From 85b4db3d043fe453b8ec80df505d21097beb0ca2 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 27 Aug 2024 10:22:38 +0100 Subject: [PATCH] update to new hardening script --- .../files/serverhardening.ps1 | 2 +- .../files/serverhardening0.3.ps1 | 27 ++++++++++++------- 2 files changed, 18 insertions(+), 11 deletions(-) diff --git a/ansible/roles/win_domain_controller/files/serverhardening.ps1 b/ansible/roles/win_domain_controller/files/serverhardening.ps1 index 77658a0..b5ed1a3 120000 --- a/ansible/roles/win_domain_controller/files/serverhardening.ps1 +++ b/ansible/roles/win_domain_controller/files/serverhardening.ps1 @@ -1 +1 @@ -serverhardening0.2.ps1 \ No newline at end of file +serverhardening0.3.ps1 \ No newline at end of file diff --git a/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 b/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 index de3a912..ede28f2 100644 --- a/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 +++ b/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 @@ -1,5 +1,9 @@ -$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName} -set-addefaultdomainpasswordpolicy -ComplexityEnabled True -MinPasswordLength 14 -MaxPasswordAge 30 +$DomainInfo = Get-ADDomain +$DomainOU = $DomainInfo.DistinguishedName +$Domain = $DomainInfo.DNSRoot +$workbenchOU = (Get-ADOrganizationalUnit -Identity "OU=Workbench,$DomainOU").DistinguishedName + +Set-ADDefaultDomainPasswordPolicy -Identity $Domain -ComplexityEnabled $True -MinPasswordLength 14 -MaxPasswordAge "30.00:00:00" #Create Workbench hardening GPO New-GPO -Name "RDS WB hardening" -comment "hardening for the workbench" @@ -182,7 +186,7 @@ Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "ConsentPromptBehaviorAd Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "SupportedEncryptionTypes" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" -Value "2147483644","2147483640" -Type MultiString - +Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force #Auditing Install-Module -Name AuditPolicy -AllowClobber -Force @@ -212,18 +216,19 @@ Set-SystemAuditPolicy -Policy 'Sensitive Privilege Use' -Value SuccessAndFailure Set-SystemAuditPolicy -Policy 'IPsec Driver' -Value SuccessAndFailure -UseAuditpol Set-SystemAuditPolicy -Policy 'Security System Extension' -Value Success -UseAuditpol +Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord +Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord +Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString +$DCOU = (Get-ADOrganizationalUnit -Identity "OU=Domain Controllers,$DomainOU").DistinguishedName +New-GPLink -Name "Default Domain Controllers Policy" -Target $DCOU -#DC only -Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord -Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord -Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString - -$domainid = Get-addomain | foreach {$_.Name} +$domainid = $DomainInfo.Name $workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName} New-GPLink -Name "RDS WB hardening" -Target $workbenchou Set-GPPermission -Name "RDS WB hardening" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply +# Unrecognized command set-addefaultDomainPolicy -identity $domainid -complexityEnabled $true -lockoutduration 00:40:00 -LockoutObservationWindow 00:15:00 -maxPasswordAge 30 -minPasswordAge 1 -minPasswordLength 14 @@ -231,4 +236,6 @@ set-addefaultDomainPolicy -identity $domainid -complexityEnabled $true -lockoutd #$domainadminid2 = $domainid + "_" + "administrator" #get-aduser -identity 'Administrator' | Rename-AdObject -NewName $domainadminid2 $domainguestid2 = $domainid + "_" + "guest" -get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2 \ No newline at end of file +get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2 + +Write-Output "THIS SCRIPT ACTUALLY RAN" | Out-File -FilePath 'C:\eidf\HardenScript.txt' \ No newline at end of file