> ## Documentation Index > Fetch the complete documentation index at: https://journal.daudaldi.my.id/llms.txt > Use this file to discover all available pages before exploring further. # Windows # Windows Hardening Windows is the dominant OS in enterprise environments, which makes it the dominant target. Active Directory, SMB, RDP, DCOM, WMI, these are all powerful features that also happen to be the bread and butter of how attackers move through corporate networks. Hardening Windows, whether it's a workstation, a server, or a domain controller, is about systematically closing those doors. This page covers the practical steps, what to actually configure, and the tools to help you do it. ## Start with Microsoft's Security Baselines Microsoft publishes **Security Baselines** - Group Policy templates with their recommended security configurations for each Windows version. These are free and are the official starting point: * Download from the [Microsoft Security Compliance Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=55319) * Baselines exist for Windows 10, Windows 11, Windows Server 2019, 2022, and Microsoft 365 Apps **CIS Benchmarks** for Windows are equally good and widely used - grab the relevant one from [cisecurity.org](https://www.cisecurity.org/cis-benchmarks/). ## Account and Authentication Hardening ### Local Account Policies Open `secpol.msc` (Local Security Policy) or configure via Group Policy: **Account Policies > Password Policy:** * Minimum password length: 14+ characters * Maximum password age: 90 days (or never, if using MFA) * Password history: 24 * Complexity requirements: Enabled **Account Policies > Account Lockout Policy:** * Account lockout threshold: 5 invalid attempts * Lockout duration: 15 minutes * Reset lockout counter after: 15 minutes ### Disable the Built-in Administrator Account The default `Administrator` account with a well-known SID (S-1-5-21-...-500) is a consistent attack target: ```powershell theme={null} # Disable the built-in Administrator Disable-LocalUser -Name "Administrator" # Rename it if you need to keep it (security through obscurity, but reduces noise) Rename-LocalUser -Name "Administrator" -NewName "something_else" ``` ### Disable the Guest Account ```powershell theme={null} Disable-LocalUser -Name "Guest" ``` ### Local Administrator Password Solution (LAPS) In domain environments, every machine having the same local admin password is a massive lateral movement risk. **Microsoft LAPS** (or the newer Windows LAPS built into Windows Server 2022/Windows 11) generates unique, random, rotated passwords for local admin accounts: ```powershell theme={null} # Check if LAPS is installed Get-Command Get-LapsADPassword -ErrorAction SilentlyContinue # View LAPS password for a computer (requires appropriate AD permissions) Get-LapsADPassword -Identity WORKSTATION01 ``` ## Windows Defender and Antivirus On modern Windows, **Microsoft Defender** is actually quite solid - but its default configuration can be improved: ```powershell theme={null} # Enable real-time protection (should be on by default) Set-MpPreference -DisableRealtimeMonitoring $false # Enable cloud-based protection Set-MpPreference -MAPSReporting Advanced Set-MpPreference -SubmitSamplesConsent SendAllSamples # Enable network protection (blocks malicious domains and IPs) Set-MpPreference -EnableNetworkProtection Enabled # Enable controlled folder access (ransomware protection) Set-MpPreference -EnableControlledFolderAccess Enabled # Enable attack surface reduction (ASR) rules # Block Office apps from creating child processes Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled # Block credential stealing from LSASS Add-MpPreference -AttackSurfaceReductionRules_Ids 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 -AttackSurfaceReductionRules_Actions Enabled ``` ## Remote Desktop Protocol (RDP) RDP is one of the most attacked services on Windows - ransomware gangs love it. If you must use RDP: ```powershell theme={null} # Restrict RDP access to specific IP ranges via Windows Firewall New-NetFirewallRule -DisplayName "RDP - Allowed Sources" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 10.0.0.0/8 -Action Allow # Block RDP from everywhere else New-NetFirewallRule -DisplayName "RDP - Block All" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block ``` **Additional RDP hardening (via Group Policy or Registry):** * Enable **Network Level Authentication (NLA)** - `Computer Config > Admin Templates > Windows Components > Remote Desktop Services > Require NLA` * Set **maximum session time** limits * Use **Remote Desktop Gateway** instead of direct RDP exposure * Consider changing the default port (3389) - not a security control, but reduces automated scanning noise ## Windows Firewall Windows Firewall with Advanced Security is actually capable - it's just rarely configured well. ```powershell theme={null} # Ensure firewall is on for all profiles Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True # Default deny inbound on all profiles Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultOutboundAction Allow # View all enabled inbound rules Get-NetFirewallRule -Direction Inbound -Enabled True | Format-Table DisplayName, Action, Profile # Disable a specific rule you don't need Disable-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" ``` ## SMB Hardening SMB is the protocol behind Windows file sharing and a common attack vector (EternalBlue, lateral movement, credential relay). ```powershell theme={null} # Disable SMBv1 - it should never be enabled in 2024+ Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force # Require SMB signing (prevents relay attacks like Responder/NTLM relay) Set-SmbServerConfiguration -RequireSecuritySignature $true -Force Set-SmbClientConfiguration -RequireSecuritySignature $true -Force # Disable SMB compression if not needed (reduces attack surface) Set-SmbServerConfiguration -DisableCompression $true -Force # Verify current SMB configuration Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, EnableSMB2Protocol, RequireSecuritySignature ``` ## Disabling Unnecessary Services and Features ```powershell theme={null} # Check running services Get-Service | Where-Object {$_.Status -eq "Running"} | Sort-Object DisplayName # Disable a service you don't need Set-Service -Name "RemoteRegistry" -StartupType Disabled Stop-Service -Name "RemoteRegistry" # Common services to evaluate for disabling (context-dependent): # RemoteRegistry - allows remote registry editing - often not needed # Telnet - should never be on # SNMP - if not actively used # Fax - almost never needed # Print Spooler (on non-print servers) - was exploited by PrintNightmare ``` ### Windows Features to Remove ```powershell theme={null} # Remove PowerShell v2 (lacks security logging and constrained language mode) Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root -NoRestart # Remove Telnet client (you shouldn't be using this) Disable-WindowsOptionalFeature -Online -FeatureName TelnetClient -NoRestart ``` ## PowerShell Security PowerShell is both essential and one of the most abused tools by attackers. Harden it without breaking legitimate use: ```powershell theme={null} # Set execution policy - RemoteSigned requires scripts from internet to be signed Set-ExecutionPolicy RemoteSigned -Scope LocalMachine # Enable Script Block Logging (logs every PowerShell script that runs) # Via Group Policy: Computer Config > Admin Templates > Windows Components > Windows PowerShell # Enable "Turn on PowerShell Script Block Logging" # Enable Module Logging (logs all PowerShell module usage) # Enable "Turn on Module Logging" in the same policy location # Enable Transcription (full PS session transcripts) # Enable "Turn on PowerShell Transcription" and specify output directory # Force PowerShell 5.1+ (not PS 2.0) to prevent downgrade attacks # Done by removing the PS v2 feature (see above) ``` ## Credential Protection ### Enable Credential Guard Credential Guard uses virtualization-based security to protect LSASS credentials, preventing tools like Mimikatz from dumping them: ```powershell theme={null} # Check if Credential Guard is running (Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard -ClassName Win32_DeviceGuard).SecurityServicesRunning # Value 1 = Credential Guard running # Enable via Group Policy: # Computer Config > Admin Templates > System > Device Guard # "Turn On Virtualization Based Security" > Enable # Set Credential Guard to: Enabled with UEFI lock ``` ### Disable NTLM Where Possible NTLM is an older authentication protocol that's frequently abused for relay attacks. Where Kerberos can be used, it should be: ```powershell theme={null} # Restrict NTLM usage (be careful - this can break things in older environments) # Via Group Policy: Computer Config > Windows Settings > Security Settings > Local Policies > Security Options # "Network Security: Restrict NTLM: NTLM authentication in this domain" > Deny All ``` ### Disable WDigest Authentication WDigest stores plaintext credentials in memory - it shouldn't be enabled on modern Windows, but sometimes gets re-enabled: ```powershell theme={null} # Disable WDigest (prevents plaintext credential storage in LSASS) Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -Name "UseLogonCredential" -Value 0 ``` ## Windows Event Logging Default Windows logging is insufficient for any meaningful detection or forensics. You need to increase log sizes and enable additional audit policies. ### Audit Policy ```powershell theme={null} # Enable comprehensive audit policy via auditpol auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable auditpol /set /category:"Account Logon" /success:enable /failure:enable auditpol /set /category:"Account Management" /success:enable /failure:enable auditpol /set /category:"Policy Change" /success:enable /failure:enable auditpol /set /category:"Privilege Use" /success:enable /failure:enable auditpol /set /category:"Object Access" /success:enable /failure:enable auditpol /set /subcategory:"Process Creation" /success:enable # Check current audit policy auditpol /get /category:* ``` ### Increase Log Sizes Default Windows log sizes are way too small for any real environment: ```powershell theme={null} # Set Security log size to 1GB wevtutil sl Security /ms:1073741824 # Set System log size to 256MB wevtutil sl System /ms:268435456 # Set Application log size to 256MB wevtutil sl Application /ms:268435456 ``` ### Enable Sysmon **Sysmon** (System Monitor) from Sysinternals is a free tool that dramatically improves Windows visibility. It logs process creation, network connections, file creation, and more with much more detail than native audit logging: ```powershell theme={null} # Download Sysmon from Microsoft Sysinternals # Run with a config (SwiftOnSecurity's config is a popular community baseline) sysmon64 -accepteula -i sysmonconfig.xml # Update config sysmon64 -c sysmonconfig.xml ``` Use the [SwiftOnSecurity Sysmon config](https://github.com/SwiftOnSecurity/sysmon-config) as a starting point. ## AppLocker and Windows Defender Application Control (WDAC) Control which applications are allowed to run - one of the most effective defenses against malware and ransomware. **AppLocker** (older, easier to configure): * Available in Enterprise/Education editions * Configure via Group Policy: `Computer Config > Windows Settings > Security Settings > Application Control Policies > AppLocker` * Start in Audit mode to understand what would be blocked before enforcing **WDAC** (newer, more robust): * Works at the kernel level, harder to bypass than AppLocker * Managed via Group Policy or Intune * Microsoft provides a [WDAC Wizard](https://webapp-wdac-wizard.azurewebsites.net/) to help build policies ## Windows Update and Patch Management ```powershell theme={null} # Check Windows Update status Get-WindowsUpdateLog # Force check for updates (requires PSWindowsUpdate module) Install-Module PSWindowsUpdate -Force Get-WindowsUpdate Install-WindowsUpdate -AcceptAll -AutoReboot ``` In enterprise environments, use **WSUS** (Windows Server Update Services) or **Microsoft Endpoint Configuration Manager (MECM/SCCM)** for centralized patch management. ## Useful Tools | Tool | What it's for | | ----------------------------------------- | -------------------------------------------------------------------- | | **Microsoft Security Compliance Toolkit** | Official baseline configs from Microsoft | | **CIS-CAT** | Benchmark assessment against CIS Windows benchmarks | | **Sysmon** | Enhanced Windows event logging | | **BloodHound / SharpHound** | AD attack path analysis - run it defensively to find your own issues | | **Pingcastle** | Active Directory security audit tool | | **LAPS** | Local Administrator Password Solution | | **Defender for Endpoint** | Commercial EDR - best-in-class Windows detection | | **Microsoft Baseline Security Analyzer** | Legacy tool but still useful for basic checks | | **PowerStig** | PowerShell module for DISA STIG compliance | ## Active Directory Specific Hardening If you're hardening in a domain environment, AD hardening deserves its own attention: * **Tier model** - Separate admin accounts by tier (T0: Domain Controllers, T1: Servers, T2: Workstations). Never use the same account across tiers. * **Protected Users group** - Add sensitive accounts to the Protected Users security group to restrict credential caching and weak auth * **Disable unconstrained delegation** - Extremely dangerous. Audit with: `Get-ADComputer -Filter {TrustedForDelegation -eq $true}` * **Review AdminSDHolder** - Controls ACLs on privileged accounts * **Monitor Kerberoastable accounts** - Service accounts with SPNs and weak passwords: `Get-ADUser -Filter {ServicePrincipalName -ne "$null"}` * **Run Pingcastle or BloodHound** - These tools specifically find AD attack paths ## Reference * [Microsoft Security Baselines](https://www.microsoft.com/en-us/download/details.aspx?id=55319) * [CIS Windows Benchmark](https://www.cisecurity.org/benchmark/microsoft_windows_desktop) * [DISA STIG for Windows](https://public.cyber.mil/stigs/) * [Sysmon + SwiftOnSecurity config](https://github.com/SwiftOnSecurity/sysmon-config) * [Pingcastle AD Audit](https://www.pingcastle.com/) *** *Windows hardening in enterprise environments is a team sport. Most of it happens through Group Policy and requires coordination between IT and security. Start with the Microsoft Security Baselines and work outward from there.*