Windows Server 2012R2安全基线加固与合规配置

# 重命名内置管理员账户
$Computer = $env:COMPUTERNAME
$Admin = [ADSI]"WinNT://$Computer/Administrator"
$Admin.Rename("SecAdmin-" + (Get-Random -Min 1000 -Max 9999))

# 禁用来宾账户
Disable-LocalUser -Name "Guest"

# 禁用SMBv1协议（高危漏洞）
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# 启用SMB加密
Set-SmbServerConfiguration -EncryptData $true -Force

# 禁用LLMNR（避免NTLM中继攻击）
New-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -Value 0 -PropertyType DWORD

# 审核凭据验证
auditpol /set /subcategory:"凭据验证" /success:enable /failure:enable

# 审核敏感权限使用
auditpol /set /subcategory:"敏感权限使用" /success:enable /failure:enable

# 配置事件日志大小
wevtutil sl Security /ms:209715200  # 200MB

# 使用Windows Server Backup
wbadmin start backup -backupTarget:E: -include:C: -allCritical -quiet
wbadmin get versions

# 启用Windows Defender Application Control
# 仅允许可信应用运行
$PolicyPath = "$env:USERPROFILE\Desktop\AppControlPolicy.xml"
New-CIPolicy -FilePath $PolicyPath -ScanPath "C:\Program Files" -Level Auto
ConvertFrom-CIPolicy -XmlFilePath $PolicyPath     -BinaryFilePath "C:\Windows\System32\CodeIntegrity\SIPolicy.p7b"

# 配置AppLocker（通过组策略或PowerShell）
Set-AppLockerPolicy -PolicyType Appx -XmlPolicy $xml -Merge

# 配置WinRM安全
# 启用HTTPS监听器
$cert = New-SelfSignedCertificate -DnsName "$env:COMPUTERNAME" -CertStoreLocation Cert:\LocalMachine\My
New-WSManInstance -ResourceURI winrm/config/Listener     -SelectorSet @{Address="*";Transport="HTTPS"}     -ValueSet @{CertificateThumbprint=$cert.Thumbprint}

# 设置WinRM信任主机
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "192.168.1.0/24" -Concatenate

# 配置JEA (Just Enough Administration)
New-PSSessionConfigurationFile -SessionType RestrictedRemoteServer     -Path .\JEASession.pssc
Register-PSSessionConfiguration -Name JEA -Path .\JEASession.pssc