> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/blue/windows-hardening.md).

# Windows Hardening

## TLDR

This is by no means an exhaustive list, but some simple hardening measures are:

* Secure boot and disk encryption with BitLocker should be enabled and in use.
* Audit writable files and directories and any binaries with the ability to launch other apps.
* Ensure that any scheduled tasks and scripts running with elevated privileges specify any binaries or executables using the absolute path.
* Do not store credentials in cleartext in world-readable files on the host or in shared drives.
* Clean up home directories and PowerShell history.
* Ensure that low-privileged users cannot modify any custom libraries called by programs.
* Remove any unnecessary packages and services that potentially increase the attack surface.
* Utilize the Device Guard and Credential Guard features built-in by Microsoft to Windows 10 and most new Server Operating Systems.
* Utilize Group Policy to enforce any configuration changes needed to company systems.

> :bulb: Create a pre-hardened image that you can replicate! This will help you reduce the time it takes for setup especially if you've taken the due diligence to reduce bloatware, and refine your image.

## WSUS (Windows Server Update Service)

For those working in an enterprise environment, you can set up a WSUS server within your environment so that each computer is not reaching out to download them individually. Instead, they can reach out to the configured WSUS server for any updates required.

## Group Policy

You may use Group Policy Management Console (GPMC) or PowerShell to configure group policy update settings for both AD and local environments. From here, you can manage everything from the individual users' backgrounds, bookmarks, and other browser settings and how and when Windows Defender scans the host and performs updates. This can be a very granular process, so ensure you have a plan for the implementation of any new group policies created or modified.

## User Management

* Limit the number of user and admin accounts on each system
* Ensure that login attempts (valid/invalid) are logged and monitored
* Strong password policy, rotate passwords periodically and restrict users from reusing old passwords (`Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy`)
* Two-factor authentication
* Ensure that users are not placed into groups that give them excessive rights unnecessary for their day-to-day tasks

## Audits

DISA [Security Technical Implementation Guides (STIGs)](https://public.cyber.mil/stigs/) or Microsoft's [Security Compliance Toolkit](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10)

STIG can be used as a box-checker exercise to ensure an organization adheres to bare minimal security measures and should not be treated as an alternative for a penetration test.

<figure><img src="https://2618442973-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmGhYQRY1OEeL4zywZ9zS%2Fuploads%2Fm1K3hxBjTfsd8mO64vIF%2Fimage.png?alt=media&amp;token=67ca1d60-6606-4c5c-8983-ef19609f0550" alt=""><figcaption></figcaption></figure>

### Compliance Frameworks

* [ISO27001](https://www.iso.org/isoiec-27001-information-security.html)
* [PCI-DSS](https://www.pcisecuritystandards.org/pci_security/)
* [HIPAA](https://www.hhs.gov/hipaa/for-professionals/security/index.html)

## Useful Tools

### [Sysmon](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon)

Provided by Microsoft as part of the Sysinternals Suite, Sysmon can enhance logging and event collection capabilities. It can gather information regarding network connections, processes, file reads and writes, login attempts and successes, and much more. These logs may be analyzed by a SIEM (Security Information and Event Management). All logs are stored in `Applications and Service Logs\Microsoft\Windows\Sysmon\Operational` hive.

### [PacketBeat](https://www.elastic.co/beats/packetbeat)

IDS\IPS implementations such as Security Onion sensors, and other network monitoring solutions can help complete the picture for your administrators. They collect and ship network traffic logs to your monitoring solutions and SIEMS.

### Netwrix

### SolarWinds