ZCSPM offers PowerShell scripts for hardening the Windows Server 2019 OS on your Microsoft Azure Virtual Machine. Make sure you test the scripts on a testing environment before running them on a production environment.

Hardening Script for CIS Compliance

CIS_Benchmark_WindowsServer2019.ps1: ZCSPM can remediate about 158 security policies to harden Windows Server 2019 on an Azure virtual machine for CIS Windows Server 2019 Benchmark.

• See the 158 security policies remediated
  1 to 10 of 158. Page 1 of 16

  Policy Title 1

  Configure 'Network access: Remotely accessible registry paths and sub-paths'

  Configure 'Network access: Remotely accessible registry paths'

  Enable 'Turn on behavior monitoring'

  Ensure 'Access Credential Manager as a trusted caller' is set to 'No One'

  Ensure 'Access this computer from the network' is set to 'Administrators, Authenticated Users, ENTERPRISE DOMAIN CONTROLLERS' (DC only)

  Ensure 'Accounts: Limit local account use of blank passwords to console logon only' is set to 'Enabled'

  Ensure 'Act as part of the operating system' is set to 'No One'

  Ensure 'Allow Basic authentication' is set to 'Disabled'

  Ensure 'Allow Cortana' is set to 'Disabled'

  Ensure 'Allow indexing of encrypted files' is set to 'Disabled'

  1 to 10 of 158

  Page 1 of 16

  Close

To harden the Windows Server 2019 OS baseline configuration running on a virtual machine (VM):

1. Ensure you have PowerShell version v5 or higher. Verify your PowerShell version using the following command:

PSVersionTable.PSVersion

2. Ensure there are no restrictions on PowerShell to run the script. Remove restrictions on PowerShell using the following command:

Set-ExecutionPolicy `
-Scope Process `
-ExecutionPolicy Bypass

3. Install the following DSC modules to run PowerShell commands while running a Quick Wins script:
   • AuditPolicyDsc
   • SecurityPolicyDsc
   • NetworkingDsc
   • PSDesiredStateConfiguration
   To verify if a module is already installed, run the following command:

Get-InstalledModule -Name <module-name>

Install a required module by running the following command:

Install-Module -Name <module-name>

4. Download the script from GitHub using the following command:

wget https://raw.githubusercontent.com/Cloudneeti/os-harderning-scripts/master/WindowsServer2019/CIS_Benchmark_WindowsServer2019_v100.ps1 -O CIS_Benchmark_WindowsServer2019_v100.ps1

5. Run the PowerShell script to compile the DSC modules using the following command:

.\CIS_Benchmark_WindowsServer2019_v100.ps1

6. Apply the baseline configuration to your VM using the following command:

Start-DscConfiguration -Path .\CIS_Benchmark_WindowsServer2019_v100  -Force -Verbose -Wait