; ============================================================
; SKYFORT ARMOR - WINDOWS SERVER 2025
; Nivel 2 - Protecao Intermediaria (50 controles)
; Versao: 1.0.0 | Data: 2026-03-01
; ============================================================

[Unicode]
Unicode=yes

[Version]
signature="$CHICAGO$"
Revision=1
ProfileString=Skyfort Armor - Windows Server 2025

[System Access]
MinimumPasswordLength = 14
PasswordComplexity = 1
PasswordHistorySize = 24
MinimumPasswordAge = 1
MaximumPasswordAge = 90
LockoutBadCount = 5
LockoutDuration = 30
EnableGuestAccount = 0
NewAdministratorName = "Admin-Skyfort"
NewGuestName = "Guest-Disabled"
ForceLogoffWhenHourExpire = 1

[Event Audit]
AuditSystemEvents = 3
AuditLogonEvents = 3
AuditObjectAccess = 3
AuditPrivilegeUse = 2
AuditPolicyChange = 3
AuditAccountManage = 3
AuditProcessTracking = 2
AuditAccountLogon = 3

[Registry Values]
; AUTENTICACAO
machine\software\microsoft\windows\currentversion\policies\system\dontdisplaylastusername=4,1
machine\software\microsoft\windows\currentversion\policies\system\legalnoticecaption=4,"Skyfort Security"
machine\software\microsoft\windows\currentversion\policies\system\legalnoticetext=4,"Acesso autorizado apenas."

; ARQUIVOS
machine\system\currentcontrolset\control\session manager\memory management\ClearPageFileAtShutdown=4,1

; REDE
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\enablefirewall=4,1
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\publicprofile\enablefirewall=4,1
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\enablefirewall=4,1
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\defaultinboundaction=4,1

; SMB
machine\system\currentcontrolset\services\lanmanserver\parameters\smb1=4,0
machine\system\currentcontrolset\services\mrxsmb10\start=4,4
machine\system\currentcontrolset\services\lanmanserver\parameters\requiresecuritysignature=4,1
machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature=4,1

; RDP
machine\system\currentcontrolset\control\terminal server\winstations\rdp-tcp\UserAuthentication=4,1
machine\software\policies\microsoft\windows nt\terminal services\DisablePasswordSaving=4,1

; LSA
machine\system\currentcontrolset\control\lsa\restrictanonymous=4,1
machine\system\currentcontrolset\control\lsa\restrictanonymoussam=4,1
machine\system\currentcontrolset\control\lsa\RunAsPPL=4,1

; SERVICOS
machine\system\currentcontrolset\services\telnet\start=4,4
machine\system\currentcontrolset\services\remoteregistry\start=4,4
machine\system\currentcontrolset\services\ssdpsrv\start=4,4
machine\system\currentcontrolset\services\upnphost\start=4,4

; SISTEMA
machine\software\policies\microsoft\windows\windowsupdate\au\AUOptions=4,4
machine\software\policies\microsoft\windows\datacollection\AllowTelemetry=4,0

; DEFENDER
machine\software\policies\microsoft\windows defender\DisableAntiSpyware=4,0
machine\software\policies\microsoft\windows defender\real-time protection\DisableRealtimeMonitoring=4,0

; APLICATIVOS
machine\software\microsoft\windows\currentversion\policies\system\EnableLUA=4,1
machine\software\policies\microsoft\windows\system\EnableSmartScreen=4,1
machine\software\microsoft\windows\currentversion\policies\explorer\NoDriveTypeAutoRun=4,255
machine\software\microsoft\windows script host\settings\TrustPolicy=4,2

; PSS-001: Carimbo de identificacao da baseline aplicada
MACHINE\Software\PSS\Baseline=1,"Skyfort Armor v2.0.0 - Windows Server 2025"

[Profile Description]
Description=Skyfort Armor - Windows Server 2025 Intermediate Security (50 controles)