BCWHSendpoint

1.0

BCWHSendpoint.psm1


<#PSScriptInfo
 
.VERSION 1.0
 
.GUID 0ddae3a4-4729-4df4-b929-216b29633b67
 
.AUTHOR WadeBach22
 
.COMPANYNAME
 
.COPYRIGHT
 
.TAGS
 
.LICENSEURI
 
.PROJECTURI
 
.ICONURI
 
.EXTERNALMODULEDEPENDENCIES
 
.REQUIREDSCRIPTS
 
.EXTERNALSCRIPTDEPENDENCIES
 
.RELEASENOTES
 
 
#>

<#
 
.DESCRIPTION
 Black Cat White Hit Security Presents Microsoft Windows Endpoint Security Module. Please view our website for more detailed information.
 
#> 
Param()


function BCWHSmod1On {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext" -Name 'VersionCheckEnabled' -Value 1;
   Write-Output "Block outdated ActiveX controls for Internet Explorer is set.";
}

function BCWHSmod1Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext" -Name 'VersionCheckEnabled' -Value 0;
   Write-Output "Block outdated ActiveX controls for Internet Explorer is reverted.";
}

function BCWHSmod2On {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutoplayfornonVolume' -Value 1;
   New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows" -Name 'Explorer' -Force;
   New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Explorer" -Name 'NoAutoplayfornonVolume' -Value 1;
   Write-Output "Disable Autoplay for non-volume devices is set.";
}

function BCWHSmod2Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutoplayfornonVolume' -Value 0;
   Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Explorer" -Name 'NoAutoplayfornonVolume' -Value 0; 
   Write-Output "Disable Autoplay for non-volume devices is reverted.";
}

function BCWHSmod3On {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoDriveTypeAutoRun' -Value 255;
   Write-Output "Disable Autoplay for all drives is set.";
}

function BCWHSmod3Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoDriveTypeAutoRun' -Value 0;
   Write-Output "Disable Autoplay for all drives is reverted.";
}

function BCWHSmod4On {
   New-Item -Path "HKLM:\Software\Policies" -Name 'Google' -Force;
   New-Item -Path "HKLM:\Software\Policies\Google" -Name 'Chrome' -Force;
   New-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BackgroundModeEnabled' -Value 0;
   Write-Output "Disable Continue running background apps when Google Chrome is closed is set.";
}

function BCWHSmod4Off {
   Set-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BackgroundModeEnabled' -Value 1;
   Write-Output "Disable Continue running background apps when Google Chrome is closed is reverted.";
}

function BCWHSmod5On {
   New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" -Name 'CredUI' -Force;
   New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Name 'EnumerateAdministrators' -Value 0;
   Write-Output "Disable Enumerate administrator accounts on elevation is set.";
}

function BCWHSmod5Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI" -Name 'EnumerateAdministrators' -Value 1;
   Write-Output "Disable Enumerate administrator accounts on elevation is reverted.";
}

function BCWHSmod6On {
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name 'RestrictAnonymous' -Value 1;
   Write-Output "Disable Enumerate administrator accounts on elevation is set.";
}

function BCWHSmod6Off {
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name 'RestrictAnonymous' -Value 0; 
   Write-Output "Disable Enumerate administrator accounts on elevation is reverted.";
}

function BCWHSmod7On {
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\" -Name 'DisableIPSourceRouting' -Value 2;
   Write-Output "Disable IP Source routing is set.";
}

function BCWHSmod7Off {
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\" -Name 'DisableIPSourceRouting' -Value 0;
    Write-Output "Disable IP Source routing is reverted.";
}

function BCWHSmod8On {
   New-Item -Path "HKLM:\SOFTWARE\Policies\Adobe\" -Name 'Acrobat Reader' -Force;
   New-Item -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader" -Name 'DC' -Force;
   New-Item -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC" -Name 'FeatureLockDown' -Force;
   New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bDisableJavaScript' -Value 1;
   New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bEnableFlash' -Value 1;
   Write-Output "Disable JavaScript/Flash on Adobe Reader DC is set.";
}

function BCWHSmod8Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bDisableJavaScript' -Value 0;
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" -Name 'bEnableFlash' -Value 0;
   Write-Output "Disable JavaScript/Flash on Adobe Reader DC is reverted.";
}

function BCWHSmod9On {
   New-Item -Path "HKLM:\Software\Policies\Microsoft" -Name 'WindowsFirewall' -Force;
   New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall" -Name 'DomainProfile' -Force;
   New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall" -Name 'PrivateProfile' -Force;
   New-Item -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall" -Name 'PublicProfile' -Force;
   New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile" -Name 'DisableNotifications' -Value 1;
   New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile" -Name 'DisableNotifications' -Value 1;
   New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile" -Name 'DisableNotifications' -Value 1;
   Write-Output "Disable Microsoft Defender Firewall notifications when programs are blocked for Domain/Public/Private profile is set.";
}

function BCWHSmod9Off {
   Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile" -Name 'DisableNotifications' -Value 0;
   Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile" -Name 'DisableNotifications' -Value 0;
   Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile" -Name 'DisableNotifications' -Value 0;
   Write-Output "Disable Microsoft Defender Firewall notifications when programs are blocked for Domain/Public/Private profile is reverted.";
}
function BCWHSmod10On {
   New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\" -Name 'Internet Explorer' -Force;
   New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer" -Name 'Download' -Force;
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Download\" -Name 'RunInvalidSignatures' -Value 0;
   Write-Output "Disable running or installing downloaded software with invalid signature is set.";
}
function BCWHSmod10Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Download\" -Name 'RunInvalidSignatures' -Value 1;
   Write-Output "Disable running or installing downloaded software with invalid signature is reverted.";
}
function BCWHSmod11On {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name 'LocalAccountTokenFilterPolicy' -Value 0;
   Write-Output "Enable Apply UAC restrictions to local accounts on network logons is set.";
}

function BCWHSmod11Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name 'LocalAccountTokenFilterPolicy' -Value 1; 
   Write-Output "Enable Apply UAC restrictions to local accounts on network logons is reverted."; 
}

function BCWHSmod12On {
   New-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BlockThirdPartyCookies' -Value 1;
   Write-Output "Enable Block third party cookies is set.";
}

function BCWHSmod12Off {
   Set-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome" -Name 'BlockThirdPartyCookies' -Value 0;
   Write-Output "Enable Block third party cookies is reverted.";
}

function BCWHSmod13On {
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name 'RequireSecuritySignature' -Value 1;
   Write-Output "Enable Microsoft network client: Digitally sign communications (always) is set.";
}

function BCWHSmod13Off {
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name 'RequireSecuritySignature' -Value 0;
   Write-Output "Enable Microsoft network client: Digitally sign communications (always) is reverted.";
}
function BCWHSmod14On {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableEmailScanning' -Value 0;
   Write-Output "Enable Microsoft Defender Antivirus Email Scanning is set.";
}
function BCWHSmod14Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableEmailScanning' -Value 1;
   Write-Output "Enable Microsoft Defender Antivirus Email Scanning is reverted.";
}
function BCWHSmod15On {
   New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows Defender" -Name 'Scan' -Force;
   New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableRemovableDriveScanning' -Value 0;
   Write-Output "Enable scanning of removable drives during a full scan is set.";
}

function BCWHSmod15Off {
   Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\Scan" -Name 'DisableRemovableDriveScanning' -Value 1;
   Write-Output "Enable scanning of removable drives during a full scan is reverted.";
}

function BCWHSmod16On {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\cloud\office\16.0\common\officeupdate" -Name 'enableautomaticupdates' -Value 1;
   New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft" -Name 'Office' -Force;
   New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft\Office" -Name '16.0' -Force;
   New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0" -Name 'Common' -Force;
   New-Item -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common" -Name 'Officeupdate' -Force;
   New-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'hideenabledisableupdates' -Value 1; 
   New-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'enableautomaticupdates' -Value 1;
   Write-Output "Hide Option & Enable Automatic Updates is set.";
}

function BCWHSmod16Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\cloud\office\16.0\common\officeupdate" -Name 'enableautomaticupdates' -Value 0;
   Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'hideenabledisableupdates' -Value 0; 
   Set-ItemProperty -Path "HKLM:\SOFTWARE\policies\Microsoft\Office\16.0\Common\Officeupdate" -Name 'enableautomaticupdates' -Value 0;
   Write-Output "Hide Option & Enable Automatic Updates is reverted.";
}

function BCWHSmod17On {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" -Name 'NC_ShowSharedAccessUI' -Value 0;
   Write-Output "Prohibit use of Internet Connection Sharing on your DNS domain network is set.";
}

function BCWHSmod17Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Network Connections" -Name 'NC_ShowSharedAccessUI' -Value 1;
   Write-Output "Prohibit use of Internet Connection Sharing on your DNS domain network is reverted.";
}
function BCWHSmod18On {
   net accounts /lockoutduration:15;
   Write-Output "Set Account lockout duration to 15 minutes or more is set.";
}
function BCWHSmod18Off {
   Write-Output "Set Account lockout duration to 15 minutes or more is unchanged.";
}
function BCWHSmod19On {
   net accounts /lockoutthreshold:10;
   Write-Output "Set Account lockout threshold to 1-10 invalid login attempts is set.";
}

function BCWHSmod19Off {
   Write-Output "Set Account lockout threshold to 1-10 invalid login attempts is unchanged.";
}

function BCWHSmod20On {
   net accounts /uniquepw:24; 
   Write-Output "Set Enforce Password History to 24 or more password(s) is set.";
}

function BCWHSmod20Off {
   Write-Output "Set Enforce Password History to 24 or more password(s) is unchaanged.";
}

function BCWHSmod21On {
   New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" -Name 'InactivityTimeoutSecs'  -PropertyType DWORD -Value 0x00000384 -Force;
   Write-Output "Set Interactive logon: Machine inactivity limit to 1-900 seconds is set.";
}

function BCWHSmod21Off {
   Write-Output "Set Interactive logon: Machine inactivity limit to 1-900 seconds is unchanged.";
    
}
function BCWHSmod22On {
   net accounts /minpwage:1;
   Write-Output "set Minimum Password Age to 1 or more day(s) is set.";
}
function BCWHSmod22Off {
   Write-Output "set Minimum Password Age to 1 or more day(s) is unchanged.";
}
function BCWHSmod23On {
   net accounts /lockoutwindow:15;
   Write-Output "Set Reset account lockout counter after to 15 minutes or more is set.";
}

function BCWHSmod23Off {
   Write-Output "Set Reset account lockout counter after to 15 minutes or more is unchanged.";
}

function BCWHSmod24On {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutorun' -Value 1;
   Write-Output "Set default behavior for AutoRun to Enabled: Do not execute any autorun commands is set.";
}

function BCWHSmod24Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name 'NoAutorun' -Value 0; 
   Write-Output "Set default behavior for AutoRun to Enabled: Do not execute any autorun commands is reverted.";
}

function BCWHSmod25On {
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\" -Name 'DisableIPSourceRouting' -Value 2;
   Write-Output "Set IPV6 source routing to highest protection is set.";
}

function BCWHSmod25Off {
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\" -Name 'DisableIPSourceRouting' -Value 0;
   Write-Output "Set IPV6 source routing to highest protection is reverted.";
}
function BCWHSmod26On {
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" -Name 'LmCompatibilityLevel' -Value 5;
   Write-Output "Set LAN Manager authentication level to Send NTLMv2 response only. Refuse LM & NTLM is set.";
}
function BCWHSmod26Off {
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\" -Name 'LmCompatibilityLevel' -Value 3;
   Write-Output "Set LAN Manager authentication level to Send NTLMv2 response only. Refuse LM & NTLM is reverted.";

}
function BCWHSmod27On {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" -Name 'ConsentPromptBehaviorUser' -Value 0;
   Write-Output "Set User Account Control (UAC) to automatically deny elevation requests is set.";
}

function BCWHSmod27Off {
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\" -Name 'ConsentPromptBehaviorUser' -Value 3;
   Write-Output "Set User Account Control (UAC) to automatically deny elevation requests is reverted.";
}

function BCWHSallOn {
    BCWHSmod1On; BCWHSmod2On; BCWHSmod3On; BCWHSmod4On; BCWHSmod5On; BCWHSmod6On; BCWHSmod7On; BCWHSmod8On; BCWHSmod9On; BCWHSmod10On; 
    BCWHSmod11On; BCWHSmod12On; BCWHSmod13On; BCWHSmod14On; BCWHSmod15On; BCWHSmod16On; BCWHSmod17On; BCWHSmod18On; BCWHSmod19On; BCWHSmod20On; 
    BCWHSmod21On; BCWHSmod22On; BCWHSmod23On; BCWHSmod24On; BCWHSmod25On; BCWHSmod26On; BCWHSmod27On; 
}

function BCWHSallOff {
    BCWHSmod1Off; BCWHSmod2Off; BCWHSmod3Off; BCWHSmod4Off; BCWHSmod5Off; BCWHSmod6Off; BCWHSmod7Off; BCWHSmod8Off; BCWHSmod9Off; BCWHSmod10Off; 
    BCWHSmod11Off; BCWHSmod12Off; BCWHSmod13Off; BCWHSmod14Off; BCWHSmod15Off; BCWHSmod16Off; BCWHSmod17Off; BCWHSmod18Off; BCWHSmod19Off; BCWHSmod20Off; 
    BCWHSmod21Off; BCWHSmod22Off; BCWHSmod23Off; BCWHSmod24Off; BCWHSmod25Off; BCWHSmod26Off; BCWHSmod27Off; 
}