It is important to note, that after hardening a system, one has to test to see if the applications that you run still runs as expected. The ideal candidate of this project is a home user with no need for communications among PCs in the LAN. That is because the more network ports you open, the less secure you become.
Testing was done on Windows 10 Pro and Home 64 bit machines.
After hardening, all control panel items are tested working, with the following exceptions:
If your system has already been compromised, the best course of action is to re-install Windows. Because there is no telling what backdoors and botnets clients have been installed on your system. You cannot fight back at someone who already has administrator control of your system. You can implement something and they will just disable it. You best chance of survival is to re-install Windows and then hardening it to prevent further attacks from happening.
For details of the Automated Configuration files, see the Automated Configuration section near the bottom of this document. They will also be mentioned as when applicable in each section though out the document..
Things you need downloaded beforehand
Since the release of Windows 10 on Windows Insider, there has been critical updates that could stop you from performing Windows Check for Updates. If you have attackers on your tail, you may very well be stopped from obtaining critical updates. Or that you may be compromised when you go online to fetch updates.
There is a free tool called WSUS Offline Update, which can download updates for all Windows platforms and create a ISO image file. Just burn this image file to DVD and slip it into your PC and it will commence installing the updates.This tool eliminates a critical gap in Windows installation. That is when you only have the latest version but are missing all updates. An attacker can attack you while you are updating online and vulnerable. The tool is available from here: http://www.wsusoffline.net/ . The site is in German and English.
So the plan is to run this tool on another PC to fetch the updates, and take the updates disc to the machine you are installing.
On the main screen, select the platforms which you want updates for, and checkmark Create ISO images 'per selected product and language', then click the Start button.After it finishes, check the iso sub folder to locate the ISO image file. Note that this is a DVD image file. You need to right click on it and select 'Burn disc image'. Or you can use the free ImgBurn utility if you are not on Win 7 or Win 8. If the ISO file is too big for a DVD (larger than 4.5 GB) then you would need to copy the ISO file to a USB memory stick and then copy it onto the system being installed. Once on the system, right click the file and choose Mount. This should result in a mounted drive. Go inside, and copy all the files and folders of the ISO into a new folder. Then start the updater program and click it's start button.
As per normal, to securely install an OS, one should install it disconnected from the network..If you are using an ethernet cable, disconnect the cable. If you are on WiFi, Right click on Start button > go to Control Panel > Network and Sharing Center > Change Adapter Settings and right click disable the WiFi interface.
To perform an upgrade from Windows 7 or 8.1, boot that version of Windows and run 'setup' from the DVD drive/USB memory stick. Do not boot with the ISO and do a clean install, as you won't be able to Activate your Windows 10 afterwards.
After you have done 1 upgrade and activated that, then you can boot the DVD created with MS Media Creation Tool, and perform a 'clean install'. MS will remember your PC from your last activation.
Use the updates disc create by WSUS Offline Update and install the patches.
Before we go on to hardening, it would be wise to create a drive image using Macrium at this point to capture a clean virgin Windows install. That way, if you want to undo all the hardening in one swoop, you can reimage the machine using this image file
Install your antivirus program now. You would also need to specify a outbound firewall rule to allow the antivirus to fetch signature updates. Windows 10 comes with Windows Defender antivirus. If you want to use this default antivirus, and MS is turning out to be a real great contender in this market, then nothing needs to be done except allowing it outbound in the firewall (already listed in the default firewall rules) Some antivirus products also require other files added to the firewall outbound rules - like ESET antivirus, which has a file called "ekrn.exe" that intercepts web browsing and inspects traffic.
One of the main concepts underlying hardening is least privilege. It means to configure your system so that it is only capable of doing things you normally do, and nothing else. So, that means that if a feature in Windows is not used, it is to be turned off, or disabled.
The reason behind it, is that the more features you enable, the larger your attack surface is. It means you have more to defend. And one vulnerable spot is all it takes to get hacked. The more features you have, the more potential bugs ( some security related ) you have. Now attackers know a lot about the security bugs in the system – that’s how they attack. If you go live on the internet with all features turned on, the attacker would have a lot of choices. If you disable unused features, then he’d have less to play with.
One of the first things you should do in line with least privilege is to create a Standard user account, and use that account for your daily work. Only login to the administrative account to install programs, configure networking, or do system maintenance tasks. Because when you are working in a Standard account, any malware or hacker that makes it onto your system will inherit your privilege and not have admin privileges to make system wide modifications. And that’s a win for you.
Remember that an attacker will have all the access that you have at the that moment of attack. So if you have important data stored in that account's Document folder, he will have the same access. ( more on that later ) So, if you have secret level data, it is best to store them in an account which you don't surf with.
From a different perspective, a Standard account is a barrier to other accounts, and is also a container for attacks. If you have your services set up correctly and don't allow the command RunAs, ( it is the Seondary Logon service ), then automated attacks and hackers cannot gain access to your other accounts. If you notice different behavior of your browser or something that looks like virus activity, you can rebuild your account and delete the old one as part of a recovery procedure. It may not contain the attacker if she attacks a service that is run by the System account. But that's why we disable services that are not necessary further on down
Control Panel, select 'View by: Small Icons'. This shows all the configurations choices available.
When MS released Vista, there were some complaints about UAC asking for confirmation to do this, that and the other. So MS made a compromise in Windows 7 and allow customers to choose what level of prompting they want. Know that turning completely off UAC also means turning off Protected Mode in Internet Explorer, and not too many people realize that a major piece of protection is now turned off. UAC pops up mostly during the setup phase, once you have finished setting up your computer, you will rarely encounter it.
Control Panel\All Control Panel Items\User Accounts\Change User Account Control Settings
Move slider to top
Windows network has 3 network types, domain, private and public. Work and home are similar and are labeled as 'private' under it's firewall tool. The private setting is set to allow 'network discovery', so that Windows is allowed to talk to other PCs. The public setting is the most secure and is meant to be used at cafe hotspots, airports etc. If your network contains insecure PCs, then you should set the network profile to public. The domain setting cannot be chosen by the user, and is used after the PC has joined a domain. Since we are hardening the PC, we want the most secure setting, and only allow Windows to talk when it is cal led for. So for those that intend to join a domain, choose the private profile; and if not, choose the public profile.
Control Panel \ Network and Sharing Center
When you plug in the ethernet cable or connect to WiFi after hardening, set network to Public, which is the most restictive and secure.
Note: if you selected Private and later want to change it to Public, the only method for Windows 10 that I am aware of involves using PowerShell.
Right click on PowerShell and then click Run as Admin, then type in this:
and you will get something similar to this:Name : Network
note the Name, and then type this, replacing the word Network with the name found above:
Set-NetConnectionProfile -name "Network" -NetworkCategory public
In order for a attacker to hack you remotely, he needs to interact with a network facing program running on your PC. Some networking components implement protocols. Networking protocols are grammar rules for bits and bytes to communicate with other PCs. And each has weaknesses. So unless your environment requires that a protocol must be used, we will want to disable all except the bare essentials. More protocols mean a larger attack surface.The only protocol you really need is IPv4. And most networking equipment requires IPv4 in order to function. IPv6 will be increasingly necessary as we have run out of IPv4 addresses. As of this writing ( Windows ver 1803; May 2018) big ISP's has begun shipping IPv6 capable router/modems.
NetBIOS over TCP/IP is not required because NetBIOS is already active without this option. Disabling NetBIOS over TCP/IP should limit NetBIOS traffic to the local subnet.
The Discovery protocols are used to provide a nice graphical map of your network. For home users, this is not needed, as there is only one router. You would only get to see a picture depicting your PCs connected to your router. For Domain users, this feature is automatically turned off once you join the domain.
File and Printer Sharing should only be enabled if you plan to share some of your folders on the network or if you want to share your locally connected printer over the network. If printer sharing is desired, it is better to get a printer that has networking built in, so that when attacked, they only gain access to a printer instead of your PC. Disable this feature unless absolutely required.
Control Panel\Network and Sharing Center\Change Adapter Settings
Right click on Local Area Connection, choose Properties\
uncheckmark the following:
Select 'Internet Protocol version 4 (TCP IPv4), click Properties, click Advanced,
In line with layers of security, besides deactivating security protocols, we will be disabling services that serve these protocols. (see 'disabling vulnerable servies' section below)
As mentioned previously, IPv6 tunneling bypasses the security of your IPv4 router and hardware firewall.
See this page:: http://support.microsoft.com/kb/9298522 ( Note that the FixIts do not work on Windows 8 ))
You want to do it manually:
Under the registry key “HKLM\SYSTEM\CurrentControlSet\Services\tcpip6\Parameters”,
right click on the right pane, create an New entry of type DWORD(32bit) called DisabledComponents,
Then double click on it and enter one of the following:
Note that the value "0" is the default setting.
If you have the Automated Configuration Pack, you can right click on "NoTCPIP6 All.reg" and select Merge to disable all TCP/IP6, or you can right click on "NoTCPIP6 Tunnels.reg" and select Merge to disable all tunneling protocols.
Control Panel / Device Manager, View menu / Show Hidden Devices
I have never seen this protocol used. When something is unused, least privilege says it should be disabled.
Start button\All Programs\Accessories\command prompt, right click, click on "run as administrator" at the bottom of the screen and paste in this command:
Netsh interface ipv4 set global mldlevel=none
The intention of UPnP is ease of configuration, so such things as games can auto-configure the firewall to let other players from the internet join in. However, with users each poking holes into your firewall with UPnP, pretty soon it will be Swiss cheese and cease to function as a firewall. It is better to configure firewall rules manually so that each firewall rule is known and accounted for. If your hardware firewall or router has an option to disable UPnP, do so.
right click on right pane, new dword:32 bit,named UPnPMode
Double click on that and set the value to 2.
If you have the Automated Configuration Pack, you can right click on the file "UPnP.reg" and select "Merge"
SMB is the file sharing protocol used for File and Printer Sharing and inter-process communication. It has 3 versions. MS does not recommend disabling v2 or v3. Version 2 was released with Vista. Version 3 is new to Windows 8 and Server 2012 and has a encryption feature. There has been worms which attack SMB shares, and depending on the payload, could gain complete control of the machine. For further information on disabling all versions of SMB, read this: http://support.microsoft.com/kb/2696547
Go to Control Panel > Programs and Features > Turn Windows Features on or off. Uncheckmark SMB 1.0/CIFS File Sharing Support. New to Windows v1803 - SMB v1 is disabled by default.
When you run the command 'netstat -abn', it will show you which ports are open and listening to the network. Normally, you would want to close those ports unless you really need them. Windows 10's listening processes and their port numbers are RPCss ( 135 ), eventlog service ( 49409 ), Spoolsv ( 49410 ), schedule ( 49411 ), lsass.exe ( 49414 ). (The port numbers above 49152 can change between reboots), However, the default firewall policy for inbound traffic is to 'block' for all network profiles ( domain, private, public ). That means nobody can touch those listening ports unless the firewall is off, or you have made inbound 'allow' rules to pass traffic onto those processes. This has been verified by connecting to them with telnet and all attempts failed, unless one turns off the firewall or makes 'allow' rules. Also, as far as I can determine, all of those processes are essential to Windows, epecially RPCss and lsass.
If a printer is seldom needed, one can disable the spool service and eliminate one listening service.
This will stop the spooler service from starting up with the PC. Some services are designed not to be stoppable. You can see those in Start> Administrative Tools> services, when you right click on them, the Start and Stop options are greyed out. Spooler, like some other services, are not listed there for whatever reason. One can see all of the services in Task Manager > Services tab. Or you can open an admin command prompt and type in 'sc query'.
Buy a router that has Stateful Packet Inspection ( SPI ) firewall. This kind of firewall will monitor outbound traffic and only allow matching return traffic. Like when you surf to a web site, your browser initiate a request to the site, and the site returns the web page. Buy one even if you have only 1 PC. And if you are using a cable modem which only has 1 Ethernet port, you definitely need one.
More expensive hardware firewall routers will have more tools, like configurable rules, sending logs to remote syslog servers, and fancier protection like spotting syntactical illegal ip packets. For an example of small/medium size business product, take a look at the www.sonicwall.com site. They have products which integrates a firewall, gateway antivirus and antispyware, and VPN. These usually costs $400 and up.
As an alternative, there are free Linux distributions that offer almost the same features, like IPFire and pfSense. See the section Intrusion Detection part 4 below.
The basic principle for configuring firewalls is 'default deny'. That means all traffic is to be blocked unless you have made a rule to allow it. Those rules are your 'whitelist' of known good applications and protocols.
Window's firewall's default policy is set to inbound deny and outbound allow all. 'Outbound allow all' eases configuration, doesn't follow the default deny principle, and is not ideal. We don’t want malware to be able to call back to their master servers.
Most people don't know that you have to turn outbound blocking on. When outbound blocking is turned on, it only allows the programs and services you specify to talk to the net. Malware will have a hard time reporting back to their servers. However, it is missing a feature that tells you what programs it has blocked outbound. So after installing a program that needs to connect to the net, like your antivirus program, you have test those exe files one by one to see which is responsible for talking and allow that exe to talk with a outbound rule.Start/Settings/Administrative Tools/Windows Firewall with Advanced Security
If you have the Automated Configuration Pack, you can right click on "netsh-advfirewall.bat" or "netsh-advfirewall - if not using TCPIPV6.bat" and choose Run as admin. This will set up all firewall rules and profile settings.
-----Firewall Rules ------
HowTo allow a windows service outbound: Click on Outbound Rules on the left, click on 'New Rule', select 'Custom', next to 'Services' click customize, select 'Apply to this service', scroll and find 'Windows Update', next, ports and protocol - (no change), next, IP addresses ( no change ), next, select 'Allow The Connection'. Checkmark all profiles,next. Give the rule a name, eg "Allow service X".
HowTo Allow a program outbound: Click on Outbound Rules on the left, click on 'New Rule', Select "Program", next, select "This program Path" and click on "Browse" button, Navigate to program folder and select the EXE, next, select "Allow the connection", Checkmark all profiles,next. Give the rule a name, eg "Allow Program X".
HowTo Allow communication to a destination port # and IP address: Click on Outbound rules on the left. Click on 'New Rule'. Select 'Custom'. next. Select 'All Programs'. next. For 'Protocol Type' select 'TCP' or 'UDP' as the case may be. For 'Remote Port', select 'Specific Ports'. Then type in the port number(s) below. next. For 'Remote address this rule applies to' select 'These ip addresses'. Click 'Add' button, and in the following dialog box, type in an ip address into 'This ip address or subnet'. ok. next. Select 'Allow the connection'. next. Checkmark all profiles,next. Give the rule a name, eg "Allow out to port ### on server YYY.The firewall rules have been revised from previous editions of this document. Previously, there were 2 separate rules for the Windows Update service, and Time service. Now these rules are not needed.
The following rules applies to all 3 profiles: Domain, Private and Public
The rules marked with "**" are noticed to send traffic, but after testing found unnecessary for Activation and Windows Update. So those rules are created in the automated configuration but marked as disabled. The goal of the sub-project Quiet Lights is to have as little background traffic as possible unless some internet application is running in the foreground.
Some apps install Inbound allow rules to itself. When you install an app, you should check the Inbound rules to see if any new rules have appeared, and disable those if you don't want inbound traffic to that app. Note that an inbound rule to an app essentially makes that application a server. That is, it will accept any transmission to the PC and can be exploited
To preserve your firewall rules from MS modification, you will need to Export Profile and re-import the profile when you notice the firewall rules has been modified. Check the rules after every Windows Update and Windows Upgrade.
FIPS and Windows Advanced Firewall
Do NOT enable FIPS in Local Security Policy > Local Policies > Security Options, or else you will not be able to Import Firewall Policy.
Local Security Policy > Local Policies > Security Options > System cryptography: Use FIPS compliant algorithms .."
Windows will automatically search for a HTTP Proxy for each account by default. A HTTP Proxy is a server service that receives HTTP requests and forwards the request to the internet. Usually it is used to filter web site request to ban certain web sites. And companies use it enforce policies like banning Facebook and other productivity draining activities. Most home environments do not have a HTTP Proxy server. If an attacker plants a HTTP Proxy service on your network, then she can monitor your web activities. Or even redirect your web requests to a malicious site. This should be turned off.
Go to Settings > Network and Internet > Proxy and turn off 'Automatically detect settings'
Setting up the system to use a MS Account for login is needed if you plan to do purchases through the Windows app Store.
However, it is not recommended that your admin account be an MS account, because it is exposed on the net on Outlook.com and allows attackers to crack your password before even touching your network or your computer.
You can use gmail or yahoo mail or outlook.com or hotmail.com addresses for this "MS Account". If you use a gmail or yahoo mail account, Windows will create a mirror account on outlook.com that uses the same name and password. It will also migrate your phone number over to this account. The phone number is used for 2nd factor authentication when you go do Billing things.
A workaround for this is to pay for the WinApps you want to install and immediately go to outlook.com to remove the credit card info from the account.
WARNING: an MS account is a semi-admin. She can install Win Apps from the Store even if she is not an admin account. And depending on the Win App, the installation could open inbound 'allow' firewall rules which will make your PC vulnerable. Modifying firewall rules used to require admin rights but MS has apparently decided to bypass this. So, create an MS account only for an admin person and never for a user, as a user cannot be trusted to treat security as important. All a user wants at the moment is to try out that new software.
If you have to use MS accounts for your users, you can put a ban on the Windows Store.
Open Regedit, and navigate to
Make a Dword32 named RemoveWindowsStore
Setting RemoveWindowsStore to 0 will reactivate the Store.
If you want, you can install another software firewall, although the Windows 10 firewall is quite good. Note that installing a third party firewall will automatically disable the Windows 10 one, because having 2 firewalls will cause conflicts. For example, currently, the Comodo firewall is top rated, However, the part which I don't like is that it has an internal list of programs which it designates as "safe". I prefer my own white list, containing programs that I know of and approve, like in the rules list above. It also has to do with Least Privilege, because one doesn't want rules to allow programs connecting out to the internet if one never uses them.
If you do want to use Comodo, then set the Comodo firewall to use "Custom Policy". In this mode, the firewall will prompt and tell you about both "safe" and unknown applications that try to connect to the internet, giving you the authority to decide. The good thing about using a third party firewall like Comodo is that it tells you what applications are trying to connect outbound, whereas Windows Firewall doesn't. And it does make for easier operation.
When activated, Software Restriction Policy will prevent any program from running except if it is residing in \Program Files or \Windows. That means any downloaded malware in Temporary Internet Files or elsewhere will not be able to run. ( browsers and plug-ins sometimes have vulnerabilities to let infected web sites to force them to download ) Since you will be running as a standard user daily, that malware cannot install itself to the above 2 locations, because you need admin rights to do so. So you are covered against unwanted Desktop programs running.
Feature not available in Windows 10 Home.
Simple SRP 2.1 is a free tool that provides the majority of the functionality of Windows’ own SRP in a small program that sits in the systray. And it works on Windows 10 64bit.
This program provides crucial protection to Windows 10. After installation, only programs in \Program Files and \Windows will execute. So in order to run the BAT files of this guide’s automated configuration, you need to choose the tool’s UnLock from the right click menu, which will give you 30 mins of unlocked time.
The program installs into \Windows\SoftwarePolicy. Configuration is done via an .ini file that can be accessed and edited from its menu. There are some configuration items that need modification. Right click on the program’s systray icon and choose Configure. Notepad will start.
Locate [CustomPolicies] and add the following line:
Add the following extensions to the end of "FileExtensions": VBS, JS, JSE, OTF, SCT, SHB, VBE, WSF, WSH, PS1. Then remove the ';' from the beginning of the line.
Locate "includeDLLs" and set it to 1.
Next, add the following lines underneath [Disallowed]
C:\Program Files (x86)\Google\Chrome\Application\SetupMetrics=1
C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files=1
C:\Windows\System32\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update=1
C:\Windows\System32\Tasks\Microsoft\Windows\File Classification Infrastructure\Property Definition Sync=1
C:\Windows\SysWOW64\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update=1
In recent months (Apr 2017) there have been attacks that do not utilize malware but uses Windows' built-in scripting engines to execute script lines. As such, there are no files in the payload for antiviruses or anti-exe's to detect and block. (The anti-exe Voodoo Shield is an exception in that in it's locked mode it prompts the user if Powershell is run) Nevertheless, it is sound protection to use SRP to block the execution of script engines until you temporarily unlock to run a script.
Now extract the AccessChk.zip file that was downloaded. Then create a 'find SRP block paths.bat' with the following lines:
accesschk -w -s -q -u Users "C:\Program Files"
accesschk -w -s -q -u Users "C:\Program Files (x86)"
accesschk -w -s -q -u Users "C:\Windows"
accesschk -w -s -q -u Everyone "C:\Program Files"
accesschk -w -s -q -u Everyone "C:\Program Files (x86)"
accesschk -w -s -q -u Everyone "C:\Windows"
accesschk -w -s -q -u "Authenticated Users" "C:\Program Files"
accesschk -w -s -q -u "Authenticated Users" "C:\Program Files (x86)"
accesschk -w -s -q -u "Authenticated Users" "C:\Windows"
accesschk -w -s -q -u Interactive "C:\Program Files"
accesschk -w -s -q -u Interactive "C:\Program Files (x86)"
accesschk -w -s -q -u Interactive "C:\Windows"
Place the bat file into the folder where you extracted Accesschk.exe, and run it file to find out which folders on your system you need to add to the Disallowed section.
Lastly, if you use the Opera browser, find in the [LimitedApps] section the line 'Opera=...' and place a semicolon (;) in front of the line to exclude Opera from protection, because Opera v30 (the latest version as of this writing) will not function with this enabled.
Save the file, exit Notepad and apply the policy.
The above configures the program to require a Windows admin account password. And it secures the mentioned paths under \Windows which can be modified by users to prevent malware from executing from in there.
Also, you can add a “;” in front of these lines to remove extra menu items, as they add clutter to the right click menu:;(C:\)=explorer.exe C:\
Windows defaults to allowing 'sideloaded' apps, which is to accept apps from a local install. Normally, Apps are mostly downloaded from the Store, which are vetted by MS. Unless you are a developer, you have no need for the sideload feature, and is best disabled.Go to Settings > Update and Security > For developers, and change the setting to Windows Store Apps.
Most people are aware that services can be security problems, and that some should be disabled. The culprits are partially network services that listen to the net. Anything that takes input from the net is candidate for manipulation by attackers. When one looks at the list of services that are disabled below, one might say that there are no known exploits for such and such a service. But the principle again is least privilege. Only those services that are needed should be active. And we don't want to wait until an exploit hits the security news sites and then take action. Least privilege is a pro-active, preventative concept.
There are various servers in the list of services which listens 24x7 to everybody sending them stuff.( which includes exploits ) Like the simply named 'Server' service that is responsible for File and Printer sharing. Another server is UPnP Device Host, which lets other PCs interact with devices on this PC. Components that allow remote management are also turned off - like Remote Registry and Windows Remote Management. The first allow other PCs to change your registry; and the second allows remote shell access. The Secondary Logon service is turned off, because it let command line users run programs as admin. It requires the admin's password, but then attackers have all day to figure that out. DNS Client used to be not needed, but MS has changed that in v1809 so that it can't be disabled. HomeGroup is a file sharing mechanism and the whole network's shared stuff (all material from all PCs) is secured via 1 password. With the File and Printer Sharing way, at least you can have different logons for different PCs. I have left 6 services on Automatic/Manual start which do react to inputs from the net, These services tell other windows programs about your network and allows you to choose your firewall profile (public or private). One of them is related to Direct Access, which only can be used in an environment that has Windows Servers, but I found that disabling it causes networking to malfunction.
There is another angle to services that makes some more desirable targets, and that is the account that runs them. The System account is all powerful and is equal in power to administrators. A network facing service which use this account, like the WMI Performance Adapter (gone from v1809) or the Printer Extensions and Notifications, will be prized, A service running as System will also be targeted by attackers who gained entry into a Standard account, they will try to take over the service to gain System rights. (This is called "escalation of privilege").
There are some services which activate if you have the right equipment, like. Microsoft iSCSI initiator service, Bluetooth support service, Fax, SmartCard. SmartCard removal policy and WWAN autoconfig are all dependent on specific hardware. In my personal configuration, they are all disabled, because I don't have them. In particular, Bluetooth support service is one that ought to be disabled if one doesn't have any bluetooth peripherals; it is a networking component that can be abused by attackers, and there are free hacking tools available. It is not disabled in the default configuration file because I don't want someone to apply the config and suddently find that their keyboard or mouse doesn't work.
When you configure services, clicking on each will display a description. If that is not enough for you, you can check outt http://blackviper.comm, sometimes they have additional information..
If you have the Automated Configuration Pack, you can set up the services by right clicking on "Harden Win 10 Home Services.bat" and choosing "Run as Administrator"
Items in <angle brackets> are optional and not setup in the Automated Configuration file.
Right click on Start button/Control Panel/Administrative Tools/Services
Right click on the following services, choose Properties and set Startup Type to Disable.
Name (Original Mode), what it does
WARNING: Geolocation service:(manual) used by cortana, If you disable this one, you won't be able to reset it back to normal again. Current Windows bug as of 2015-Aug-19 Update 2018-10-05 Fixed in v1809, so you can now disable it if you don't like Windows'location tracking
If you have the Automated Configuration Pack, my personal additional settings are in "My Personal Win 10 Home Disabled Services.BAT".
There should be limited logins available from the network. The 2 local security policies are set also in the Harden Win 10 Home Services BAT file if you have the Autpmated Configuration Pack.
However, if we stop user and admin accounts from login through the network, then Simple Software Restriction Policy will stop working. However we are still protected by Windows Firewall. So the accounts that are denied are: Guests, Anonymous Logon, NETWORK SERVICE, SERVICE, and LOCAL SERVICE.
A LiveTile on the Start Menu accepts input from the Internet. It has been said if the attacker can make her way onto the desktop, then all is lost. To be safe, Right click on each LiveTile and choose Turn LiveTile off. You can always click on a tile to run that app. If you are sure that you don't ever want to see a particular LiveTile, then right click and choose Unpin from Start.
At this point, you have hardened networking components. Switch to your Standard account..Connect now to internet. There are 3 things you need to check before you can perform activation.Open Start > All apps > Windows Administrative Tools > Services. And right click to start these 2 services:
Check your Date & Time, and your Time Zone is correct. You may have to disable automatic time zone updater service.
Then Right click on This PC, choose Properties, click on ActivateOr, you can open an elevated command prompt and run the following:
Then immediately do Check for Updates.
Settings > Update & Security > Windows Update. .
DO NOT SURF the net while updates are going on, as Edge and Internet Explorer are still unpatched and vulnerable.
If you wish, you may want to defer Windows Update until we reach the end of this guide, when all attack venues are covered.After doing every Windows Update, you need to check if MS has changed the firewall rules for you. If so, then run the netsh-advfirewall BAT file again or re-import your saved Firewall policy.
Install antispyware and antimalware Then install File Hippo's Program Manager, Adobe PDF Reader, your browser, your Office suite, your printer driver and all other applications.
If you use MS Office, then go do Microsoft Update now.
Settings > Update & Security > Windows Update > Advanced Options > checkmark Give me updates for additional Microsoft Products.
Remember to update your firewall outbound rules to allow the programs that need the internet, like Adobe Reader which now have their own update service, so add allow outbound rules for those services. Also your browser, antivirus and File Hippo Program Manager (see below) need to reach outbound to the internet.
With Windows 10 Fall Creators Update v1709, Windows Defender gains anti-exploit features. It is MS EMET transcribed for Windows 10. And it does not require the Secondary Logon service. It comes by default with preset protection settings for Windows executables like SVCHOST. Since MS knows it's own programs the best, it is not recommended to change the settings for Windows 10 programs. However, you can add programs to be protected. Go to Windows Defender Security Center > App and Browser Control > Exploit Protection Settings to take a look. From there, click on Program Settings > Add program to customize. A good program to add would be your 3rd party browser. The way to customize is to override each setting one by one, and then testing the program. For browsers, I would open 2 tabs, one to google.com and another to msn.com; a simple page and a complex page. So change one setting, and start your browser. If it doesn't work, you switch to Windows Defender and undo that change. Below are the settings for Chrome:
One of the most important things to do is to update EVERYTHING on your computer, constantly, that means Windows Update and updating all programs and plug-ins. It is very important to know that security patches closes the holes that malware/hackers need to get onto your computer. Patching the security holes is the ultimate preventative measure that treats the source of the problem.
It is known that attackers reverse engineer MS patches to exploit the vulnerabilities. It only takes a few days for them to do so, so be sure to patch on time. MS's patch schedule is on the second Tuesday of each month. Calendar a repeating entry on your cellphone. The features patches are on the fourth Tuesday of the month.
Windows Update supplies security fixes to Windows and its programs like Edge and Internet Explorer. If you use a buggy Edge, then hacked websites can install viruses/malware unbeknown to you.
Adobe Flash is another component that lots of people forget about. Luckily, three browsers, Edge, Internet Explorer and Google Chrome, will fetch Flash updates automatically, so you don't have to do a thing. If you use Firefox, Opera or another browser, then you need to download the Flash plugin for them. Adobe Flash has an automatic update feature for Flash, if you install Flash, you must make an outbound allow firewall rule for the service. An alternative to Flash is HTLM 5. Many sites are supporting this now, and you may find that you don't need Flash anymore.File Hippo offers a free program called Program Manager that detects which of your installed programs have a new version. This is a lifesaver. It will tell you about a new version, and link you to patch downloads. This is a very important part of maintaining security of your machine.
AutoPlay is a problem when it comes to removable devices like USB memory sticks and CDs. Because it will run whatever program it is set for whenever you insert it. Hackers are known to casually leave CDs around in public washrooms and label it something like 'layoff positions for next quarter', Once inserted, their hacking tools will run in the background and call back to its master server. AutoPlay is the successor to AutoRun, and can be disabled in Windows.
Go to Settings > Devices > AutoPlay, set AutoPlay to off.
It is very important to guard your sign on passphrases, espcially your admin account one. attackers will try to trick you into giving out the passphrase by installing a tojan that looks like the Windows sign on screen and upon seeing this most users will key in their passphrase without question. Microsoft has made a feature whereby you need to press CTRL-ALT-DEL in order to reach the sign on screen, because the special key sequence CTRL-ALT-DEL can only be trapped by the operating system. This feature is normally only active when a PC is domain joined to Windows Servers. However it can be enabled without Windows servers.
Another MS security feature is not displaying the account name in the sign on screen, even when the user is currently signed on and has locked the system by pressing WinKey-L. This means the attacker needs to get both the account name and the passphrase right and significantly enhances security.
If you have the >Automated Configuration Pack, you can right click on Harden Win 10 Pro Security options.bat and choose Run as admin to enable these 2 features. Further down the document, all the settings in Security options are given.
Onedrive lets you keep your documents, pictures and PC settings on the net, ready for syncing to all of your PCs. However, your personal files are sitting there on the internet 24x7x365 waiting for someone to crack your password. This is not secure to say the least.
Another issue is that OneDrive currently breaks Software Restriction Policy (including SSRP). The executable is located in \Users\<yourAccountName>\AppData\Local\Microsoft\OneDrive\, the folder is user writable. The problem is that if we extend SRP to allow programs to execute from this folder, then an attacker can place his tools in this folder and they will get the same permissions, all because the folder is under \Users\, and is user writable. If we make the SRP rule mention the executable, the attacker can overwrite the exe with his own program. So, do NOT create a rule in SSRP to allow OneDrive to execute. Sign-in to to those MS Account accounts and run Task Manager, go to the startup tab, and disable OneDrive from starting up upon sign-in.
Data Execution Prevention is a technology that foils some types of attacks when they are coded in a certain way. By default, this feature is enabled but protects only Windows executables. You want to enable it to protect all programs, like your Firefox, Opera, Acrobat Reader and others.
Right Click Computer/ Properties/ Advanced System Settings
/Performance Settings button/ Data Execution Prevention Tab
Select "Turn on DEP for all programs ..."
Dump files are memory dumps, and everything in memory are saved to a file. This is used for debugging problems when your system crashes. However, passwords and all confidential stuff that are running currently are also saved to this file. You should enable this feature only when you are experiencing problems and need to debug.
Computer > Properties > Advanced System Settings > Startup and Recovery Settings - settings button
Write debugging info: None.
Remote assistance allow a helper to control your PC with complete desktop, keyboard and mouse access. This is not a attacker favorite as there is built in protection that allow only the invited to take control. However, there are phone scams that lure users into giving them remote access, and you will want to protect your users and prevent them from compromising your computer.
Computer/Properties/Advanced System settings/Remote tab
Un-checkmark allow remote assistance
System Restore can be a life saver when you encounter system errors. Setting it to use more disk space and making more restore points is good policy
Right click Computer/Properties/Advanced Systems Settings/System Protection tab
Configure button/create bigger system restore cache
You want to be able to see all files and folders in Windows. If you do not do this step, hackers can hide their installed tools from you. Although the attacker can also install a rootkit which also hides their files, they may not be able to get that far into your system to do so.
Windows Explorer/ View pull down menu / Options button / Change Folders and Search options / View tabCHECKMARK items below
Unattended PCs are obvious security risks. But many people fail to take care of this via this simple setting. Most larger companies that are security aware have strict rules to enable this and not to leave PCs logged in and unattended.
Go to Settings > Personalize > Lock Screen > Screen Time out settings, configure it to wait 10 minutes.
If you look at \Windows\System32 folder, you will see a lot of exe programs. Some of them are Windows' GUI components and needed by the system. And some are command line programs used to administrate Windows. A Standard user account doing daily work has little use for these command line programs, as they are intended for IT administrators. In accordance with Least Privilege, these command line admin tools should be partitioned away from the User group. See the following RBAC section.
Attackers aim to get use of three accounts, the admin account, the "Administrator" account, and the System account. The admin account is needed for configuring the system, so it needs full access to command line tools and we cannot avoid this. The 'Administrator' account is by default disabled. And the System account is used by some services. In testing, it is revealed that the System account cannot be constricted or else our Restore BAT wouldn't work. So in the provided configuration file, command line tools are set so that only members of the administrators group and 'TrustedInstaller' can invoke them. (The System acount gets inheritied rights) Also, in line with layers of security, the command line admin programs are denied execution by low integrity processes.
As an example, few people are aware that there is a command line FTP program, as most people use their browsers to download. This program is used mainly by attackers who need to bring over their tools once they gained command prompt or powershell access.
Role Based Access Control means setting up accounts to do what it is only necessary for the job role. Hence an accountant would be set up so that he can run the accounting program, and not others like our hardening scripts. This is in accordance to the Least Privilege pricinple.
When we analyse our security posture, the weakest point of defense is when we are using our admin account. Sometimes, a program installer needs Software Restriction Policy turned off; because it writes to and then executes a temporary exe from within the temp folder. And it might also need Outbound firewall access set back to allow; because that temporary exe needs to download components from the internet. If we are using a full administrative account, which houses our hardening scripts as well as other important documents, there is a lot to lose. And installing a new program usually takes time, may be a good half hour or more to configure, test and so on. So in this hour we are essentially running an insecure semi-hardened box. This calls for a role called the Installation Admin.
In the Configuration Pack, the Dual Admin BAT creates an installation admin (you choose the actual account name) and restricts it from running admin command line tools, and administration GUI apps. In addition, it removes oridnary user accounts from accessing admin command line tools. After configuration, the command line administrative tools ( plus regedit, regedt32 and tasksched ) can only be accessed from a full admin account using an elevated command prompt. Also, only the full admin account has take ownership right. Right click on the BAT file and choose Run as Admin.
Note: the dual admin BAT script does not assign a password to the Install Admin. Sign on into the Install Admin account and give it a passphrase.In effect, the only special rights this installation admin account possess are the right to write anywhere in the hard drive, (like the Program Files folder, which only an admin can write to). and to write to any registry key. This seems very generous, but the fact is we are not able to restrict it further. This account would then be used when you install a program, which is a very common task for an admin role.
Very often, an attacker will install a Remote Access Tool/Trojan (RAT) to monitor the victim. This program is just like an ordinary program that provides remote access like Window's own Remote Desktop or the commercial program TeamViewer. It can view our screens, see what we type and control the PC by running any program. They are very hard to detect, espcially if the attacker does not make any changes to your system and just watches you. The goal is to hamper this RAT. The RAT will get all the permissions of the account that you sign into and require an online connection. So here is the second step; we will make our full privilege admin account go offline when used. This will buy us time to find and eliminate the RAT.
Now we create 5 scheduled tasks. The first one is for the full admin sign in to disconnect the network adpater. Ensure that you are signed in as the full admin.
Note: Scheduled Tasks action line reference the network adpater name. In the majority of cases, they are called Ethernet and Wi-Fi. But if you have multiple network adapters, then the names will be different and the network adapter name needs to be changed, from'Ethernet' and 'Wi-Fi' and replace them with what you have. The adapter names you currently have is shown at Control Panel > Network and Sharing Center > Change Adapter Settings.
Next, we make a scheduled task for full admin switch out, re-enables the network.
Next, we make a scheduled task for switching to full admin . (Fast user switching)
Next, we create 2 actions for your Limited Admin account to sign in.
And we create 2 actions for Limited Account Switch To.
Repeat the above 2 tasks for any non-admin account
Lastly we create a scheduled task for system startup, say if you restart the system while signed on as full admin. So we want to always startup the system on a connected state.
The whole set of scheduled tasks is designed to disconnect the network adapter for the full admin, when he signs in, or when his account is switched to. And we reconnect the network adapter when he switches to another account or signs out. You can verify this when you sign on to the full admin account by looking at the Internet icon in the systray - it will have the red X when you logon to the account.
Prior versions of this document creates a Sign Out task by referencing Sign out EventID 4647. But in Windows 10 v1709, MS has taken this capability away. So we now have to create a Scheduled Task for every non-Full-Admin account sign in.
New to ver 4 of Dual Admin, it is now possible to run the following networking commands in the Install Admin account:
Update: nslookup needs it own firewall rule and the built in DNS rule does not work. So in Windows Defender Firewall, create an Outbound rule to allow Protocol UDP with Remote Port of 53.
The Documents folder has 3 ACL rules allowing access for System, YOU, and the Administrators group. If you right click on the Documents folder and choose Properties > Security tab, you will see this.
The System account is present in almost all files and folders, but it doesn't need to be as far it can be determined. Attackers also can use escalation of privilege attacks to get to use the System account because it is as powerful as an admin. You can choose Edit and Remove to take the right away.
However, the Configuration Pack BAT files need System to work, that is, if you unzipped the Configuration Pack into Documents. To work around this, you can create a Security folder under your Users\<YourAccount>\ folder and extract the files there. Just remember to move the contents back to the Documents folder when you're done.
The Administrators group is present so that any admin can access your files in an emergency. This can be removed to ensure that the Install Admin can't get at your files. Because the Install Admin has internet access, a RAT (Remote Access Trojan) can use that account to get your files if access is granted for the Administrators group. Removing the ACL entry will ensure that your data stays private. The downside of this is when you need to remove this account using Start > Settings > Accounts > Family and Other People, the Documents folder can not be deleted and will be orphaned. If the account will never be removed, or if you can remember to re-instate the Administrators group, then this rule can be deleted.
There is also an option where low integrity programs can be made so that they can't even read medium integrity locations. That’s what the commands below do. When you execute the commands, your desktop, document, pictures, videos and music folders will be unreadable to any programs marked as low integrity. The last command above makes the Downloads folder a low integrity folder. This is necessary because you need a place to save your downloads.( Low can't write to Medium) You will also want to create an Upload directory, and copy the file which you want to upload there. Because this Upload folder has not been processed by chml, the low integrity browser can read this folder.
Since you also have a Standard User account, run the commands below stating your Standard User account too. Note: this measure only protects you against attacks to your low integrity programs like Internet Explorer. (and Firefox or Opera, if you followed the above instructions) But since browsers are primary vectors of attack, this security measure is important. You can also experiment and set other internet facing programs to low integrity, like your chat program.
Visit http://www.minasi.com/apps// to download chml.exee
Then right click on command prompt and choose 'run as administrator".
Then execute the following commands for Each user.
cd "\user\<yourAccName>\downloads\chml" ( or wherever you saved chml )
File History saves your documents, pictures, music, contacts and IE favorites every hour to a removable drive ( or USB key ). It does it every hour by default and keeps versions of the files as they change. This is a very convenient method of performing backups and should be used. Just remember to unplug the USB key when you shut down the computer and carry it with you, or else your attackers will gain access to all your files.
Go to Settings > Update & Security >Backup and click on "Add a drive"
Edge is the default web browser of Windows 10, and is pinned to the task bar. Edge has some new security features, like removing support for AciveX, VBScript, Browner Helper Objects (BHO) and VML. It also is a Windows app, and lives within a sandbox, which contains attacks. It also has Smart Screen Filter, like IE. It supports the W3C standard 'Content Security Policy', and also has HTTP Strict Transport Security. It is also a 64 bit browser, and uses ASLR (address space layout randomization) fully. There is also a new feature caled 'Control Flow Guard' which controls coding jumps in memory (in most attacks, attackers injects code to some place in memory and try to make the browser code execution jump to his own code). In accordance with good security practice, MS has also offered a handsome bounty to security bug reporters.
Open Edge, click on settings (the "..." button. Click on Settings, then 'View advanced settings'.
.Turn off 'Use Adobe Flash'. Many sites now use HTML 5, which also does videos. And so you no longer need Flash to view videos any more. Flash has had many security vulnerabilities discovered and currently (2015-08-07) has a few vulnerbilities unpatched, and you need to constantly baby sit it and update it.
.Turn on 'Help protect me from malicious sites and downloads with SmartScreen Filter'
Because browsers are the primary interface to the web, and used by everyone, they are a PRIMARY vector of attack. attackers will attack a website and modify it to deliver malware, using security holes in the browser. Or they can send attacks forging the address of a web page you are on. ( If you have a tab of your favorite web site always open, they can forge that web site's address and send attacks).
Internet Explorer was the most popular browser because it is installed by default. Edge may soon surpass it in popularity because it is pinned to the task bar.
Internet Explorer has an important defense mechanism, called Protected Mode. It is another name for Integrity Levels. Basically, the entire system is marked as Medium integrity. While frequently attacked programs like Internet Explorer is marked as Low integrity. Low integrity cannot modify Medium. So even if someone compromises IE and gains access to your PC, they cannot modify your system. You can set the integrity level of a program yourself, so you can make Firefox or other browsers use Protected Mode as well.
Popular alternatives to IE are Firefox, Opera and Chrome. There have been security holes discovered in them just like IE, but they are reputed to be more secure, primarily because they don’t use ActiveX. There are ActiveX code libraries strewn about in Windows, and many are not safe for web use. Attackers often make IE call to these ActiveX code modules as a means of attack.
Set IE to use Protected Mode Always
Control Panel/Internet Options/Security Tab
Checkmark Protected Mode for all zones
Login to EACH user account and repeat.
Set IE to use ActiveX Filtering
Open Internet Explorer, Gear icon / Safety / checkmark ActiveX Filtering
Login to EACH user account and repeat.
IE has this stupid distinction about the source of a web page. By default, if a web server is within your network (like a company web server), then Protected mode is disabled. Well, if a attacker wants to attack your network, they would just simply attack your web server first, and let his tools spread when internal visitors use the infected company web server.
Set IE11 to use Enhanced Protected Mode
Windows 8 has Enhanced Protected Mode that protects your private files and folders like the Document folder. However, to remain compatible to plugins like 3rd party toolbars etc, Enhanced Protected Mode has to be manually enabled. Go to Control Panel > Internet Options > Advanced; scroll the Settings list to Security section
checkmark "Enable 64 bit Processes for Enhanced Protected Mode".
checkmark 'Enable Enhanced Protect Mode'
Note that by doing this, some plugins may not work.
Note: the above settings are a per user setting, so you have to enabled this individually for EACH account. I will remind you of this at the end of this document.
Mozilla Firefox is open source software. Proponents of open source say because the code is open for all to inspect, it makes for a safer product. (as opposed to IE, which only a limited number of MS programmers work on). Mozilla has also once called on white hat hackers to help test attack Firefox. But whether or not this is an ongoing engagement is unclear.
To cover the angle of malicious ads, there is plug-in called AdBlock Plus. This plug-in removes all ads from sites. Its side benefit is that sites load faster without the ads.
There is another Firefox plug-in call WOT (web of trust). This plug-in marks search engine results with ratings. If a site is known to deliver malware, you will see a red danger icon next to it. And you can click on the icon to see detailed ratings by threat category. The ratings are driven by community help. WOT is now also available for Internet Explorer.
There is another free plug-in by Mcafee called SiteAdvisor. It also marks search engine results with a safety rating icon, and this product works with both IE and Firefox..There are lots of plug-ins and browser extensions that are named close to the real/original ones. Some have been discovered to host malware, so your protection is out the door once you install them. When in doubt, don't install.
Low Integrity Firefox
As mentioned above, you can enhance Firefox's security by setting it to low integrity. Open an elevated command prompt and copy and paste in following commands, one line at a time, substituting <yourAccName> with your account name:
icacls "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe" /setintegritylevel low
icacls "C:\Users\<yourAccName>\AppData\Local\Temp" /setintegritylevel(oi)(ci) low /t
icacls "C:\Users\<yourAccName>\AppData\Local\Mozilla" /setintegritylevel(oi)(ci) low /t
icacls "C:\Users\<yourAccName>\AppData\Roaming\Mozilla" /setintegritylevel(oi)(ci) low /t
icacls "C:\Users\<yourAccName>\Downloads" /setintegritylevel(oi)(ci) low /t
icacls "C:\Users\<nextAccName>\AppData\Local\Temp" /setintegritylevel(oi)(ci) low /t
icacls "C:\Users\<nextAccName>\AppData\Local\Mozilla" /setintegritylevel(oi)(ci) low /t
icacls "C:\Users\<nextAccName>\AppData\Roaming\Mozilla" /setintegritylevel(oi)(ci) low /t
icacls "C:\Users\<nextAccName>\Downloads" /setintegritylevel(oi)(ci) low /t
Note that in order for Firefox to run as low integrity, it required the setting of \AppData\Local\Temp folder also to low integrity, which was previously medium. This folder may contain sensitive temporary data from other applications. An intruder gaining access through Firefox may be locked into low integrity mode and can't change system settings, but he can glean data from this folder, which may be undesirable.
Note: every time you update Firefox, you have to re-run the command that makes the exe a low integrity program. ( ... setintegritylevel low )
Opera is another alternative browser. The thing that is good about them is that they patch up publicly disclosed vulnerabilities quite quickly.
Low integrity Opera
If you run Opera using the desktop icon for launcher.exe, Opera is launched as ntegritylevel:Untrusted
So there is no need to set integrity level with icacls.
Chrome has 2 versions, one is for ordinary users and one is for business. The ordinary one installs itself into \users\...\appdata, thus allowing users to install the product without IT dept's blessing. That is, if software restriction policy has not been turned on. The business edition installs into \Program Files (x86), like what normal 32 bit programs usually do. You should use the business edition.
There is a program called Sandboxie ( http://www.sandboxie.com/ which applies the sandbox security concept to protect any browser. Basically, the protected browser is made to look within a small directory, but it thinks that that directory is drive C. Sandboxie, and any sandbox in general, does not aim to prevent an attack, but instead contains the attack, within that directory. If the attack creates folders and files, it will be created in that directory. If it installs hacking tools and malware, they will all be confined to that directory. All your downloads will also arrive into that directory first, and Sandboxie will help move it back to the outside world. And everything in that directory can be wiped away with one click. This program is vital to securing your browser.Update v1809 2018-10-19. The main stable version of Sandboxie (v526) malfunctions in v1809. You have to download the v527 beta version from a link provided in their forums.
To start your web browser, right click on the sandboxie systray icon, select default box, select Run web browser.
Tip, if you have a favorite site that requires login, and you allow the site remember your login so you don't have to login every time, you can start the browser outside of Sandboxie to quickly login and let the site save a cookie. Then restart the browser using Sandboxie. Sandboxie will copy the cookies from outside to the sandbox when initiating.
You should have strong passwords to safe guard your accounts, particularly the admin accounts. The first account created when you install Windows is an administrative account. So you need to protect that. There is also a hidden account called “Administrator” which you should also protect with a password, but it first has to be enabled, as it is disabled by default. This is done with the following command at an elevated command prompt:
net user Administrator <password>
Your passwords should be long ( 15+ characters ) and also use upper and lower case, numbers and symbols. The best way is to create passphrases. For example, take the sentence “James T Kirk is the captain of the USS Enterprise 1701";. That would form the password “JTKitcotUSSE1701". Throw in symbols and it becomes “JTK$itcot%USSE1701". This password is now long and complex enough to foil attacks.
It is not secure to use the same password everywhere. Some people think it is OK to use the same password for email, banking, Facebook, windows login and so on. If your password is discovered, ( say by a keylogger ) the next logical thing is to try that on your email account. Once they get access to your email, they can use the ‘forgot my password’ feature of many web sites to have them email over your access password for that site. And very shortly everything will be compromised. Password attack programs either use a brute force approach or a dictionary approach. The brute force method tries every combination of numbers and letters. The dictionary approach tries out known words. These password attack programs are fast and can test thousands of passwords per minute. A short password is crackable in no time. A secure site would have safety features like locking your account after several failed tries or making you answer the security questions. But not every site is secure like that. And those weak sites are the primary target of password attack programs.
See Automated Configuration section.
It is also prudent to password protect your BIOS, so that people cannot boot your PC. Also, you should change the boot order in the BIOS so that it boots the hard drive first, rather than the CD/DVD. If an attacker can insert a Linux Live CD and start up your PC, then they will be able to mount your hard drive and read all data from it, and all Windows security will be bypassed.
Physical security is very important and should not be overlooked. If someone has physical access to your PC, then they could bypass a lot of the hardening that was done.
For example, if a attacker could access your PC and boot up a Linux Live CD, he could then read and copy off all files from the Windows disk partition. Or he could remove your hard drive and put it into another PC as a secondary drive and get data off that way. Either way, Window's password security will be of no use, because the hard drive's copy of Windows was never started.
Lock your office or study room or bedroom containing your PC.
BitLocker is a full disk encryption feature of Windows 10 Pro, When that is active, the whole drive is encrypted and will not be readable with other copies of Windows or Linux. This eliminates the offline attacks as mentioned above.
If you have the Configuration Pack, there is a cab file included that contains all the modified settings for Win 10 v1607. Just click on Import "SCM (.cab)" on the right and import "Strict4 - Win10-1607 Computer Security Compliance.cab" and "Strict4 - Win10-1607 Domain Security Compliance.cab" and you will see them appear on the list of baselines on the left side product listing.
To use the imported baseline, you MUST change 2 settings. The 'take ownership right' account (search for 'ownership' in the top right search box); set this to your full admin account name. Then search for 'change system time' and also specifiy your full admin account name.
There is one setting named "require trusted path" which makes you press CTRL-ALT-DEL everytime a normal UAC prompt comes up. In interest of security this is enabled. But you may wish to disable this because it is too troublesome.
Good security partly consists of deter, deny and delay. That is what hardening does. Good security is also about detection: Detection of unwanted changes like unauthorized account creations, running of malware and other unwanted apps, etc. Fortunately, a lot of things are tracked in the event logs. Windows’ Event Viewer holds a lot of information about your system (Control Panel > Administrative Tools > Event Viewer). One cannot claim to know what is going on in a system without examining the logs periodically.
Microsoft created a Security Monitoring and Attack Detection Planning Guide.
In the guide, it examines what security monitoring one should do and provides the relevant Event ID's. In the section below, those Event IDs are placed into Custom filters, which allows you to monitor for signs of intrusion.
Note that the guide gives Event ID's for Windows XP. With Vista, Windows 7, Windows 8 and Windows 10, you need to take the given Event ID and add 4096 to get the correct event under these 3 newer operating systems.Just because the guide is old doesn't mean it is not useful. Attacks still follow a general pattern when an attacker compromises a system. There may be new mechanics to use when attacking, but it always leave a trail. And the event logs hold that trail. There will always be admin account 'misuse'; the standard account is used daily - but why is the admin account suddenly logged on on a particular day? ( It may be wise to keep a paper log book of the times you use the admin account ) The attack may use a buffer overflow technique for different programs and services for gaining entry, but it usually leaves a Application Hang event or a Service Terminated event. If the attacker tried to guess a password, it will leave repeated Logon Failure events. If the attacker tried to execute a program outside of Program Files and Windows folder, it will leave a Software Restriction (SRP) event. If the attack gained hold of the System account, you may not spot the that logon event in the multitude of System account logons that happen through out the day because Windows uses that account for itself, but you may find the buffer overflow. Why is the system time suddenly off by 5 hours? It could be that an attacker is trying to hide herself by making event logs records inaccurate. (And that is also a good reason to have a centralized syslog server, see below) And don't disregard Windows 10's own Defender, which can detect many newer attacks; it recognized a Remote Access Tool for me.
Make Event Log files Bigger
(also covered by automated configuration part 2)
You may not discover an intrusion right on the first day when they get in. Very often, the discovery comes several weeks to months later. You will need to retain log entries, and the default log sizes allow for too short a period.
Control Panel/Administrative Tools /Event Viewer
Expand 'Windows Logs'. Right click on Application, Properties and set log size to 1000000. Do the same for 'Security' and 'System'.
Security Events to Monitor for
If you have the Automated Configuration Pack, the 'custom view' filters are in the folder "Event Viewer Custom Views". Simply choose 'Import Custom View' to import each xml file one by one.
Create Custom Views for the following Event IDs;
HOWTO: click 'Create Custom View'. Select 'By Log', pull down 'Event Logs', Checkmark 'Windows Logs', Move to the field <All Event IDs> and copy and paste in the event id numbers, click OK and name the view.4723,4724 - Change Password
The above items are important to review.
Now that Windows is hardened, most of the vulnerabilities you face will come from applications. The concepts that underlie protecting apps are the same as protecting the OS. Be careful of apps that have high privileges, and scrutinise network facing apps. Patching is really important and upgrade the app when new versions are posted. Monitor Event Viewer's "application hang" and "application error" custom views - if something fishy is going on and it happened after an application hang/error then there is a chance that you have been attacked. Be aware of what is normal and what is not. Know the protection settings that have been applied and know when a change is made (by an attacker). For example, your full-admin's Documents folder has been set to only have 1 ACL which is full accesss by the full-admin; if you find that suddenly that another ACL has been added giving access to, for example, the administrators group then something is wrong.
If you have several machines, you might consider setting up an event log collector machine. The benefits are:
Logalyze install consists of 4 downloads:
To see the logs that Logalyze collected, go to the Search tab, set the time frame drop down, and click on the magnifying glass icon to the right of the search bar.
To search for several Event ID's, just type in each number separated by space and an upper case "OR".
To find logs of a particular Windows machine, type "loghostname:" followed by the Windows Computer name which you find in This PC > Properties; for example "loghostname:desktop-u3ehvod". To find logs of a device like your router, use for example "loghostname:192.168.0.1" where 192.168.0.1 is your gateway/router's ip address.
You can find event ID's on a particular machine, for example "loghostname:desktop-u3ehvod AND 4624".
To save a query/search, click on the floppy icon to the right of the search bar. To see your saved queries, go to the Admin tab, click on Definitions pull down and choose Query Definitions.
Routers and Linux generally expect the syslog server to run on UDP port 514.
Intrusion detection also has to do with seeing that things aren’t different from what is normal. Your PC was running perfectly on day 1 after hardening, is it doing anything different today? To answer that question, we need baselines.
What we want to know is what programs are normally running when we first login. If we know that, then we can be sure that we aren’t contaminated with spyware or other hacking tools. There are 2 programs we want to get, all free. The first one is AutoRuns, available from here: http://technet.microsoft.com/en-us/sysinternals/bb9639022
It doesn’t have a setup program, just download, unzip, create a folder under \Program Files (x86) and copy the files there.
AutoRuns lists all of the places in the registry where programs are set to auto launch. Right click on it, and choose Run as admin, and use File/Save to take a snapshot of each account's current settings. Later on during your regular system checkups, you can use the File/Compare feature to see if anything is different. New entries show up in green. If all green entries are good, then save the file again with todays date, and do the comparison with the new file in the next scheduled check.
The second program is Process Explorer, available here: http://technet.microsoft.com/en-us/sysinternals/bb896653
This program is like Task Manager, but it shows more info. Many malware name themselves with familiar Windows program names, trying to hide themselves. Login to your admin account, then right click on Process Manager and choose 'run as admin', go to View/Select Columns and checkmark ‘command line’. Then do a File/Save . The resulting text file is now a snapshot of what normally runs when you first login.
When you do a comparison using Process Explorer, note that you cannot use a file comparison tool like ‘fc’ (file compare) to check for differences, that is because the PID (process identifier) for each program/process would be different on different boot-ups. You would have to do a visual check of the command line.
Next, reboot your PC and open an elevated command prompt with 'run as admin', and type
netstat -abn > netstat-baseline.txt
The netstat program shows you a list of programs that are listening and connecting to the net. If a attacker connects to your PC, his program would have to connect back from your PC to his PC, and his program would show up here in this list.
Driverquery is a command line tool in Windows, What it does is list all the drivers in use. Some virus and rootkits now come in the form of a driver. When you perform you routine checks, first run this:
driverquery > out.txt
If this is the first snapshot, then rename the out.txt to driverquery-out.txt.
Next time, run this;
driverquery > out.txt
Then use 2 Compare to compare the original against the new one.
The thing to do is to create a first txt, then create a 2nd txt just before you do each Windows Update, and use Beyond Compare to see if there are any diffferences. If there are, investigate, because nothing should have changed unless you installed new software, or that someone has added something to your machine in between the last Windows Update till now. That would be around 2 weeks, and most changes should be still fresh in your mind.
If there are no difference, do the Windows Update and create another set of baselines.
Now we have 4 baselines, save them onto a USB memory stick for use in comparisons later. One should also save the Autoruns, and Process Explorer files onto the memory stick as well. Because, after an attack, programs may get altered or rendered unusable You Have to keep the baselines on a USB memory stick because attackers will modify your baselines to make you think nothing has changed.
Last thing when doing baseline comparisons is to run “sfc /scannow” to determine if any system files has been modified. SFC contains the correct windows files signatures and makes a comparison to the current setup. It will also fix the problem.
You should definitely install antivirus and antispyware programs. However note, you can only have one realtime antivirus program. The realtime capability monitors file access and file modifications as they happen. And having more than one realtime antivirus will cause problems. Having more than one anti-spyware program usually doesn’t cause problems. Windows 10 has Windows Defender installed by default, which is an antivirus program. It will also scan ActiveX components before use and does network behaviour monitoring.
There are also a lot of fake antivirus programs floating around, so make sure you find the reviews before installing one. The fake ones report of non-existent infections and just ask you for your money and do nothing. Some will even stop you from going to legitimate antivirus program sites, stop your programs from working and make you think you are infected with a virus. If you happen to have installed a fake antivirus, there is one anti-malware program that can remove it. It’s called MalwareBytes. (( https://www.malwarebytes.org) MalwareBytes has a free version, which doesn't include real time detection and automatic signature updates. It is a very good tool to have, just remember to update the signatures before doing a scan..
Bear in mind that no antivirus/anti-spyware program will catch everything you encounter. There has been a study that was done that found that the best detection rate is around 60%. Vendors can’t hope to have captured and analyzed ALL the viruses out there, because lots of new ones are introduced every day.
Yes, you can’t fully trust your antivirus program to do a perfect job. To be on the safe side, use online scanners once in a while to do a double check. There are quite a few of them: TrendMicro Housecall, BitDefender, Kapersky, Panda and ESET. Google for "online scan" and you will see them.
If you download stuff from P2P and bittorents, beware. Lots of infected programs are floating around. And they would even work as expected, except that they will also get you infected. And those viruses tend to be new ones, so most likely your antivirus program will not even beep. You have been warned. The best that you could do is upload the file to virustotal.com and let them run your file against their 39 antivirus programs, and then decide if you want to keep the file or not. You have to remember that it is hackers who release pirated software, cracks and keygens, and they seed these files on P2P and bittorrent. And most likely, they also want to own your PC.
Security suites are very popular. For example, Norton 360 includes antivirus, anti-spyware, anti-rootkit, smart firewall, network monitoring, parental controls, anti-spam and more. They certainly seem to be value for your money. But when weighing effectiveness, many choose a best of breed, mix and match, solution. For example: one can use ESET antivirus and anti-spyware, Webroot anti-spyware, Windows firewall, NetNanny parental control, Gmail’s anti-spam and Gmer anti-rootkit.
If you are considering security suites, then you should also Google for "<brand> end point protection". End Point Protection is the name used for antivirus suites for businesses. And like MS's way of adding more security feaures for Windows Enterprise, the business products of major antivirus brands offer more security features. Most will also offer a trial version, so you can test them before making the leap.
Another program you must have is an anti-executable. This class of protection stops any program from running unless you have clicked on it or that it resides in a small whitelist. So if you clicked on it, then it runs; if you didn't, then it gets blocked. This stops drive by downloads where web sites get hacked to deliver malware. Also, many exploits download a malware of their choosing (mostly RATs) and executes it. Anti-executables is a great class of protection to have. There are several on the market, like Anti-Executable, AppGuard, No Virus Thanks, and Voodoo Shield. The last one is free. Note: you have to allow Voodoo Shield outbound in the firewall.
For your maintenance routine. You should do 2 more things.
1.Check that your antivirus is still alive and active. Go to http://www.eicar.org/86-0-Intended-use.html. And copy that test virus line of text, paste it into notepad, save it and try to open it again. Your antivirus should detect it.
2.Do an antivirus scan.
IPFire calls the external internet connection RED, and the internal network GREEN. And if you use 3 ethernet cards, a DMZ can be created labeled ORANGE. You have to assign a network card to each RED, ORANGE and GREEN zone. You can make the lights on the card light up and find out which card is which. After install, go to the web ip address you assigned during install and start configuration, just like configuring a router.
In IPFire the built in intrusion detection is called snort and their intrusion prevention is an add-on called Guardian. Guardian takes the ip addresses found by snort and blocks them. Add-ons are available for install from the PakFire pull down menu. Once installed, go to Services > Intrusion detection and download the free signatures from EmergingThreats. Then you review the rulesets and disable those rule groups that give alerts for services that you don't have in your LAN. Then checkmark Guardian and save. The ET rules update approximately once a month, the update is not automatic. Create an reoccuring appointment in your smartphone
Note: only enable Guardian intrutsion prevention if you are using IPFire as the main router. If IPFire is behind another router, then it will only see that router as the source of intrusion and block that.
Open a new Tab, and you can then read in the capture file with this command:
sudo tcpdump -A -tttt -r <yourFileName> | less
Explanation, the 'sudo' part runs the command as admin, the 'A' parameter specifies showing packets in ascii. The 'i' parameter is the interface, and eth0 is the default ethernet port on a Linux machine. The 'tttt' parameter shows the full date. The 'w' parameter is for writing to a file. And the 'r' parameter is for reading from a file. The '| less' part "pipes" the output to 'less', a program that lets you scroll down any long document (or else everything will just quickly scroll past and disappear). When you are finished viewing the output in 'less', typing 'q' will exit 'less'.
You can see the source and destination of each packet, the ports used, and the network packet contents in ascii. Start tcpdump and then boot up the Windows machine without logging on. This will allow you to see what network traffic occurs at Windows boot time. Then login into Windows and restart the read command again.
There would be quite a lot of packets to go thru. Open firefox and go to any web site that can do 'ip to domain' conversion, and type in an ip from tcpdump output. This will tell you the domain name that the packet is going to. Along with the domain name, it usually states the company which is managing that network/site. You can then lookup that company's web site. Then identify the harmless ones that belong to Microsoft and Alkamai (which I think is a server ISP that caters to coorparate clients like MS) and sites like your antivirus update site. Anything else would be suspicious, especically if the domain is a home user ISP, or the ip belongs to some company that is from another country which you don't go to, like 'ru' (Russia) and 'cn' (China)
The beauty of tcpdump is that it can see ALL network packets from the outside of your Windows machine. So even if you have a rootkit infection, and Windows' netstat tells you nothing is wrong, tcpdump will reveal the rootkitted admin tool's traffic.
A Honey Pot is usually a unused dummy system set up just to lure attackers. Once you notice traffic on it, then it is guarenteed that you have an attacker. You can setup auditing for a 'honey folder' which you never click on to act as an intrusion detector.
First create a folder, called for example 'Plans for the New year', and then right click on it and choose Properties. Then go to Security tab > Advanced > Audit tab. First you set up which user account to watch for, then leave the settings for 'Read and Execute' which will generate an Event Viewer entry
If you have the Configuration Pack, the Event Viewer custom views xml files allow you to import the custom views. Click on 'Access audited file' view to see the entries generated by the intruder. Also, you have to run the Harden Audit BAT and the Harden Security Options BAT to enable the auditing.
Take care not to audit folders and files you normally use, because each access generates 6 or more entries. And could fill up the log and cause old entries to be emptied away.
This class of spyware deserves mentioning on their own. Unlike other hacker attacks, these do not aim to penetrate and gain admin rights, but they are deployed by criminal hackers. They function in a standard account. Their aim is to capture credentials to your web accounts like banking account numbers and passwords, email account and others. Antivirus programs do not detect them. To counter these, I know of 2 programs, Zemana AntiLogger. (http://www.zemana.com) which has anti-keylogger as well as anti-screen grabber functions. The other one is KeyScrambler (http://www.qfxsoftware.comm) which is only a anti-keylogger. ( Both programs now have free editions.)
The first thing you should do if you suspect an intrusion is to determine if it is really an intrusion. For example, let's say you found that the XXX service has stopped and restarted by viewing EventViewer. It may look like an attack, since if everything was hunky dorey that error should not occur. But if you look further down at past events, you may see that it did the same thing while you were still configuring the machine and was offline then. Some Windows errors may be due to mis-configuration, and some Windows errors happen on their own anyways. Those may be errors messages that were designed to be observed by the programmer so they can write code to catch those error conditions and have the program react to them. For example if you were going to burn a DVD and didn't put a blank DVD in, the program would throw an error, and the programmer would write code to respond to that error message and put up a dialog box to tell you there is no blank disk in the drive.
The next thing to do is to run security programs like antivirus and anitmalware. Hopefully they identify something and quarrantine it. Hackers don't use viruses and malware most of the time, they are too easily identified and removed by common security programs. For example, most av and antimalware are useless at detecting remote access tools. The reason is that remote access tools may be legitimately used by the computer user to give access to their friends or service technicians, or themselves when they are in a remote location like a coffee shop.
The next step is to contain the attacker. And make sure that attacker cannot further progress to totally own the machine and attack other machines in your network. Close all browsers and networking apps, so that the connection traffic dies down. Then open an administrative command prompt and do "netstat -anb". This will show all the connections to the machine. The program which makes the connection can sometimes be listed too. If the attacker's program can be listed by netstat, they will often disguise it by naming it with a familiar Windows exe name. And netstat does not show the program's path, so you can't distinguish that the attacker's svchost is residing in \Windows\temp. Regardless, given that netstat's connection listing while the machine is quiet gives you the connections' ip addresses. Open the browser and google for "ip to domain". This will list several sites which let you see what domains an ip address belongs to. Go thru the connections ip address listing individually, and see what organizations they belong to. If the domain belongs to Microsoft, then ignore that one. If it belongs to a residential internet service provider or belong to companies that may offer public hotspots like Star Bucks Coffee, then you may have identified your attacker. Google the organization's name to find out if it is a residential ISP or a bussiness oriented network provider.
The ip to domain tool will also give you the attacker's ip network address range. Lets say the network's ip is 206.248 168.128/26. Now create a firewall inbound rule that blocks that address range.
The reason to block the network range instead of a single ip address is that the attacker maybe able to move to another connection within her network. And blocking the entire network of a residential ISP couldn't hurt, or maybe you are blocking the entire Russian militia.
One may choose to block the network ip range at the Windows firewall or router firewall, if the router has a firewall rules feature. Most Linux based Firewall distros have that. A easy-to-use one is SmoothWall.
Now you have to decide what to do with the resident evil code on your machine. There are 2 choices: 1) try to remove it, 2) back up your data and restore from image.
Removing an infection requires someone who investigates malware, every day, as they are released. You may have an embedded remote access tool and not malware, but there are similarities between the two. There are malware researchers who do this for a living. They are the people who work for the likes of Norton, Kaspersky or Snort. Thankfully, some also donate their time in free forums to help the public. Here's two. Google for 'malware removal forum' to see more.
Note that the removal process might take a day or two. The forums' helpers will ask you to download detection tools, and ask you to paste the tool's output report back to the forum. If one tool does not reveal anything, they would ask you to download another tool and repeat. Finally they will offer a removal tool together with a custom script, which removes your particular infection. This is the only route to go if there are no backup of program installers and install keys.
If one or two days is too long, and you need to resume work quickly, then backup your data and restore from image. That's almost what larger companies do: they backup an image of the infected hard drive and RAM and give those to their forensics department; then they restore the machine from image. Then they would restore yesterday's data from backup tapes. So one loses a morning's work, but is able to get up and running in a few hours. Forensics will investigate deeper into the attack code, and the incident responders will dig deeper in the networking logs. Perhaps the attack compromised other workstations, perhaps a Windows server; larger companies have the resources and need to investigate.
Security is a process, that is ongoing after we perform hardening. Your hardened Windows Windows 10 is good and now has multiple layers of security, but new vulnerabilities will be discovered in various software that you use and weaken your stance. Take the case of the browser; attackers target browsers all the time, and new security holes will be revealed. One has to know when these holes are discovered, and take steps to mitigate.
The first step is to know about the new vulnerabilities. The following websites report on security matters ::
You should visit them once a week to learn of new security vulnerabilities. The articles will tell you about new security holes in applications or OS, which version it applies to, and give a brief description of the weakness. Sometimes, the software vendor will inform us of some configuration change for you to apply for the time being, until they make a patch ready. Also, the articles may tell us if attacks using the vulnerability has been spotted in use..
This information are of great help for you to maintain security. To continue on our browser example, lets say the new vulnerability involves an ActiveX component that is called via Internet Explorer. Then you might mitigate that by using another browser for the time being, and monitor the vendor’s site for a new version release. Or Microsoft may issue an advisory informing us to how to disable an ActiveX through settings in the registry. Or you may decide that using that browser together with Sandboxie would contain the threat. Or you may decide to disable scripting features of the browser. (File Hippo's Program Manager program will also tell you when new program versions have been made, as mentioned previously). The main thing is that you get to know about potential problems from these web sites and takes steps to mitigate.
Next, as part of the security process, you have to monitor your system and detect attacks. You have to perform those log checks, baseline comparisons, and virus scans (as mentioned earlier) on a regular basis, like every 1 or 2 weeks. We are being lax here already, for in a secure environment, they use tools to monitor logs on a real time basis. Monitoring is crucial, as even the most hardened systems will have holes in its defenses. We cannot think that our hardened system is impervious.
After a few months of use, computer settings change invariably: new software installed, new devices added, etc. We now have to check that all security settings are still in place. For example, are the user accounts still standard accounts, or has one been changed to admin for temporary problem troubleshooting? Has the firewall been set to OutBound Allow during installation of a program and left forgotten?? So, after you put those locks on the doors, are they still locked??Or has there been tampering? We have to revisit the hardening process and check everything. This is to ensure that the system is still as secure as day one.
Note that 32 bit Windows is not covered by the Dual Admin (which is a set of ACL configs) file. There are many more executables on a 32bit machine
If you wish to revert the changes to out of box defaults, use::
To configure, right click on the bat files and choose 'Run as Administrator'..
To configure manually, open a elevated command prompt ( right click on Command Prompt and choose 'run as admin' ) Type in the following command::
SecEdit /configure /db <any_name>.sdb /cfg <template.inf>>
The <any_name>.sdb will hold the configured results, you make up the filename, but the file extension must be .sdb. The <template,inf> is either one of the templates named above..
Also provided in the package are Event Viewer 'custom view' xml files. These xml files setup filters for select event IDs, so that you get to see, for example, all login failures, in one screen,,
Use this bat file to setup what events to audit. It also sets up the event log file maximum file sizes for Application, Security and System..
It sets up the following::
Use this bat file to setup the password and account lockout settings..
Use of this file requires that you understand what the settings do. The numbers are:
Password history means that the system will remember 24 previous passwords so that they cannot be reused so that they are unique..
Password age means that the system will prompt you 14 days before 60 days is up to change your password. Minimum password age of 1 day means you cannot change your password again until 1 day have passed. This is so that users cannot rotate 24 times rapidly and reuse an old password..
Minimum password length is 14 characters. If you use a passphrase, then this shouldn't be a problem. Complexity requirement means that the passphrase must include upper and lower case, numbers and symbols.
The lockout settings are as follows:
What these numbers mean is that you are allowed 50 tries to get the right password. After that, the system locks up for 15 minutes. So, when you realize you have forgotten a password, write down the various passwords that you want to try and try to find the right one within 50 tries. After 50 tries, the system will not respond until 15 minutes have passed..
Unfortunately this can give rise to a denial of service (DoS) attack, where the attacker randomly tries out 50 passwords and her aim isn't to get in but to lock you out of the system. If we don't define a threshold number for password attempts, then an attacker can use a program to bruteforce or dictionary attack the system because they can do so an infinite number of times. If you realize that such a DoS attack is taking place, all you can do is unplug the ethernet cable and go for a 15 minute break..
Use the 'Dual Admin.bat' to remove the standard users accounts from accesssing command line admin tools. This script also sets up a heavily restricted admin account for installing non-security software. Together with this, you should set up the included login scripts that takes the full admin account offline automatically upon login. This aids in combating attacks where the attacker has remote access to your machine.
Some of these settings default to 'undefined'. And due to the fact that SecEdit does not handle settings that specify 'undefined', no restore bat file is offered to reverse these password and lockout settings..
Lastly, there is a security options file:
This file includes a group of security settings, as follows::
The 'security options' settings, audit, and 'password and lockout' settings are taken from MS Security Compliance Manager tool.
Disable flash in your admin account. Internet Explorer > Gear > Manage Addons > Toolbars and Extensions > Show All Addons > Shockwave Flash Object > Disable button..
Disable flash in Edge for each account..
Disable Autoplay for all user accounts: Control Panel > AutoPlay. Choose 'Take No Action' for everything
Uncheck "Use AutoPlay for all media and devices""
Set IE to turn on ActiveX Filtering for each account. Gear icon > Safety > ActiveX Filtering..
Set IE to use Protected Mode for all zones. Gear icon > Internet options >Security tab > click each icon ( Internet, Local Intranet, Trusted sites, Restricted sites ),check mark Enable Protected Mode for each. Do this for all user accounts..
Set IE to use Enhanced Potected Mode for all users. Control Panel > Internet Options > Advanced; scroll the Settings list to Security section, checkmark Enable 64 bit Processes for Enhanced Protected Mode" and 'Enable Enhanced Protect Mode''
Go to Settings > Network and Internet > Proxy and turn off 'Automatically detect settings' for each account
Run Acrobat Reader ( if you have installed it ) to setup security.for each accountt
Edit > Preferencess
> Security Enhanced. Protected View : All Filess
> Security Enhanced: Create Protected Mode Log File..
> Security Enhanced: Uncheckmark Automatically Trust Sites from my Win OS Security Zones..
> Trust Manager: Uncheckmark Allow Opening of Non-PDF file attachmentss
> <Trust Manager: Internet Access from PDF outside the web browser Change Settings button, select Block PDF file access to all web sites.> This one is optional, some times you need to click on an internet link inside a PDF document.
Run Java in Control Panel (if you have installed it). Go to Security tab, uncheckmark 'enable Java content in browser'.
This PC > Properties > Advanced System Settings > System Protection tab > Create button.
This is important, your last line of defense is restoring from backup. This backup saves all of the settings you have done so far so you don't have to repeat them when you need to reinstall Windows. There is a free image backup tool called Macrium Reflect, available from here: http://www.macrium.com/reflectfree.aspx. Use the tool to create a drive image and store it in an external USB hard drive. Don't forget to create the rescue CD.
When you are finished with hardening, move the hardening scripts folder to a USB memory stick or a USB drive. Don't leave it for the attacker to discover.
Whenever you choose to install a new application, you need to consider it's security ramifications. For example an older app which needs admin rights and accesses the internet is bad. That's because one successful attack will give the attackers admin rights over your machine. Another thing is listening apps. Technically they are servers, likr a FTP server. As revealed by doing 'netstat -abn' from an admin command prompt, and any such apps listens 24x7 to anyone who cares to connect. While you may sleep, servers do not, and you won't be around to monitor it's security. One may point out that FTP servers have username and password protection. But attackers don't usually attack the main entrance. If you are deploying a server, it would be a good idea to restrict connections to your friends' ip address in the firewall rules (bearing in mind that home ISP's change residential ip's frequently, and you'd have to update those ip addresses frequently)
It's a good idea to checkout www.exploit-db.com to look for existance of any attack exploits before installing any app. Some exploits only work in certain versions of the software. So if you find an old exploiit, there is a chance it won't work against newer versions. But to be really sure, you would have to complile the exploit and test it, which if you aren't a programmer, can be difficult. Be aware of the risk and decide.
When installing new software, sometimes the setup program needs to connect to the internet to download components. And also, it may create a exe inside a temp folder to do the downloading, and the exe is automatically removed when install finishes. On such occasions, it may not be possible to create an outbound allow rule for that exe. So the only solution would be to go to Windows Firewall with Advanced Security and temporarily set Outbound to allow for the Public profile. Just remember to set Outbound back to block when you have finished setting up that new program.
When Simple Software Restriction Policy is installed, remember that programs will not run when they are located outside of \Windows or \Program Files. To enable your install program to run, lets say from your Downloads folder, you have to Right Click on SSRP in the systray and choose Unlock. Always remember to check the status of SSRP before leaving your admin account.
When installing security programs, some installers require default settings of services and ACLs. In the Automated Configuration Pack, there are 2 bat files: Restore Services bat and Restore ACLs bat. If your antivirus installer causes errors, you can run them and then install your new antivirus and redo Harden Services bat and Dual Admin bat. Kaspersky products (Total Security and Small Office Security) are known to require this step..