Reply to thread

Message

<blockquote data-quote="TairikuOkami" data-source="post: 1110571" data-attributes="member: 61892">Yes, several options are available, pagefile being the main one, removing it at shutdown works till the PC is reset, then it is pointless.[SPOILER][CODE]rem Encrypt the Pagefilefsutil behavior set EncryptPagingFile 1rem 1 - The device does not store the user&#039;s credentials for automatic sign-in after a Windows Update restart. The users&#039; lock screen apps are not restarted after the system restarts.reg add &quot;HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System&quot; /v &quot;DisableAutomaticRestartSignOn&quot; /t REG_DWORD /d &quot;1&quot; /frem Determines how many user account entries Windows saves in the logon cache on the local computer.reg add &quot;HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon&quot; /v &quot;CachedLogonsCount&quot; /t REG_DWORD /d &quot;0&quot; /frem 1 - Do not allow storage of passwords and credentials for network authentication in the Credential Managerreg add &quot;HKLM\System\CurrentControlSet\Control\Lsa&quot; /v &quot;DisableDomainCreds&quot; /t REG_DWORD /d &quot;1&quot; /frem Digest Security Provider is disabled by default, but malware can enable it to recover the plain text passwords from the system’s memory (+CachedLogonsCount/+DisableDomainCreds/+DisableAutomaticRestartSignOn)reg add &quot;HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest&quot; /v &quot;Negotiate&quot; /t REG_DWORD /d &quot;0&quot; /freg add &quot;HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest&quot; /v &quot;UseLogonCredential&quot; /t REG_DWORD /d &quot;0&quot; /frem Restrict Delegation of Credentialsrem https://medium.com/blue-team/preventing-mimikatz-attacks-ed283e7ebdd5reg add &quot;HKLM\System\CurrentControlSet\Control\Lsa&quot; /v &quot;DisableRestrictedAdmin&quot; /t REG_DWORD /d &quot;0&quot; /freg add &quot;HKLM\System\CurrentControlSet\Control\Lsa&quot; /v &quot;DisableRestrictedAdminOutboundCreds&quot; /t REG_DWORD /d &quot;1&quot; /frem https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protectionreg add &quot;HKLM\System\CurrentControlSet\Control\Lsa&quot; /v &quot;RunAsPPL&quot; /t REG_DWORD /d &quot;1&quot; /freg add &quot;HKLM\System\CurrentControlSet\Control\Lsa&quot; /v &quot;RunAsPPLBoot&quot; /t REG_DWORD /d &quot;2&quot; /f[/CODE][/SPOILER]</blockquote>

[QUOTE="TairikuOkami, post: 1110571, member: 61892"] Yes, several options are available, pagefile being the main one, removing it at shutdown works till the PC is reset, then it is pointless. [SPOILER][CODE]rem Encrypt the Pagefile fsutil behavior set EncryptPagingFile 1 rem 1 - The device does not store the user's credentials for automatic sign-in after a Windows Update restart. The users' lock screen apps are not restarted after the system restarts. reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableAutomaticRestartSignOn" /t REG_DWORD /d "1" /f rem Determines how many user account entries Windows saves in the logon cache on the local computer. reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "CachedLogonsCount" /t REG_DWORD /d "0" /f rem 1 - Do not allow storage of passwords and credentials for network authentication in the Credential Manager reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "DisableDomainCreds" /t REG_DWORD /d "1" /f rem Digest Security Provider is disabled by default, but malware can enable it to recover the plain text passwords from the system’s memory (+CachedLogonsCount/+DisableDomainCreds/+DisableAutomaticRestartSignOn) reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v "Negotiate" /t REG_DWORD /d "0" /f reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v "UseLogonCredential" /t REG_DWORD /d "0" /f rem Restrict Delegation of Credentials rem https://medium.com/blue-team/preventing-mimikatz-attacks-ed283e7ebdd5 reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "DisableRestrictedAdmin" /t REG_DWORD /d "0" /f reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "DisableRestrictedAdminOutboundCreds" /t REG_DWORD /d "1" /f rem https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d "1" /f reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RunAsPPLBoot" /t REG_DWORD /d "2" /f[/CODE][/SPOILER] [/QUOTE]

Verification