{"id":1918,"date":"2017-01-25T18:23:03","date_gmt":"2017-01-25T18:23:03","guid":{"rendered":"http:\/\/obieta.com\/?p=1918"},"modified":"2017-01-25T18:23:03","modified_gmt":"2017-01-25T18:23:03","slug":"windows-server-hardening-disable-weak-ciphers","status":"publish","type":"post","link":"http:\/\/obieta.com\/?p=1918","title":{"rendered":"Windows Server Hardening – Disable weak ciphers"},"content":{"rendered":"

; ASLR hardening settings for Internet Explorer in KB3125869
\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING]
\n“iexplore.exe”=dword:00000001
\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING]
\n“iexplore.exe”=dword:00000001<\/p>\n

; Disable weak ciphers
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\NULL]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 40\/128]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 56\/128]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\DES 56\/56]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\NULL]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 40\/128]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 56\/128]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 40\/128]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 56\/128]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 64\/128]
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 128\/128]
\n“Enabled”=dword:00000000<\/p>\n

; Disable DLL binary planting
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager]
\n“CWDIllegalInDllSearch”=dword:00000002<\/p>\n

; Require SMB Signing (Client)
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\LanmanWorkstation\\Parameters]
\n“EnableSecuritySignature”=dword:00000001
\n“RequireSecuritySignature”=dword:00000001<\/p>\n

; Require SMB Signing (Server)
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\LanmanServer\\Parameters]
\n“enablesecuritysignature”=dword:00000001
\n“requiresecuritysignature”=dword:00000001<\/p>\n

; Disable cached logons
\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]
\n“CachedLogonsCount”=”0”<\/p>\n

; Disable SSLv2, SSLv3 enable TLS 1.1 and 1.2 (1.0 implied enabled by default)
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 2.0\\Client]
\n“DisabledByDefault”=dword:00000001
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 2.0\\Server]
\n“Enabled”=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 3.0\\Client]
\n“DisabledByDefault”=dword:00000001
\n“Enabled”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\SSL 3.0\\Server]
\n“Enabled”=dword:00000000<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.1\\Client]
\n“Enabled”=dword:00000001
\n“DisabledByDefault”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.1\\Server]
\n“Enabled”=dword:00000001
\n“DisabledByDefault”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.2\\Client]
\n“Enabled”=dword:00000001
\n“DisabledByDefault”=dword:00000000
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.2\\Server]
\n“Enabled”=dword:00000001
\n“DisabledByDefault”=dword:00000000<\/p>\n

; Set LANMAN Auth to level 5
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa]
\n“LmCompatibilityLevel”=dword:00000005<\/p>\n

; Disable LAN Manager Hash Value on Next Password Change
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa]
\n“NoLmHash”=dword:00000001<\/p>\n

; Disable DES-CBC3-SHA
\n[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\Triple DES 168]
\n“Enabled”=dword:00000000<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

; ASLR hardening settings for Internet Explorer in KB3125869 [HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING] “iexplore.exe”=dword:00000001 [HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING] “iexplore.exe”=dword:00000001 ; Disable weak ciphers [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\NULL] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 40\/128] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 56\/128] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\DES 56\/56] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\NULL] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 40\/128] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC2 56\/128] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 40\/128] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 56\/128] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 64\/128] “Enabled”=dword:00000000 [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Ciphers\\RC4 128\/128] “Enabled”=dword:00000000 ; Disable DLL binary planting […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts\/1918"}],"collection":[{"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1918"}],"version-history":[{"count":0,"href":"http:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts\/1918\/revisions"}],"wp:attachment":[{"href":"http:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1918"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}