Group Policies Objects/Default Domain Policy/Lanman Workstation.md

@@ -1,5 +0,0 @@
-# Lanman Workstation
-
-`Computer Configuration\Policies\Administrative Templates\Network\Lanman Workstation`
-
-- Enable insecure guest logons -> Disabled

Group Policies Objects/Default Domain Policy/Microsoft Defender Antivirus.md

@@ -15,14 +15,6 @@
 
 - Configure Controlled folder access -> Enabled -> Block
 
-## Attack Surface Reduction
-
-`Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack surface reduction`
-
-- Configure Attack Surface Reduction rules -> Add all rules from the [GUID Matrix](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#asr-rule-to-guid-matrix) except `01443614-cd74-433a-b99e-2ecdc07bfc25`. Set their value to 1.
-
-Rationale: `01443614-cd74-433a-b99e-2ecdc07bfc25` depends on Microsoft Cloud Protection (MAPS). The only place where I use MAPS is my gaming machine, and it needs to be able to run not-so-reputable programs anyways.
-
 ## MpEngine
 
 `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\MpEngine`

Group Policies Objects/Default Domain Policy/Security Options.md

@@ -4,30 +4,7 @@ Documentation: https://learn.microsoft.com/en-us/windows/security/application-se
 
 `Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options`
 
-(**Follow this guide to setup LDAPS if you do not have key server: https://www.dvolve.net/blog/2019/12/using-lets-encrypt-for-active-directory-domain-controller-certificates/**)
+- User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode -> Prompt for credentials
-
-- Accounts: Block Microsoft accounts -> Users can't add or log on with Microsoft accounts
-- Accounts: Guest account status -> Disabled
-- Devices: Prevent users from installing printer drivers -> Enabled
-- Domain controller: LDAP server signing requirements: Require signing
-- Domain controller: LDAP server channel binding token requirements: Always
-- Domain member: Digitally encrypt or sign secure channel data (always) -> Enabled
-- Domain member: Require strong (Windows 2000 or later) session key -> Enabled
-- Microsoft network client: Digitally sign communications (always) -> Enabled
-- Microsoft network server: Digitally sign communications (always) -> Enabled
-- Network access: Allow anonymous SID/Name translation -> Disabled
-- Network security: Do not store LAN Manager hash value on next password change -> Enabled
-- Network security: Force logoff when logon hours expire -> Disabled
-- Network security: LDAP client signing requirements: Require signing
-- Network security: Restrict NTLM: Incoming NTLM traffic -> Deny all accounts
-- Network security: Restrict NTLM: NTLM authentication in this domain -> Deny all
-- Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers -> Deny all
-- Shutdown: Clear virtual memory pagefile -> Enabled
-- User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop -> Disabled
-- User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode -> Prompt for credentials on the secure desktop
-- User Account Control: Behavior of the elevation prompt for standard users -> Prompt for credentials on the secure desktop
 - User Account Control: Only elevate executables that are signed and validated -> Enabled
-- User Account Control: Only elevate UIAccess applications that are installed in secure locations -> Enabled
+- User Account Control: Switch to the secure desktop when prompting for elevation -> Enabled (Docs says it is enabled by default, but it is off on my Parallels VM somehow)
-- User Account Control: Run all administrators in Admin Approval Mode
+- Network security: LDAP client signing requirements: Require signing (**Follow this guide to setup LDAPS if you do not have key server: https://www.dvolve.net/blog/2019/12/using-lets-encrypt-for-active-directory-domain-controller-certificates/**)
-- User Account Control: Switch to the secure desktop when prompting for elevation -> Enabled
-- User Account Control: Virtualize file and registry write failures to per-user locations -> Enabled

Group Policies Objects/Default Domain Policy/Services.md

@@ -1,6 +0,0 @@
-# Services
-
-`Computer Configuration\Preferences\Control Panel Settings\Services`
-
-- Startup: Disabled -> Service name: Webclient -> Service action: Stop service
-

Scripts/DisableSMB1.ps1

@@ -1 +0,0 @@
-Set-SmbServerConfiguration -EnableSMB1Protocol $false

Scripts/README.md

@@ -1,8 +1,4 @@
 # Scripts
 
 - Put these in your NETLOGON directory
-- In group policy objects, select the object you want to edit -> Computer Configuration -> Windows Setings -> Scripts -> Startup -> PowerShell Script, and add the scripts you want to use. Personally, I use all of these scripts in my Default Domain Policy object.
+- In group policy objects, select the object you want to edit -> Computer Configuration -> Windows Setings -> Scripts -> Startup -> PowerShell Script, and add the scripts you want to use. Personally, I use all of these scripts in my Default Domain Policy object.
-
-## Notes
-
-- The DisableSMB1.ps1 script is not stricly necessary as SMB1 shouldn't be installed anyways. It's just there for extra assurances.