-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathSecureWindows.bat
More file actions
312 lines (246 loc) · 19.6 KB
/
Copy pathSecureWindows.bat
File metadata and controls
312 lines (246 loc) · 19.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
Title Secure Windows Script
REM Remote Desktop
set /p Chk="Enable remote desktop (y/n)"
if %Chk%==y (
REM Enable
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v AllowTSConnections /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
reg ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 6969 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=yes
)
if %Chk%==n (
REM Disable
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v AllowTSConnections /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fAllowToGetHelp /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\RemoteDesktop" /v "Enabled" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=no
netsh advfirewall firewall set service type = remotedesktop mode = disable
sc config iphlpsvc start= disabled >> nul 2>&1
sc stop iphlpsvc >> nul 2>&1
sc config umrdpservice start= disabled >> nul 2>&1
sc stop umrdpservice >> nul 2>&1
sc config termservice start= disabled >> nul 2>&1
sc stop termservice >> nul 2>&1
)
set loca=%~dp0
reg add "HKLM\SYSTEM\ControlSet001\Control\Remote Assistance" /V CreateEncryptedOnlyTickets /T REG_DWORD /D 1 /F >> nul 2>&1
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /V fDisableEncryption /T REG_DWORD /D 0 /F >> nul 2>&1
reg add "HKLM\SYSTEM\ControlSet001\Control\Remote Assistance" /V fAllowFullControl /T REG_DWORD /D 0 /F >> nul 2>&1
reg add "HKLM\SYSTEM\ControlSet001\Control\Remote Assistance" /V fAllowToGetHelp /T REG_DWORD /D 0 /F >> nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /V AllowRemoteRPC /T REG_DWORD /D 0 /F >> nul 2>&1
netsh advfirewall firewall set multicastbroadcastresponse disable
netsh advfirewall firewall set multicastbroadcastresponse mode=disable profile=all
setx PATH "%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\"
REM Disable Guest Account
net user Guest /active:no
REM Disable Administrator Account
net user Administrator /active:no
REM Turn on Firewall
netsh advfirewall set allprofiles state on
REM account password policy set
net accounts /FORCELOGOFF:30 /MINPWLEN:8 /MAXPWAGE:30 /MINPWAGE:2 /UNIQUEPW:24 /lockoutwindow:30 /lockoutduration:10 /lockoutthreshold:10
REM Stop Sharing C Drive
net share C:\ /delete
REM Enables DEP
bcdedit.exe /set {current} nx AlwaysOn
REM Turns on Auditing.
auditpol /set /category:* /success:enable
auditpol /set /category:* /failure:enable
Set-AuditPolicy -Policy "'Credential Validation'" -Success "enable" -Failure "enable"
Set-AuditPolicy -Policy "'Application Group Management'" -Success "enable" -Failure "enable"
Set-AuditPolicy -Policy "'Computer Account Management'" -Success "enable" -Failure "enable"
REM Flush DNS
ipconfig /flushdns
REM Writing over the hosts file
attrib -r -s C:\WINDOWS\system32\drivers\etc\hosts
echo > C:\Windows\System32\drivers\etc\hosts
attrib +r +s C:\WINDOWS\system32\drivers\etc\hosts
REM Get All The Profiles
netsh advfirewall set Domainprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set Domainprofile logging maxfilesize 20000
netsh advfirewall set Privateprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set Privateprofile logging maxfilesize 20000
netsh advfirewall set Publicprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set Publicprofile logging maxfilesize 20000
netsh advfirewall set Publicprofile logging droppedconnections enable
netsh advfirewall set Publicprofile logging allowedconnections enable
netsh advfirewall set currentprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set currentprofile logging maxfilesize 4096
netsh advfirewall set currentprofile logging droppedconnections enable
netsh advfirewall set currentprofile logging allowedconnections enable
REM Delete Startup folders
for /d %%D in (C:\Users\*) do for %%F in ("%%~fD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*") do del /F /Q "%%~fF"
del /F /Q "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*"
del /F /Q "C:\autoexec.bat"
REM Deletes Scripts
del /F /Q C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup
del /F /Q C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Shutdown
del /F /Q C:\WINDOWS\System32\GroupPolicy\User\Scripts\Logon
del /F /Q C:\WINDOWS\System32\GroupPolicy\User\Scripts\Logoff
Del /S /F /Q %temp%
Del /S /F /Q %Windir%\Temp
REM Turns on UAC
reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f
REM UAC
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /V ConsentPromptBehaviorAdmin /T REG_DWORD /D 1 /F >> nul 2>&1
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /V ConsentPromptBehaviorUser /T REG_DWORD /D 0 /F >> nul 2>&1
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /V FilterAdministratorToken /T REG_DWORD /D 1 /F >> nul 2>&1
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /V EnableVirtualization /T REG_DWORD /D 1 /F >> nul 2>&1
REM Lock Screen Stuff
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization /v NoLockScreenCamera /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization /v NoLockScreenSlideshow /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v AllowInputPersonalization /T REG_DWORD /D 0 /F
REM Firewall
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile /V EnableFirewall /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile /V EnableFirewall /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile /V EnableFirewall /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile /V DefaultInboundAction /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile /V DefaultInboundAction /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile /V DefaultInboundAction /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile /V DefaultOutboundAction /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile /V DefaultOutboundAction /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile /V DefaultOutboundAction /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile /V DisableNotifications /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile /V DisableNotifications /T REG_DWORD /D 1 /F
reg add HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile /V DisableNotifications /T REG_DWORD /D 1 /F
REM Disable tailored experiences
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy" /v "TailoredExperiencesWithDiagnosticDataEnabled" /t REG_DWORD /d 0 /f
echo Cleaning startup files
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /VA /F >> nul 2>&1
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /VA /F >> nul 2>&1
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /VA /F >> nul 2>&1
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /VA /F >> nul 2>&1
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /V ctfmon /T REG_SZ /D C:\Windows\System32\ctfmon.exe /F >> nul 2>&1
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer /V NoDriveTypeAutorun /T REG_DWORD /D 255 /F >> nul 2>&1
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer /V NoDriveTypeAutorun /T REG_DWORD /D 255 /F >> nul 2>&1
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer /V NoAutorun /T REG_DWORD /D 1 /F >> nul 2>&1
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer /V NoAutorun /T REG_DWORD /D 1 /F >> nul 2>&1
REM Windows automatic updates
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /t REG_DWORD /d 1 /f
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 4 /f
REM Enable Auto Updates Download and install
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions /t REG_DWORD /d 4 /f
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v ElevateNonAdmins /t REG_DWORD /d 0 /f
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWindowsUpdate /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWindowsUpdate /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\Internet Communication Management\Internet Communication" /v DisableWindowsUpdateAccess /t REG_DWORD /d 0 /f
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate /v DisableWindowsUpdateAccess /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate /v DisableWindowsUpdateAccess /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /V IncludeRecommendedUpdates /T REG_DWORD /D 1 /F >> nul 2>&1
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /V ScheduledInstallTime /T REG_DWORD /D 22 /F >> nul 2>&1
REM NTP server to pool.ntp.org
reg add "HKLM\SOFTWARE\Policies\Microsoft\W32time\Parameters" /v "NtpServer" /t REG_SZ /d "pool.ntp.org,0x8" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\W32time\Parameters" /v "Type" /t REG_SZ /d "NTP" /f
REM Windows Explorer Settings
reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /V HideFileExt /T REG_DWORD /D 0 /F >> nul 2>&1
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt" /v "CheckedValue" /t REG_DWORD /d 0 /f
reg ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 1 /F
REM Disable Dump file creation
reg ADD HKLM\SYSTEM\CurrentControlSet\Control\CrashControl /v CrashDumpEnabled /t REG_DWORD /d 0 /f
REM Disable Autorun
reg ADD HKCU\SYSTEM\CurrentControlSet\Services\CDROM /v AutoRun /t REG_DWORD /d 1 /f
reg ADD HKLM\SYSTEM\CurrentControlSet\Services\CDROM /v AutoRun /t REG_DWORD /d 1 /f
REM Disable sticky keys
reg ADD "HKU\.DEFAULT\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
REM Enable Windows Defender.
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableHeuristics" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "ScanWithAntiVirus" /t REG_DWORD /d 3 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "CheckForSignaturesBeforeRunningScan" /t REG_DWORD /d 1 /f
REM Configure Windows Defender.
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpynetReporting" /t REG_DWORD /d 0 /f
REM Disable picture passwords.
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "BlockDomainPicturePassword" /t REG_DWORD /d 1 /f
REM Disable Windows Update deferrals.
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferFeatureUpdates" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferQualityUpdates" /t REG_DWORD /d 0 /f
REM Disable Cortana
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCloudSearch" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortana" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortanaAboveLock" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowSearchToUseLocation" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchUseWeb" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "DisableWebSearch" /t REG_DWORD /d 1 /f
REM Force enable Data Execution Prevention (DEP).
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "NoDataExecutionPrevention" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "DisableHHDEP" /t REG_DWORD /d 0 /f
REM Prevent print driver installs
reg ADD "HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers" /v AddPrinterDrivers /t REG_DWORD /d 1 /f
REM Disable driveAutorun.
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoAutorun" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
REM Limit local account use of blank passwords to console
reg ADD "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LimitBlankPasswordUse /t REG_DWORD /d 1 /f
REM Restrict CD ROM drive
reg ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AllocateCDRoms /t REG_DWORD /d 1 /f
REM Automatic Admin logon
reg ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_DWORD /d 0 /f
echo pref("general.config.obscure_value", 0); // only needed if you do not want to obscure the content with ROT-13 > "C:\Program Files (x86)\Mozilla Firefox\defaults\pref\local-settings.js"
echo pref("general.config.filename", "mozilla.cfg"); >> "C:\Program Files (x86)\Mozilla Firefox\defaults\pref\local-settings.js"
echo pref("general.config.obscure_value", 0); // only needed if you do not want to obscure the content with ROT-13 > "C:\Program Files\Mozilla Firefox\defaults\pref\local-settings.js"
echo pref("general.config.filename", "mozilla.cfg"); >> "C:\Program Files\Mozilla Firefox\defaults\pref\local-settings.js"
REM Sets Custom Mozilla config
copy /Y "%~dp0BlankTemplates\Basic\mozilla.cfg" "C:\Program Files (x86)\Mozilla Firefox\mozilla.cfg"
copy /Y "%~dp0BlankTemplates\Basic\mozilla.cfg" "C:\Program Files\Mozilla Firefox\mozilla.cfg"
CD /D C:
dism /online /disable-feature /featurename:TFTP
dism /online /disable-feature /featurename:TelnetClient
dism /online /disable-feature /featurename:TelnetServer
dism /online /disable-feature /featurename:"SMB1Protocol"
REM Stopping Services. "How Many?" Yes.
set servicesD=SysMain seclogon TapiSrv p2pimsvc simptcp fax Msftpsvc iprip ftpsvc RasAuto W3svc Smtpsvc Dfs TrkWks MSDTC ERSvc NtFrs Iisadmin IsmServ WmdmPmSN helpsvc Spooler RDSessMgr RSoPProv SCardSvr Sacsvr TermService uploadmgr VDS VSS WINS CscService hidserv IPBusEnum PolicyAgent SCPolicySvc SharedAccess SSDPSRV Themes upnphost nfssvc nfsclnt MSSQLServerADHelper UmRdpService SessionEnv Server TeamViewer TeamViewer7 HomeGroupListener HomeGroupProvider AxInstSV AXInstSV Netlogon lltdsvc iphlpsvc AdobeARMservice tlntsvr msftpsvc snmptrap ssdpsrv termservice sessionenv Messenger upnphos WAS RemoteAccess mnmsrvc NetTcpPortSharing RasMan TabletInputService RpcSs SENS EventSystem XblAuthManager XblGameSave XboxGipSvc xboxgip xbgm wecsvc WerSvc PNRPAutoReg MSiSCSI wercplsupport PNRPsvc dmwappushservice DiagTrack DNS ERSVC RetailDemo WinRM WMPNetworkSvc HTTPFilter IISADMIN MSFTPSVC MSFtpsvc RPCLocator RsoPProv SMTPSVC SZCSVC bthserv mcx2svc telnet MapsBroker Browser lfsvc bthhfsrv irmon xblauthmanager xblgamesave xboxnetapisvc LxssManager ScardSvr ICS icscvc ShellHWDetection Telephony Tlntsvr Uploadmgr W3SVC WinHttpAutoProxySvc p2psvc SNMP WMSvc
set servicesM=dmserver SrvcSurg
set servicesG=Dhcp Dnscache NtLmSsp eventlog mpssvc wuauserv EventLog MpsSvc WinDefend WdNisSvc Sense Schedule SCardSvr ScDeviceEnum SCPolicySvc wscsvc
for %%a in (%servicesD%) do (
sc stop "%%a"
sc config "%%a" start= disabled
)
for %%b in (%servicesM%) do (
sc config "%%b" start= demand
)
for %%c in (%servicesG%) do (
sc config "%%c" start= auto
)
REM Services that are an automatic (delayed) start.
for %%S in (windefend,sppsvc,wuauserv) do (
sc config %%S start= delayed-auto >> nul 2>&1
sc start %%S >> nul 2>&1
)
sc delete DiagTrack
sc delete dmwappushservice
REM Disabling Windows Features
set features=IIS-WebServerRole IIS-CommonHttpFeatures IIS-HttpErrors IIS-HttpRedirect IIS-ApplicationDevelopment IIS-NetFxExtensibility IIS-NetFxExtensibility45 IIS-HealthAndDiagnostics IIS-HttpLogging IIS-LoggingLibraries IIS-RequestMonitor IIS-HttpTracing IIS-Security IIS-URLAuthorization IIS-RequestFiltering IIS-IPSecurity IIS-Performance IIS-HttpCompressionDynamic IIS-WebServerManagementTools IIS-ManagementScriptingTools IIS-IIS6ManagementCompatibility IIS-Metabase IIS-HostableWebCore IIS-StaticContent IIS-DefaultDocument IIS-DirectoryBrowsing IIS-WebDAV IIS-WebSockets IIS-ApplicationInit IIS-ASPNET IIS-ASPNET45 IIS-ASP IIS-CGI IIS-ISAPIExtensions IIS-ISAPIFilter IIS-ServerSideIncludes IIS-CustomLogging IIS-BasicAuthentication IIS-HttpCompressionStatic IIS-ManagementConsole IIS-ManagementService IIS-WMICompatibility IIS-LegacyScripts IIS-LegacySnapIn IIS-FTPServer IIS-FTPSvc IIS-FTPExtensibility TFTP TelnetClient TelnetServer
for %%a in (%features%) do dism /online /NoRestart /disable-feature /featurename:%%a
attrib -h -r -s %windir%\system32\catroot2
attrib -h -r -s %windir%\system32\catroot2\*.*
net stop wuauserv
net stop CryptSvc
net stop BITS
ren %windir%\system32\catroot2 catroot2.old
ren %windir%\SoftwareDistribution sold.old
ren "%ALLUSERSPROFILE%\application data\Microsoft\Network\downloader" downloader.old
net Start BITS
net start CryptSvc
net start wuauserv
reg.exe ADD HKCU\Software\Sysinternals /v EulaAccepted /t REG_DWORD /d 1 /f
reg.exe ADD HKU\.DEFAULT\Software\Sysinternals /v EulaAccepted /t REG_DWORD /d 1 /f
REM Searches for Rootkits
gpupdate /force
powershell Invoke-WebRequest -OutFile MBRTKit.exe https://data-cdn.mbamupdates.com/web/mbar-1.10.3.1001.exe
MBRTKit.exe
sc config trustedinstaller start= auto
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow