.dll) manages line-of-sight optical wireless communications using the legacy Infrared Data Association (IrDA) protocol stack and Object Exchange (OBEX) profiles. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Infrared monitor service (irmon), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disableirmon.ps1 # Configure-Disableirmon.ps1 # Description: Disables the unnecessary Infrared monitor service (irmon) service. Write-Host "Applying hardening requirement: Disable Infrared monitor service service..." -ForegroundColor Cyan $ServiceName = "irmon" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-irmonStatus.ps1 # Get-irmonStatus.ps1 # Description: Audits the startup configuration of Infrared monitor service (irmon) service. Write-Host "--- Auditing Infrared monitor service (irmon) Service ---" -ForegroundColor Cyan $ServiceName = "irmon" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disableirmon.ps1 # Description: Disables the unnecessary Infrared monitor service (irmon) service. Write-Host "Applying hardening requirement: Disable Infrared monitor service service..." -ForegroundColor Cyan $ServiceName = "irmon" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-039](../../07-paws/services/disable-sharedaccess.md); for Domain Controllers, refer to [REQ-DC-044](../../02-domain-controllers/services/disable-sharedaccess.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-sharedaccess.md The Internet Connection Sharing service (SharedAccess / ICS) provides Network Address Translation (NAT), dynamic addressing (embedded DHCP server), and name resolution (DNS proxy) capabilities to allow local devices on a network segment to share an external network connection. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Internet Connection Sharing (ICS) (SharedAccess), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableSharedAccess.ps1 # Configure-DisableSharedAccess.ps1 # Description: Disables the unnecessary Internet Connection Sharing (ICS) (SharedAccess) service. Write-Host "Applying hardening requirement: Disable Internet Connection Sharing (ICS) service..." -ForegroundColor Cyan $ServiceName = "SharedAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-SharedAccessStatus.ps1 # Get-SharedAccessStatus.ps1 # Description: Audits the startup configuration of Internet Connection Sharing (ICS) (SharedAccess) service. Write-Host "--- Auditing Internet Connection Sharing (ICS) (SharedAccess) Service ---" -ForegroundColor Cyan $ServiceName = "SharedAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableSharedAccess.ps1 # Description: Disables the unnecessary Internet Connection Sharing (ICS) (SharedAccess) service. Write-Host "Applying hardening requirement: Disable Internet Connection Sharing (ICS) service..." -ForegroundColor Cyan $ServiceName = "SharedAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-040](../../07-paws/services/disable-lxssmanager.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-lxssmanager.md The Windows Subsystem for Linux (WSL) service (LxssManager) coordinates the lifecycle, initialization, and execution of Linux distributions within Windows, managing syscall translation (WSL 1) or lightweight Hyper-V micro-virtual machines (WSL 2). Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate LxssManager (LxssManager), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableLxssManager.ps1 # Configure-DisableLxssManager.ps1 # Description: Disables the unnecessary LxssManager (LxssManager) service. Write-Host "Applying hardening requirement: Disable LxssManager service..." -ForegroundColor Cyan $ServiceName = "LxssManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-LxssManagerStatus.ps1 # Get-LxssManagerStatus.ps1 # Description: Audits the startup configuration of LxssManager (LxssManager) service. Write-Host "--- Auditing LxssManager (LxssManager) Service ---" -ForegroundColor Cyan $ServiceName = "LxssManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableLxssManager.ps1 # Description: Disables the unnecessary LxssManager (LxssManager) service. Write-Host "Applying hardening requirement: Disable LxssManager service..." -ForegroundColor Cyan $ServiceName = "LxssManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-041](../../07-paws/services/disable-ftpsvc.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-ftpsvc.md The Microsoft FTP Service (FTPSVC) is an IIS server component that provides File Transfer Protocol (FTP) hosting services over TCP port 21. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Microsoft FTP Service (FTPSVC), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableFTPSVC.ps1 # Configure-DisableFTPSVC.ps1 # Description: Disables the unnecessary Microsoft FTP Service (FTPSVC) service. Write-Host "Applying hardening requirement: Disable Microsoft FTP Service service..." -ForegroundColor Cyan $ServiceName = "FTPSVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-FTPSVCStatus.ps1 # Get-FTPSVCStatus.ps1 # Description: Audits the startup configuration of Microsoft FTP Service (FTPSVC) service. Write-Host "--- Auditing Microsoft FTP Service (FTPSVC) Service ---" -ForegroundColor Cyan $ServiceName = "FTPSVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableFTPSVC.ps1 # Description: Disables the unnecessary Microsoft FTP Service (FTPSVC) service. Write-Host "Applying hardening requirement: Disable Microsoft FTP Service service..." -ForegroundColor Cyan $ServiceName = "FTPSVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-042](../../07-paws/services/disable-sshd.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-sshd.md The OpenSSH SSH Server service (sshd) provides inbound secure shell access, interactive command-line terminal hosting (cmd/PowerShell), and secure file transfer (SFTP/SCP) over TCP port 22. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate OpenSSH SSH Server (sshd), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disablesshd.ps1 # Configure-Disablesshd.ps1 # Description: Disables the unnecessary OpenSSH SSH Server (sshd) service. Write-Host "Applying hardening requirement: Disable OpenSSH SSH Server service..." -ForegroundColor Cyan $ServiceName = "sshd" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-sshdStatus.ps1 # Get-sshdStatus.ps1 # Description: Audits the startup configuration of OpenSSH SSH Server (sshd) service. Write-Host "--- Auditing OpenSSH SSH Server (sshd) Service ---" -ForegroundColor Cyan $ServiceName = "sshd" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disablesshd.ps1 # Description: Disables the unnecessary OpenSSH SSH Server (sshd) service. Write-Host "Applying hardening requirement: Disable OpenSSH SSH Server service..." -ForegroundColor Cyan $ServiceName = "sshd" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-043](../../07-paws/services/disable-rpclocator.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-rpclocator.md The Remote Procedure Call (RPC) Locator service (RpcLocator) manages the legacy RPC name service database, originally designed in early Windows NT architectures to allow RPC server applications to publish interface bindings and RPC clients to discover those interfaces by name across network domains. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Remote Procedure Call (RPC) Locator (RpcLocator), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableRpcLocator.ps1 # Configure-DisableRpcLocator.ps1 # Description: Disables the unnecessary Remote Procedure Call (RPC) Locator (RpcLocator) service. Write-Host "Applying hardening requirement: Disable Remote Procedure Call (RPC) Locator service..." -ForegroundColor Cyan $ServiceName = "RpcLocator" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-RpcLocatorStatus.ps1 # Get-RpcLocatorStatus.ps1 # Description: Audits the startup configuration of Remote Procedure Call (RPC) Locator (RpcLocator) service. Write-Host "--- Auditing Remote Procedure Call (RPC) Locator (RpcLocator) Service ---" -ForegroundColor Cyan $ServiceName = "RpcLocator" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableRpcLocator.ps1 # Description: Disables the unnecessary Remote Procedure Call (RPC) Locator (RpcLocator) service. Write-Host "Applying hardening requirement: Disable Remote Procedure Call (RPC) Locator service..." -ForegroundColor Cyan $ServiceName = "RpcLocator" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-044](../../07-paws/services/disable-remoteaccess.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-remoteaccess.md The Routing and Remote Access Service (RemoteAccess / RRAS) provides multi-protocol LAN-to-LAN routing, Network Address Translation (NAT), dial-up networking, and VPN server capabilities (PPTP, L2TP, SSTP, IKEv2). Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Routing and Remote Access (RemoteAccess), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableRemoteAccess.ps1 # Configure-DisableRemoteAccess.ps1 # Description: Disables the unnecessary Routing and Remote Access (RemoteAccess) service. Write-Host "Applying hardening requirement: Disable Routing and Remote Access service..." -ForegroundColor Cyan $ServiceName = "RemoteAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-RemoteAccessStatus.ps1 # Get-RemoteAccessStatus.ps1 # Description: Audits the startup configuration of Routing and Remote Access (RemoteAccess) service. Write-Host "--- Auditing Routing and Remote Access (RemoteAccess) Service ---" -ForegroundColor Cyan $ServiceName = "RemoteAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableRemoteAccess.ps1 # Description: Disables the unnecessary Routing and Remote Access (RemoteAccess) service. Write-Host "Applying hardening requirement: Disable Routing and Remote Access service..." -ForegroundColor Cyan $ServiceName = "RemoteAccess" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-045](../../07-paws/services/disable-simptcp.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-simptcp.md The Simple TCP/IP Services (simptcp) implement a suite of legacy diagnostic protocols conceived in the 1980s over both TCP and UDP: Echo (port 7, RFC 862), Discard (port 9, RFC 863), Character Generator / Chargen (port 19, RFC 864), Daytime (port 13, RFC 867), and Quote of the Day / QOTD (port 17, RFC 865). Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Simple TCP/IP Services (simptcp), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disablesimptcp.ps1 # Configure-Disablesimptcp.ps1 # Description: Disables the unnecessary Simple TCP/IP Services (simptcp) service. Write-Host "Applying hardening requirement: Disable Simple TCP/IP Services service..." -ForegroundColor Cyan $ServiceName = "simptcp" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-simptcpStatus.ps1 # Get-simptcpStatus.ps1 # Description: Audits the startup configuration of Simple TCP/IP Services (simptcp) service. Write-Host "--- Auditing Simple TCP/IP Services (simptcp) Service ---" -ForegroundColor Cyan $ServiceName = "simptcp" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disablesimptcp.ps1 # Description: Disables the unnecessary Simple TCP/IP Services (simptcp) service. Write-Host "Applying hardening requirement: Disable Simple TCP/IP Services service..." -ForegroundColor Cyan $ServiceName = "simptcp" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-046](../../07-paws/services/disable-sacsvr.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-sacsvr.md The Special Administration Console (SAC) Helper service (sacsvr) supports Emergency Management Services (EMS), an out-of-band management architecture developed for headless Windows Server hardware to allow remote diagnostic console access over physical or virtual serial (COM) ports. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Special Administration Console Helper (sacsvr), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disablesacsvr.ps1 # Configure-Disablesacsvr.ps1 # Description: Disables the unnecessary Special Administration Console Helper (sacsvr) service. Write-Host "Applying hardening requirement: Disable Special Administration Console Helper service..." -ForegroundColor Cyan $ServiceName = "sacsvr" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-sacsvrStatus.ps1 # Get-sacsvrStatus.ps1 # Description: Audits the startup configuration of Special Administration Console Helper (sacsvr) service. Write-Host "--- Auditing Special Administration Console Helper (sacsvr) Service ---" -ForegroundColor Cyan $ServiceName = "sacsvr" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disablesacsvr.ps1 # Description: Disables the unnecessary Special Administration Console Helper (sacsvr) service. Write-Host "Applying hardening requirement: Disable Special Administration Console Helper service..." -ForegroundColor Cyan $ServiceName = "sacsvr" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-047](../../07-paws/services/disable-ssdpsrv.md); for Domain Controllers, refer to [REQ-DC-060](../../02-domain-controllers/services/disable-ssdpsrv.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-ssdpsrv.md The Simple Service Discovery Protocol (SSDP) Discovery service (SSDPSRV) listens on UDP port 1900 multicast (239.255.255.250 for IPv4 and [FF02::C] / [FF05::C] for IPv6) to discover Universal Plug and Play (UPnP) networked devices such as consumer printers, residential gateways, smart displays, and media renderers. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate SSDP Discovery (SSDPSRV), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableSSDPSRV.ps1 # Configure-DisableSSDPSRV.ps1 # Description: Disables the unnecessary SSDP Discovery (SSDPSRV) service. Write-Host "Applying hardening requirement: Disable SSDP Discovery service..." -ForegroundColor Cyan $ServiceName = "SSDPSRV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-SSDPSRVStatus.ps1 # Get-SSDPSRVStatus.ps1 # Description: Audits the startup configuration of SSDP Discovery (SSDPSRV) service. Write-Host "--- Auditing SSDP Discovery (SSDPSRV) Service ---" -ForegroundColor Cyan $ServiceName = "SSDPSRV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableSSDPSRV.ps1 # Description: Disables the unnecessary SSDP Discovery (SSDPSRV) service. Write-Host "Applying hardening requirement: Disable SSDP Discovery service..." -ForegroundColor Cyan $ServiceName = "SSDPSRV" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-048](../../07-paws/services/disable-upnphost.md); for Domain Controllers, refer to [REQ-DC-063](../../02-domain-controllers/services/disable-upnphost.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-upnphost.md The UPnP Device Host service (upnphost) enables a Windows endpoint to announce, configure, and host dynamic Universal Plug and Play (UPnP) devices and control points. When software components or peripherals register with upnphost, the service publishes XML device descriptions and listens on local HTTP endpoints to process incoming UPnP SOAP control actions. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate UPnP Device Host (upnphost), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disableupnphost.ps1 # Configure-Disableupnphost.ps1 # Description: Disables the unnecessary UPnP Device Host (upnphost) service. Write-Host "Applying hardening requirement: Disable UPnP Device Host service..." -ForegroundColor Cyan $ServiceName = "upnphost" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-upnphostStatus.ps1 # Get-upnphostStatus.ps1 # Description: Audits the startup configuration of UPnP Device Host (upnphost) service. Write-Host "--- Auditing UPnP Device Host (upnphost) Service ---" -ForegroundColor Cyan $ServiceName = "upnphost" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disableupnphost.ps1 # Description: Disables the unnecessary UPnP Device Host (upnphost) service. Write-Host "Applying hardening requirement: Disable UPnP Device Host service..." -ForegroundColor Cyan $ServiceName = "upnphost" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-049](../../07-paws/services/disable-wmsvc.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-wmsvc.md The Web Management Service (WMSvc) facilitates remote web server administration for Internet Information Services (IIS), listening for incoming remote management connections over HTTPS TCP port 8172. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Web Management Service (WMSvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableWMSvc.ps1 # Configure-DisableWMSvc.ps1 # Description: Disables the unnecessary Web Management Service (WMSvc) service. Write-Host "Applying hardening requirement: Disable Web Management Service service..." -ForegroundColor Cyan $ServiceName = "WMSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-WMSvcStatus.ps1 # Get-WMSvcStatus.ps1 # Description: Audits the startup configuration of Web Management Service (WMSvc) service. Write-Host "--- Auditing Web Management Service (WMSvc) Service ---" -ForegroundColor Cyan $ServiceName = "WMSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableWMSvc.ps1 # Description: Disables the unnecessary Web Management Service (WMSvc) service. Write-Host "Applying hardening requirement: Disable Web Management Service service..." -ForegroundColor Cyan $ServiceName = "WMSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-050](../../07-paws/services/disable-wmpnetworksvc.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-wmpnetworksvc.md The Windows Media Player Network Sharing Service (WMPNetworkSvc, hosted by wmpnetwk.exe or svchost.exe) shares Windows Media Player multimedia libraries (audio, video, playlists) with other network media players and control devices over Universal Plug and Play (UPnP) and Digital Living Network Alliance (DLNA) protocols. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Windows Media Player Network Sharing Service (WMPNetworkSvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableWMPNetworkSvc.ps1 # Configure-DisableWMPNetworkSvc.ps1 # Description: Disables the unnecessary Windows Media Player Network Sharing Service (WMPNetworkSvc) service. Write-Host "Applying hardening requirement: Disable Windows Media Player Network Sharing Service service..." -ForegroundColor Cyan $ServiceName = "WMPNetworkSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-WMPNetworkSvcStatus.ps1 # Get-WMPNetworkSvcStatus.ps1 # Description: Audits the startup configuration of Windows Media Player Network Sharing Service (WMPNetworkSvc) service. Write-Host "--- Auditing Windows Media Player Network Sharing Service (WMPNetworkSvc) Service ---" -ForegroundColor Cyan $ServiceName = "WMPNetworkSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableWMPNetworkSvc.ps1 # Description: Disables the unnecessary Windows Media Player Network Sharing Service (WMPNetworkSvc) service. Write-Host "Applying hardening requirement: Disable Windows Media Player Network Sharing Service service..." -ForegroundColor Cyan $ServiceName = "WMPNetworkSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-051](../../07-paws/services/disable-icssvc.md); for Domain Controllers, refer to [REQ-DC-072](../../02-domain-controllers/services/disable-icssvc.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-icssvc.md The Windows Mobile Hotspot Service (icssvc) manages software-based wireless access points (SoftAP) and connection tethering features, allowing an endpoint to share its Ethernet, Wi-Fi, or cellular connection with external wireless devices. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Windows Mobile Hotspot Service (icssvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-Disableicssvc.ps1 # Configure-Disableicssvc.ps1 # Description: Disables the unnecessary Windows Mobile Hotspot Service (icssvc) service. Write-Host "Applying hardening requirement: Disable Windows Mobile Hotspot Service service..." -ForegroundColor Cyan $ServiceName = "icssvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-icssvcStatus.ps1 # Get-icssvcStatus.ps1 # Description: Audits the startup configuration of Windows Mobile Hotspot Service (icssvc) service. Write-Host "--- Auditing Windows Mobile Hotspot Service (icssvc) Service ---" -ForegroundColor Cyan $ServiceName = "icssvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-Disableicssvc.ps1 # Description: Disables the unnecessary Windows Mobile Hotspot Service (icssvc) service. Write-Host "Applying hardening requirement: Disable Windows Mobile Hotspot Service service..." -ForegroundColor Cyan $ServiceName = "icssvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-052](../../07-paws/services/disable-w3svc.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-w3svc.md The World Wide Web Publishing Service (W3SVC) is the core Internet Information Services (IIS) HTTP/HTTPS web server engine. It manages HTTP listeners, routes web traffic to w3wp.exe worker processes, and hosts ASP.NET, PHP, and static web content over TCP ports 80 and 443. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate World Wide Web Publishing Service (W3SVC), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableW3SVC.ps1 # Configure-DisableW3SVC.ps1 # Description: Disables the unnecessary World Wide Web Publishing Service (W3SVC) service. Write-Host "Applying hardening requirement: Disable World Wide Web Publishing Service service..." -ForegroundColor Cyan $ServiceName = "W3SVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-W3SVCStatus.ps1 # Get-W3SVCStatus.ps1 # Description: Audits the startup configuration of World Wide Web Publishing Service (W3SVC) service. Write-Host "--- Auditing World Wide Web Publishing Service (W3SVC) Service ---" -ForegroundColor Cyan $ServiceName = "W3SVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableW3SVC.ps1 # Description: Disables the unnecessary World Wide Web Publishing Service (W3SVC) service. Write-Host "Applying hardening requirement: Disable World Wide Web Publishing Service service..." -ForegroundColor Cyan $ServiceName = "W3SVC" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-053](../../07-paws/services/disable-xboxgipsvc.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-xboxgipsvc.md The Xbox Accessory Management Service (XboxGipSvc, hosted in svchost.exe via XboxGipSvc.dll) manages connected Xbox peripherals, gamepads, steering wheels, headsets, and consumer wireless dongles by interfacing with the Xbox Game Input Protocol (GIP) kernel driver stack (xboxgip.sys). Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Xbox Accessory Management Service (XboxGipSvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableXboxGipSvc.ps1 # Configure-DisableXboxGipSvc.ps1 # Description: Disables the unnecessary Xbox Accessory Management Service (XboxGipSvc) service. Write-Host "Applying hardening requirement: Disable Xbox Accessory Management Service service..." -ForegroundColor Cyan $ServiceName = "XboxGipSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-XboxGipSvcStatus.ps1 # Get-XboxGipSvcStatus.ps1 # Description: Audits the startup configuration of Xbox Accessory Management Service (XboxGipSvc) service. Write-Host "--- Auditing Xbox Accessory Management Service (XboxGipSvc) Service ---" -ForegroundColor Cyan $ServiceName = "XboxGipSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableXboxGipSvc.ps1 # Description: Disables the unnecessary Xbox Accessory Management Service (XboxGipSvc) service. Write-Host "Applying hardening requirement: Disable Xbox Accessory Management Service service..." -ForegroundColor Cyan $ServiceName = "XboxGipSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-054](../../07-paws/services/disable-xblauthmanager.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-xblauthmanager.md The Xbox Live Auth Manager (XblAuthManager, hosted in svchost.exe via XblAuthManager.dll) provides programmatic authentication and token brokering services for consumer Microsoft Accounts (MSA) and the Xbox Live cloud gaming platform. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Xbox Live Auth Manager (XblAuthManager), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableXblAuthManager.ps1 # Configure-DisableXblAuthManager.ps1 # Description: Disables the unnecessary Xbox Live Auth Manager (XblAuthManager) service. Write-Host "Applying hardening requirement: Disable Xbox Live Auth Manager service..." -ForegroundColor Cyan $ServiceName = "XblAuthManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-XblAuthManagerStatus.ps1 # Get-XblAuthManagerStatus.ps1 # Description: Audits the startup configuration of Xbox Live Auth Manager (XblAuthManager) service. Write-Host "--- Auditing Xbox Live Auth Manager (XblAuthManager) Service ---" -ForegroundColor Cyan $ServiceName = "XblAuthManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableXblAuthManager.ps1 # Description: Disables the unnecessary Xbox Live Auth Manager (XblAuthManager) service. Write-Host "Applying hardening requirement: Disable Xbox Live Auth Manager service..." -ForegroundColor Cyan $ServiceName = "XblAuthManager" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-055](../../07-paws/services/disable-xblgamesave.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-xblgamesave.md The Xbox Live Game Save Service (XblGameSave, hosted in svchost.exe via XblGameSave.dll) manages background synchronization of game state, telemetry, and save container files between the local workstation file system and Microsoft Xbox Live consumer cloud storage. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Xbox Live Game Save (XblGameSave), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableXblGameSave.ps1 # Configure-DisableXblGameSave.ps1 # Description: Disables the unnecessary Xbox Live Game Save (XblGameSave) service. Write-Host "Applying hardening requirement: Disable Xbox Live Game Save service..." -ForegroundColor Cyan $ServiceName = "XblGameSave" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-XblGameSaveStatus.ps1 # Get-XblGameSaveStatus.ps1 # Description: Audits the startup configuration of Xbox Live Game Save (XblGameSave) service. Write-Host "--- Auditing Xbox Live Game Save (XblGameSave) Service ---" -ForegroundColor Cyan $ServiceName = "XblGameSave" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableXblGameSave.ps1 # Description: Disables the unnecessary Xbox Live Game Save (XblGameSave) service. Write-Host "Applying hardening requirement: Disable Xbox Live Game Save service..." -ForegroundColor Cyan $ServiceName = "XblGameSave" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-056](../../07-paws/services/disable-xboxnetapisvc.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-xboxnetapisvc.md The Xbox Live Networking Service (XboxNetApiSvc, hosted in svchost.exe via XboxNetApiSvc.dll) provides network interface management, peer-to-peer session establishment, and NAT traversal capabilities for Xbox Live multiplayer, party chat, and Windows gaming network APIs. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the target endpoints GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate Xbox Live Networking Service (XboxNetApiSvc), double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableXboxNetApiSvc.ps1 # Configure-DisableXboxNetApiSvc.ps1 # Description: Disables the unnecessary Xbox Live Networking Service (XboxNetApiSvc) service. Write-Host "Applying hardening requirement: Disable Xbox Live Networking Service service..." -ForegroundColor Cyan $ServiceName = "XboxNetApiSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup type of this unnecessary service: Download Script: Get-XboxNetApiSvcStatus.ps1 # Get-XboxNetApiSvcStatus.ps1 # Description: Audits the startup configuration of Xbox Live Networking Service (XboxNetApiSvc) service. Write-Host "--- Auditing Xbox Live Networking Service (XboxNetApiSvc) Service ---" -ForegroundColor Cyan $ServiceName = "XboxNetApiSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableXboxNetApiSvc.ps1 # Description: Disables the unnecessary Xbox Live Networking Service (XboxNetApiSvc) service. Write-Host "Applying hardening requirement: Disable Xbox Live Networking Service service..." -ForegroundColor Cyan $ServiceName = "XboxNetApiSvc" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 client workstations and member servers. (For Tier 0 Privileged Access Workstations, refer to tightened baseline [REQ-PAW-166](../../07-paws/services/disable-webclient.md); for Domain Controllers, refer to [REQ-DC-146](../../02-domain-controllers/services/disable-webclient.md)). Operating Systems: Windows 10 (all supported editions), Windows 11 Enterprise/Pro, Windows Server 2016, 2019, 2022, and 2025. File Path: 08-endpoints/services/disable-webclient.md The WebClient service (WebClient, driven by davclnt.sys) enables Windows programs to create, access, and modify remote files on Internet-based web servers using the Web Distributed Authoring and Versioning (WebDAV) protocol over HTTP and HTTPS. Option A: Group Policy Object (GPO) Configuration (Preferred) Open the Group Policy Management Console (gpmc.msc). Edit the Endpoint GPO (e.g., GPO_Hardening_Endpoints). Navigate to: Computer Configuration\Policies\Windows Settings\Security Settings\System Services Locate WebClient, double-click to define the policy, and select Disabled. Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-DisableEndWebClient.ps1 # Configure-DisableEndWebClient.ps1 # Description: Disables the unnecessary WebClient service on standard client endpoints and member servers. Write-Host "Applying hardening requirement: Disable WebClient service on Endpoint..." -ForegroundColor Cyan $ServiceName = "WebClient" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } To verify the startup configuration of the WebClient service on the endpoint: Download Script: Get-EndWebClientStatus.ps1 # Get-EndWebClientStatus.ps1 # Description: Audits the startup configuration of the WebClient service on the local endpoint. Write-Host "--- Auditing WebClient Service on Endpoint ---" -ForegroundColor Cyan $ServiceName = "WebClient" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $IsVulnerable = $false if (Test-Path -Path $RegPath) { $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue if ($null -ne $StartVal) { $Start = $StartVal.Start if ($Start -eq 4) { Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red $IsVulnerable = $true } } else { Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green } if ($IsVulnerable) { Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red exit 1 } else { Write-Host "Audit Result: SECURE" -ForegroundColor Green exit 0 } # Configure-DisableEndWebClient.ps1 # Description: Disables the unnecessary WebClient service on standard client endpoints and member servers. Write-Host "Applying hardening requirement: Disable WebClient service on Endpoint..." -ForegroundColor Cyan $ServiceName = "WebClient" $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)" $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue if ($null -ne $Service) { if ($Service.StartType -ne "Disabled") { if ($Service.Status -eq "Running") { Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null } Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green } else { Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray } } else { Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray } if (Test-Path -Path $RegPath) { Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green } Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/audit-policy/configure-end-audit-audit-override.md Enforcing advanced audit policy overrides prevents legacy category settings from overriding refined subcategory policies, and disabling verbose Kerberos logging ensures that event logs are not flooded with diagnostic events. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Registry: HKLM\System\CurrentControlSet\Control\Lsa\ SCENoApplyLegacyAuditPolicy = 1 (DWord) * Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\ LogLevel = 0 (DWord) Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAuditAuditoverride.ps1 # Configure-EndAuditAuditoverride.ps1 Write-Host "Applying Audit Policy category: audit-override..." -ForegroundColor Cyan # Set Registry Override: SCENoApplyLegacyAuditPolicy if (-not (Test-Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa")) { New-Item -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -Value 1 -Type DWord -Force Write-Host " Enforced SCENoApplyLegacyAuditPolicy = 1" -ForegroundColor Green # Set Registry Override: LogLevel if (-not (Test-Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters")) { New-Item -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "LogLevel" -Value 0 -Type DWord -Force Write-Host " Enforced LogLevel = 0" -ForegroundColor Green To audit the hardening status: Download Script: Get-EndAuditAuditoverrideStatus.ps1 # Get-EndAuditAuditoverrideStatus.ps1 $script:Vulnerable = $false # Audit Registry: SCENoApplyLegacyAuditPolicy $RegVal = Get-ItemProperty -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.SCENoApplyLegacyAuditPolicy -ne 1) { $script:Vulnerable = $true } # Audit Registry: LogLevel $RegVal = Get-ItemProperty -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "LogLevel" -ErrorAction SilentlyContinue if (-not $RegVal -or $RegVal.LogLevel -ne 0) { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditAuditoverride.ps1 Write-Host "Applying Audit Policy category: audit-override..." -ForegroundColor Cyan # Set Registry Override: SCENoApplyLegacyAuditPolicy if (-not (Test-Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa")) { New-Item -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -Value 1 -Type DWord -Force Write-Host " Enforced SCENoApplyLegacyAuditPolicy = 1" -ForegroundColor Green # Set Registry Override: LogLevel if (-not (Test-Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters")) { New-Item -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Force | Out-Null } Set-ItemProperty -Path "reg:\HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" -Name "LogLevel" -Value 0 -Type DWord -Force Write-Host " Enforced LogLevel = 0" -ForegroundColor Green Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/audit-policy/configure-end-audit-account-logon.md Auditing account logon events captures authentication requests processed by the local system or the domain controller, which is critical for identifying Kerberoasting, NTLM relaying, and brute-force attempts. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Credential Validation -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAuditAccountlogon.ps1 # Configure-EndAuditAccountlogon.ps1 Write-Host "Applying Audit Policy category: account-logon..." -ForegroundColor Cyan # Set Audit Subcategory: Credential Validation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Credential Validation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Credential Validation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Credential Validation. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-EndAuditAccountlogonStatus.ps1 # Get-EndAuditAccountlogonStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Credential Validation $RawOutput = auditpol.exe /get /subcategory:"Credential Validation" /r if ($RawOutput -notmatch ",Credential Validation,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditAccountlogon.ps1 Write-Host "Applying Audit Policy category: account-logon..." -ForegroundColor Cyan # Set Audit Subcategory: Credential Validation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Credential Validation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Credential Validation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Credential Validation. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/audit-policy/configure-end-audit-account-management.md Auditing account management logs security principal modifications (creations, deletions, password resets, group modifications) to detect privilege escalation attempts on domain or local administrative groups. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: User Account Management -> Success and Failure * Subcategory: Security Group Management -> Success and Failure * Subcategory: Other Account Management Events -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAuditAccountmanagement.ps1 # Configure-EndAuditAccountmanagement.ps1 Write-Host "Applying Audit Policy category: account-management..." -ForegroundColor Cyan # Set Audit Subcategory: User Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"User Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory User Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory User Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security Group Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Account Management Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Account Management Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Account Management Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Account Management Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-EndAuditAccountmanagementStatus.ps1 # Get-EndAuditAccountmanagementStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: User Account Management $RawOutput = auditpol.exe /get /subcategory:"User Account Management" /r if ($RawOutput -notmatch ",User Account Management,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Security Group Management $RawOutput = auditpol.exe /get /subcategory:"Security Group Management" /r if ($RawOutput -notmatch ",Security Group Management,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other Account Management Events $RawOutput = auditpol.exe /get /subcategory:"Other Account Management Events" /r if ($RawOutput -notmatch ",Other Account Management Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditAccountmanagement.ps1 Write-Host "Applying Audit Policy category: account-management..." -ForegroundColor Cyan # Set Audit Subcategory: User Account Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"User Account Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory User Account Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory User Account Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security Group Management $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security Group Management`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security Group Management to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security Group Management. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Account Management Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Account Management Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Account Management Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Account Management Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/audit-policy/configure-end-audit-detailed-tracking.md Detailed tracking records process creations and device arrivals to ensure EDR/SIEM visibility into executable command lines and hardware plug events. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Process Creation -> Success and Failure * Subcategory: DPAPI Activity -> Success and Failure * Subcategory: PNP Activity -> Success Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAuditDetailedtracking.ps1 # Configure-EndAuditDetailedtracking.ps1 Write-Host "Applying Audit Policy category: detailed-tracking..." -ForegroundColor Cyan # Set Audit Subcategory: Process Creation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Process Creation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Process Creation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Process Creation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: DPAPI Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"DPAPI Activity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory DPAPI Activity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory DPAPI Activity. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: PNP Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"PNP Activity`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory PNP Activity to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory PNP Activity. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-EndAuditDetailedtrackingStatus.ps1 # Get-EndAuditDetailedtrackingStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Process Creation $RawOutput = auditpol.exe /get /subcategory:"Process Creation" /r if ($RawOutput -notmatch ",Process Creation,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: DPAPI Activity $RawOutput = auditpol.exe /get /subcategory:"DPAPI Activity" /r if ($RawOutput -notmatch ",DPAPI Activity,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: PNP Activity $RawOutput = auditpol.exe /get /subcategory:"PNP Activity" /r if ($RawOutput -notmatch ",PNP Activity,.*,Success") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditDetailedtracking.ps1 Write-Host "Applying Audit Policy category: detailed-tracking..." -ForegroundColor Cyan # Set Audit Subcategory: Process Creation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Process Creation`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Process Creation to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Process Creation. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: DPAPI Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"DPAPI Activity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory DPAPI Activity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory DPAPI Activity. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: PNP Activity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"PNP Activity`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory PNP Activity to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory PNP Activity. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/audit-policy/configure-end-audit-logon-logoff.md Auditing logon/logoff events monitors administrative session states, special elevations, and failed logon attempts, which is critical for finding unauthorized remote access or lateral movement. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Logon -> Success and Failure * Subcategory: Logoff -> Success * Subcategory: Special Logon -> Success and Failure * Subcategory: Account Lockout -> Success and Failure * Subcategory: Other Logon/Logoff Events -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAuditLogonlogoff.ps1 # Configure-EndAuditLogonlogoff.ps1 Write-Host "Applying Audit Policy category: logon-logoff..." -ForegroundColor Cyan # Set Audit Subcategory: Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Logoff $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logoff`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logoff to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logoff. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Special Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Special Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Special Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Special Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Account Lockout $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Account Lockout`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Account Lockout to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Account Lockout. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Logon/Logoff Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Logon/Logoff Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Logon/Logoff Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Logon/Logoff Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-EndAuditLogonlogoffStatus.ps1 # Get-EndAuditLogonlogoffStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Logon $RawOutput = auditpol.exe /get /subcategory:"Logon" /r if ($RawOutput -notmatch ",Logon,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Logoff $RawOutput = auditpol.exe /get /subcategory:"Logoff" /r if ($RawOutput -notmatch ",Logoff,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: Special Logon $RawOutput = auditpol.exe /get /subcategory:"Special Logon" /r if ($RawOutput -notmatch ",Special Logon,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Account Lockout $RawOutput = auditpol.exe /get /subcategory:"Account Lockout" /r if ($RawOutput -notmatch ",Account Lockout,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other Logon/Logoff Events $RawOutput = auditpol.exe /get /subcategory:"Other Logon/Logoff Events" /r if ($RawOutput -notmatch ",Other Logon/Logoff Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditLogonlogoff.ps1 Write-Host "Applying Audit Policy category: logon-logoff..." -ForegroundColor Cyan # Set Audit Subcategory: Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Logoff $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Logoff`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Logoff to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Logoff. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Special Logon $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Special Logon`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Special Logon to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Special Logon. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Account Lockout $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Account Lockout`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Account Lockout to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Account Lockout. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Logon/Logoff Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Logon/Logoff Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Logon/Logoff Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Logon/Logoff Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/audit-policy/configure-end-audit-object-access.md Auditing object access (files, registry keys, and shares) helps monitor unauthorized modifications to system configuration files and access to restricted shares. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Registry -> Failure * Subcategory: File Share -> Failure * Subcategory: Detailed File Share -> Failure * Subcategory: Handle Manipulation -> Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAuditObjectaccess.ps1 # Configure-EndAuditObjectaccess.ps1 Write-Host "Applying Audit Policy category: object-access..." -ForegroundColor Cyan # Set Audit Subcategory: Registry $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Registry`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Registry to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Registry. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"File Share`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory File Share to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Detailed File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Detailed File Share`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Detailed File Share to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Detailed File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Handle Manipulation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Handle Manipulation`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Handle Manipulation to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Handle Manipulation. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-EndAuditObjectaccessStatus.ps1 # Get-EndAuditObjectaccessStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Registry $RawOutput = auditpol.exe /get /subcategory:"Registry" /r if ($RawOutput -notmatch ",Registry,.*,Failure") { $script:Vulnerable = $true } # Audit Subcategory: File Share $RawOutput = auditpol.exe /get /subcategory:"File Share" /r if ($RawOutput -notmatch ",File Share,.*,Failure") { $script:Vulnerable = $true } # Audit Subcategory: Detailed File Share $RawOutput = auditpol.exe /get /subcategory:"Detailed File Share" /r if ($RawOutput -notmatch ",Detailed File Share,.*,Failure") { $script:Vulnerable = $true } # Audit Subcategory: Handle Manipulation $RawOutput = auditpol.exe /get /subcategory:"Handle Manipulation" /r if ($RawOutput -notmatch ",Handle Manipulation,.*,Failure") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditObjectaccess.ps1 Write-Host "Applying Audit Policy category: object-access..." -ForegroundColor Cyan # Set Audit Subcategory: Registry $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Registry`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Registry to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Registry. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"File Share`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory File Share to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Detailed File Share $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Detailed File Share`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Detailed File Share to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Detailed File Share. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Handle Manipulation $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Handle Manipulation`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Handle Manipulation to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Handle Manipulation. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/audit-policy/configure-end-audit-policy-change.md Auditing policy changes tracks attempts to modify authorization policies, auditing configuration changes, or firewall rule alterations to hide adversarial tracks. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Policy Change -> Success and Failure * Subcategory: Authentication Policy Change -> Success * Subcategory: Authorization Policy Change -> Success * Subcategory: MPSSVC Rule-Level Policy Change -> Success and Failure * Subcategory: Other Policy Change Events -> Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAuditPolicychange.ps1 # Configure-EndAuditPolicychange.ps1 Write-Host "Applying Audit Policy category: policy-change..." -ForegroundColor Cyan # Set Audit Subcategory: Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authentication Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authentication Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authentication Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authentication Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authorization Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authorization Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authorization Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authorization Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: MPSSVC Rule-Level Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"MPSSVC Rule-Level Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory MPSSVC Rule-Level Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory MPSSVC Rule-Level Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Policy Change Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Policy Change Events`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Policy Change Events to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Policy Change Events. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-EndAuditPolicychangeStatus.ps1 # Get-EndAuditPolicychangeStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Policy Change $RawOutput = auditpol.exe /get /subcategory:"Policy Change" /r if ($RawOutput -notmatch ",Policy Change,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Authentication Policy Change $RawOutput = auditpol.exe /get /subcategory:"Authentication Policy Change" /r if ($RawOutput -notmatch ",Authentication Policy Change,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: Authorization Policy Change $RawOutput = auditpol.exe /get /subcategory:"Authorization Policy Change" /r if ($RawOutput -notmatch ",Authorization Policy Change,.*,Success") { $script:Vulnerable = $true } # Audit Subcategory: MPSSVC Rule-Level Policy Change $RawOutput = auditpol.exe /get /subcategory:"MPSSVC Rule-Level Policy Change" /r if ($RawOutput -notmatch ",MPSSVC Rule-Level Policy Change,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Other Policy Change Events $RawOutput = auditpol.exe /get /subcategory:"Other Policy Change Events" /r if ($RawOutput -notmatch ",Other Policy Change Events,.*,Failure") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditPolicychange.ps1 Write-Host "Applying Audit Policy category: policy-change..." -ForegroundColor Cyan # Set Audit Subcategory: Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authentication Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authentication Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authentication Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authentication Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Authorization Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Authorization Policy Change`" /success:enable /failure:disable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Authorization Policy Change to Success" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Authorization Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: MPSSVC Rule-Level Policy Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"MPSSVC Rule-Level Policy Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory MPSSVC Rule-Level Policy Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory MPSSVC Rule-Level Policy Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Other Policy Change Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other Policy Change Events`" /success:disable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other Policy Change Events to Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other Policy Change Events. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/audit-policy/configure-end-audit-privilege-use.md Auditing sensitive privilege use logs attempts by processes or users to exercise rights like ActAsPartOfTypeOperatingSystem or LoadDrivers, identifying potential privilege escalations. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Sensitive Privilege Use -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAuditPrivilegeuse.ps1 # Configure-EndAuditPrivilegeuse.ps1 Write-Host "Applying Audit Policy category: privilege-use..." -ForegroundColor Cyan # Set Audit Subcategory: Sensitive Privilege Use $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Sensitive Privilege Use`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Sensitive Privilege Use to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Sensitive Privilege Use. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-EndAuditPrivilegeuseStatus.ps1 # Get-EndAuditPrivilegeuseStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Sensitive Privilege Use $RawOutput = auditpol.exe /get /subcategory:"Sensitive Privilege Use" /r if ($RawOutput -notmatch ",Sensitive Privilege Use,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditPrivilegeuse.ps1 Write-Host "Applying Audit Policy category: privilege-use..." -ForegroundColor Cyan # Set Audit Subcategory: Sensitive Privilege Use $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Sensitive Privilege Use`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Sensitive Privilege Use to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Sensitive Privilege Use. Exit Code: $($Process.ExitCode)" } Target Scope: Applicable Systems: Tier 2 Client Workstations Operating Systems: Windows 10/11 Enterprise/Professional File Path: 08-endpoints/audit-policy/configure-end-audit-system-events.md Auditing system security extensions, integrity violations, and driver arrivals monitors boot health and tampering of host security services. Option A: Group Policy Object (GPO) Configuration (Preferred) Configure Advanced Audit Policy subcategory or registry override preferences matching: * Subcategory: Other System Events -> Success and Failure * Subcategory: Security State Change -> Success and Failure * Subcategory: Security System Extension -> Success and Failure * Subcategory: System Integrity -> Success and Failure Option B: PowerShell & Registry Configuration (Remediation / Non-GPO) Download Script: Configure-EndAuditSystemevents.ps1 # Configure-EndAuditSystemevents.ps1 Write-Host "Applying Audit Policy category: system-events..." -ForegroundColor Cyan # Set Audit Subcategory: Other System Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other System Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other System Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other System Events. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security State Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security State Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security State Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security State Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security System Extension $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security System Extension`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security System Extension to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security System Extension. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: System Integrity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"System Integrity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory System Integrity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory System Integrity. Exit Code: $($Process.ExitCode)" } To audit the hardening status: Download Script: Get-EndAuditSystemeventsStatus.ps1 # Get-EndAuditSystemeventsStatus.ps1 $script:Vulnerable = $false # Audit Subcategory: Other System Events $RawOutput = auditpol.exe /get /subcategory:"Other System Events" /r if ($RawOutput -notmatch ",Other System Events,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Security State Change $RawOutput = auditpol.exe /get /subcategory:"Security State Change" /r if ($RawOutput -notmatch ",Security State Change,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: Security System Extension $RawOutput = auditpol.exe /get /subcategory:"Security System Extension" /r if ($RawOutput -notmatch ",Security System Extension,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } # Audit Subcategory: System Integrity $RawOutput = auditpol.exe /get /subcategory:"System Integrity" /r if ($RawOutput -notmatch ",System Integrity,.*,(Success and Failure|Success & Failure)") { $script:Vulnerable = $true } if ($script:Vulnerable) { Write-Output "Non-Compliant" exit 1 } else { Write-Output "Compliant" exit 0 } # Configure-EndAuditSystemevents.ps1 Write-Host "Applying Audit Policy category: system-events..." -ForegroundColor Cyan # Set Audit Subcategory: Other System Events $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Other System Events`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Other System Events to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Other System Events. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security State Change $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security State Change`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security State Change to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security State Change. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: Security System Extension $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"Security System Extension`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory Security System Extension to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory Security System Extension. Exit Code: $($Process.ExitCode)" } # Set Audit Subcategory: System Integrity $Process = Start-Process auditpol -ArgumentList "/set /subcategory:`"System Integrity`" /success:enable /failure:enable" -Wait -NoNewWindow -PassThru if ($Process.ExitCode -eq 0) { Write-Host " Enforced subcategory System Integrity to Success and Failure" -ForegroundColor Green } else { Write-Error " Failed to configure subcategory System Integrity. Exit Code: $($Process.ExitCode)" }