DOCSEARCHbyAlgolia
Submit Docs

Harden Windows Security

repository·main·Indexed 26 days ago

https://github.com/hotcakex/harden-windows-security

A collection of tools and guides to secure Windows OS using official Microsoft methods. It includes the Harden System Security app for OS hardening and policy verification, and the AppControl Manager for configuring Windows Application Control. The project provides guidance on defense in depth, secured-core PC hardware selection, BYOVD protection, and system management via the ComManager utility.

Tokens
128.8K
Snippets
166
Records
693
Agent score
89%

What's inside Harden Windows Security

  1. Overview of Firewall Sentinel

    main
    Firewall Sentinel is an advanced feature within the AppControl Manager that implements an automated, identity-based allowlisting framework for the Windows Firewall. It enforces a strict egress filtering model where outbound traffic is prohibited by default and only authorized via identity-based rules. This mitigates data exfiltration, neutralizes reverse shells, preserves privacy, and provides immediate indicators of compromise through logs.

  2. Overview of Microsoft Pluton Security Chip

    main

    Microsoft Pluton is a dedicated physical security chip designed to be impervious to tampering and physical attacks (such as jumper cable attacks).

    Key characteristics include:

    • Architecture: Runs on Azure Sphere architecture.
    • Isolation: It is physically on the same die as the CPU but is 'out of band'; the CPU has no control over it as Pluton runs its own dedicated, self-maintaining operating system.
    • Self-Sufficiency: Unlike firmware-based TPMs (fTPMs) which rely on the CPU for emulation, Pluton is completely self-sufficient.
    • Security Goal: Protects against firmware threats and secures sensitive data against sophisticated physical attacks.

  4. Inspect and query Windows CSP policies with Harden System Security

    main

    The Harden System Security app allows you to inspect and query Windows Configuration Service Provider (CSP) policies to gain real-time configuration intelligence. It uses Policy DDF (Device Description Framework) files to generate a catalog of system settings and interacts with the local MDM (Mobile Device Management) client to query live system states via OMA-URIs.

    Note: On systems not enrolled in an MDM (such as Microsoft Intune), the amount of available data will be limited.

  5. Configure Windows Hello Multi-Factor Authentication

    main
    To prevent unauthorized access if a single credential (like a PIN or biometric) is compromised, administrators can configure multi-factor unlock for Windows Hello for Business. This extends Windows Hello by requiring a combination of factors and trusted signals to unlock the device.

  6. Understand Device Guard and Virtualization-Based Security (VBS) features

    main

    The Harden Windows Security project provides policies to enable and lock various Device Guard and Virtualization-Based Security (VBS) features. These features can be configured via Group Policy or Configuration Service Provider (CSP).

    Key features include:

    • Virtualization-Based Security + UEFI Lock: Enables VBS and memory integrity.
    • Secure Boot: Provides Secure Boot with DMA protection if IOMMUs are present, or standard Secure Boot otherwise.
    • Virtualization-based protection of Code Integrity + UEFI Lock: Enables Hypervisor-Enforced Code Integrity (HVCI).
    • Require UEFI Memory Attributes Table (MAT): Ensures the hardware supports required memory attributes.
    • Windows Defender Credential Guard + UEFI Lock: Protects credentials using VBS.
    • System Guard Secure Launch and SMM protection: Provides firmware protection.
    • Kernel Mode Hardware Enforced Stack Protection: Protects against stack-based attacks.
    • Local Security Authority (LSA) process Protection + UEFI Lock: Protects the LSA process.
    • Machine Identity Isolation Configuration: Enables this in Enforcement mode.
    • Mandatory Mode VBS/Memory Integrity: Enables VBS and Memory Integrity in Mandatory mode. Warning: Use extreme caution, as failure of virtualization modules may prevent the system from booting.

  7. Harden System Security Features and Capabilities

    main

    The Harden System Security app provides several key technical capabilities:

    • Comprehensive Logging: Detailed logging capabilities for system security monitoring.
    • Security Hardening: Implements official Microsoft methods to harden Windows security.
    • Dependencies: The app relies on specific system dependencies to function correctly (refer to the app's technical details for specific requirements).

  8. Understand Zero Trust DNS (ZTDNS)

    main

    ZTDNS integrates the Windows DNS client and the Windows Filtering Platform (WFP) to enable domain-name-based lockdown.

    • It uses DoH (DNS over HTTPS) or DoT (DNS over TLS) capable Protective DNS servers.
    • These servers are expected to only resolve allowed domain names.
    • Provisioning can include allowed IP subnets, expected Protective DNS server certificate identities, and client authentication certificates.

  9. Harden Windows Networking via Group Policy and CSP

    main

    The Harden System Security project applies several networking security enhancements to Windows using Group Policy and Configuration Service Providers (CSP). Key networking hardening actions include:

    • Disabling Legacy Protocols: Disables NetBIOS over TCP/IP on all interfaces, disables Smart Multi-Homed Name Resolution (to prevent NetBIOS/LLMNR usage), and disables the LMHOSTS lookup protocol.
    • Disabling Unencrypted/Legacy Features: Disables Printing over HTTP and clears all entries in Remotely accessible registry paths and subpaths.
    • SMB Hardening:
      • Sets minimum SMB version to 3.1.1 for both Client and Server.
      • Requires encryption for SMB Client.
      • Enables encryption for SMB Server.
      • Enables QUIC for both SMB Client and Server.
      • Reorders Cipher Suites for both Client and Server to prioritize AES_256_GCM,AES_256_CCM over AES_128_GCM,AES_128_CCM.
    • NTLM Blocking: Completely blocks NTLM by applying policies for SMB, all incoming connections, and all outgoing connections. It also disables the RPC Endpoint Mapper Client Authentication policy.

    Warning: Blocking all outgoing NTLM connections can prevent remote RDP access via IP address. It is recommended to use Quick Assist or Azure Bastion as secure alternatives.