Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1052873" data-attributes="member: 96560">Do this for ALL of your PCs.Open Control Panel &gt; Windows Tools &gt; Local Security Policy.Go to Security Settings &gt; Local Policies &gt; User Right Assignment &gt;Deny access to this computer from the network: EVERYONEDeny logon through Remote Desktop Services: EVERYONEGo to Security Settings &gt; Local Policies &gt; Security Options &gt;Network access: Do not allow anonymous enumeration of SAM accounts ...(x2): EnabledNetwork Security: Restrict NTLM: Incoming NTLM Traffic: Deny all accountsNetwork Security: Restrict NTLM: NTLM authentcation in this domain: Deny allNetwork Security: Restrict NTLM: Outgoing NTLM traffic to remote servers: Deny allNetwork Security: Minimum session security for NTLM SSP ... (x2) : Require NTLMv2 session security, Require 128bit encryptionDo NOT setup SSH remote access.Note: This means that none of your PCs inter communicate. No shared folders either. These settings will stop lateral movement should one of your PC&#039;s is compromised. No funny pass-the-hash stuff will work.</blockquote>

[QUOTE="Victor M, post: 1052873, member: 96560"] Do this for ALL of your PCs. Open Control Panel > Windows Tools > Local Security Policy. Go to Security Settings > Local Policies > User Right Assignment > Deny access to this computer from the network: EVERYONE Deny logon through Remote Desktop Services: EVERYONE Go to Security Settings > Local Policies > Security Options > Network access: Do not allow anonymous enumeration of SAM accounts ...(x2): Enabled Network Security: Restrict NTLM: Incoming NTLM Traffic: Deny all accounts Network Security: Restrict NTLM: NTLM authentcation in this domain: Deny all Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers: Deny all Network Security: Minimum session security for NTLM SSP ... (x2) : Require NTLMv2 session security, Require 128bit encryption Do NOT setup SSH remote access. Note: This means that none of your PCs inter communicate. No shared folders either. These settings will stop lateral movement should one of your PC's is compromised. No funny pass-the-hash stuff will work. [/QUOTE]

Verification