윈도우11 시작11

[동우]

REM "VSS 서비스 관련 강화 네트워킹 엑센스 읽기로 변경 https://cafe.daum.net/candan/BLQD/102"
icacls %windir%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\ /deny "NT AUTHORITY\NETWORK SERVICE":(OI)(CI)RX

REM "VSS 서비스 네트워킹 사용자 차단"
REM "사용자 엑센스 비활성 NETWORK SERVICE, ANONYMOUS LOGON,GUEST,GUESTS,IIS_IUSRS,REMOTE INTERACTIVE LOGON,Remote Management Users"
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VSS" /v "NT AUTHORITY\NETWORK SERVICE" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VSS\AccessControl\NT AUTHORITY\NETWORK SERVICE" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VSS\AccessControl\EveryoneIncludesAnonymous" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VSS\AccessControl\GuestAccess" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VSS\AccessControl\GuestsAccess" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VSS\AccessControl\IIS_IUSRSAccess" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VSS\AccessControl\RemoteInteractiveLogonAccess" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VSS\AccessControl\RemoteManagementUsersAccess" /t REG_DWORD /d 0 /f

REM "이걸 중지 하면 업데이트 안된다 ㅠ"

REM "VSS 보안 강화 하기 시스텝 보안 관련 보호 하기 https://cafe.daum.net/candan/BLQD/102"
REM REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v "RequiredPrivileges" /t REG_MULTI_SZ /d "SeDenyBackupPrivilege\0SeChangeNotifyPrivilege\0SeCreateGlobalPrivilege\0SeCreatePermanentPrivilege\0SeImpersonatePrivilege\0SeManageVolumePrivilege\0SeRestorePrivilege\0SeIncreaseBasePriorityPrivilege\0SeManageVolumePrivilege\0SeRestorePrivilege\0SeTcbPrivilege" /f

REM "Shadow Copy 중지"

REM REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v "Start" /t REG_DWORD /d 4 /f

REM "기본값 3"

REM REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v "Start" /t REG_DWORD /d 3 /f

REM 중지 사용안함 sc stop "swprv" & sc config "swprv" start= disabled
REM 수동으로 sc config "swprv" start= demand
REM 바로 실행 sc start "swprv"

REM "이걸로 해킹 당할수 있다고 한다. 서버를 실행 하려고함 이걸로 -_-; 난 서버도 아닌대"

REM REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v "ObjectName" /t REG_SZ /d "NT AUTHORITY\LocalService" /f
REM reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v "Everyone" /t REG_DWORD /d 0 /f
REM reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v "System" /t REG_DWORD /d 0 /f

REM "이게 최선 같다"

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v EveryoneIncludesAnonymous /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v GuestAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v GuestsAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v IIS_IUSRSAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v RemoteInteractiveLogonAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv" /v RemoteManagementUsersAccess /t REG_DWORD /d 0 /f

---

REM "rundll32.exe를 이건 숨기는 방법이래요 비워 놓기"
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe" /v "Debugger" /t REG_SZ /d "" /f

REM "rundll32.exe 이 해킹 당하는 느낌이라 누가 원격으로 켜는 느낌이다 -_- https://cafe.daum.net/candan/GGFN/450"

---

REM "레지스트 기본 LocalSystem 를 NT AUTHORITY\LocalSystem 형태로 변경 해야 보안 강화가 된다고.. 의심 스러운 부분은 보안 강화 하는 것이 좋다  에러가 난다 ㅠㅠ 그냥 기존 그대로"
REM "https://learn.microsoft.com/ko-kr/windows/win32/services/localsystem-account"

REM "WpnUserService에 대한 의심스러운 애들 제안 하기"
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnUserService" /v EveryoneIncludesAnonymous /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnUserService" /v GuestAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnUserService" /v GuestsAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnUserService" /v IIS_IUSRSAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnUserService" /v RemoteInteractiveLogonAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnUserService" /v RemoteManagementUsersAccess /t REG_DWORD /d 0 /f



REM "인터넷 인터페이스 관련 임 ㅎㅎ 조심 스럽게 많이 건들면 에러가 날수 있음"

REM "오류가 난다 https://cafe.daum.net/candan/GGFN/452  Service Control Manager 7034 7000"

REM REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnService" /v "ObjectName" /t REG_SZ /d "NT AUTHORITY\LocalSystem" /f

REM "이렇게 바꾸라고 조언 (이것도 에러가 나네요 ㅠ)"

REM REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnService" /v "ObjectName" /t REG_SZ /d "NT AUTHORITY\LocalService" /f

REM "그냥 기본값으로 해야 하나 봐요"

REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnService" /v "ObjectName" /t REG_SZ /d "LocalSystem" /f

REM "WpnService에 대한 의심스러운 애들 제안 하기"
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnService" /v EveryoneIncludesAnonymous /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnService" /v GuestAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnService" /v GuestsAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnService" /v IIS_IUSRSAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnService" /v RemoteInteractiveLogonAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpnService" /v RemoteManagementUsersAccess /t REG_DWORD /d 0 /f

---

REM "MDM 이놈이 핵심 같다. 중지 하기 수상한 짓함 -_-;; Windows 운영 체제에서 성능 최적화 TiWorker.exe https://dreamsososo.tistory.com/184"
schtasks /Change /TN "\Microsoft\Windows\Maintenance\WinSAT" /Disable

REM "시스템> 고급 시스템 설정> 하드웨어> 장치 설치설정> 장치에 사용 가능한 제조업체 앱 및 사용자 지정 아이콘을 자동으로 다운로드 하시겠습니까? 아니요.(비활성) 헨드폰 연결이 이것 때문에 안되나?"
REM reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings" /v NoAppIconDownload /t REG_DWORD /d 1 /f

REM "Windows Modules Installer 이거랑 업데이트 서비스는 그냥 두는 것이."
REM "컴퓨터 이름을 자꾸 가상으로 만든다 -_-"

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName" /v EveryoneIncludesAnonymous /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName" /v GuestAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName" /v GuestsAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName" /v IIS_IUSRSAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName" /v RemoteInteractiveLogonAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName" /v RemoteManagementUsersAccess /t REG_DWORD /d 0 /f

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" /v EveryoneIncludesAnonymous /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" /v GuestAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" /v GuestsAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" /v IIS_IUSRSAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" /v RemoteInteractiveLogonAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" /v RemoteManagementUsersAccess /t REG_DWORD /d 0 /f

REM "NT SERVICE\TrustedInstaller 권한을 바꾸어야 한다 어드민s로 해야 수정이 된다"
reg add "HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages" /v EveryoneIncludesAnonymous /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages" /v GuestAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages" /v GuestsAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages" /v IIS_IUSRSAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages" /v RemoteInteractiveLogonAccess /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\DriverDatabase\DriverPackages" /v RemoteManagementUsersAccess /t REG_DWORD /d 0 /f



reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide" /v "Everyone" /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide" /v "Administrators" /t REG_DWORD /d 0xf003f /f

---

REM " https://social.msdn.microsoft.com/Forums/vstudio/en-US/951e5d39-d3d2-472d-b2e7-64e05ea3ae96/outlook-account-setup-and-microsoftaadbrokerpluginexe?forum=WindowsAzureAD "
REM "학교 관련 프로세스 Microsoft.AAD.BrokerPlugin.exe 사용안함"
REG ADD "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Identity" /v "DisableADALatopWAMOverride" /t REG_DWORD /d 1 /f

REM "HxTsr.exe 프로세스 활동 중지 Microsoft Outlook, Microsoft Mail, Microsoft Calendar 메일이나 그런거라고 한다"

reg add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Identity" /v DisableAADWAM /t REG_DWORD /d 1 /f

---

REM "https://cafe.daum.net/candan/GGFN/446 https://cafe.daum.net/candan/ASdB/431 https://cafe.daum.net/candan/ASdB/428 https://gist.github.com/sjas/2d7a9b9c976bb2aa410757044d4282c9 원래 있던 자리."

REM "오픽스 사용안함"

3.txt

2.24KB

REM "Office 경로에서 ?.? 모두 찾으세요 그리고 test.txt로 입력 하세요" 
REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office" /k /f "*.*" /s > %temp%\test.txt

REM "입력한 test.txt에서 원하는 내용만 추출 하여 777.txt로 보내세요"
findstr /C:"HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office" %temp%\test.txt > %temp%\777.txt

REM "만들어진 내용을 출력 하세요 type 가 출력 하는 말이다. for 예문은 내부에 %i가 임시 표현 방식으로.. 그리고 이것을 do set를 통해서 보내고 보낸 내용을 set 으로 해서 등록 하고. 사용"
for /f "delims=" %i in ('type %temp%\777.txt') do set "aa=%i" & cmd /V:ON /C "REG ADD "!aa!\Publisher\Security" /v "vbawarnings" /t REG_DWORD /d 4 /f & REG ADD "!aa!\Word\Security" /v "vbawarnings" /t REG_DWORD /d "4" /f & REG ADD "!aa!\Outlook\Security" /v "markinternalasunsafe" /t REG_DWORD /d "0" /f & REG ADD "!aa!\Word\Security" /v "blockcontentexecutionfrominternet" /t REG_DWORD /d "1" /f"

REM "두번째 같은 방법"
for /f "delims=" %i in ('type %temp%\777.txt') do set "aa=%i" & cmd /V:ON /C "REG ADD "!aa!\Excel\Security" /v "blockcontentexecutionfrominternet" /t REG_DWORD /d 1 /f & REG ADD "!aa!\PowerPoint\Security" /v "blockcontentexecutionfrominternet" /t REG_DWORD /d "1" /f & REG ADD "!aa!\Word\Options" /v "DontUpdateLinks" /t REG_DWORD /d "1" /f & REG ADD "!aa!\Word\Options\WordMail" /v "DontUpdateLinks" /t REG_DWORD /d "1" /f"

REM "세번째 같음"
for /f "delims=" %i in ('type %temp%\777.txt') do set "aa=%i" & cmd /V:ON /C "REG ADD "!aa!\Outlook\Options" /v "disableexchange" /t REG_DWORD /d 1 /f & REG ADD "!aa!\Outlook\Options" /v "disableeas" /t REG_DWORD /d "1" /f & REG ADD "!aa!\Outlook\Options" /v "disablepop3" /t REG_DWORD /d "1" /f & REG ADD "!aa!\Outlook\Options" /v "disableimap" /t REG_DWORD /d "1" /f"

REM "네번째"
for /f "delims=" %i in ('type %temp%\777.txt') do set "aa=%i" & cmd /V:ON /C "REG ADD "!aa!\Outlook\Options" /v "disableothertypes" /t REG_DWORD /d 1 /f & REG ADD "!aa!\Outlook\setup" /v "DisableOffice365SimplifiedAccountCreation" /t REG_DWORD /d "1" /f & REG ADD "!aa!\Common\Identity" /v "DisableADALatopWAMOverride" /t REG_DWORD /d "1" /f"

REM "다섯 번째 Microsoft Office의 클라우드 기능이 비활성화"
for /f "delims=" %i in ('type %temp%\777.txt') do set "aa=%i" & cmd /V:ON /C "REG ADD "!aa!\Common\Identity" /v DisableAADWAM /t REG_DWORD /d 1 /f & REG ADD "!aa!\Common\Cloud" /v "EnableADAL" /t REG_DWORD /d 0 /f"

REM "Microsoft Office의 클라우드 기능이 비활성화 CDPUserSvc _92a3f 켜지는 문제"

REM REG ADD "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Cloud" /v "EnableADAL" /t REG_DWORD /d 0 /f

---

REM "SMB 관련 보안 강화"

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v NullSessionPipes /t REG_BINARY /d 00000000 /f

REM "https://fishilico.github.io/generic-config/windows/hardening_script.bat.raw.html 다른 사람 보안 강화"

[동우]

https://hurricanelabs.com/wp-content/uploads/Windows-Hardening-Checklist.pdf