adding more Hardening to script

[AverageUser125]

In my opinion the Script mostly debloat, and other utils, and Doen't do any Hardening.
Don't get me wrong the scripts Debloat also help with security but I think there is room for Improvments.

Here are Some Examples:
https://adsecurity.org/?p=3299 # General
https://support.microsoft.com/en-us/help/4073119/protect-against-speculative-execution-side-channel-vulnerabilities-in # Specture and Meltdown
https://www.blackhillsinfosec.com/how-to-disable-llmnr-why-you-want-to/ #LLMNR

Some Of this Examples may be to extreme, so only implement necessary parts.

Note: all Example for this Discussion come from this repo:
https://github.com/simeononsecurity/Windows-Optimize-Harden-Debloat
So all credit to him, Also I reccomend looking at other things he has done in this script.

[ChrisTitusTech]

Great Ideas, I actually have that repo already starred and used it in the past.

I'm sure I can bake these into the tool.

[Tech1Guy1One]

@ChrisTitusTech I realize this is an older post, so it's possible that you already have this completed, but i have been working on a new Security Package for Windows XP, as more of a proof of concept, but, in doing this I have an exported configuration of Registry settings for Windows 10/11 For the STIG Configuration from January 2024, that If you want, i can send them to you, so you can take a look at them, but they basically will set the STIG policy configuration to the registry without the need for a domain controller to apply them. A lot of time went into my XP Proof of concept, but again since i merged the registry configuration for windows 10 into XP, you could theoretically just use the Windows 10 Policy and merge it into Windows 10/11 and get the same results..

Full Disclosure is that I haven't quite figured out how to randomize the cipher yet on the deployment of the IPSec encryption policies on the windows system without triggering the AV, as there's no DC, so i can't use a Domain signed cert to attach the configuration and circumvent the bark of the AV, which as of now barks a false positive about the encryption key.. But i am working on that..

Let me know if you are interested, or have an email address I can Zip this and send what i have to you..

https://www.youtube.com/@GenericTechSupport
Is me, if you want to check out who I am.