adam/windows-ansible
1
0 Fork 0
mirror of https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git synced 2026-10-26 15:17:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

update to new hardening script

Browse Source
This commit is contained in:
abrown38 committed 2024-09-02 13:19:29 +01:00
1 parent 99521ae414
commit 85b4db3d04
2 files changed
+18 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ansible/roles/win_domain_controller/files/serverhardening.ps1
+1 -1
View File
@@ -1 +1 @@
serverhardening0.2.ps1
serverhardening0.3.ps1
ansible/roles/win_domain_controller/files/serverhardening0.3.ps1
+17 -10
View File
@@ -1,5 +1,9 @@
$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName}
set-addefaultdomainpasswordpolicy -ComplexityEnabled True -MinPasswordLength 14 -MaxPasswordAge 30
$DomainInfo = Get-ADDomain
$DomainOU = $DomainInfo.DistinguishedName
$Domain = $DomainInfo.DNSRoot
$workbenchOU = (Get-ADOrganizationalUnit -Identity "OU=Workbench,$DomainOU").DistinguishedName
Set-ADDefaultDomainPasswordPolicy -Identity $Domain -ComplexityEnabled $True -MinPasswordLength 14 -MaxPasswordAge "30.00:00:00"
#Create Workbench hardening GPO
New-GPO -Name "RDS WB hardening" -comment "hardening for the workbench"
@@ -182,7 +186,7 @@ Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "ConsentPromptBehaviorAd
Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "SupportedEncryptionTypes" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" -Value "2147483644","2147483640" -Type MultiString
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
#Auditing
Install-Module -Name AuditPolicy -AllowClobber -Force
@@ -212,18 +216,19 @@ Set-SystemAuditPolicy -Policy 'Sensitive Privilege Use' -Value SuccessAndFailure
Set-SystemAuditPolicy -Policy 'IPsec Driver' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Security System Extension' -Value Success -UseAuditpol
Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString
$DCOU = (Get-ADOrganizationalUnit -Identity "OU=Domain Controllers,$DomainOU").DistinguishedName
New-GPLink -Name "Default Domain Controllers Policy" -Target $DCOU
#DC only
Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString
$domainid = Get-addomain | foreach {$_.Name}
$domainid = $DomainInfo.Name
$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName}
New-GPLink -Name "RDS WB hardening" -Target $workbenchou
Set-GPPermission -Name "RDS WB hardening" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
# Unrecognized command
set-addefaultDomainPolicy -identity $domainid -complexityEnabled $true -lockoutduration 00:40:00 -LockoutObservationWindow 00:15:00 -maxPasswordAge 30 -minPasswordAge 1 -minPasswordLength 14
@@ -231,4 +236,6 @@ set-addefaultDomainPolicy -identity $domainid -complexityEnabled $true -lockoutd
#$domainadminid2 = $domainid + "_" + "administrator"
#get-aduser -identity 'Administrator' | Rename-AdObject -NewName $domainadminid2
$domainguestid2 = $domainid + "_" + "guest"
get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2
get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2
Write-Output "THIS SCRIPT ACTUALLY RAN" | Out-File -FilePath 'C:\eidf\HardenScript.txt'