Setup Idea Stop Lateral Movement on a Home LAN

[Victor M]

Do this for ALL of your PCs.

Open Control Panel > Windows Tools > Local Security Policy.

Go to Security Settings > Local Policies > User Right Assignment >
Deny access to this computer from the network: EVERYONE
Deny logon through Remote Desktop Services: EVERYONE

Go to Security Settings > Local Policies > Security Options >
Network access: Do not allow anonymous enumeration of SAM accounts ...(x2): Enabled
Network Security: Restrict NTLM: Incoming NTLM Traffic: Deny all accounts
Network Security: Restrict NTLM: NTLM authentcation in this domain: Deny all
Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers: Deny all
Network Security: Minimum session security for NTLM SSP ... (x2) : Require NTLMv2 session security, Require 128bit encryption

Do NOT setup SSH remote access.

Note: This means that none of your PCs inter communicate. No shared folders either. These settings will stop lateral movement should one of your PC's is compromised. No funny pass-the-hash stuff will work.

 

[Victor M]

Note: 'EVERYONE' is a built in group account name that includes all user accounts.

 

[cartaphilus]

Thanks! That will finally take care of those pesky teenagers!!!


Edit: ohhh you meant LAN and not LAWN. Sorry. Freaking text to speech failed me again!


On a serious note: I did that before, I buttoned up my home network like fort Knox. It took me half a day to do it but I did it. That lasted about a week before realizing that yeap I can't live without sharing files across the network. I started creating rules to allow specific users etc but then that defeated the whole purpose of this.
I mean it's a great solution if you live with roommates etc but as a home environment I realized that I use my NAS way too much. Plus this killed any and all LAN gaming (although honestly it's been years since wife and I lan gamed .. sigh... miss those days).

 

[Victor M]

Well, the solution is not for everyone. Those with mapped drives / shared folders cannot do this. I use a personal USB external drive for my backups.

 

[Victor M]

@cartaphilus

Forgot to mention one thing. If you keep your backups online, like on the NAS, ransomware can find them.

 

[Sandbox Breaker - DFIR]

Also disallow all unsolicited incoming. Kills network attacks and network exploits. Trust me.

If you have a supported router... flash it pfsense or similar... make vlans for everyone with zero routing. You can further harden the network firewall and IPS with free snort key and tight firewall rules.

 

[SpyNetGirl]

Set all network adapters' locations to Public. Harden your PCs with proper policies.
Then, even in the most hostile environments, your device will stay protected.