Union of lists & prompting users.

[ls-milkyway]

Hi!
First, I would like to congratulate you all for this nice project making life easy for the administrators!

Just wondering how to make proper union of the csv security definitions files in the list?
Union of 2 files say: baseline + DOD or any other definition will allow to incorporate all settings for better tightening of a particular Windows version?

And prompting users to make some changes while using "HAILMARY" option?

Actually, I used "finding_list_msft_security_baseline_windows_10_22h2_machine" and found 2 settings badly hindering my usabality in standalone personal desktop, so I reverted them:

1. User Account Control: Behavior of the elevation prompt for standard users.
   &
2. BitLocker Drive Encryption: Removable Data Drives: Deny write access to removable drives not protected by BitLocker.

Prompting users before enabling them with proper description or link to a page with proper description will certainly make the tool easy & fast to implement.
Thanks.

[0x6d69636b]

I recommend to build your own list, combine different finding lists and strip the findings you don't need or which do not work in your setup. Do you know the CIS Benchmark documentation? You have to register to download their PDF, but they describe every setting and its impact.

Additionally, you might found the filter function usefully, you can filter a list for severity, categories and other data:

Invoke-HardeningKitty -Filter { $_.Severity -eq "Medium" }

Regarding prompting users, would you consider this for each setting?

[ls-milkyway]

I recommend to build your own list, combine different finding lists and strip the findings you don't need or which do not work in your setup.

This process is included in the "HardeningKitty" (using some commands) or I have to manually edit csv files??

Regarding prompting users, would you consider this for each setting?

Nope, only those which can hinder usability as stated in my first post...(hmm OK I understand usability is on need and personal basis)..
also I am using edge browser & from the readme it was difficult for me to understand that edge version 98 was applicable to edge 106 .... only found it from the baseline blog
.

Do you know the CIS Benchmark documentation?

Thanks, I have registered for it. Earlier when using Windows 7 or XP .... I used to implement all settings (US DOD as it included everything from baseline) one by one via gpedit.msc & then backed it up using LGPO (time consuming & PITA).

it's very confusing & difficult to understand which lists I can apply for my Win 10 22H2 standalone PC with edge (106) ...generating lists is ok but I am also afraid of creating conflicting GPO & Registry settings.

Applied:

1. finding_list_msft_security_baseline_windows_10_22h2_machine.csv
2. finding_list_msft_security_baseline_windows_10_22h2_user.csv &
3. finding_list_msft_security_baseline_edge_98_machine.csv

"finding_list_0x6d69636b_machine.csv" is I guess your (sort of META) list? How can I confirm it will not conflict with previous 3 lists?

[0x6d69636b]

I get your pain and sadly I haven't got an easy solution for it. I use a sqlite database to maintain all findings list, but this makes it not easier to create a new one. I would start with choosing your "favourite" benchmark (CIS, Microsoft Security Baseline, DoD, BSI, whatever) and use this as a baseline. As today, only Microsoft has a benchmark for Windows 10 22H2 and uses new features (like local administrator lockout). I guess CIS will follow shortly. After that you have to compare other lists for additions or different settings, HardeningKitty has no function for that. I personally would compare the lists in Excel or whatever tool you prefer.

The "finding_list_0x6d69636b_machine.csv" list is my recommendation. I have also homework to do and should update the list with the new features of 22H2. I'd say my list is more security focused and has some settings which might hinder usability.

If you decide to use the Microsoft Baseline, I would use the tool from Microsoft to apply the settings from ADMX files. This has the advantage to HardeningKitty that you can use gpedit to see/modify the settings. The group policy editor uses the registry.pol file to store all settings and does not read it from the registry as far as I know. I don't know how to properly edit this file and therefore HardeningKitty HailMary does not put entries in that file. Therefore, you can't see the configuration in gpedit after using HardeningKitty.

[ls-milkyway]

I don't know how to properly edit this file and therefore HardeningKitty HailMary does not put entries in that file. Therefore, you can't see the configuration in gpedit after using HardeningKitty.

Thanks for clarifying, long back it took me weeks to implement best possible settings without hindering my usability in Windows 7 & now it's useless .... Microsoft makes life very tough for us ... sometimes I feel it's best to choose LTS versions.

If you decide to use the Microsoft Baseline, I would use the tool from Microsoft to apply the settings from ADMX files. This has the advantage to HardeningKitty that you can use gpedit to see/modify the settings.

Thanks again for your precise & honest answers. Last 2 questions:
Hmm using HardeningKitty means I have to keep track of both GPO & registry ... Is there any tool to keep track of both? As, if a user is not aware than he/she can mess up later when he/she wants to add or remove some settings.

Suppose I choose ADMX files:
I have created backups before using HAILMARY option.... will it clear all registry & GPO entries (specially registry entries) if I use backup CSV files with HailMary option of HardeningKitty to restore?

[0x6d69636b]

Thanks again for your precise & honest answers. Last 2 questions: Hmm using HardeningKitty means I have to keep track of both GPO & registry ... Is there any tool to keep track of both? As, if a user is not aware than he/she can mess up later when he/she wants to add or remove some settings.

I'm not aware of one tool that does both. Microsoft has their PowerShell scripts and LGPO to set settings and the PolicyAnalyzer to audit them (for a local machine) - or all the enterprise utilities like Intune and the Group Policy Management in Active Directory. Because PolicyAnalyzer could not audit all settings HardeningKitty exists. ;-)

Suppose I choose ADMX files: I have created backups before using HAILMARY option.... will it clear all registry & GPO entries (specially registry entries) if I use backup CSV files with HailMary option of HardeningKitty to restore?

Yes, that should work. Additionally the HailMary mode creates a System Restore Point, you could use this to go back to the state before.

[ls-milkyway]

Additionally the HailMary mode creates a System Restore Point, you could use this to go back to the state before.

Yeah, but it didn't work even after re-booting by starting & setting the service to automatic. Hence, I chose "-SkipRestorePoint".

[0x6d69636b]

Yeah, but it didn't work even after re-booting by starting & setting the service to automatic. Hence, I chose "-SkipRestorePoint".

I see, sometimes it fails because it has not enough space left/not enough space configured, you can check this with vssadmin list shadowstorage.