Server Hardening

(Page WIP)

Overview

Server Hardening is the process of preemptively patching any security vulnerabilities that may arise. This is done by a multiplicity of policy adjustments either manually or run through a script. Scripts act as a blanket when it comes to changing policy, its great for changing lots of different areas on different devices quickly. On the other hand, manual server hardening can be tedious, but gives you the scalpel to change device specific policies that you may want to be enacted. Server Hardening itself is a broad category itself as well, ranging from password policy to remote connection policy, to firewall policy. There isn't any "one size fits all" solutions either, you will have to make some changes depending on the current 24pin policy.

Windows

The Path to Password Policy in the GPO Editor

Windows is one of the most common OSes out there, and is the one you'll most likely find running a server. Its relatively easy to understand what each policy does, its just that with the sheer quantity of policy, it can be somewhat difficult to understand what the whole does.

Manual Server Hardening

Windows has plenty of menus to parse through, making manual adjustments much more of a chore than anything. To find the policy you need, it'll most likely be through Group Policy Management, from there you can edit the default domain policy, wherein everything would be applied to every computer. Though be warned, unless it's something simple like password policy, you won't find what you're looking for unless you know exactly where it is without spending the greater years of your life digging around for it.

Scripted Server Hardening

Scripts can be ran from an elevated PowerShell instance directly, or can be used to create an .MOF file. Ours can be copied and pased into PowerShell and it will create an .MOF.^[1] It may claim that you don't have the required PowerShell module, in that case it should give you the command to install it. If not the required commands are

• install-module AuditPolicyDSC
• install-module ComputerManagementDsc
• install-module SecurityPolicyDsc

If it still says that you're unable to install the modules, a workaround that I've found is to run the following command.

• [Net.ServicePointManager]::Security Protocol = [Net.SecurityProtocolType]::Tls12

Now with that all out of the way, you should have just created a .MOF file, now this MOF file isn't the endpoint. What we just did was compress that whole block of text into something readable by Windows PowerShell, why couldn't we just do it from the.txt file? I don't know ,but this way works so we're rolling with it. Next step will be to run that .MOF file that was just created.

• Start-DscConfiguration -Path .\Name of MOF -Force -Wait -Verbose

DscConfiguration will read the script and configure the policy listed in the .MOF file, -path will allow you to put in the path to the MOF, when the MOF is done compiling it should give you the path so make sure to write that down or remember it good. -Force will, well, force its way over any running commands. -Wait will wait for -Force to stop the running command before running the DscConfiguration command, and lastly -Verbose will generate a more detailed output.

References

Our Windows script for Server 2019[1]

Original Script & Scripts for Server 2016[2]