Skip to content

Commit d945002

Browse files
Harvester57Harvester57
authored
Merge pull request #36 from Harvester57/refactoring
[v1.1] Major refactoring
2 parents 5ab4f51 + 65188b4 commit d945002

17 files changed

+4991
-3670
lines changed

‎AdditionalDebugPolicies.admx‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
3+
<policyNamespaces>
4+
<target prefix="AddDebugPolicies" namespace="AddDebugPolicies.Policies.AddDebugPolicies" />
5+
<using prefix="windows" namespace="Microsoft.Policies.Windows" />
6+
<using prefix="parent" namespace="AddHard.Policies.AddHard" />
7+
</policyNamespaces>
8+
<resources minRequiredRevision="1.0" />
9+
<policies>
10+
<!-- Hardening policies section -->
11+
<!-- DEBUG SETTINGS -->
12+
<policy name="EnableKASAN" class="Machine" displayName="$(string.EnableKASAN)" explainText="$(string.EnableKASAN_Explain)" key="SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" valueName="KasanEnabled">
13+
<parentCategory ref="parent:Cat_Debug" />
14+
<supportedOn ref="windows:SUPPORTED_Windows_10_0" />
15+
<enabledValue>
16+
<decimal value="1" />
17+
</enabledValue>
18+
<disabledValue>
19+
<decimal value="0" />
20+
</disabledValue>
21+
</policy>
22+
</policies>
23+
</policyDefinitions>

‎AdditionalHardening.admx‎

Lines changed: 16 additions & 1945 deletions
Large diffs are not rendered by default.

‎AdditionalHardeningFromMicrosoft.admx‎

Lines changed: 514 additions & 0 deletions
Large diffs are not rendered by default.

‎AdditionalLegacyHardening.admx‎

Lines changed: 239 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,239 @@
1+
<policyDefinitions revision="1.0" schemaVersion="1.0">
2+
<policyNamespaces>
3+
<target prefix="AddLegacyHard" namespace="AddSystemHard.Policies.AddLegacyHard" />
4+
<using prefix="windows" namespace="Microsoft.Policies.Windows" />
5+
<using prefix="parent" namespace="AddHard.Policies.AddHard" />
6+
</policyNamespaces>
7+
<resources minRequiredRevision="1.0" />
8+
9+
<policies>
10+
11+
<policy name="Pol_MSS_AutoAdminLogon" class="Machine" displayName="$(string.DisableAutoLogon)" explainText="$(string.DisableAutoLogon_Help)" key="Software\Microsoft\Windows NT\CurrentVersion\Winlogon" valueName="AutoAdminLogon">
12+
<parentCategory ref="parent:Cat_Legacy" />
13+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
14+
<enabledValue>
15+
<string>1</string>
16+
</enabledValue>
17+
<disabledValue>
18+
<string>0</string>
19+
</disabledValue>
20+
</policy>
21+
22+
<policy name="Pol_MSS_AutoReboot" class="Machine" displayName="$(string.AutoReboot)" explainText="$(string.AutoReboot_Help)" key="SYSTEM\CurrentControlSet\Control\CrashControl" valueName="AutoReboot">
23+
<parentCategory ref="parent:Cat_Legacy" />
24+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
25+
<enabledValue>
26+
<decimal value="1" />
27+
</enabledValue>
28+
<disabledValue>
29+
<decimal value="0" />
30+
</disabledValue>
31+
</policy>
32+
33+
<policy name="Pol_MSS_DisableSavePassword" class="Machine" displayName="$(string.DisableSavePassword)" explainText="$(string.DisableSavePassword_Help)" key="SYSTEM\CurrentControlSet\Services\RasMan\Parameters" valueName="DisableSavePassword">
34+
<parentCategory ref="parent:Cat_Legacy" />
35+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
36+
<enabledValue>
37+
<decimal value="1" />
38+
</enabledValue>
39+
<disabledValue>
40+
<decimal value="0" />
41+
</disabledValue>
42+
</policy>
43+
44+
<policy name="Pol_MSS_EnableDeadGWDetect" class="Machine" displayName="$(string.EnableDeadGWDetect)" explainText="$(string.EnableDeadGWDetect_Help)" key="System\CurrentControlSet\Services\Tcpip\Parameters" valueName="EnableDeadGWDetect">
45+
<parentCategory ref="parent:Cat_Legacy" />
46+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
47+
<enabledValue>
48+
<decimal value="1" />
49+
</enabledValue>
50+
<disabledValue>
51+
<decimal value="0" />
52+
</disabledValue>
53+
</policy>
54+
55+
<policy name="Pol_MSS_EnableICMPRedirect" class="Machine" displayName="$(string.EnableICMPRedirect)" explainText="$(string.EnableICMPRedirect_Help)" key="System\CurrentControlSet\Services\Tcpip\Parameters" valueName="EnableICMPRedirect">
56+
<parentCategory ref="parent:Cat_Legacy" />
57+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
58+
<enabledValue>
59+
<decimal value="1" />
60+
</enabledValue>
61+
<disabledValue>
62+
<decimal value="0" />
63+
</disabledValue>
64+
</policy>
65+
66+
<policy name="Pol_MSS_HideFromBrowseList" class="Machine" displayName="$(string.HideFromBrowseList)" explainText="$(string.HideFromBrowseList_Help)" key="System\CurrentControlSet\Services\Lanmanserver\Parameters" valueName="Hidden">
67+
<parentCategory ref="parent:Cat_Legacy" />
68+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
69+
<enabledValue>
70+
<decimal value="1" />
71+
</enabledValue>
72+
<disabledValue>
73+
<decimal value="0" />
74+
</disabledValue>
75+
</policy>
76+
77+
<policy name="Pol_MSS_NoNameReleaseOnDemand" class="Machine" displayName="$(string.NoNameReleaseOnDemand)" explainText="$(string.NoNameReleaseOnDemand_Help)" key="System\CurrentControlSet\Services\Netbt\Parameters" valueName="NoNameReleaseOnDemand">
78+
<parentCategory ref="parent:Cat_Legacy" />
79+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
80+
<enabledValue>
81+
<decimal value="1" />
82+
</enabledValue>
83+
<disabledValue>
84+
<decimal value="0" />
85+
</disabledValue>
86+
</policy>
87+
88+
<policy name="Pol_MSS_PerformRouterDiscovery" class="Machine" displayName="$(string.PerformRouterDiscovery)" explainText="$(string.PerformRouterDiscovery_Help)" key="System\CurrentControlSet\Services\Tcpip\Parameters" valueName="PerformRouterDiscovery">
89+
<parentCategory ref="parent:Cat_Legacy" />
90+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
91+
<enabledValue>
92+
<decimal value="1" />
93+
</enabledValue>
94+
<disabledValue>
95+
<decimal value="0" />
96+
</disabledValue>
97+
</policy>
98+
99+
<policy name="Pol_MSS_SafeDllSearchMode" class="Machine" displayName="$(string.SafeDllSearchMode)" explainText="$(string.SafeDllSearchMode_Help)" key="SYSTEM\CurrentControlSet\Control\Session Manager" valueName="SafeDllSearchMode">
100+
<parentCategory ref="parent:Cat_Legacy" />
101+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
102+
<enabledValue>
103+
<decimal value="1" />
104+
</enabledValue>
105+
<disabledValue>
106+
<decimal value="0" />
107+
</disabledValue>
108+
</policy>
109+
110+
111+
<policy name="Pol_MSS_ScreenSaverGracePeriod" class="Machine" displayName="$(string.ScreenSaverGracePeriod)" explainText="$(string.ScreenSaverGracePeriod_Help)" presentation="$(presentation.ScreenSaverGracePeriod)" key="Software\Microsoft\Windows NT\CurrentVersion\Winlogon">
112+
<parentCategory ref="parent:Cat_Legacy" />
113+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
114+
<elements>
115+
<decimal id="ScreenSaverGracePeriod" storeAsText="true" valueName="ScreenSaverGracePeriod"/>
116+
</elements>
117+
</policy>
118+
119+
<policy name="Pol_MSS_TcpMaxDataRetransmissions" class="Machine" displayName="$(string.TcpMaxDataRetransmissions)" explainText="$(string.TcpMaxDataRetransmissions_Help)" presentation="$(presentation.TcpMaxDataRetransmissions)" key="System\CurrentControlSet\Services\Tcpip\Parameters">
120+
<parentCategory ref="parent:Cat_Legacy" />
121+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
122+
<elements>
123+
<decimal id="TcpMaxDataRetransmissions" valueName="TcpMaxDataRetransmissions"/>
124+
</elements>
125+
</policy>
126+
127+
<policy name="Pol_MSS_TcpMaxDataRetransmissionsIPv6" class="Machine" displayName="$(string.TcpMaxDataRetransmissionsIPv6)" explainText="$(string.TcpMaxDataRetransmissionsIPv6_Help)" presentation="$(presentation.TcpMaxDataRetransmissions)" key="System\CurrentControlSet\Services\Tcpip6\Parameters">
128+
<parentCategory ref="parent:Cat_Legacy" />
129+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
130+
<elements>
131+
<decimal id="TcpMaxDataRetransmissions" valueName="TcpMaxDataRetransmissions"/>
132+
</elements>
133+
</policy>
134+
135+
<policy name="Pol_MSS_NtfsDisable8dot3NameCreation" class="Machine" displayName="$(string.NtfsDisable8dot3NameCreation)" explainText="$(string.NtfsDisable8dot3NameCreation_Help)" presentation="$(presentation.NtfsDisable8dot3NameCreation)" key="System\CurrentControlSet\Control\FileSystem">
136+
<parentCategory ref="parent:Cat_Legacy" />
137+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
138+
<elements>
139+
<enum id="NtfsDisable8dot3NameCreation" valueName="NtfsDisable8dot3NameCreation" required="true">
140+
<item displayName="$(string.NtfsDisable8dot3NameCreation0)"> <value> <decimal value="0"/> </value> </item>
141+
<item displayName="$(string.NtfsDisable8dot3NameCreation1)"> <value> <decimal value="1"/> </value> </item>
142+
<item displayName="$(string.NtfsDisable8dot3NameCreation2)"> <value> <decimal value="2"/> </value> </item>
143+
<item displayName="$(string.NtfsDisable8dot3NameCreation3)"> <value> <decimal value="3"/> </value> </item>
144+
</enum>
145+
</elements>
146+
</policy>
147+
148+
<policy name="Pol_MSS_KeepAliveTime" class="Machine" displayName="$(string.KeepAliveTime)" explainText="$(string.KeepAliveTime_Help)" presentation="$(presentation.KeepAliveTime)" key="System\CurrentControlSet\Services\Tcpip\Parameters">
149+
<parentCategory ref="parent:Cat_Legacy" />
150+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
151+
<elements>
152+
<enum id="KeepAliveTime" valueName="KeepAliveTime" required="true">
153+
<item displayName="$(string.KeepAliveTime0)"> <value> <decimal value="150000"/> </value> </item>
154+
<item displayName="$(string.KeepAliveTime1)"> <value> <decimal value="300000"/> </value> </item>
155+
<item displayName="$(string.KeepAliveTime2)"> <value> <decimal value="600000"/> </value> </item>
156+
<item displayName="$(string.KeepAliveTime3)"> <value> <decimal value="1200000"/> </value> </item>
157+
<item displayName="$(string.KeepAliveTime4)"> <value> <decimal value="2400000"/> </value> </item>
158+
<item displayName="$(string.KeepAliveTime5)"> <value> <decimal value="3600000"/> </value> </item>
159+
<item displayName="$(string.KeepAliveTime6)"> <value> <decimal value="7200000"/> </value> </item>
160+
</enum>
161+
</elements>
162+
</policy>
163+
164+
<policy name="Pol_MSS_NoDefaultExempt" class="Machine" displayName="$(string.NoDefaultExempt)" explainText="$(string.NoDefaultExempt_Help)" presentation="$(presentation.NoDefaultExempt)" key="System\CurrentControlSet\Services\IPSEC">
165+
<parentCategory ref="parent:Cat_Legacy" />
166+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
167+
<elements>
168+
<enum id="NoDefaultExempt" valueName="NoDefaultExempt" required="true">
169+
<item displayName="$(string.NoDefaultExempt0)"> <value> <decimal value="0"/> </value> </item>
170+
<item displayName="$(string.NoDefaultExempt1)"> <value> <decimal value="1"/> </value> </item>
171+
<item displayName="$(string.NoDefaultExempt2)"> <value> <decimal value="2"/> </value> </item>
172+
<item displayName="$(string.NoDefaultExempt3)"> <value> <decimal value="3"/> </value> </item>
173+
</enum>
174+
</elements>
175+
</policy>
176+
177+
<policy name="Pol_MSS_SynAttackProtect" class="Machine" displayName="$(string.SynAttackProtect)" explainText="$(string.SynAttackProtect_Help)" presentation="$(presentation.SynAttackProtect)" key="System\CurrentControlSet\Services\Tcpip\Parameters">
178+
<parentCategory ref="parent:Cat_Legacy" />
179+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
180+
<elements>
181+
<enum id="SynAttackProtect" valueName="SynAttackProtect" required="true">
182+
<item displayName="$(string.SynAttackProtect0)"> <value> <decimal value="0"/> </value> </item>
183+
<item displayName="$(string.SynAttackProtect1)"> <value> <decimal value="1"/> </value> </item>
184+
</enum>
185+
</elements>
186+
</policy>
187+
188+
<policy name="Pol_MSS_TcpMaxConnectResponseRetransmissions" class="Machine" displayName="$(string.TcpMaxConnectResponseRetransmissions)" explainText="$(string.TcpMaxConnectResponseRetransmissions_Help)" presentation="$(presentation.TcpMaxConnectResponseRetransmissions)" key="System\CurrentControlSet\Services\Tcpip\Parameters">
189+
<parentCategory ref="parent:Cat_Legacy" />
190+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
191+
<elements>
192+
<enum id="TcpMaxConnectResponseRetransmissions" valueName="TcpMaxConnectResponseRetransmissions" required="true">
193+
<item displayName="$(string.TcpMaxConnectResponseRetransmissions0)"> <value> <decimal value="0"/> </value> </item>
194+
<item displayName="$(string.TcpMaxConnectResponseRetransmissions1)"> <value> <decimal value="1"/> </value> </item>
195+
<item displayName="$(string.TcpMaxConnectResponseRetransmissions2)"> <value> <decimal value="2"/> </value> </item>
196+
<item displayName="$(string.TcpMaxConnectResponseRetransmissions3)"> <value> <decimal value="3"/> </value> </item>
197+
</enum>
198+
</elements>
199+
</policy>
200+
201+
<policy name="Pol_MSS_WarningLevel" class="Machine" displayName="$(string.WarningLevel)" explainText="$(string.WarningLevel_Help)" presentation="$(presentation.WarningLevel)" key="SYSTEM\CurrentControlSet\Services\Eventlog\Security">
202+
<parentCategory ref="parent:Cat_Legacy" />
203+
<supportedOn ref="windows:SUPPORTED_WindowsVista" />
204+
<elements>
205+
<enum id="WarningLevel" valueName="WarningLevel" required="true">
206+
<item displayName="$(string.WarningLevel0)"> <value> <decimal value="50"/> </value> </item>
207+
<item displayName="$(string.WarningLevel1)"> <value> <decimal value="60"/> </value> </item>
208+
<item displayName="$(string.WarningLevel2)"> <value> <decimal value="70"/> </value> </item>
209+
<item displayName="$(string.WarningLevel3)"> <value> <decimal value="80"/> </value> </item>
210+
<item displayName="$(string.WarningLevel4)"> <value> <decimal value="90"/> </value> </item>
211+
</enum>
212+
</elements>
213+
</policy>
214+
215+
</policies>
216+
</policyDefinitions>
217+
218+
<!--
219+
;========= Start of MSS Registry Values =========
220+
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon,1,%DisableAutoLogon%,0
221+
MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\AutoReboot,4,%AutoReboot%,0
222+
MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters\DisableSavePassword,4,%DisableSavePassword%,0
223+
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\EnableDeadGWDetect,4,%EnableDeadGWDetect%,0
224+
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\EnableICMPRedirect,4,%EnableICMPRedirect%,0
225+
MACHINE\System\CurrentControlSet\Services\Lanmanserver\Parameters\Hidden,4,%HideFromBrowseList%,0
226+
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveTime,4,%KeepAliveTime%,3,150000|%KeepAliveTime0%,300000|%KeepAliveTime1%,600000|%KeepAliveTime2%,1200000|%KeepAliveTime3%,2400000|%KeepAliveTime4%,3600000|%KeepAliveTime5%,7200000|%KeepAliveTime6%
227+
MACHINE\System\CurrentControlSet\Services\IPSEC\NoDefaultExempt,4,%NoDefaultExempt%,3,0|%NoDefaultExempt0%,1|%NoDefaultExempt1%,2|%NoDefaultExempt2%,3|%NoDefaultExempt3%
228+
MACHINE\System\CurrentControlSet\Services\Netbt\Parameters\NoNameReleaseOnDemand,4,%NoNameReleaseOnDemand%,0
229+
MACHINE\System\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation,4,%NtfsDisable8dot3NameCreation%,3,0|%NtfsDisable8dot3NameCreation0%,1|%NtfsDisable8dot3NameCreation1%,2|%NtfsDisable8dot3NameCreation2%,3|%NtfsDisable8dot3NameCreation3%
230+
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\PerformRouterDiscovery,4,%PerformRouterDiscovery%,0
231+
MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode,4,%SafeDllSearchMode%,0
232+
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScreenSaverGracePeriod,1,%ScreenSaverGracePeriod%,1
233+
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\SynAttackProtect,4,%SynAttackProtect%,3,0|%SynAttackProtect0%,1|%SynAttackProtect1%
234+
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxConnectResponseRetransmissions,4,%TcpMaxConnectResponseRetransmissions%,3,0|%TcpMaxConnectResponseRetransmissions0%,1|%TcpMaxConnectResponseRetransmissions1%,2|%TcpMaxConnectResponseRetransmissions2%,3|%TcpMaxConnectResponseRetransmissions3%
235+
MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\TcpMaxDataRetransmissions,4,%TcpMaxDataRetransmissions%,1
236+
MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security\WarningLevel,4,%WarningLevel%,3,50|%WarningLevel0%,60|%WarningLevel1%,70|%WarningLevel2%,80|%WarningLevel3%,90|%WarningLevel4%
237+
MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters\TcpMaxDataRetransmissions ,4,%TcpMaxDataRetransmissionsIPv6%,1
238+
;========= End of MSS Registry Values =========
239+
-->

0 commit comments

Comments
 (0)