Disclaimer: I have no knowledge in this field, therefore, I have certainly missed steps, or done steps incorrectly, so please feel free to correct me. Furthermore, make sure you understand the purposes of the recommended settings before applying them (you can always revert individual settings). Please feel free to suggest edits to this post so I can add more information on the purpose of each setting and the impacts of each settings on your system, as well as formatting advice.
Shout out to @anon34108895 and @sha123.
1. Before applying the security baseline you need to do the following:
-
Navigate to the Microsoft Edge for Business download page.
-
Click on âDownload Windows 64-bit Policyâ. Please note that this is different from the main download button located above it.
-
After downloading, extract the âMicrosoftEdgePolicyTemplates.cabâ file. This will create a file named âMicrosoftEdgePolicyTemplates.zipâ.
-
Open the âMicrosoftEdgePolicyTemplates.zipâ file.
-
Navigate to the following path within the zip file:
MicrosoftEdgePolicyTemplates.zip > windows > admx > msedge.admx. -
Move the âmsedge.admxâ file to your
C:\Windows\PolicyDefinitionsfolder. -
Next, find the file at this path:
MicrosoftEdgePolicyTemplates.zip > windows > admx > (your locale code) > msedge.adml. -
Move the âmsedge.admlâ file to your
C:\Windows\PolicyDefinitions(your locale code)folder. -
Click the big blue download button.
-
Find the âadmintemplates_x64_5423.1000_en-us.exeâ file, open it, accept the conditions, then choose a folder for it to extract files there. For example, you can choose the âDownloadsâ folder.
-
It will create two side-by-side folders named âadminâ and âadmxâ.
-
Open the âadmxâ folder and copy all the files with the format âsomething16.admxâ over to the
C:\Windows\PolicyDefinitionsfolder. -
Similarly, for the language-specific files, navigate to the âadmx > (your locale code)â folder within the âadminâ folder.
-
Copy all the âsomething16.admlâ files to your
C:\Windows\PolicyDefinitions(your locale code)folder.
I am using Fluent Reader to subscribe to the Microsoft Security Baselines Blog articles (use the URL and click âadd sourceâ on Fluent Reader), where update for the security baseline are updated by Microsoft. However, I do not know whether I have the time to update these baselines and apply them again.
2. Apply the Windows security baselines.
- Warning: Baselines affect hundreds of settings, but you can create a recovery point before proceeding with the following steps!
- Download the âWindows 11 v23H2 Security Baseline.zipâ, âMicrosoft Edge v117 Security Baseline.zipâ and âMicrosoft 365 Apps for Enterprise 2306.zipâ and âLGPO.zipâ files from here.
-
I will show you how to apply the âWindows 11 v23H2 Security Baselineâ below, the steps are the same for the âMicrosoft Edge v117 Security Baseline.zipâ and âMicrosoft 365 Apps for Enterprise 2306.zipâ files.
-
Begin by unzipping both the âLGPO.zipâ and âWindows 11 v23H2 Security Baseline.zipâ files.
-
In the unzipped LGPO file, navigate to
LGPO_30 > LGPO.exe. -
Copy the
LGPO.exefile toWindows 11 v23H2 Security Baseline > Scripts > Tools. -
Open Windows PowerShell as an administrator.
-
Change the directory to the Scripts folder in the Windows 11 v23H2 Security Baseline file by typing:
cd 'C:\Users\Redacted\Downloads\Windows 11 v23H2 Security Baseline\Windows 11 v23H2 Security Baseline\Scripts'
- Set the execution policy to unrestricted for the current process by typing:
Set-ExecutionPolicy -Scope Process Unrestricted
-
You will be prompted with a message about the execution policy change. Respond with
Yto confirm the change. -
Run the
Baseline-LocalInstall.ps1script with the-Win11NonDomainJoinedparameter (if your device is not connected to a domain [which I donât know what this is to be honest]) by typing:
.\Baseline-LocalInstall.ps1 -Win11NonDomainJoined
-
You will receive a security warning. Respond with
Rto run the script once. -
Leave PowerShell open and repeat the steps above for the other two baselines: âMicrosoft Edge v117 Security Baseline.zipâ and âMicrosoft 365 Apps for Enterprise 2306.zipâ.
-
Once you have finished applying the three baselines, open PowerShell as an administrator and type in the following to set the execution policy for the LocalMachine scope to
AllSigned:
Set-ExecutionPolicy -ExecutionPolicy AllSigned
- Now, click enter. You will be prompted with a message about the execution policy change. Respond with
Yto confirm the change.
3. The baseline configuration will disable Controlled Folder Access, setting it to Audit Mode. If you want to change this setting to Block, you can do so manually.
-
Open the Group Policy Management Editor.
-
Navigate to
Computer Configurationand selectAdministrative Templates. -
Expand the tree to the following path:
Windows components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled folder access
-
Double-click on the
Configure Controlled folder accesssetting. -
In the options, set it to
Enabled. -
This will enable the Controlled Folder Access setting in Microsoft Defender. Please note that this might restrict access to protected folders by applications, which can affect their functionality.
-
After applying the baseline, there is an additional step you should take. There is a specific file for this in the baseline package.
-
Locate the file
ep-reset.xmlin the following path within the baseline package:
Windows 11 v23H2 Security Baseline.zip/scripts/configfiles/ep-reset.xml
- You need to configure a policy to use this XML file. In the Group Policy Management Editor, navigate to the following path:
Windows components > Windows Defender Exploit Guard > Exploit Protection > Use a common set of exploit protection settings
-
Configure this policy to use the
ep-reset.xmlfile. -
This will apply a common set of exploit protection settings across your system, enhancing its security. Please note that changes to security settings can have significant impacts on your system. Always ensure you understand the changes youâre making, and consider backing up your system before making any modifications. If youâre unsure, seek assistance from a professional.
4. Important settings:
-
Before adjusting the Virtualization Based Security policy, there are several BIOS settings you should modify:
-
Secure Boot: Turn this on and (if applicable) disable the third-party Microsoft UEFI CA which is for Linux.
-
Virtualization Settings: Turn these on (this was @anon34108895âs advice, I have no idea what these are specifically).
-
Thunderbolt Security Settings: Set these to the highest level (again, if applicable I couldnât find these).
-
BIOS Password: Set a BIOS password.
-
Boot Sequence Settings: Only boot your hard drive and disable all other items (if applicable, I couldnât find these).
-
TPM: Turn on TPM and set Pluton as default if you have it (if applicable, I couldnât find these).
-
After adjusting the BIOS settings, navigate to the policy by clicking
Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security. This policy contains several important settings that cannot be easily reverted to default status: -
Secure Boot and DMA Protection: If your laptop was shipped after 2018, select it to secure boot and DMA protection.
-
VBS (Code Integrity): Most hardware is compatible with this. Select it to on/on with UEFI lock. UEFI lock means this setting is written to your BIOS rather than only the system (Windows). Also, turn on
Require UEFI Memory Attributes Table. -
Credential Guard: Select it to on/on with UEFI lock.
-
Secure Launch (System Guard Secure Launch/Firmware Protection): SMM protection is included in secure launch. This requires an Intel vPro CPU. If your device is compatible, turn it on.
-
Hardware Enforced Stack Protection: If your device is compatible, turn it on.
5. Turning on Smart App Control without using Windows Defender settings:
-
First, install the WDAC Wizard on your system.
-
Open the WDAC Wizard and follow these steps:
Select âPolicy Creatorâ.
Choose âBase Policyâ.
Select âSigned and Reputable Modeâ.
Under âPolicy Rulesâ, disable âAudit Modeâ.
Under âFile Rulesâ, check âMerge and the 2 rulesâ. -
Once done, click âFinishâ.
-
Find the
.cipfile you created (it should be in your Documents folder). Open an administrator command prompt and execute the following command:
$PolicyBinary = "C:\Users\YourUsername\Documents\{BF7C2699-87B0-4A61-B0D5-EED077419032}.cip"
CiTool --update-policy $PolicyBinary [-json]
-
Replace
YourUsernamewith your actual username. -
If you need to disable the WDAC policy, use the following command:
CiTool.exe -rp "{BF7C2699-87B0-4A61-B0D5-EED077419032}" -json
- Note: WDAC might not be suitable for everyone due to its strict control over applications. Please consider your needs and system requirements before enabling it.
6. Apply additional measures as recommended by @anon34108895:
-
Configuring Attack Surface Reduction Rules:
-
In the Group Policy Editor, navigate to the following path:
Windows components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack surface reduction > Configure Attack Surface Reduction rules
- This policy should already be enabled by the security baseline. Then, click the âShowâ option next to âSee the state for each ASR ruleâ. You will see 13 lines there. Add these 3 lines:
56a863a9-875e-4185-98a7-b882c64b5ce5
d1e49aac-8f56-4280-b9ba-993a6d77406c
01443614-cd74-433a-b99e-2ecdc07bfc25
-
Then, change the value of all 16 lines from 1 to 6. These rules warn you when you are about to perform an action that may infect your PC. You can only continue to execute the potentially dangerous operation if you click âallowâ.
-
Securing your Intel CPU:
-
If your CPU is Intel, execute the following commands in an administrator command prompt or PowerShell:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 72 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v RetsPredictedFromRsbOnly /t REG_DWORD /d 1 /f
-
These settings may slow down your PC a bit but will make your PC more secure against some CPU exploits.
-
Some more recommended settings:
-
Open the command prompt as an administrator.
-
Execute the following commands:
setx /M MP_FORCE_USE_SANDBOX 1
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config" /v EnableCertPaddingCheck /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" /v EnableCertPaddingCheck /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\OLELinkConversionFromOLESTREAMToIStorage" /v Disabled /t REG_DWORD /d 1 /f
Below are what the commands do:
setx /M MP_FORCE_USE_SANDBOX 1
- This command sets the environment variable
MP_FORCE_USE_SANDBOXto1.
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 0 /f
- This command disables the
LocalAccountTokenFilterPolicy.
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f
- This command disables the
DisableRestrictedAdminpolicy.
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\Config" /v EnableCertPaddingCheck /t REG_DWORD /d 1 /f
- This command enables the
EnableCertPaddingCheckpolicy.
reg add "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config" /v EnableCertPaddingCheck /t REG_DWORD /d 1 /f
- This command enables the
EnableCertPaddingCheckpolicy for 32-bit applications on 64-bit platforms.
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\OLELinkConversionFromOLESTREAMToIStorage" /v Disabled /t REG_DWORD /d 1 /f
- This command disables the
OLELinkConversionFromOLESTREAMToIStoragepolicy.
Windows privacy
- Just like the Windows security baselines you can apply the Windows Restricted Traffic Limited Functionality Baseline, however, not all settings within this baseline are recommended. Which settings to apply and not to apply is a work in progress for me. We will need more discussion on this matter.
