From 126369787299334cd257b03aa204ac348418980d Mon Sep 17 00:00:00 2001 From: abrown38 Date: Wed, 11 Jun 2025 09:57:14 +0100 Subject: [PATCH] Fix RDP session timeout and disconnect --- .../roles/win_domain_controller/files/serverhardening0.3.ps1 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 b/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 index ede28f2..94f7484 100644 --- a/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 +++ b/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 @@ -159,7 +159,7 @@ Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "fDisablePNPRedir" -key Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "fPromptForPassword " -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "fEncryptRPCTraffic" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "SecurityLayer" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Value 2 -Type DWord -Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "MaxDisconnectionTime" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Value 432000 -Type DWord +Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "MaxDisconnectionTime" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Value 432000000 -Type DWord Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "DisableEnclosureDownload " -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" -Value 1 -Type DWord Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "AllowCloudSearch" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search" -Value 0 -Type DWord Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "NoGenTicket" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" -Value 1 -Type DWord @@ -167,7 +167,7 @@ Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "EnableSmartScreen" -key Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "ShellSmartScreenLevel" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" -Value Block -Type String Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "AllowSuggestedAppsInWindowsInkWorkspace" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsInkWorkspace" -Value 0 -Type DWord Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "AllowDigest" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client" -Value 0 -Type DWord -Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "MaxIdleTime" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Value 900000 -Type DWord +Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "MaxIdleTime" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "ScenarioExecutionEnabled" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}" -Value 0 -Type DWord Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "SMBServerNameHardeningLevel" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" -Value 1 -Type DWord Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "RestrictAnonymous" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" -Value 1 -Type DWord