; ============================================================ ; SKYFORT ARMOR - WINDOWS 11 ; Nivel 2 - Protecao Intermediaria (50 controles) ; Versao: 1.0.0 | Data: 2026-03-01 ; Aplicar: secedit /configure /db secedit.sdb /cfg Skyfort_Armor_Windows11.inf ; ============================================================ [Unicode] Unicode=yes [Version] signature="$CHICAGO$" Revision=1 ProfileString=Skyfort Armor - Windows 11 ; ============================================================ ; AUTENTICACAO - 8 controles ; ============================================================ [System Access] ; ARMOR-AUTH-001: Senha minima 14 caracteres MinimumPasswordLength = 14 ; ARMOR-AUTH-002: Bloqueio apos 5 falhas LockoutBadCount = 5 ResetLockoutCount = 15 LockoutDuration = 30 ; ARMOR-AUTH-003: Conta Guest desabilitada EnableGuestAccount = 0 ; ARMOR-AUTH-004: Complexidade de senha PasswordComplexity = 1 PasswordHistorySize = 24 MinimumPasswordAge = 1 MaximumPasswordAge = 90 ; ARMOR-AUTH-005: Renomear conta Administrator NewAdministratorName = "Admin-Skyfort" ; ARMOR-AUTH-006: Renomear conta Guest NewGuestName = "Guest-Disabled" ; ARMOR-AUTH-007: Forcar logoff quando hora expira ForceLogoffWhenHourExpire = 1 ; ARMOR-AUTH-008: Requerer logon para alterar senha RequireLogonToChangePassword = 1 ; ============================================================ ; AUDITORIA - 5 controles ; ============================================================ [Event Audit] ; ARMOR-AUDIT-001: Auditoria de logon AuditLogonEvents = 3 AuditAccountLogon = 3 ; ARMOR-AUDIT-002: Auditoria de sistema AuditSystemEvents = 3 AuditObjectAccess = 3 AuditPrivilegeUse = 2 AuditPolicyChange = 3 AuditAccountManage = 3 AuditProcessTracking = 2 AuditDSAccess = 3 ; ============================================================ ; REGISTRO - 37 controles ; ============================================================ [Registry Values] ; ========== AUTENTICACAO ========== ; ARMOR-AUTH-009: Nao exibir ultimo usuario machine\software\microsoft\windows\currentversion\policies\system\dontdisplaylastusername=4,1 ; ARMOR-AUTH-010: Aviso legal de logon machine\software\microsoft\windows\currentversion\policies\system\legalnoticecaption=4,"Skyfort Security" machine\software\microsoft\windows\currentversion\policies\system\legalnoticetext=4,"Acesso autorizado apenas. Todas as atividades sao monitoradas e registradas." ; ARMOR-AUTH-011: Ctrl+Alt+Del obrigatorio machine\software\microsoft\windows\currentversion\policies\system\DisableCAD=4,0 ; ========== SISTEMA DE ARQUIVOS ========== ; ARMOR-FILE-001: NTFS obrigatorio (verificado via script) ; ARMOR-FILE-002: Permissao pasta Windows machine\software\microsoft\windows\currentversion\policies\system\EnableLUA=4,1 ; ARMOR-FILE-003: Limpar arquivo de paginacao machine\system\currentcontrolset\control\session manager\memory management\ClearPageFileAtShutdown=4,1 ; ARMOR-FILE-004: Desabilitar cache de thumbnails machine\software\microsoft\windows\currentversion\explorer\advanced\DisableThumbnailCache=4,1 ; ARMOR-FILE-005: Desabilitar arquivos offline machine\software\policies\microsoft\windows\offlinefiles\Enabled=4,0 ; ========== REDE ========== ; ARMOR-NET-001: Firewall ativo todos perfis machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\enablefirewall=4,1 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\publicprofile\enablefirewall=4,1 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\enablefirewall=4,1 ; ARMOR-NET-002: Firewall bloqueia inbound por default machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\defaultinboundaction=4,1 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\publicprofile\defaultinboundaction=4,1 ; ARMOR-NET-003: SMBv1 desabilitado machine\system\currentcontrolset\services\lanmanserver\parameters\smb1=4,0 machine\system\currentcontrolset\services\mrxsmb10\start=4,4 ; ARMOR-NET-004: SMB assinatura obrigatoria machine\system\currentcontrolset\services\lanmanserver\parameters\requiresecuritysignature=4,1 machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature=4,1 ; ARMOR-NET-005: RDP com NLA machine\system\currentcontrolset\control\terminal server\winstations\rdp-tcp\UserAuthentication=4,1 ; ARMOR-NET-006: RDP desabilitado por default ; ARMOR-NET-007: Desabilitar Anonymous enumeration machine\system\currentcontrolset\control\lsa\restrictanonymous=4,1 machine\system\currentcontrolset\control\lsa\restrictanonymoussam=4,1 machine\system\currentcontrolset\control\lsa\everyoneincludesanonymous=4,0 ; ARMOR-NET-008: Desabilitar armazenamento de senhas RDP machine\software\policies\microsoft\windows nt\terminal services\DisablePasswordSaving=4,1 ; ARMOR-NET-009: Nao permitir WinRM sobre HTTP machine\software\policies\microsoft\windows\winrm\client\AllowUnencryptedTraffic=4,0 ; ARMOR-NET-010: LSA Protection machine\system\currentcontrolset\control\lsa\RunAsPPL=4,1 ; ========== SISTEMA ========== ; ARMOR-SYS-001: Windows Update automatico machine\software\policies\microsoft\windows\windowsupdate\au\AUOptions=4,4 machine\software\policies\microsoft\windows\windowsupdate\au\NoAutoUpdate=4,0 machine\software\policies\microsoft\windows\windowsupdate\au\ScheduledInstallDay=4,0 machine\software\policies\microsoft\windows\windowsupdate\au\ScheduledInstallTime=4,3 ; ARMOR-SYS-002: Telnet desabilitado machine\system\currentcontrolset\services\telnet\start=4,4 ; ARMOR-SYS-003: PowerShell v2 desabilitado machine\software\microsoft\powershell\1\powershellengine\ApplicationBase=4,0 ; ARMOR-SYS-004: Remote Registry desabilitado machine\system\currentcontrolset\services\remoteregistry\start=4,4 ; ARMOR-SYS-005: SSDP Discovery desabilitado machine\system\currentcontrolset\services\ssdpsrv\start=4,4 ; ARMOR-SYS-006: UPnP Host desabilitado machine\system\currentcontrolset\services\upnphost\start=4,4 ; ARMOR-SYS-007: Windows Error Reporting desabilitado machine\software\policies\microsoft\windows\windows error reporting\Disabled=4,1 ; ARMOR-SYS-008: Telemetria reduzida machine\software\policies\microsoft\windows\datacollection\AllowTelemetry=4,0 ; ========== MONITORAMENTO ========== ; ARMOR-MON-001: Windows Defender ativo machine\software\policies\microsoft\windows defender\DisableAntiSpyware=4,0 machine\software\policies\microsoft\windows defender\real-time protection\DisableRealtimeMonitoring=4,0 machine\software\policies\microsoft\windows defender\real-time protection\DisableIOAVProtection=4,0 ; ARMOR-MON-002: Defender Cloud Protection machine\software\policies\microsoft\windows defender\spynet\SpynetReporting=4,2 machine\software\policies\microsoft\windows defender\spynet\SubmitSamplesConsent=4,3 ; ARMOR-MON-003: Defender PUA Protection machine\software\policies\microsoft\windows defender\MpEngine\MpEnablePus=4,1 ; ========== APLICATIVOS ========== ; ARMOR-APP-001: UAC habilitado machine\software\microsoft\windows\currentversion\policies\system\EnableLUA=4,1 machine\software\microsoft\windows\currentversion\policies\system\ConsentPromptBehaviorAdmin=4,2 machine\software\microsoft\windows\currentversion\policies\system\EnableVirtualization=4,1 ; ARMOR-APP-002: SmartScreen habilitado machine\software\policies\microsoft\windows\system\EnableSmartScreen=4,1 machine\software\policies\microsoft\microsoftedge\phishingfilter\EnabledV9=4,1 machine\software\policies\microsoft\internet explorer\phishingfilter\EnabledV9=4,1 ; ARMOR-APP-003: AutoRun desabilitado machine\software\microsoft\windows\currentversion\policies\explorer\NoDriveTypeAutoRun=4,255 machine\software\microsoft\windows\currentversion\policies\explorer\NoAutoRun=4,1 ; ARMOR-APP-004: Windows Script Host restrito machine\software\microsoft\windows script host\settings\TrustPolicy=4,2 ; ARMOR-APP-005: Macro Office desabilitado machine\software\policies\microsoft\office\16.0\access\security\VBAWarnings=4,4 machine\software\policies\microsoft\office\16.0\excel\security\VBAWarnings=4,4 machine\software\policies\microsoft\office\16.0\word\security\VBAWarnings=4,4 machine\software\policies\microsoft\office\16.0\powerpoint\security\VBAWarnings=4,4 ; ARMOR-APP-006: Download de fontes externas bloqueado machine\software\policies\microsoft\windows\datacollection\AllowFontProviders=4,0 ; PSS-001: Carimbo de identificacao da baseline aplicada MACHINE\Software\PSS\Baseline=1,"Skyfort Armor v2.0.0 - Windows 11" [Profile Description] Description=Skyfort Armor - Windows 11 Intermediate Security (50 controles)