Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1124797" data-attributes="member: 96560">[USER=114717]@bazang[/USER]. Yes I know what least privilege is.In addition to using a standard user account, I remove rights for that account to run powershell, regedit, reg, and schtask plus a few more things.But least privilege is not enough. Attackers have privilege escalation tricks and exploits.For Least Functionality,&nbsp; I disable certain services, turn off remote &lt;anything&gt;,&nbsp; turn off network protocols,&nbsp; uninstall apps, firewall known MS telemetry ip&#039;s, turn off various Start&gt;Settings&gt;Privacy&amp;Security, and so on.I think the 5 hrs is mostly due to inefficiency, I was doing gpedits by hand instead of backing up and restoring. And chatgpt introduced a way to backup and restore Start&gt;Settings partially. I estimate those 2 things should eliminate ~2 hrs. Creating cip files takes 45 mins; which can be backed up and restored instead. Installing various apps takes 1 hr which actually shouldn&#039;t be included in the total because it is not hardening. Pretty close to your 1 hr benchmark. And for the rest of the stuff mentioned above I already have scripts made. Still, if you don&#039;t mind sharing your insights, I would like to hear them, if it is not a trade secret.I keep putting off reading 800-53 - too many bracketed role names, interferes with reading. I follow PCI-DSS.</blockquote>

[QUOTE="Victor M, post: 1124797, member: 96560"] [USER=114717]@bazang[/USER]. Yes I know what least privilege is. In addition to using a standard user account, I remove rights for that account to run powershell, regedit, reg, and schtask plus a few more things. But least privilege is not enough. Attackers have privilege escalation tricks and exploits. For Least Functionality, I disable certain services, turn off remote <anything>, turn off network protocols, uninstall apps, firewall known MS telemetry ip's, turn off various Start>Settings>Privacy&Security, and so on. I think the 5 hrs is mostly due to inefficiency, I was doing gpedits by hand instead of backing up and restoring. And chatgpt introduced a way to backup and restore Start>Settings partially. I estimate those 2 things should eliminate ~2 hrs. Creating cip files takes 45 mins; which can be backed up and restored instead. Installing various apps takes 1 hr which actually shouldn't be included in the total because it is not hardening. Pretty close to your 1 hr benchmark. And for the rest of the stuff mentioned above I already have scripts made. Still, if you don't mind sharing your insights, I would like to hear them, if it is not a trade secret. I keep putting off reading 800-53 - too many bracketed role names, interferes with reading. I follow PCI-DSS. [/QUOTE]

Verification