; ============================================================
; SKYFORT SHIELD - WINDOWS SERVER 2022
; Nivel 1 - Protecao Essencial (20 controles)
; Versao: 1.0.0 | Data: 2026-03-01
; Aplicar: secedit /configure /db secedit.sdb /cfg Skyfort_Shield_Server2022.inf
; ============================================================

[Unicode]
Unicode=yes

[Version]
signature="$CHICAGO$"
Revision=1
ProfileString=Skyfort Shield - Windows Server 2022

[System Access]
; AUTH-001: Senha minima 14 caracteres
MinimumPasswordLength = 14

; AUTH-002: Bloqueio apos 5 falhas
LockoutBadCount = 5
ResetLockoutCount = 15
LockoutDuration = 15

; AUTH-003: Conta Guest desabilitada
EnableGuestAccount = 0

; AUTH-004: Complexidade de senha
PasswordComplexity = 1
PasswordHistorySize = 24
MinimumPasswordAge = 1
MaximumPasswordAge = 90

[Event Audit]
; AUDIT-001: Auditoria de logon
AuditLogonEvents = 3
AuditAccountLogon = 3

; AUDIT-002: Auditoria de sistema
AuditSystemEvents = 3
AuditObjectAccess = 2
AuditPolicyChange = 3
AuditAccountManage = 3

[Registry Values]
; NET-001: Firewall ativo
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\enablefirewall=4,1
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\publicprofile\enablefirewall=4,1
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\enablefirewall=4,1

; NET-002: SMBv1 desabilitado
machine\system\currentcontrolset\services\lanmanserver\parameters\smb1=4,0
machine\system\currentcontrolset\services\mrxsmb10\start=4,4

; NET-003: RDP com NLA
machine\system\currentcontrolset\control\terminal server\winstations\rdp-tcp\UserAuthentication=4,1

; SYS-001: Windows Update automatico
machine\software\policies\microsoft\windows\windowsupdate\au\AUOptions=4,4

; SYS-002: Telnet desabilitado
machine\system\currentcontrolset\services\telnet\start=4,4

; SYS-003: Remote Registry desabilitado
machine\system\currentcontrolset\services\remoteregistry\start=4,4

; APP-001: UAC habilitado
machine\software\microsoft\windows\currentversion\policies\system\EnableLUA=4,1

; APP-002: AutoRun desabilitado
machine\software\microsoft\windows\currentversion\policies\explorer\NoDriveTypeAutoRun=4,255

; PSS-001: Carimbo de identificacao da baseline aplicada
MACHINE\Software\PSS\Baseline=1,"Skyfort Top15 v2.0.0 - Windows Server 2022"

[Profile Description]
Description=Skyfort Shield - Windows Server 2022 Essential Security (20 controles)