More security options

Signed-off-by: Tommy <contact@tommytran.io>

Group Policies Objects/Default Domain Policy/Lanman Workstation.md

@@ -0,0 +1,5 @@
+# Lanman Workstation
+
+`Computer Configuration\Policies\Administrative Templates\Network\Lanman Workstation`
+
+- Enable insecure guest logons -> Disabled

Group Policies Objects/Default Domain Policy/Microsoft Defender Antivirus.md

@@ -15,6 +15,14 @@
 
 - Configure Controlled folder access -> Enabled -> Block
 
+## Attack Surface Reduction
+
+`Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack surface reduction`
+
+- Configure Attack Surface Reduction rules -> Add all rules from the [GUID Matrix](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#asr-rule-to-guid-matrix) except `01443614-cd74-433a-b99e-2ecdc07bfc25`. Set their value to 1.
+
+Rationale: `01443614-cd74-433a-b99e-2ecdc07bfc25` depends on Microsoft Cloud Protection (MAPS). The only place where I use MAPS is my gaming machine, and it needs to be able to run not-so-reputable programs anyways.
+
 ## MpEngine
 
 `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\MpEngine`

Group Policies Objects/Default Domain Policy/Security Options.md

@@ -4,7 +4,30 @@ Documentation: https://learn.microsoft.com/en-us/windows/security/application-se
 
 `Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options`
 
-- User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode -> Prompt for credentials
+(**Follow this guide to setup LDAPS if you do not have key server: https://www.dvolve.net/blog/2019/12/using-lets-encrypt-for-active-directory-domain-controller-certificates/**)
+
+- Accounts: Block Microsoft accounts -> Users can't add or log on with Microsoft accounts
+- Accounts: Guest account status -> Disabled
+- Devices: Prevent users from installing printer drivers -> Enabled
+- Domain controller: LDAP server signing requirements: Require signing
+- Domain controller: LDAP server channel binding token requirements: Always
+- Domain member: Digitally encrypt or sign secure channel data (always) -> Enabled
+- Domain member: Require strong (Windows 2000 or later) session key -> Enabled
+- Microsoft network client: Digitally sign communications (always) -> Enabled
+- Microsoft network server: Digitally sign communications (always) -> Enabled
+- Network access: Allow anonymous SID/Name translation -> Disabled
+- Network security: Do not store LAN Manager hash value on next password change -> Enabled
+- Network security: Force logoff when logon hours expire -> Disabled
+- Network security: LDAP client signing requirements: Require signing
+- Network security: Restrict NTLM: Incoming NTLM traffic -> Deny all accounts
+- Network security: Restrict NTLM: NTLM authentication in this domain -> Deny all
+- Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers -> Deny all
+- Shutdown: Clear virtual memory pagefile -> Enabled
+- User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop -> Disabled
+- User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode -> Prompt for credentials on the secure desktop
+- User Account Control: Behavior of the elevation prompt for standard users -> Prompt for credentials on the secure desktop
 - User Account Control: Only elevate executables that are signed and validated -> Enabled
-- User Account Control: Switch to the secure desktop when prompting for elevation -> Enabled (Docs says it is enabled by default, but it is off on my Parallels VM somehow)
-- Network security: LDAP client signing requirements: Require signing (**Follow this guide to setup LDAPS if you do not have key server: https://www.dvolve.net/blog/2019/12/using-lets-encrypt-for-active-directory-domain-controller-certificates/**)
+- User Account Control: Only elevate UIAccess applications that are installed in secure locations -> Enabled
+- User Account Control: Run all administrators in Admin Approval Mode
+- User Account Control: Switch to the secure desktop when prompting for elevation -> Enabled
+- User Account Control: Virtualize file and registry write failures to per-user locations -> Enabled

Group Policies Objects/Default Domain Policy/Services.md

@@ -0,0 +1,6 @@
+# Services
+
+`Computer Configuration\Preferences\Control Panel Settings\Services`
+
+- Startup: Disabled -> Service name: Webclient -> Service action: Stop service
+

Scripts/DisableSMB1.ps1

@@ -0,0 +1 @@
+Set-SmbServerConfiguration -EnableSMB1Protocol $false

Scripts/README.md

@@ -2,3 +2,7 @@
 
 - Put these in your NETLOGON directory
 - In group policy objects, select the object you want to edit -> Computer Configuration -> Windows Setings -> Scripts -> Startup -> PowerShell Script, and add the scripts you want to use. Personally, I use all of these scripts in my Default Domain Policy object.
+
+## Notes
+
+- The DisableSMB1.ps1 script is not stricly necessary as SMB1 shouldn't be installed anyways. It's just there for extra assurances.