BCWHSendpoint.psm1
<#PSScriptInfo .VERSION 1.0 .GUID 0ddae3a4-4729-4df4-b929-216b29633b67 .AUTHOR WadeBach22 .COMPANYNAME .COPYRIGHT .TAGS .LICENSEURI .PROJECTURI .ICONURI .EXTERNALMODULEDEPENDENCIES .REQUIREDSCRIPTS .EXTERNALSCRIPTDEPENDENCIES .RELEASENOTES #> <# .DESCRIPTION Black Cat White Hit Security Presents Microsoft Windows Endpoint Security Module. Please view our website for more detailed information. #> Param() function BCWHSmod1On { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext" -Name 'VersionCheckEnabled' -Value 1; Write-Output "Block outdated ActiveX controls for Internet Explorer is set."; } function BCWHSmod1Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext" -Name 'VersionCheckEnabled' -Value 0; Write-Output "Block outdated ActiveX controls for Internet Explorer is reverted."; } function BCWHSmod2On { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutoplayfornonVolume' -Value 1; New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows" -Name 'Explorer' -Force; New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Explorer" -Name 'NoAutoplayfornonVolume' -Value 1; Write-Output "Disable Autoplay for non-volume devices is set."; } function BCWHSmod2Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutoplayfornonVolume' -Value 0; Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Explorer" -Name 'NoAutoplayfornonVolume' -Value 0; Write-Output "Disable Autoplay for non-volume devices is reverted."; } function BCWHSmod3On { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoDriveTypeAutoRun' -Value 255; Write-Output "Disable Autoplay for all drives is set."; } function BCWHSmod3Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoDriveTypeAutoRun' -Value 0; Write-Output "Disable Autoplay for all drives is reverted."; } function BCWHSmod4On { New-Item -Path "HKLM:\Software\Policies" -Name 'Google' -Force; New-Item -Path "HKLM:\Software\Policies\Google" -Name 'Chrome' -Force; New-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BackgroundModeEnabled' -Value 0; Write-Output "Disable Continue running background apps when Google Chrome is closed is set."; } function BCWHSmod4Off { Set-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BackgroundModeEnabled' -Value 1; Write-Output "Disable Continue running background apps when Google Chrome is closed is reverted."; } function BCWHSmod5On { New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" -Name 'CredUI' -Force; New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Name 'EnumerateAdministrators' -Value 0; Write-Output "Disable Enumerate administrator accounts on elevation is set."; } function BCWHSmod5Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Name 'EnumerateAdministrators' -Value 1; Write-Output "Disable Enumerate administrator accounts on elevation is reverted."; } function BCWHSmod6On { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name 'RestrictAnonymous' -Value 1; Write-Output "Disable Enumerate administrator accounts on elevation is set."; } function BCWHSmod6Off { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name 'RestrictAnonymous' -Value 0; Write-Output "Disable Enumerate administrator accounts on elevation is reverted."; } function BCWHSmod7On { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\" -Name 'DisableIPSourceRouting' -Value 2; Write-Output "Disable IP Source routing is set."; } function BCWHSmod7Off { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\" -Name 'DisableIPSourceRouting' -Value 0; Write-Output "Disable IP Source routing is reverted."; } function BCWHSmod8On { New-Item -Path "HKLM:\SOFTWARE\Policies\Adobe\" -Name 'Acrobat Reader' -Force; New-Item -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader" -Name 'DC' -Force; New-Item -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC" -Name 'FeatureLockDown' -Force; New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bDisableJavaScript' -Value 1; New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bEnableFlash' -Value 1; Write-Output "Disable JavaScript/Flash on Adobe Reader DC is set."; } function BCWHSmod8Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bDisableJavaScript' -Value 0; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bEnableFlash' -Value 0; Write-Output "Disable JavaScript/Flash on Adobe Reader DC is reverted."; } function BCWHSmod9On { New-Item -Path "HKLM:\Software\Policies\Microsoft" -Name 'WindowsFirewall' -Force; New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall" -Name 'DomainProfile' -Force; New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall" -Name 'PrivateProfile' -Force; New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall" -Name 'PublicProfile' -Force; New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile" -Name 'DisableNotifications' -Value 1; New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile" -Name 'DisableNotifications' -Value 1; New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile" -Name 'DisableNotifications' -Value 1; Write-Output "Disable Microsoft Defender Firewall notifications when programs are blocked for Domain/Public/Private profile is set."; } function BCWHSmod9Off { Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile" -Name 'DisableNotifications' -Value 0; Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile" -Name 'DisableNotifications' -Value 0; Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile" -Name 'DisableNotifications' -Value 0; Write-Output "Disable Microsoft Defender Firewall notifications when programs are blocked for Domain/Public/Private profile is reverted."; } function BCWHSmod10On { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\" -Name 'Internet Explorer' -Force; New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer" -Name 'Download' -Force; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Download\" -Name 'RunInvalidSignatures' -Value 0; Write-Output "Disable running or installing downloaded software with invalid signature is set."; } function BCWHSmod10Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Download\" -Name 'RunInvalidSignatures' -Value 1; Write-Output "Disable running or installing downloaded software with invalid signature is reverted."; } function BCWHSmod11On { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name 'LocalAccountTokenFilterPolicy' -Value 0; Write-Output "Enable Apply UAC restrictions to local accounts on network logons is set."; } function BCWHSmod11Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name 'LocalAccountTokenFilterPolicy' -Value 1; Write-Output "Enable Apply UAC restrictions to local accounts on network logons is reverted."; } function BCWHSmod12On { New-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BlockThirdPartyCookies' -Value 1; Write-Output "Enable Block third party cookies is set."; } function BCWHSmod12Off { Set-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BlockThirdPartyCookies' -Value 0; Write-Output "Enable Block third party cookies is reverted."; } function BCWHSmod13On { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name 'RequireSecuritySignature' -Value 1; Write-Output "Enable Microsoft network client: Digitally sign communications (always) is set."; } function BCWHSmod13Off { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name 'RequireSecuritySignature' -Value 0; Write-Output "Enable Microsoft network client: Digitally sign communications (always) is reverted."; } function BCWHSmod14On { Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableEmailScanning' -Value 0; Write-Output "Enable Microsoft Defender Antivirus Email Scanning is set."; } function BCWHSmod14Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableEmailScanning' -Value 1; Write-Output "Enable Microsoft Defender Antivirus Email Scanning is reverted."; } function BCWHSmod15On { New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name 'Scan' -Force; New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableRemovableDriveScanning' -Value 0; Write-Output "Enable scanning of removable drives during a full scan is set."; } function BCWHSmod15Off { Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableRemovableDriveScanning' -Value 1; Write-Output "Enable scanning of removable drives during a full scan is reverted."; } function BCWHSmod16On { Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\cloud\office\16.0\common\officeupdate" -Name 'enableautomaticupdates' -Value 1; New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft" -Name 'Office' -Force; New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft\Office" -Name '16.0' -Force; New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0" -Name 'Common' -Force; New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common" -Name 'Officeupdate' -Force; New-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'hideenabledisableupdates' -Value 1; New-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'enableautomaticupdates' -Value 1; Write-Output "Hide Option & Enable Automatic Updates is set."; } function BCWHSmod16Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\cloud\office\16.0\common\officeupdate" -Name 'enableautomaticupdates' -Value 0; Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'hideenabledisableupdates' -Value 0; Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'enableautomaticupdates' -Value 0; Write-Output "Hide Option & Enable Automatic Updates is reverted."; } function BCWHSmod17On { Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" -Name 'NC_ShowSharedAccessUI' -Value 0; Write-Output "Prohibit use of Internet Connection Sharing on your DNS domain network is set."; } function BCWHSmod17Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" -Name 'NC_ShowSharedAccessUI' -Value 1; Write-Output "Prohibit use of Internet Connection Sharing on your DNS domain network is reverted."; } function BCWHSmod18On { net accounts /lockoutduration:15; Write-Output "Set Account lockout duration to 15 minutes or more is set."; } function BCWHSmod18Off { Write-Output "Set Account lockout duration to 15 minutes or more is unchanged."; } function BCWHSmod19On { net accounts /lockoutthreshold:10; Write-Output "Set Account lockout threshold to 1-10 invalid login attempts is set."; } function BCWHSmod19Off { Write-Output "Set Account lockout threshold to 1-10 invalid login attempts is unchanged."; } function BCWHSmod20On { net accounts /uniquepw:24; Write-Output "Set Enforce Password History to 24 or more password(s) is set."; } function BCWHSmod20Off { Write-Output "Set Enforce Password History to 24 or more password(s) is unchaanged."; } function BCWHSmod21On { New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" -Name 'InactivityTimeoutSecs' -PropertyType DWORD -Value 0x00000384 -Force; Write-Output "Set Interactive logon: Machine inactivity limit to 1-900 seconds is set."; } function BCWHSmod21Off { Write-Output "Set Interactive logon: Machine inactivity limit to 1-900 seconds is unchanged."; } function BCWHSmod22On { net accounts /minpwage:1; Write-Output "set Minimum Password Age to 1 or more day(s) is set."; } function BCWHSmod22Off { Write-Output "set Minimum Password Age to 1 or more day(s) is unchanged."; } function BCWHSmod23On { net accounts /lockoutwindow:15; Write-Output "Set Reset account lockout counter after to 15 minutes or more is set."; } function BCWHSmod23Off { Write-Output "Set Reset account lockout counter after to 15 minutes or more is unchanged."; } function BCWHSmod24On { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutorun' -Value 1; Write-Output "Set default behavior for AutoRun to Enabled: Do not execute any autorun commands is set."; } function BCWHSmod24Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutorun' -Value 0; Write-Output "Set default behavior for AutoRun to Enabled: Do not execute any autorun commands is reverted."; } function BCWHSmod25On { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\" -Name 'DisableIPSourceRouting' -Value 2; Write-Output "Set IPV6 source routing to highest protection is set."; } function BCWHSmod25Off { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\" -Name 'DisableIPSourceRouting' -Value 0; Write-Output "Set IPV6 source routing to highest protection is reverted."; } function BCWHSmod26On { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" -Name 'LmCompatibilityLevel' -Value 5; Write-Output "Set LAN Manager authentication level to Send NTLMv2 response only. Refuse LM & NTLM is set."; } function BCWHSmod26Off { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" -Name 'LmCompatibilityLevel' -Value 3; Write-Output "Set LAN Manager authentication level to Send NTLMv2 response only. Refuse LM & NTLM is reverted."; } function BCWHSmod27On { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" -Name 'ConsentPromptBehaviorUser' -Value 0; Write-Output "Set User Account Control (UAC) to automatically deny elevation requests is set."; } function BCWHSmod27Off { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" -Name 'ConsentPromptBehaviorUser' -Value 3; Write-Output "Set User Account Control (UAC) to automatically deny elevation requests is reverted."; } function BCWHSallOn { BCWHSmod1On; BCWHSmod2On; BCWHSmod3On; BCWHSmod4On; BCWHSmod5On; BCWHSmod6On; BCWHSmod7On; BCWHSmod8On; BCWHSmod9On; BCWHSmod10On; BCWHSmod11On; BCWHSmod12On; BCWHSmod13On; BCWHSmod14On; BCWHSmod15On; BCWHSmod16On; BCWHSmod17On; BCWHSmod18On; BCWHSmod19On; BCWHSmod20On; BCWHSmod21On; BCWHSmod22On; BCWHSmod23On; BCWHSmod24On; BCWHSmod25On; BCWHSmod26On; BCWHSmod27On; } function BCWHSallOff { BCWHSmod1Off; BCWHSmod2Off; BCWHSmod3Off; BCWHSmod4Off; BCWHSmod5Off; BCWHSmod6Off; BCWHSmod7Off; BCWHSmod8Off; BCWHSmod9Off; BCWHSmod10Off; BCWHSmod11Off; BCWHSmod12Off; BCWHSmod13Off; BCWHSmod14Off; BCWHSmod15Off; BCWHSmod16Off; BCWHSmod17Off; BCWHSmod18Off; BCWHSmod19Off; BCWHSmod20Off; BCWHSmod21Off; BCWHSmod22Off; BCWHSmod23Off; BCWHSmod24Off; BCWHSmod25Off; BCWHSmod26Off; BCWHSmod27Off; } |