Windows 10 Hardening via Local Group Policy

[Andy Ful]

The WinLogon CTRL + ALT + DEL is also a part of it.

I edited and extended my post, because it was not good enough.

 

[DeepWeb]

I am using the good driver policy. Everything will boot perfectly fine unless you use some extreme modded drivers from some forum.
If you want to go really secure try this:
Enable virtualization-based protection of code integrity

 

[509322]

I edited and extended my post, because it was not good enough.

Only a smart Polish guy would know what the SAS descriptors mean in GPO.

I can't stop laughing.

Despicable Me Lol GIF - Find & Share on GIPHY

Windows... what a mess.

Gordon Ramsay Smh GIF by Fox TV - Find & Share on GIPHY

Now I really can't stop laughing.

 

[ParaXY]

Some computers can be set to require the SAS when logging to the account or run applications with elevation (using different policy settings than the above). The "Disable or enable software secure attention sequence" policy was created for sending of Ctrl-Alt-Del (SAS) on the remote computer. You can enable/restrict/disable this by properly setting this policy. This of course makes sense if the SAS is enabled.
.
Why SAS is good for security?
When for example, you execute the program that requires elevation, then when using this setting, you first will see the SAS alert, press OK, and then press CTRL+ALT+DEL to see UAC window. The malware cannot replicate this behavior (cannot do CTRL+ALT+DEL programmatically). This is an additional security when the malware is going to fool you showing the fake UAC alert and next stealing your admin password.
Post was edited.

I don't run any remote control or other software remotely on my machine. Does this mean I should or shouldn't enable this option?

I am using the good driver policy. Everything will boot perfectly fine unless you use some extreme modded drivers from some forum.
If you want to go really secure try this:
Enable virtualization-based protection of code integrity

I wanted to enable code integrity. I really wanted to also use VBS (virtual based security) but I have three serious issues with it when I wanted to use it or try it out:

1. It requires HyperV - as a VMware Workstation user (I use it every single day) you can't run VMware and HyperV side by side and HyperV is required to use VBS/code of integrity
2. When I did try it, it blue screened my machine when I played videos - I guess it didn't like some of my drivers
3. It was difficult and unfriendly to use

So in the end I dumped it and bought AppGuard and couldn't be happier!

 

[Andy Ful]

I don't run any remote control or other software remotely on my machine. Does this mean I should or shouldn't enable this option?
...

This setting is not for you. It allows the remote administrator (or hacker) to send SAS programmatically during the remote session on your computer. Leave the "Disable or enable software secure attention sequence" as 'Not configured" (default Windows setting). Then only some special Windows applications (Ease of Access applications like: Magnifier, Narrator, On-Screen Keyboard, and Speech Recognition) will be able to simulate SAS on the secure desktop. The remote administrators, hackers, and malware will not be able to simulate SAS.

 

[ParaXY]

Ok, so I'll leave this setting to "Not configured then".

What about the following policy:

Boot-start Driver initialization Policy

Should this be enabled/configured?

 

[Andy Ful]

Ok, so I'll leave this setting to "Not configured then".

What about the following policy:

Boot-start Driver initialization Policy

Should this be enabled/configured?

This policy allows you bypassing the default setting that blocks bad and unknown drivers. This can be useful when you must use such drivers. If your system boots with all necessary drivers, then setting this policy is useless and makes a hole in your security.

 

[ParaXY]

I'm not sure if this has been shared on the forum but I'll post it here anyways. I found two really good PDFs for hardening Windows 10 and Office 2016 at:

https://www.asd.gov.au/publications/protect/Hardening_MS_Office_2016.pdf

https://www.asd.gov.au/publications/protect/Hardening_Win10.pdf

There's tons of good info in these PDFs but you can pick and choose what will help you secure your machine.