Damien Coles
f172d00514
Infrastructure-as-code framework for Active Directory objects and Group Policy. Sanitized from production deployment for public sharing.
116 lines
3.9 KiB
Markdown
116 lines
3.9 KiB
Markdown
# Servers-01 GPO
|
|
|
|
Server hardening policy for domain-joined servers in the ExampleServers OU.
|
|
|
|
## Linked To
|
|
|
|
`OU=ExampleServers,DC=example,DC=internal`
|
|
|
|
## Design
|
|
|
|
Full audit, logging, and hardening baseline for servers. Compared to Workstations-01:
|
|
|
|
- **Full audit coverage** -- every category audits both success and failure, including process tracking and DS access
|
|
- **PowerShell transcription** -- complete session recording to `C:\PSlogs\Transcripts`
|
|
- **Module logging** -- all PowerShell modules logged
|
|
- **Command line in process creation** -- Event ID 4688 includes full command line
|
|
- **Larger event logs** -- 64/256 MB (matches AdminWorkstations-01)
|
|
- **Weekly updates** -- Sunday 3 AM instead of daily (minimize reboot disruption for services)
|
|
|
|
Compared to AdminWorkstations-01, this GPO does **not** include:
|
|
|
|
- `LocalAccountTokenFilterPolicy` (servers are not admin workstations)
|
|
- Defender exclusions for JetBrains (servers are not dev machines)
|
|
|
|
## WMI Filter
|
|
|
|
| Property | Value |
|
|
|---|---|
|
|
| Name | Member Servers Only |
|
|
| Query | `SELECT * FROM Win32_OperatingSystem WHERE ProductType = 3` |
|
|
|
|
Defense-in-depth: ensures this GPO only applies to member servers (ProductType 3), not domain controllers (ProductType 2) or workstations (ProductType 1).
|
|
|
|
## Restricted Groups
|
|
|
|
| Local Group | Enforced Members |
|
|
|---|---|
|
|
| BUILTIN\Administrators | Domain Admins, MasterAdmins |
|
|
|
|
Any locally-added administrator accounts are removed on next GPO refresh.
|
|
|
|
## Security Policy Settings (GptTmpl.inf)
|
|
|
|
### System Access
|
|
|
|
| Setting | Value | Effect |
|
|
|---|---|---|
|
|
| EnableGuestAccount | 0 | Local guest account disabled |
|
|
|
|
### Event Audit
|
|
|
|
| Setting | Value | Effect |
|
|
|---|---|---|
|
|
| AuditSystemEvents | 3 | Success + Failure |
|
|
| AuditLogonEvents | 3 | Success + Failure |
|
|
| AuditObjectAccess | 3 | Success + Failure |
|
|
| AuditPrivilegeUse | 3 | Success + Failure |
|
|
| AuditPolicyChange | 3 | Success + Failure |
|
|
| AuditAccountManage | 3 | Success + Failure |
|
|
| AuditProcessTracking | 3 | Success + Failure |
|
|
| AuditDSAccess | 3 | Success + Failure |
|
|
| AuditAccountLogon | 3 | Success + Failure |
|
|
|
|
### Registry Values (Security Options)
|
|
|
|
| Setting | Value | Effect |
|
|
|---|---|---|
|
|
| InactivityTimeoutSecs | 900 | Auto-lock after 15 minutes |
|
|
| DontDisplayLastUserName | 1 | Don't show last user at login screen |
|
|
| DisableCAD | 0 | Require Ctrl+Alt+Del |
|
|
|
|
## Registry Settings (Administrative Templates)
|
|
|
|
### Autorun / Autoplay
|
|
|
|
| Key | ValueName | Value | Effect |
|
|
|---|---|---|---|
|
|
| Policies\Explorer | NoDriveTypeAutoRun | 255 | Disable autorun on all drives |
|
|
| Policies\Explorer | NoAutorun | 1 | Disable autoplay |
|
|
|
|
### Windows Update
|
|
|
|
| Key | ValueName | Value | Effect |
|
|
|---|---|---|---|
|
|
| WindowsUpdate\AU | NoAutoUpdate | 0 | Enable automatic updates |
|
|
| WindowsUpdate\AU | AUOptions | 4 | Auto download + schedule install |
|
|
| WindowsUpdate\AU | ScheduledInstallDay | 1 | Sunday |
|
|
| WindowsUpdate\AU | ScheduledInstallTime | 3 | 3:00 AM |
|
|
|
|
### Logging & Auditing
|
|
|
|
| Key | ValueName | Value | Effect |
|
|
|---|---|---|---|
|
|
| PowerShell\ScriptBlockLogging | EnableScriptBlockLogging | 1 | Log all script blocks |
|
|
| PowerShell\Transcription | EnableTranscripting | 1 | Record full PS sessions |
|
|
| PowerShell\Transcription | OutputDirectory | C:\PSlogs\Transcripts | Transcript save location |
|
|
| PowerShell\Transcription | EnableInvocationHeader | 1 | Timestamp per command |
|
|
| PowerShell\ModuleLogging | EnableModuleLogging | 1 | Log all module activity |
|
|
| PowerShell\ModuleLogging\ModuleNames | * | * | All modules |
|
|
| System\Audit | ProcessCreationIncludeCmdLine_Enabled | 1 | Command line in Event 4688 |
|
|
|
|
### Event Log Sizes
|
|
|
|
| Log | Size | vs. Workstations-01 |
|
|
|---|---|---|
|
|
| Application | 64 MB | 2x |
|
|
| Security | 256 MB | ~1.3x |
|
|
| System | 64 MB | 2x |
|
|
| PowerShell | 64 MB | new |
|
|
|
|
### Remote Desktop
|
|
|
|
| Key | ValueName | Value | Effect |
|
|
|---|---|---|---|
|
|
| Terminal Services | UserAuthentication | 1 | Require NLA |
|