adam/windows-ansible
1
0 Fork 0
mirror of https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git synced 2026-10-26 14:07:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

update hardening script

Browse Source
This commit is contained in:
abrown38 committed 2024-08-13 21:29:26 +01:00
1 parent ebcb9ff15a
commit 8174b098e2
2 files changed
+45 -21
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ansible/roles/win_domain_controller/files/serverhardening.ps1
+1 -1
View File
@@ -1 +1 @@
serverhardening0.3.ps1
serverhardening0.2.ps1
ansible/roles/win_domain_controller/files/serverhardening0.2.ps1
+44 -20
View File
@@ -1,6 +1,9 @@
$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName}
$Domain = (Get-ADDomain).DNSRoot
set-addefaultdomainpasswordpolicy -Identity $Domain -ComplexityEnabled $true -MinPasswordLength 14 -MaxPasswordAge "30.00:00:00"
$DomainInfo = Get-ADDomain
$DomainOU = $DomainInfo.DistinguishedName
$Domain = $DomainInfo.DNSRoot
$workbenchOU = (Get-ADOrganizationalUnit -Identity "OU=Workbench,$DomainOU").DistinguishedName
Set-ADDefaultDomainPasswordPolicy -Identity $Domain -ComplexityEnabled $True -MinPasswordLength 14 -MaxPasswordAge "30.00:00:00"
#Create Workbench hardening GPO
New-GPO -Name "RDS WB hardening" -comment "hardening for the workbench"
@@ -179,38 +182,59 @@ Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "Start" -key "HKEY_LOCAL
Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "LogDroppedPackets" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging" -Value 1 -Type DWord
Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "ConsentPromptBehaviorAdmin" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value 2 -Type DWord
Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "SupportedEncryptionTypes" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" -Value "2147483644","2147483640" -Type MultiString
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
#Auditing
auditpol command /set /subcategory:"Credential Validation" /success:enable /failure:enable
auditpol command /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol command /set /subcategory:"Application Group Management" /success:enable /failure:enable
auditpol command /set /subcategory:"Distribution Group Management" /success:enable
auditpol command /set /subcategory:"Other Account Management Events" /success:enable
auditpol command /set /subcategory:"User Account Management" /success:enable /failure:enable
Install-Module -Name AuditPolicy -AllowClobber -Force
Set-SystemAuditPolicy -Policy 'Credential Validation' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Kerberos Authentication Service' -Value SuccessAndFailure -UseAuditpol
#DC only Set-SystemAuditPolicy -Policy 'Kerberos Authentication Service' -Value SuccessAndFailure -UseAuditpol
#DC only Set-SystemAuditPolicy -Policy 'Kerberos Authentication Service' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Application Group Management' -Value SuccessAndFailure -UseAuditpol
#DC only Set-SystemAuditPolicy -Policy 'Distribution Group Management' -Value SuccessAndFailure -UseAuditpol
#DC only Set-SystemAuditPolicy -Policy 'Other Account Management Events' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'User Account Management' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Plug and Play Events' -Value Success -UseAuditpol
Set-SystemAuditPolicy -Policy 'Process Creation' -Value Success -UseAuditpol
#DC only Set-SystemAuditPolicy -Policy 'Directory Service Access' -Value Failure -UseAuditpol
#DC only Set-SystemAuditPolicy -Policy 'Directory Service Changes' -Value Failure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Account Lockout' -Value Success -UseAuditpol
Set-SystemAuditPolicy -Policy 'Group Membership' -Value Success -UseAuditpol
Set-SystemAuditPolicy -Policy 'Other Logon/Logoff Events' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Detailed File Share' -Value Failure -UseAuditpol
Set-SystemAuditPolicy -Policy 'File Share' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Other Object Access Events' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Removable Storage' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Authorization Policy Change' -Value Success -UseAuditpol
Set-SystemAuditPolicy -Policy 'MPSSVC Rule-Level Policy Change' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Other Policy Change Events' -Value Failure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Sensitive Privilege Use' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'IPsec Driver' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Security System Extension' -Value Success -UseAuditpol
# 3 LINES BELOW DONT WORK NO GPO CALLED "Default Domain Controller Policy"
#DC only
Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString
$domainid = $DomainInfo.Name
$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName}
New-GPLink -Name "RDS WB hardening" -Target $workbenchou
Set-GPPermission -Name "RDS WB hardening" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
net.exe accounts /MinPWLEN:14 /lockoutthreshold:5 /MAXPWAGE:30
# Unrecognized command
set-addefaultDomainPolicy -identity $domainid -complexityEnabled $true -lockoutduration 00:40:00 -LockoutObservationWindow 00:15:00 -maxPasswordAge 30 -minPasswordAge 1 -minPasswordLength 14
#$domainid = Get-addomain | foreach {$_.Name}
#$domainadminid2 = $domainid + "_" + "administrator"
#get-aduser -identity 'Administrator' | Rename-AdObject -NewName $domainadminid2
$domainguestid2 = $domainid + "_" + "guest"
get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2
Write-Output "THIS SCRIPT ACTUALLY RAN" | Out-File -FilePath 'C:\eidf\HardeningScript.txt'
get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2