Check for unquoted paths vulnerability

Source:

• https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464

Add word of thanks for:

• Center for Internet Security (CIS)
• getadmx.com

Include browser in hardening (Chrome/Edge/IE)?

Incorporate enable/disable Fast Restart in Power Options?

Letting it enabled can hinder encryption software like TrueCrypt.

Check the for now excluded parts of CIS benchmark

They are excluded due to being Windows 10 Home, but let's check everything just to be sure.

• Windows Firewall
• Local Administrator Password Solution (LAPS)
• BitLocker Drive Encryption
• Microsoft Solutions for Security (MSS) (Legacy)
• Security Compliance Manager (SCM)
• Windows Connection Manager (WCM)
• Audit Process Creation
• Early Launch Antimalware
• Group Policy
• Sleep Settings
• Remote Assistance
• Remote Desktop Services (formerly Terminal Services) & RemoteFX USB Device Redirection
• Remote Procedure Call (RPC)
• Application, Security, Setup and System Event Log Service
• Previous Versions
• Microsoft Edge
• OneDrive
• RSS Feeds
• Cortana
• Windows Store
• Windows Game Recording and Broadcasting
• Windows Ink Workspace
• Windows Installer
• Windows PowerShell
• Windows Remote Management (WinRM) Client, Server & Service
• Defer Windows Updates

Disable more network protocols?

Hi,

thx for https://github.com/teusink/Home-Security-by-W10-Hardening/blob/master/files/hklm-cis-bitlocker.reg

Just 2 additions:

• EncryptionMethodWithXtsFdv is not specified (default for external backup drives is 128bit): https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.VolumeEncryption::EncryptionMethodWithXts_Name

• Limit Direct Memory Access (DMA) attacks (CIS) is no longer necessary. This was replaced by "DisableExternalDMAUnderLock" (however I would add a comment for this one that it should be set BEFORE bitlocker is enabled, otherwise drives can no longer be automatically unlocked and trying to change a password results in an error "0x80070490 "Element not found""): https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.VolumeEncryption::DisableExternalDMAUnderLock_Name

Change default app for executables (like .js) to notepad?

Sources:

• https://fileinfo.com/filetypes/executable

Hello,

I believe you forgot to add a comment in hklm-cis-chrome.reg file at 1.1.15 (L2) line.

1.1.15 (L2) Ensure 'Allow invocation of file selection dialogs' is set to 'Enabled' ;[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] ; <deleted> = (Default) ; 0000000 = Off ; 0000001 = On (CIS) ; NON-COMPLIANCE TO NOT DISRUPT COMMON HOME FEATURES ;"AllowFileSelectionDialogs"=dword:0000001

Best regards,
Nirun M.

Look into fully disabling Flash.

# Disable built-in Adobe Flash in IE and Edge
Function DisableAdobeFlash {
	Write-Host "Disabling built-in Adobe Flash in IE and Edge..."
	If (!(Test-Path "HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Addons")) {
		New-Item -Path "HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Addons" -Force | Out-Null
	}
	Set-ItemProperty -Path "HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Addons" -Name "FlashPlayerEnabled" -Type DWord -Value 0
	If (!(Test-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D27CDB6E-AE6D-11CF-96B8-444553540000}")) {
		New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D27CDB6E-AE6D-11CF-96B8-444553540000}" -Force | Out-Null
	}
	Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D27CDB6E-AE6D-11CF-96B8-444553540000}" -Name "Flags" -Type DWord -Value 1
}

Update repo with new CIS benchmark for Windows 10 1803

• Run new check
• Compare difference
• Update Guide accordingly

Make undo REG-file for non-GUI settings

More info:

• https://support.microsoft.com/en-hk/help/310516/how-to-add-modify-or-delete-registry-subkeys-and-values-by-using-a-reg

• https://stackoverflow.com/questions/15029615/how-to-turn-off-disable-web-proxy-auto-discovery-wpad-in-windows-server-2008/25366609
• https://stackoverflow.com/questions/1674119/what-key-in-windows-registry-disables-ie-connection-parameter-automatically-det
• https://hackernoon.com/the-2017-pentester-guide-to-windows-10-privacy-security-cf734c510b8d

Input sources for this repo

Sources:

• Microsoft Baseline Security Analyzer
• Nessus Vulnerability Scan
• Microsoft AD Security Assessment
• Rapid7 Nexposed Community Edition
• CIS Security Baseline Windows 10
• https://gist.github.com/alirobe/7f3b34ad89a159e6daa1
• http://hardenwindows10forsecurity.com/

Look into DNSCrypt

https://simplednscrypt.org/

Update guide to accommodate Windows 10 October 1809 Update

• Clipboard
• AutoPlay (it is on again after upgrade)
• Phone
• For developers
• Registry differences between 1803 and 1809

Incorporate Windows Pro features in different REG file

To get Perfect Forward Secrecy

Source:

• https://scotthelme.co.uk/getting-an-a-on-the-qualys-ssl-test-windows-edition/

Checkout Windows Security Baselines

Source:

• https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-baselines

Incorporate Backup options?

Changed default BitLocker state

Source: https://www.howtogeek.com/442114/windows-10s-bitlocker-encryption-no-longer-trusts-your-ssd/

Look into disabling VBScript

Mention software to help stay secure?

Sources:

• Anti-malware
• Secunia PSI

Check DLL search path vulnerability

Source:

• https://support.microsoft.com/en-us/help/2264107/a-new-cwdillegalindllsearch-registry-entry-is-available-to-control-the

Update guide to accommodate Windows 10 May 1903 Update

Which registry key create this error when someone want to configure OS and how to fix it?
This window shows after hardening.

Settings: SystemSettings.exe - System Error

The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

https://www.thewindowsclub.com/ways-to-enable-or-disable-optional-windows-features