Skip to content

Commit 7a0c4eb

Browse files
Corrections
1 parent 81ccc61 commit 7a0c4eb

File tree

3 files changed

+68
-28
lines changed

3 files changed

+68
-28
lines changed

README.md

Lines changed: 40 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,27 @@
1-
**Optimizing and Hardening Windows 10 Deployments**
1+
# Optimizing and Hardening Windows 10 Deployments
22

3-
Download all the required files from the [GitHub Repository](https://github.com/smiltech/W10-Optimize-and-Harden)
3+
**Download all the required files from the [GitHub Repository](https://github.com/smiltech/W10-Optimize-and-Harden)**
44

55

66
Windows 10 is an invasive and insecure operating system out of the box.
77
Organizations like [PrivacyTools.io](https://PrivacyTools.io), [Microsoft](https://microsoft.com) and the
88
[Department of Defense](https://public.cyber.mil) have recomended configuration changes to lockdown, harden, and secure the operating system. These changes cover a wide range of mitigations including blocking telemetery, macros, removing bloatware, and preventing many physical attacks on a system.
99

10+
## Requirements
11+
- [x] [Standards](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure) for a highly secure Windows 10 device
12+
- [x] Latest [Windows 10 stable version](https://www.microsoft.com/en-us/software-download/windows10)
13+
- [x] System is [fully up to date](https://support.microsoft.com/en-gb/help/4027667/windows-10-update)
14+
- [x] (default activated) internal Windows Defender protection instead of external "Security" solutions
15+
- [x] Latest Driver and Program updates
16+
- [x] No "Tuning" tools
17+
- [x] Only necessary tools which you realy need
18+
- [x] [Hardware Requirements](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection#requirements-met-by-system-guard-enabled-machines) for [System Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) / [Hardware-based Isolation](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation)
19+
- [x] [Hardware Requirements](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity#baseline-protections) for [Memory integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/memory-integrity)
20+
- [x] [Hardware Requirements](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard) for Windows [Defender Application Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) (WDAG)
21+
- [x] [Hardware Requirements](https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements) for Windows [Defender Credential Guard](https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-how-it-works)
1022

1123

12-
A list of script and tools this collection utilizes:
24+
## A list of scripts and tools this collection utilizes:
1325

1426
1.) [Microsoft Security Compliance Toolkit 1.0](https://www.microsoft.com/en-us/download/details.aspx?id=55319)
1527

@@ -23,37 +35,46 @@ A list of script and tools this collection utilizes:
2335

2436
6.) [Mirinsoft - debotnet](https://github.com/builtbybel/debotnet)
2537

26-
Additional configurations were considered from:
38+
## Additional configurations were considered from:
2739

28-
[Disable TCP Timestamps](https://www.whonix.org/wiki/Disable_TCP_and_ICMP_Timestamps)
40+
[NSACyber - Hardware-and-Firmware-Security-Guidance](https://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance)
2941

30-
[IE Scripting Engine Memory Corruption](https://kb.cert.org/vuls/id/573168/)
42+
[Whonix - Disable TCP Timestamps](https://www.whonix.org/wiki/Disable_TCP_and_ICMP_Timestamps)
3143

32-
[Specture and Meltdown Mitigations](https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities)
44+
[CERT - IE Scripting Engine Memory Corruption](https://kb.cert.org/vuls/id/573168/)
3345

34-
[SSL Hardening](https://dirteam.com/sander/2019/07/30/howto-disable-weak-protocols-cipher-suites-and-hashing-algorithms-on-web-application-proxies-ad-fs-servers-and-windows-servers-running-azure-ad-connect/)
46+
[Dirteam - SSL Hardening](https://dirteam.com/sander/2019/07/30/howto-disable-weak-protocols-cipher-suites-and-hashing-algorithms-on-web-application-proxies-ad-fs-servers-and-windows-servers-running-azure-ad-connect/)
3547

36-
[Windows 10 Privacy](https://docs.microsoft.com/en-us/windows/privacy/)
48+
[Microsoft - Specture and Meltdown Mitigations](https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities)
3749

38-
[Managing Windows 10 Telemetry and Callbacks](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services)
50+
[Microsoft - Windows 10 Privacy](https://docs.microsoft.com/en-us/windows/privacy/)
3951

40-
[Windows 10 VDI Recomendations](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds_vdi-recommendations-1909)
52+
[Microsoft - Managing Windows 10 Telemetry and Callbacks](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services)
4153

54+
[Microsoft - Windows 10 VDI Recomendations](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds_vdi-recommendations-1909)
4255

56+
57+
## How to run the script
58+
59+
**The script may be lauched from the extracted GitHub download like this:**
60+
```
61+
.\W10-Optimize-and-Harden-master\installallstandalone.ps1
62+
```
4363
The script we will be using must be launched from the directory containing all the other files from the [GitHub Repository](https://github.com/smiltech/W10-Optimize-and-Harden)
4464

45-
In order to enable the Windows 10 VDI Optimizations you must uncomment the line below:
65+
**In order to enable the Windows 10 VDI Optimizations you must uncomment the line below:**
4666
```
4767
.\Scripts\"Debloating, Optimization, and Privacy"\"Windows_10_VDI"\1909_WindowsUpdateEnabled\Win10_1909_VDI_Optimize.ps1
4868
4969
```
50-
In order to enable the SSL Hardening you must uncomment the line below:
70+
71+
**In order to enable the SSL Hardening you must uncomment the line below:**
5172
```
52-
.\Scripts\"Security, Hardening, and Mitigation"s\"SSL Hardening Registries.ps1"
73+
.\Scripts\"Security, Hardening, and Mitigation"\"SSL Hardening Registries.ps1"
5374
5475
```
5576

56-
The script we will be using is called **"installallstandalone.ps1"** and its contents are:
77+
**The script we will be using is called **"installallstandalone.ps1"** and its contents are:**
5778

5879
```
5980
######SCRIPT FOR FULL INSTALL AND CONFIGURE ON STANDALONE MACHINE#####
@@ -85,23 +106,18 @@ copy-item -Path .\PolicyDefinitions\* -Destination C:\Windows\PolicyDefinitions
85106
86107
#Security Scripts Testing Required
87108
#Only enable after testing in your environment
88-
#.\Scripts\"Security, Hardening, and Mitigation"s\"SSL Hardening Registries.ps1"
109+
#.\Scripts\"Security, Hardening, and Mitigations"\"SSL Hardening Registries.ps1"
89110
90111
#Debloating Scripts
91112
92113
#ONLY ENABLE IF ON VM
93114
#.\Scripts\"Debloating, Optimization, and Privacy"\"Windows_10_VDI"\1909_WindowsUpdateEnabled\Win10_1909_VDI_Optimize.ps1
94115
116+
.\Scripts\"Debloating, Optimization, and Privacy"\"Windows 10 Debloater"\Windows10SysPrepDebloater.ps1 -Sysprep -Debloat -Privacy
117+
.\Scripts\"Debloating, Optimization, and Privacy"\"Windows 10 telemetry.ps1"
95118
.\Scripts\"Debloating, Optimization, and Privacy"\ultimate performance mode.ps1
96-
.\Scripts\"Debloating, Optimization, and Privacy"\startupcleantelem.ps1
97119
.\Scripts\"Debloating, Optimization, and Privacy"\optimizevmvirtalization.ps1
98-
.\Scripts\"Debloating, Optimization, and Privacy"\"Windows 10 Debloater"\Windows10SysPrepDebloater.ps1 -Sysprep -Debloat -Privacy
120+
.\Scripts\"Debloating, Optimization, and Privacy"\startupcleantelem.ps1
99121
.\Scripts\"Debloating, Optimization, and Privacy"\sharpapp\sharpappscripts.ps1
100122
.\Scripts\"Debloating, Optimization, and Privacy"\debotnet\debotnetscripts.ps1
101123
```
102-
103-
104-
**The script may be lauched from the extracted GitHub download like this:**
105-
```
106-
.\W10-Optimize-and-Harden-master\installallstandalone.ps1
107-
```

Scripts/Debloating, Optimization, and Privacy/startupcleantelem.ps1

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,3 +130,26 @@ reg add "HKLM\SOFTWARE\Policies\Microsoft\VisualStudio\Feedback" /v DisableScree
130130
sc stop "VSStandardCollectorService150"
131131
net stop "VSStandardCollectorService150"
132132
sc config "VSStandardCollectorService150" start=disabled
133+
#General Optmizations
134+
#Delete "windows.old" folder
135+
%SystemRoot%\System32\Cmd.exe /c Cleanmgr /sageset:65535 & Cleanmgr /sagerun:65535
136+
137+
#Display full path in explorer
138+
@echo off
139+
140+
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState" /V FullPath /T REG_DWORD /D 1 /F
141+
142+
taskkill /f /im explorer.exe
143+
start explorer.exe
144+
145+
#Make icons easier to touch in exploere
146+
@echo off
147+
148+
:: Needs: Windows 10 build 19592+
149+
150+
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /V FileExplorerInTouchImprovement /T REG_DWORD /D 1 /F
151+
152+
:: To kill and restart explorer
153+
taskkill /f /im explorer.exe
154+
start explorer.exe
155+
#disable

installallstandalone.ps1

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,16 +27,17 @@ copy-item -Path .\PolicyDefinitions\* -Destination C:\Windows\PolicyDefinitions
2727

2828
#Security Scripts Testing Required
2929
#Only enable after testing in your environment
30-
#.\Scripts\"Security, Hardening, and Mitigation"s\"SSL Hardening Registries.ps1"
30+
#.\Scripts\"Security, Hardening, and Mitigations"\"SSL Hardening Registries.ps1"
3131

3232
#Debloating Scripts
3333

3434
#ONLY ENABLE IF ON VM
3535
#.\Scripts\"Debloating, Optimization, and Privacy"\"Windows_10_VDI"\1909_WindowsUpdateEnabled\Win10_1909_VDI_Optimize.ps1
3636

37+
.\Scripts\"Debloating, Optimization, and Privacy"\"Windows 10 Debloater"\Windows10SysPrepDebloater.ps1 -Sysprep -Debloat -Privacy
38+
.\Scripts\"Debloating, Optimization, and Privacy"\"Windows 10 telemetry.ps1"
3739
.\Scripts\"Debloating, Optimization, and Privacy"\ultimate performance mode.ps1
38-
.\Scripts\"Debloating, Optimization, and Privacy"\startupcleantelem.ps1
3940
.\Scripts\"Debloating, Optimization, and Privacy"\optimizevmvirtalization.ps1
40-
.\Scripts\"Debloating, Optimization, and Privacy"\"Windows 10 Debloater"\Windows10SysPrepDebloater.ps1 -Sysprep -Debloat -Privacy
41+
.\Scripts\"Debloating, Optimization, and Privacy"\startupcleantelem.ps1
4142
.\Scripts\"Debloating, Optimization, and Privacy"\sharpapp\sharpappscripts.ps1
42-
.\Scripts\"Debloating, Optimization, and Privacy"\debotnet\debotnetscripts.ps1
43+
.\Scripts\"Debloating, Optimization, and Privacy"\debotnet\debotnetscripts.ps1

0 commit comments

Comments
 (0)