windowsserver2016安全基线设置脚本:: 账号安全
@prompt #
echo [version] >account.inf
echo signature="$CHICAGO$" >>account.inf
echo [System Access] >>account.inf
REM 设置帐户密码最短为10
echo MinimumPasswordLength=10 >>account.inf
REM 开启帐户密码复杂性要求
echo PasswordComplexity=1 >>account.inf
REM 设置帐户密码最长使⽤期限为120天
echo MaximumPasswordAge=120 >>account.inf
REM 禁⽤Guest帐户
echo EnableGuestAccount=0 >>account.inf
REM 设定帐户锁定阀值为6次
echo LockoutBadCount=6 >>account.inf
secedit /configure /db account.sdb /cfg account.inf /log account.log /quiet
del account.*
:: 授权权限设置
@prompt #
REM 授权配置
echo [version] >rightscfg.inf
echo signature="$CHICAGO$" >>rightscfg.inf
echo [Privilege Rights] >>rightscfg.inf
REM 从远端系统强制关机只指派给Administrators组
echo seremoteshutdownprivilege=Administrators >>rightscfg.inf
REM 关闭系统仅指派给Administrators组
echo seshutdownprivilege=Administrators >>rightscfg.inf
REM 取得⽂件或其它对象的所有权仅指派给Administrators
echo setakeownershipprivilege=Administrators >>rightscfg.inf
REM 在本地登陆权限仅指派给Administrators
echo seinteractivelogonright=Administrators >> rightscfg.inf
secedit /configure /db rightscfg.sdb /cfg rightscfg.inf /log rightscfg.log /quiet
del rightscfg.*
:
: 认证安全
@prompt #
echo [version] >audit.inf
echo signature="$CHICAGO$" >>audit.inf
echo [Event Audit] >>audit.inf
REM 开启审核系统事件
echo AuditSystemEvents=3 >>audit.inf
REM 开启审核对象访问
echo AuditObjectAccess=3 >>audit.inf
REM 开启审核特权使⽤
echo AuditPrivilegeUse=3 >>audit.inf
REM 开启审核策略更改
echo AuditPolicyChange=3 >>audit.inf
REM 开启审核帐户管理
echo AuditAccountManage=3 >>audit.inf
REM 开启审核过程跟踪
echo AuditProcessTracking=2 >>audit.inf
REM 开启审核⽬录服务访问
echo AuditDSAccess=3 >>audit.inf
REM 开启审核登陆事件
echo AuditLogonEvents=3 >>audit.inf
REM 开启审核帐户登陆事件
windows server2016echo AuditAccountLogon=3 >>audit.inf
echo AuditLog >>audit.inf
secedit /configure /db audit.sdb /cfg audit.inf /log audit.log /quiet
del audit.*
:: 系统⽇志
@prompt #
echo [version] >logcfg.inf
echo signature="$CHICAGO$" >>logcfg.inf
REM 设置系统⽇志
echo [System Log] >>logcfg.inf
REM 设置系统⽇志⽂件最⼤8192KB
echo MaximumLogSize=8192 >>logcfg.inf
REM 设置当达到最⼤的⽇志尺⼨时按需要改写事件
echo AuditLogRetentionPeriod=0 >>logcfg.inf
REM 设置限制GUEST访问应⽤⽇志
echo RestrictGuestAccess=1 >>logcfg.inf
REM 设置安全⽇志
echo [Security Log] >>logcfg.inf
REM 设置安全⽇志⽂件最⼤8192KB
echo MaximumLogSize=8192 >>logcfg.inf
REM 设置当达到最⼤的⽇志尺⼨时按需要改写事件
echo AuditLogRetentionPeriod=0 >>logcfg.inf
REM 设置限制GUEST访问安全⽇志
echo RestrictGuestAccess=1 >>logcfg.inf
echo [Application Log] >>logcfg.inf REM 设置应⽤程序⽇志
REM 设置应⽤程序⽇志⽂件最⼤8192KB
echo MaximumLogSize=8192 >>logcfg.inf
REM 设置当达到最⼤的⽇志尺⼨时按需要改写事件
echo AuditLogRetentionPeriod=0 >>logcfg.inf
REM 设置限制GUEST访问应⽤程序⽇志
echo RestrictGuestAccess=1 >>logcfg.inf
secedit /configure /db logcfg.sdb /cfg logcfg.inf /log logcfg.log
del logcfg.*
REM 关闭⾃动播放
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" /v DisableAutoplay /t REG_DWORD /d 1 /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
@Rem 启⽤“不显⽰最后⽤户名”策略
echo **** 配置登录屏幕上不要显⽰上次登录的⽤户名
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DontDisplayLastUserName /t REG_DWORD /d 1 /f :: 删除默认共享，请⾃⾏增删盘符
@prompt #
REM 删除当前默认共享
net share c$ /delete
net share admin$ /delete
sc stop browser
sc stop dfs
sc stop lanmanserver
sc config browser start= demand
sc config dfs start= demand
sc config lanmanserver start= demand
REM 修改共享的注册表
@echo Windows Registry Editor Version 5.00>&
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]>&
@echo "AutoShareWks"=dword:0>&
@echo "AutoShareServer"=dword:0>&
@regedit /
@
REM 限制IPC共享(禁⽌SAM帐户和共享的匿名枚举)
@echo Windows Registry Editor Version 5.00>&
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]>&
@echo "RestrictAnonymous"=dword:1>&
@echo "restrictanonymoussam"=dword:1>&
@regedit /
@
@Rem 启⽤并正确配置WSUS（⾃定义WSUS地址）
echo **** 启⽤并正确配置WSUS（⾃动下载并通知安装）
::--启⽤策略组“配置⾃动更新”
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v AUOptions /t REG_DWORD /d 3 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v ScheduledInstallDay /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v ScheduledInstallTime /t REG_DWORD /d 3 /f
::--启⽤策略组（指定Intranet Microsoft更新服务位置）
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer /t REG_SZ /d 10.10.100.10 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUStatusServer /t REG_SZ /d 10.10.100.10 /f
@Rem 只允许运⾏带⽹络级⾝份验证的远程桌⾯的计算机连接
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f
@Rem 启⽤windows防⽕墙
netsh advfirewall set allprofiles state on
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v EnableFirewall /t REG_DWORD /d 1 /f
@Rem 防⽕墙⼊站规则启⽤“回显请求-ICMPv4-In”和“远程桌⾯服务”
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v FPS-ICMP4-ERQ-In /t REG_SZ /d "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=1|ICMP4=8:*|Name=@Fi reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v RemoteDesktop-In-TCP /t REG_SZ /d "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=3389|App=Sy reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v RemoteDesktop-UserMode-In-TCP /t REG_SZ /d "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=33
::-------------上⾯为原基线配置END
:
:-------------下⾯是新增部分
REM 禁⽤匿名访问命名管道和共享
@echo Windows Registry Editor Version 5.00>&
@echo [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters]>&
@echo "NullSessionShares"=->&
@regedit /
@
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters" /v NullSessionShares /t REG_MULTI_SZ /d "" /f
REM 禁⽤可远程访问的注册表路径和⼦路径
@echo Windows Registry Editor Version 5.00>&
@echo [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths]>&
@echo "Machine"=->&
@echo [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths]>&
@echo "Machine"=->&
@regedit /
@
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths" /v Machine /t REG_MULTI_SZ /d "" /f
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths" /v Machine /t REG_MULTI_SZ /d "" /f
REM 源路由欺骗保护
@echo Windows Registry Editor Version 5.00>&
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters]>&
@echo "DisableIPSourceRouting"=dword:2>&
@regedit /
@
REM 碎⽚攻击保护
@echo Windows Registry Editor Version 5.00>&
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters]>&
@echo "EnablePMTUDiscovery"=dword:1>&
@regedit /
@
REM 防syn洪⽔攻击
@prompt #
@echo Windows Registry Editor Version 5.00>&
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]>&
@echo "SynAttackProtect"=dword:2>&
@echo "TcpMaxPortsExhausted"=dword:5>&
@echo "TcpMaxHalfOpen"=dword:500>&
@echo "TcpMaxHalfOpenRetried"=dword:400>&
@REM DDOS
@echo "EnableICMPRedirect"=dword:0>&
@regedit /
@
echo ">>更改完成任意键退出"
pause
将上述代码复制到xxx.bat⽂件运⾏即可。

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。