Home

Awesome

STIGing Standalone Windows Servers

Sponsor Test script against windows docker containerVirusTotal Scan

Download all the required files from the GitHub Repository

Note: This script should work for most, if not all, systems without issue. While @SimeonOnSecurity creates, reviews, and tests each repo intensively, we can not test every possible configuration nor does @SimeonOnSecurity take any responsibility for breaking your system. If something goes wrong, be prepared to submit an issue. Do not run this script if you don't understand what it does. It is your responsibility to review and test the script before running it.

Introduction:

Windows Server 2012, 2016, and 2019 are insecure operating systems out of the box and requires many changes to insure FISMA compliance. Microsoft, Cyber.mil, the Department of Defense, and the National Security Agency have recommended and required configuration changes to lockdown, harden, and secure the operating system and ensure government compliance. These changes cover a wide range of mitigations including blocking telemetry, macros, removing bloatware, and preventing many physical attacks on a system.

Standalone systems are some of the most difficult and annoying systems to secure. When not automated, they require manual changes of each STIG/SRG. Totalling over 1000 configuration changes on a typical deployment and an average of 5 minutes per change equaling 3.5 days worth of work. This script aims to speed up that process significantly.

Notes:

Ansible:

We now offer a playbook collection for this script. Please see the following:

Docker

This script is tested using an automated docker container

Requirements:

Recommended reading material:

A list of scripts and tools this collection utilizes:

Additional configurations were considered from:

STIGS/SRGs Applied:

Editing policies in Local Group Policy after the fact:

How to run the script:

Automated Install:

The script may be launched from the extracted GitHub download like this:

iex ((New-Object System.Net.WebClient).DownloadString('https://simeononsecurity.ch/scripts/standalonewindowsserver.ps1'))

Manual Install:

If manually downloaded, the script must be launched from the directory containing all the files from the GitHub Repository

All of the parameters in the "sos-secure-standalone-server.ps1" script are optional, with a default value of $true. This means that if no value is specified for a parameter when the script is run, it will be treated as if it were set to $true.

The script takes the following parameters, all of which are optional and default to $true if not specified:

An example of how to run the script with all default parameters would be:

.\sos-secure-standalone-server.ps1

If you want to specify a different value for one or more of the parameters, you can include them in the command along with their desired value. For example, if you wanted to run the script and set the $firefox parameter to $false, the command would be:

.\sos-secure-standalone-server.ps1 -firefox $false

You can also specify multiple parameters in the command like this:

.\sos-secure-standalone-server.ps1 -firefox $false -chrome $false

Note that in this example, both the Firefox and Chrome parameters are set to $false.

<a href="https://simeononsecurity.ch" target="_blank" rel="noopener noreferrer">   <h2>Explore the World of Cybersecurity</h2>   <img src="https://simeononsecurity.ch/img/banner.png" alt="SimeonOnSecurity Logo" width="300" height="300"> </a>

Links: