Setup Idea Stop Lateral Movement on a Home LAN

PC Setup Ideas
6 Replies 2,595 Views
Thread details
Last updated
Jul 10, 2023
Main use of this computer
For home and private use
Operating system
macOS 15 Sequoia
OS version and support details
Windows 10
On-device encryption
Windows BitLocker / Device Encryption
Device sign-in security
    • Windows Hello PIN or biometric sign-in (face / fingerprint / Touch ID)
    • Account password
Security updates
Allow security updates and latest features
Update channels
Allow stable updates only
User Account Control (UAC)
Always notify
Smart App Control
Not applicable / not available on this device
Network firewall
Enabled
Real-time protection
n/a
Device firewall
Microsoft Defender Firewall with Advanced Security
Custom security settings
n/a
Periodic malware scanners
n/a
Malware sample testing
I do not participate in malware testing
Environment for malware testing
n/a
Browsers and extensions
n/a
Secure DNS
n/a
Desktop VPN
n/a
Password and passkey manager
n/a
File and photo backups
n/a
System recovery
n/a
Usage and exposure
    • Visiting familiar websites
    • Browsing the Internet without an ad-blocker
    • Visiting unknown or untrusted websites
    • Browsing the dark web
    • Working from home
    • Making audio/video calls
    • Opening email attachments
    • Downloading software and files from reputable sites
    • Downloading files from unknown or untrusted sources
    • Sharing and receiving files and torrents
    • Requesting and accepting remote access
    • Gaming
    • Gaming with third-party mods
    • Streaming audio/video content from trusted sites or paid subscriptions
    • Streaming from untrusted sites
    • Coding and development
    • Downloading malware samples
Computer specs
n/a
Recommended for
  1. All types of users
Victor M

Victor M

Level 28
Verified
Top Poster
Well-known
Do this for ALL of your PCs.

Open Control Panel > Windows Tools > Local Security Policy.

Go to Security Settings > Local Policies > User Right Assignment >
Deny access to this computer from the network: EVERYONE
Deny logon through Remote Desktop Services: EVERYONE

Go to Security Settings > Local Policies > Security Options >
Network access: Do not allow anonymous enumeration of SAM accounts ...(x2): Enabled
Network Security: Restrict NTLM: Incoming NTLM Traffic: Deny all accounts
Network Security: Restrict NTLM: NTLM authentcation in this domain: Deny all
Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers: Deny all
Network Security: Minimum session security for NTLM SSP ... (x2) : Require NTLMv2 session security, Require 128bit encryption

Do NOT setup SSH remote access.

Note: This means that none of your PCs inter communicate. No shared folders either. These settings will stop lateral movement should one of your PC's is compromised. No funny pass-the-hash stuff will work.
 
Last edited:
Upvote 0 Downvote
Thanks! That will finally take care of those pesky teenagers!!!


Edit: ohhh you meant LAN and not LAWN. Sorry. Freaking text to speech failed me again!


On a serious note: I did that before, I buttoned up my home network like fort Knox. It took me half a day to do it but I did it. That lasted about a week before realizing that yeap I can't live without sharing files across the network. I started creating rules to allow specific users etc but then that defeated the whole purpose of this.
I mean it's a great solution if you live with roommates etc but as a home environment I realized that I use my NAS way too much. Plus this killed any and all LAN gaming (although honestly it's been years since wife and I lan gamed .. sigh... miss those days).
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top