Tutorial Windows Basic Powershell Harden

Code:
# Enable Windows Defender and ensure it's up to date
Set-MpPreference -DisableRealtimeMonitoring $false
Start-MpScan -ScanType QuickScan
Update-MpSignature

# Enable Windows Firewall
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# Enable BitLocker for system drive encryption
# Note: Customize the encryption method as needed (e.g., AES256)
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly

# Set a strong password policy
# Note: Adjust settings based on your organization's policies
secpol.exe /s /t /p "Security Settings\Account Policies\Password Policy" /v "MinimumPasswordAge" /d "1"
secpol.exe /s /t /p "Security Settings\Account Policies\Password Policy" /v "PasswordComplexity" /d "1"
secpol.exe /s /t /p "Security Settings\Account Policies\Password Policy" /v "PasswordLength" /d "12"

# Disable Remote Assistance and Remote Desktop
# Adjust as per your requirements
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1

# Disable PowerShell scripts from running without signing
Set-ExecutionPolicy RemoteSigned

# Enable User Account Control (UAC)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 5

# Enable SmartScreen Filter for Internet Explorer and Microsoft Edge
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" -Name "EnabledV9" -Value 1
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "SmartScreenEnabled" -Value 1

# Disable Autorun for removable drives
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Value 255

# Enable auditing of logon events
Auditpol /set /subcategory:"Logon" /success:enable /failure:enable

# Restart the system for changes to take effect
Restart-Computer -Force