simeononsecurity / standalone-windows-stig-script

Create a compliant and secure Windows 10/11 system with our Gold Master image creation tool. Adhere to DoD STIG/SRG Requirements and NSA Cybersecurity guidance for standalone Windows systems with ease, using our ultimate STIG script.

Windows 10 and 11 STIG Script

Download all the required files from the GitHub Repository

Note: This script should work for most, if not all, systems without issue. While @SimeonOnSecurity creates, reviews, and tests each repo intensively, we can not test every possible configuration nor does @SimeonOnSecurity take any responsibility for breaking your system. If something goes wrong, be prepared to submit an issue. Do not run this script if you don't understand what it does. It is your responsibility to review and test the script before running it.

Ansible:

We now offer a playbook collection for this script. Please see the following:

• Github Repo
• Ansible Galaxy

Docker:

We test this script using an automated docker container

• DockerHub

Introduction:

Windows is insecure operating system out of the box and requires many changes to insure FISMA compliance. Organizations like Microsoft, Cyber.mil, the Department of Defense, and the National Security Agency have recommended and required configuration changes to lockdown, harden, and secure the operating system and ensure government compliance. These changes cover a wide range of mitigations including blocking telemetry, macros, removing bloatware, and preventing many physical attacks on a system.

Standalone systems are some of the most difficult and annoying systems to secure. When not automated, they require manual changes of each STIG/SRG. Totalling over 1000 configuration changes on a typical deployment and an average of 5 minutes per change equaling 3.5 days worth of work. This script aims to speed up that process significantly.

Notes:

• This script is designed for operation in Enterprise environments and assumes you have hardware support for all the requirements.
  • For personal systems please see this GitHub Repository
• This script is not designed to bring a system to 100% compliance, rather it should be used as a stepping stone to complete most, if not all, the configuration changes that can be scripted.
  • Minus system documentation, this collection should bring you up to about 95% compliance on all the STIGS/SRGs applied.

Requirements:

• Windows 10 Enterprise is required per STIG.
• Standards for a highly secure Windows 10 device
• System is fully up to date
  • Run the Windows 10 Upgrade Assistant to update and verify latest major release.
• Bitlocker must be suspended or turned off prior to implementing this script, it can be enabled again after rebooting.
  • Follow-up runs of this script can be run without disabling bitlocker.
• Hardware Requirements
  • Hardware Requirements for Memory Integrity
  • Hardware Requirements for Virtualization-Based Security
  • Hardware Requirements for Windows Defender Application Guard
  • Hardware Requirements for Windows Defender Credential Guard

Recommended reading material:

• System Guard Secure Launch
• System Guard Root of Trust
• Hardware-based Isolation
• Memory integrity
• Windows Defender Application Guard
• Windows Defender Credential Guard

A list of scripts and tools this collection utilizes:

• Cyber.mil - Group Policy Objects
• Microsoft Security Compliance Toolkit 1.0

Additional configurations were considered from:

• Microsoft - Recommended block rules
• Microsoft - Recommended driver block rules
• Microsoft - Windows Defender Application Control
• NSACyber - Application Whitelisting Using Microsoft AppLocker
• NSACyber - Hardware-and-Firmware-Security-Guidance
• NSACyber - Windows Secure Host Baseline

STIGS/SRGs Applied:

• Adobe Acrobat Pro DC Continuous V2R1
• Adobe Acrobat Reader DC Continuous V2R1
• Firefox V5R2
• Google Chrome V2R4
• Internet Explorer 11 V1R19
• Microsoft Edge V1R2
• Microsoft .Net Framework 4 V1R9
• Microsoft Office 2013 V2R1
• Microsoft Office 2016 V2R1
• Microsoft Office 2019/Office 365 Pro Plus V2R3
• Microsoft OneDrive STIG V2R1
• Oracle JRE 8 V1R5
• Windows 10 V2R2
• Windows Firewall V1R7

Editing policies in Local Group Policy after the fact:

• Import the ADMX Policy definitions from this repo into C:\windows\PolicyDefinitions on the system you're trying to modify.
• Open gpedit.msc on on the system you're trying to modify.

How to run the script:

Automated Install:

The script may be launched from the extracted GitHub download like this:

iex ((New-Object System.Net.WebClient).DownloadString('https://simeononsecurity.ch/scripts/standalonewindows.ps1'))

Note: This installation version installs all of the configurations. If you seek to customize it, please use the Manual Install

Chocolatey Install:

Assuming you have Chocolatey installed. You may install this script via the following command:

choco install standalone-windows-stig

Or view the package on the Chocolatey Repo.

Note: The Chocolatey version of this script may lag behind this repo by multiple major versions. We update it sparingly, but stably. Additionally, this version will install all of the configurations. If you seek to customize it, please use the Manual Install

Manual Install:

If manually downloaded, the script must be launched from the directory containing all the other files from the GitHub Repository

All of the parameters in the "secure-standalone.ps1" script are optional, with a default value of $true. This means that if no value is specified for a parameter when the script is run, it will be treated as if it were set to $true.

The script takes the following parameters, all of which are optional and default to $true if not specified:

• cleargpos: (Boolean) Clear GPOs not being used
• installupdates: (Boolean) Install updates and reboot if necessary
• adobe: (Boolean) STIG Adobe Reader
• firefox: (Boolean) STIG Firefox
• chrome: (Boolean) STIG Chrome
• IE11: (Boolean) STIG Internet Explorer 11
• edge: (Boolean) STIG Edge
• dotnet: (Boolean) STIG .NET Framework
• office: (Boolean) STIG Office
• onedrive: (Boolean) STIG OneDrive
• java: (Boolean) STIG Java
• windows: (Boolean) STIG Windows
• defender: (Boolean) STIG Windows Defender
• firewall: (Boolean) STIG Windows Firewall
• mitigations: (Boolean) STIG Mitigations
• nessusPID: (Boolean) Resolve Unquoted Strings in Path
• horizon: (Boolean) STIG VMware Horizon

An example of how to run the script with all default parameters would be:

.\secure-standalone.ps1

If you want to specify a different value for one or more of the parameters, you can include them in the command along with their desired value. For example, if you wanted to run the script and set the $firefox parameter to $false, the command would be:

.\secure-standalone.ps1 -firefox $false

You can also specify multiple parameters in the command like this:

.\secure-standalone.ps1 -firefox $false -chrome $false

Note that in this example, both the Firefox and Chrome parameters are set to $false.

 

Explore the World of Cybersecurity

 

Links:

• github.com/simeononsecurity

• simeononsecurity.ch

standalone-windows-stig-script's Issues

What is the default password after running the script and where can that be changed

Describe the bug
What is the default password after running the script for X_Admin and where can that be changed ?

Some gpupdate errors

Describe the bug
Varying errors on gpupdate /force

To Reproduce
Steps to reproduce the behavior:

1. Apply STIG
2. Reboot
3. run gpupdate /force in command prompt
4. review errors

Expected behavior
No errors

Screenshots
Updating policy...

Computer Policy update has completed successfully.

The following warnings were encountered during computer policy processing:

Windows failed to apply the Group Policy Registry settings. Group Policy Registry settings might have its own log file. Please click on the "More information" link.
Windows failed to apply the Software Installation settings. Software Installation settings might have its own log file. Please click on the "More information" link.
Windows failed to apply the {FC491EF1-C4AA-4CE1-B329-414B101DB823} settings. {FC491EF1-C4AA-4CE1-B329-414B101DB823} settings might have its own log file. Please click on the "More information" link.
User Policy update has completed successfully.

The following warnings were encountered during user policy processing:

Windows failed to apply the Group Policy Registry settings. Group Policy Registry settings might have its own log file. Please click on the "More information" link.

For more detailed information, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.

Desktop (please complete the following information):

• OS: Windows 11 22H2
• Version 22621.1778

Question- Can Conflicts occur between GPO & registery entries?

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

Hi !
Does your script add/remove registry entries without reflecting the changes in the GPO? This is the main problem with hardening scripts ....for example HardeningKitty ....it's not possible to keep track of the both....conflicts can occur if user later change settings in GPO without checking it's related or created new registry entries.

Credential manager (windows credential)

Hello,
I executed the script, but it deactivates the windows credential in the credential manager.
I would not like it to be deactivated because I lose the connection to my network drives when starting my PC.

Thank you in advance for your answer.

Allow for remote scanning

Hi,

I like the script. Would it be possible to allow for the traditional services and security settings used for vulnerability settings?

Using a tool like Tenable Nessus the scans fail due to many security settings being disabled. It would also be nice to have an option to allow remote desktop. When the script runs it completely disabled RDP and it takes more than a few clicks to get it back to where it can be turned on.

Thanks

Remove coma on param

Describe the bug
Remove coma at the end of the line 36 [.... [bool]$horizon = $true**,** ]

To Reproduce
Steps to reproduce the behavior:
Run the script and the error on that line (36) prevents it from running.