[DoXeD]

Code:

# Enable Windows Defender and ensure it's up to date Set-MpPreference -DisableRealtimeMonitoring $false Start-MpScan -ScanType QuickScan Update-MpSignature # Enable Windows Firewall Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True # Enable BitLocker for system drive encryption # Note: Customize the encryption method as needed (e.g., AES256) Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly # Set a strong password policy # Note: Adjust settings based on your organization's policies secpol.exe /s /t /p "Security Settings\Account Policies\Password Policy" /v "MinimumPasswordAge" /d "1" secpol.exe /s /t /p "Security Settings\Account Policies\Password Policy" /v "PasswordComplexity" /d "1" secpol.exe /s /t /p "Security Settings\Account Policies\Password Policy" /v "PasswordLength" /d "12" # Disable Remote Assistance and Remote Desktop # Adjust as per your requirements Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1 # Disable PowerShell scripts from running without signing Set-ExecutionPolicy RemoteSigned # Enable User Account Control (UAC) Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 5 # Enable SmartScreen Filter for Internet Explorer and Microsoft Edge Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" -Name "EnabledV9" -Value 1 Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "SmartScreenEnabled" -Value 1 # Disable Autorun for removable drives Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Value 255 # Enable auditing of logon events Auditpol /set /subcategory:"Logon" /success:enable /failure:enable # Restart the system for changes to take effect Restart-Computer -Force