Windows安全基线加固-无SMB配置-无NTP配置脚本

详情见脚本内容，可自行修改
主要涉及如下安全加固内容：
1.账号安全
2.密码安全
3.系统日志
4.认证审核
5.网络安全
6.注册表安全
7.系统安全
8远程安全

SMB及NTP脚本在我另外一篇文章运维小脚本里面
https://blog.csdn.net/qq_35700085/article/details/128247802?spm=1001.2014.3001.5501

:: 账号安全
@prompt # 
echo [version] >account.inf
echo signature="$CHICAGO$" >>account.inf
echo [System Access] >>account.inf
REM 修改帐户密码最小长度为14
echo MinimumPasswordLength=14 >>account.inf
REM 开启帐户密码复杂性要求
echo PasswordComplexity=1 >>account.inf
REM 修改帐户密码最长留存期为90天
echo MaximumPasswordAge=90 >>account.inf
REM 修改强制密码历史为5次
echo PasswordHistorySize=5 >>account.inf
REM 禁用Guest帐户
echo EnableGuestAccount=0 >>account.inf
REM 设定帐户锁定阀值为6次
echo LockoutBadCount=6 >>account.inf
REM 账户锁定时间
echo ResetLockoutCount=30 >>account.inf
REM 复位账户锁定计数器
echo LockoutDuration=30 >>account.inf
secedit /configure /db account.sdb /cfg account.inf /log account.log /quiet
del account.*

:: 系统日志
@prompt # 
echo [version] >logcfg.inf
echo signature="$CHICAGO$" >>logcfg.inf
REM 设置系统日志
echo [System Log] >>logcfg.inf
REM 设置系统日志文件最大8192KB
echo MaximumLogSize=8192 >>logcfg.inf
REM 设置当达到最大的日志尺寸时按需要改写事件
echo AuditLogRetentionPeriod=0 >>logcfg.inf
REM 设置限制GUEST访问应用日志
echo RestrictGuestAccess=1 >>logcfg.inf
REM 设置安全日志
echo [Security Log] >>logcfg.inf
REM 设置安全日志文件最大8192KB
echo MaximumLogSize=8192 >>logcfg.inf 
REM 设置当达到最大的日志尺寸时按需要改写事件
echo AuditLogRetentionPeriod=0 >>logcfg.inf
REM 设置限制GUEST访问安全日志
echo RestrictGuestAccess=1 >>logcfg.inf
REM 设置应用程序日志
echo [Application Log] >>logcfg.inf
REM 设置应用程序日志文件最大8192KB
echo MaximumLogSize=8192 >>logcfg.inf
REM 设置当达到最大的日志尺寸时按需要改写事件
echo AuditLogRetentionPeriod=0 >>logcfg.inf
REM 设置限制GUEST访问应用程序日志
echo RestrictGuestAccess=1 >>logcfg.inf
secedit /configure /db logcfg.sdb /cfg logcfg.inf /log logcfg.log
del logcfg.*

:: 认证安全
REM 禁用SCENoApplyLegacyAuditPolicy
@echo Windows Registry Editor Version 5.00>>aud.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]>>aud.reg
@echo "SCENoApplyLegacyAuditPolicy"=dword:00000000>>aud.reg
@regedit /s aud.reg
@del aud.reg
@prompt # 
echo [version] >audit.inf
echo signature="$CHICAGO$" >>audit.inf
echo [Event Audit] >>audit.inf
REM 开启审核系统事件
echo AuditSystemEvents=3 >>audit.inf
REM 开启审核对象访问
echo AuditObjectAccess=3 >>audit.inf
REM 开启审核特权使用
echo AuditPrivilegeUse=3 >>audit.inf
REM 开启审核策略更改
echo AuditPolicyChange=3 >>audit.inf
REM 开启审核帐户管理
echo AuditAccountManage=3 >>audit.inf
REM 开启审核进程跟踪
echo AuditProcessTracking=3 >>audit.inf
REM 开启审核目录服务访问
echo AuditDSAccess=3 >>audit.inf
REM 开启审核登录事件
echo AuditLogonEvents=3 >>audit.inf
REM 开启审核帐户登录事件
echo AuditAccountLogon=3 >>audit.inf
echo AuditLog >>audit.inf
secedit /configure /db audit.sdb /cfg audit.inf /log audit.log /quiet
del audit.*

:: 权限设置
@prompt #
REM 授权配置
echo [version] >rightscfg.inf
echo signature="$CHICAGO$" >>rightscfg.inf
echo [Privilege Rights] >>rightscfg.inf
REM 从远端系统强制关机只指派给Administrators组
echo seremoteshutdownprivilege=Administrators >>rightscfg.inf
REM 关闭系统仅指派给Administrators组
echo seshutdownprivilege=Administrators >>rightscfg.inf
REM 取得文件或其它对象的所有权仅指派给Administrators
echo setakeownershipprivilege=Administrators >>rightscfg.inf
REM 在本地登陆权限仅指派给Administrators
echo seinteractivelogonright=Administrators >> rightscfg.inf
REM 只允许Administrators从网络访问
REM echo senetworklogonright=Administrators >>rightscfg.inf
secedit /configure /db rightscfg.sdb /cfg rightscfg.inf /log rightscfg.log /quiet
del rightscfg.*

REM 禁用匿名访问命名管道和共享
@echo Windows Registry Editor Version 5.00>>nss.reg
@echo [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters]>>nss.reg
@echo "NullSessionShares"=->>nss.reg
@regedit /s nss.reg
@del nss.reg
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters" /v NullSessionShares /t REG_MULTI_SZ /d "" /f

REM 禁用可远程访问的注册表路径和子路径
@echo Windows Registry Editor Version 5.00>>aep.reg
@echo [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths]>>aep.reg
@echo "Machine"=->>aep.reg
@echo [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths]>>aep.reg
@echo "Machine"=->>aep.reg
@regedit /s aep.reg
@del aep.reg
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths" /v Machine /t REG_MULTI_SZ /d "" /f
reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths" /v Machine /t REG_MULTI_SZ /d "" /f

REM 修改自动登录的注册表
@echo Windows Registry Editor Version 5.00>>auto.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]>>auto.reg
@echo "AutoAdminLogon"=dword:0>>auto.reg
@regedit /s auto.reg
@del auto.reg

REM 源路由配置 欺骗保护
@echo Windows Registry Editor Version 5.00>>route.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]>>route.reg
@echo "DisableIPSourceRouting"=dword:2>>route.reg
@regedit /s route.reg
@del route.reg

REM 启用TCP最大传输单元（MTU）大小自动探测 碎片攻击保护
@echo Windows Registry Editor Version 5.00>>sp.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]>>sp.reg
@echo "EnablePMTUDiscovery"=dword:0>>sp.reg
@regedit /s sp.reg
@del sp.reg

REM SYN攻击保护
@prompt # 
@echo Windows Registry Editor Version 5.00>>SynAttack.reg 
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]>>SynAttack.reg
REM 启用SYN攻击保护
@echo "SynAttackProtect"=dword:2>>SynAttack.reg
REM 设定TCP连接请求阈值:5
@echo "TcpMaxPortsExhausted"=dword:5>>SynAttack.reg
REM 设定处于SYN_RCVD 状态下的 TCP 连接阈值:500
@echo "TcpMaxHalfOpen"=dword:500>>SynAttack.reg
REM 设定处于SYN_RCVD 状态下，且至少已经进行了一次重新传输的TCP连接阈值:400
@echo "TcpMaxHalfOpenRetried"=dword:400>>SynAttack.reg
REM 设定取消尝试响应 SYN 请求之前要重新传输 SYN-ACK 的次数:2
@echo "TcpMaxConnectResponseRetransmissions"=dword:2>>SynAttack.reg

REM DDOS 在收到 ICMP 重定向数据包时禁止创建高成本的主机路由
@echo "EnableICMPRedirect"=dword:0>>SynAttack.reg

@regedit /s SynAttack.reg
@del SynAttack.reg

REM 限制IPC共享（禁止SAM帐户和共享的匿名枚举）
@echo Windows Registry Editor Version 5.00>>ipc.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]>>ipc.reg
@echo "RestrictAnonymous"=dword:1>>ipc.reg
@echo "restrictanonymoussam"=dword:1>>ipc.reg
@regedit /s ipc.reg
@del ipc.reg

REM 启用屏幕保护程序
@echo Windows Registry Editor Version 5.00>>scrsave.reg 
@echo [HKEY_CURRENT_USER\Control Panel\Desktop]>>scrsave.reg 
@echo "ScreenSaveActive"="1">>scrsave.reg
@echo "ScreenSaverIsSecure"="1">>scrsave.reg
@echo "ScreenSaveTimeOut"="900">>scrsave.reg
@regedit /s scrsave.reg
@del scrsave.reg

REM “Microsoft网络服务器”设置为“在挂起会话之前所需的空闲时间”为15分钟
@echo Windows Registry Editor Version 5.00>>lanmanautodisconn.reg 
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]>>lanmanautodisconn.reg 
@echo "autodisconnect"=dword:0000000f>>lanmanautodisconn.reg 
@regedit /s lanmanautodisconn.reg
@del lanmanautodisconn.reg

REM 关闭自动播放
@reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun /f
@reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
@echo Windows Registry Editor Version 5.00>>closeautorun.reg
@echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]>>closeautorun.reg
@echo. >>closeautorun.reg
@echo "NoDriveTypeAutoRun"=dword:000000ff>>closeautorun.reg
@regedit /s closeautorun.reg
@del closeautorun.reg

:: 网络安全
ECHO ON
REM WEB安全
echo> web.reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
echo>>web.reg "SynAttackProtect"=dword:1
echo>>web.reg "DisableIPSourceRouting"=dword:2
echo>>web.reg "TcpMaxConnectResponseRetransmissions"=dword:2
regedit /s web.reg
del web.reg

:: 修改远程桌面默认端口
@prompt #
@echo off
reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp" /v PortNumber /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp" /v PortNumber /t REG_DWORD /d 4488 /f
reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 4488 /f
REM 增加防火墙RDP规则
netsh advfirewall firewall add rule name="RDP-4488" protocol=TCP dir=in localport=4488 action=allow
netsh advfirewall firewall add rule name="RDP-4488" protocol=TCP dir=out localport=4488 action=allow

:: 关闭ipv6
@echo Windows Registry Editor Version 5.00>>ipv6.reg 
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters]>>ipv6.reg 
@echo "DisabledComponents"=dword:ffffffff>>ipv6.reg 
@regedit /s ipv6.reg
@del ipv6.reg

:: 关闭风险服务
::关闭Remote Access Connection Manager服务
sc stop RasMan
sc config RasMan start= disabled
echo 关闭Remote Access Connection服务成功
::关闭Message Queuing服务
sc stop MSMQ
sc config MSMQ start= disabled
echo 关闭Message Queuing服务成功
REM ::关闭DHCP Server服务
REM sc stop DHCPServer
REM sc config DHCPServer start= disabled
REM echo 关闭DHCPServer服务成功
REM ::关闭DHCP Client服务
REM sc stop Dhcp
REM sc config Dhcp start= disabled
REM echo 关闭Dhcp服务成功
::关闭SMTP服务
sc stop SMTP
sc config SMTP start= disabled
echo 关闭SMTP服务成功
::关闭WINS服务
sc stop WINS
sc config WINS start= disabled
echo 关闭WINS服务成功
::关闭simptcp服务
sc stop simptcp
sc config simptcp start= disabled
echo 关闭simptcp服务成功
::关闭SNMP服务
sc stop SNMP
sc config SNMP start= disabled
echo 关闭SNMP服务成功

::检查是否已开启数据DEP功能
bcdedit.exe/set {current} nx AlwaysOn
echo 开启数据DEP功能成功

::检查是否已开启UAC安全提示
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /f /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 5
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /f /v EnableLUA /t REG_DWORD /d 1
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /f /v PromptOnSecureDesktop /t REG_DWORD /d 0
echo 开启UAC安全提示成功

echo Update completed, press any key to exit...
pause >nul