Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1117815" data-attributes="member: 96560">That hardening powershell script is still undergoing developement. Last update was 5 days ago. I ran the first Hardening screen checking most boxes. It ran OK. Then I tried the Verify screen and it bombed out. Confirm that no icons were installed in Start menu.According to the site, the hardening is based off &#039;MS Security Baseline Windows 11 24H2 download&#039;. Google for it and you will find it. You have to download Both the baseline for your version of Windows and the LGPO.zip . Then extract the LGPO.exe and put it into Baseline &gt; Scripts &gt; Tools folder. Then, go to the Scripts folder, read the script, and find in the beginning comments the correct parameter that you want, probably the nonDomain option. This script is much faster than Spynetgirl&#039;s app.After the script ran sucessfully, you may want to go into gpedit and change the Bitlocker setting for Removable Media, USB. Or else it will encrypt all your USB sticks too. It will make it impossible to share your USB stick with Linux.You can also use Gpedit&#039;s filter to find all the modified settings. Note that the filter only works for the Administrative Templates section.The Baseline is made for compatibility, not tight security. In particular, I made a few changes to what the baseline did. That includes setting Encryption to use TLS 1.2 and 1.3. (Many web sites now use TLS1.3, like MT. But some sites like Linkedin still use TLS1.2.)&nbsp; And also setting Defender to High+ blocking (the baseline set it to high only)</blockquote>

[QUOTE="Victor M, post: 1117815, member: 96560"] That hardening powershell script is still undergoing developement. Last update was 5 days ago. I ran the first Hardening screen checking most boxes. It ran OK. Then I tried the Verify screen and it bombed out. Confirm that no icons were installed in Start menu. According to the site, the hardening is based off 'MS Security Baseline Windows 11 24H2 download'. Google for it and you will find it. You have to download Both the baseline for your version of Windows and the LGPO.zip . Then extract the LGPO.exe and put it into Baseline > Scripts > Tools folder. Then, go to the Scripts folder, read the script, and find in the beginning comments the correct parameter that you want, probably the nonDomain option. This script is much faster than Spynetgirl's app. After the script ran sucessfully, you may want to go into gpedit and change the Bitlocker setting for Removable Media, USB. Or else it will encrypt all your USB sticks too. It will make it impossible to share your USB stick with Linux. You can also use Gpedit's filter to find all the modified settings. Note that the filter only works for the Administrative Templates section. The Baseline is made for compatibility, not tight security. In particular, I made a few changes to what the baseline did. That includes setting Encryption to use TLS 1.2 and 1.3. (Many web sites now use TLS1.3, like MT. But some sites like Linkedin still use TLS1.2.) And also setting Defender to High+ blocking (the baseline set it to high only) [/QUOTE]

Verification