Windows 10 STIG Script

Download all the required files from the GitHub Repository

We are seeking help with the following .Net issue

Introduction:

Windows 10 is insecure operating system out of the box and requires many changes to insure FISMA compliance. Organizations like Microsoft, Cyber.mil, the Department of Defense, and the National Security Agency have recommended and required configuration changes to lockdown, harden, and secure the operating system and ensure government compliance. These changes cover a wide range of mitigations including blocking telemetry, macros, removing bloatware, and preventing many physical attacks on a system.

Standalone systems are some of the most difficult and annoying systems to secure. When not automated, they require manual changes of each STIG/SRG. Totalling over 1000 configuration changes on a typical deployment and an average of 5 minutes per change equaling 3.5 days worth of work. This script aims to speed up that process significantly.

Notes:

• This script is designed for operation in Enterprise environments and assumes you have hardware support for all the requirements.
  • For personal systems please see this GitHub Repository
• This script is not designed to bring a system to 100% compliance, rather it should be used as a stepping stone to complete most, if not all, the configuration changes that can be scripted.
  • Minus system documentation, this collection should bring you up to about 95% compliance on all the STIGS/SRGs applied.
• Bitlocker must be suspended prior to implementihdffdhfdng this script, it can be enabled again after rebooting.

Requirements:

• Windows 10 Enterprise is Required per STIG.
• Standards for a highly secure Windows 10 device
• System is fully up to date
  • Currently Windows 10 v1909 or v2004.
  • Run the Windows 10 Upgrade Assistant to be update and verify latest major release.
• Hardware Requirements
  • Hardware Requirements for Memory Integrity
  • Hardware Requirements for Windows Defender Application Guard
  • Hardware Requirements for Windows Defender Credential Guard

Recommended reading material:

• Hardware-based Isolation
• Memory integrity
• System Guard Root of Trust
• System Guard Secure Launch
• Windows Defender Application Guard
• Windows Defender Credential Guard

A list of scripts and tools this collection utilizes:

• Cyber.mil - Group Policy Objects
• Microsoft Security Compliance Toolkit 1.0
• NSACyber - Bitlocker Guidance

Additional configurations were considered from:

• Microsoft - Windows Defender Application Control
• NSACyber - Application Whitelisting Using Microsoft AppLocker
• NSACyber - Hardware-and-Firmware-Security-Guidance
• NSACyber - Windows Secure Host Baseline

STIGS/SRGs Applied:

• Adobe Reader Pro DC Classic V1R3
• Adobe Reader Pro DC Continous V1R2
• Firefox V4R29
• Google Chrome V1R19
• Internet Explorer 11 V1R19
• Microsoft .Net Framework 4 V1R9 - Work in Progress
• Microsoft Office 2013 V1R5
• Microsoft Office 2016 V1R2
• Microsoft Office 2019/Office 365 Pro Plus V1R2
• Microsoft OneDrive STIG V2R1
• Oracle JRE 8 V1R5
• Windows 10 V2R1
• Windows Defender Antivirus V2R1
• Windows Firewall V1R7

How to run the script

The script may be launched from the extracted GitHub download like this:

iex ((New-Object System.Net.WebClient).DownloadString('https://simeononsecurity.ch/scripts/standalonewindows.ps1'))

If manually downloaded, the script must be launched from the directory containing all the other files from the GitHub Repository