adam/windows-ansible
1
0 Fork 0
mirror of https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git synced 2026-10-27 23:37:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

point to correct default policy

Browse Source
This commit is contained in:
abrown38 committed 2024-08-14 16:18:02 +01:00
1 parent 335f9ad923
commit 9de40b7d93
1 file changed
+7 -9
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/win_domain_controller/files/serverhardening0.2.ps1
+7 -9
View File
@@ -216,15 +216,11 @@ Set-SystemAuditPolicy -Policy 'Sensitive Privilege Use' -Value SuccessAndFailure
Set-SystemAuditPolicy -Policy 'IPsec Driver' -Value SuccessAndFailure -UseAuditpol Set-SystemAuditPolicy -Policy 'IPsec Driver' -Value SuccessAndFailure -UseAuditpol
Set-SystemAuditPolicy -Policy 'Security System Extension' -Value Success -UseAuditpol Set-SystemAuditPolicy -Policy 'Security System Extension' -Value Success -UseAuditpol
# 3 LINES BELOW DONT WORK NO GPO CALLED "Default Domain Controller Policy" Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
#DC only Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString
New-GPO -Name "Default Domain Controller Policy" -comment "Default policy for domain controllers"
Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord
Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString
$DCOU = (Get-ADOrganizationalUnit -Identity "OU=Domain Controllers,$DomainOU").DistinguishedName $DCOU = (Get-ADOrganizationalUnit -Identity "OU=Domain Controllers,$DomainOU").DistinguishedName
New-GPLink -Name "Default Domain Controller Policy" -Target $DCOU New-GPLink -Name "Default Domain Controllers Policy" -Target $DCOU
$domainid = $DomainInfo.Name $domainid = $DomainInfo.Name
@@ -240,4 +236,6 @@ set-addefaultDomainPolicy -identity $domainid -complexityEnabled $true -lockoutd
#$domainadminid2 = $domainid + "_" + "administrator" #$domainadminid2 = $domainid + "_" + "administrator"
#get-aduser -identity 'Administrator' | Rename-AdObject -NewName $domainadminid2 #get-aduser -identity 'Administrator' | Rename-AdObject -NewName $domainadminid2
$domainguestid2 = $domainid + "_" + "guest" $domainguestid2 = $domainid + "_" + "guest"
get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2 get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2
Write-Output "THIS SCRIPT ACTUALLY RAN" | Out-File -FilePath 'C:\eidf\HardenScript.txt'