; ============================================================ ; SKYFORT FORTRESS - WINDOWS 11 ; Nivel 3 - Protecao Maxima (150+ controles) ; Versao: 1.0.0 | Data: 2026-03-01 ; Aplicar: secedit /configure /db secedit.sdb /cfg Skyfort_Fortress_Windows11.inf ; ============================================================ [Unicode] Unicode=yes [Version] signature="$CHICAGO$" Revision=1 ProfileString=Skyfort Fortress - Windows 11 ; ============================================================ ; AUTENTICACAO - 20 controles ; ============================================================ [System Access] ; FORTRESS-AUTH-001 a 020 MinimumPasswordLength = 16 PasswordComplexity = 1 PasswordHistorySize = 24 MinimumPasswordAge = 1 MaximumPasswordAge = 60 LockoutBadCount = 3 ResetLockoutCount = 30 LockoutDuration = 30 EnableGuestAccount = 0 EnableAdminAccount = 0 NewAdministratorName = "Admin-Skyfort" NewGuestName = "Guest-Disabled" ForceLogoffWhenHourExpire = 1 RequireLogonToChangePassword = 1 ; ============================================================ ; AUDITORIA - 20 controles ; ============================================================ [Event Audit] ; FORTRESS-AUDIT-001 a 020 AuditSystemEvents = 3 AuditLogonEvents = 3 AuditObjectAccess = 3 AuditPrivilegeUse = 3 AuditPolicyChange = 3 AuditAccountManage = 3 AuditProcessTracking = 3 AuditDSAccess = 3 AuditAccountLogon = 3 ; ============================================================ ; REGISTRO - 110+ controles ; ============================================================ [Registry Values] ; ========== AUTENTICACAO AVANCADA ========== ; FORTRESS-AUTH-010: Nao exibir ultimo usuario machine\software\microsoft\windows\currentversion\policies\system\dontdisplaylastusername=4,1 ; FORTRESS-AUTH-011: Aviso legal de logon machine\software\microsoft\windows\currentversion\policies\system\legalnoticecaption=4,"Skyfort Fortress Security" machine\software\microsoft\windows\currentversion\policies\system\legalnoticetext=4,"Acesso autorizado apenas. Todas as atividades sao monitoradas, registradas e podem ser usadas como evidencia em processo judicial. Tentativas de acesso nao autorizado serao denunciadas." ; FORTRESS-AUTH-012: Ctrl+Alt+Del obrigatorio machine\software\microsoft\windows\currentversion\policies\system\DisableCAD=4,0 ; FORTRESS-AUTH-013: Bloquear tela apos 15 min machine\software\policies\microsoft\windows\control panel\personalization\ScreenSaverIsSecure=4,1 machine\software\policies\microsoft\windows\control panel\personalization\ScreenSaveTimeOut=4,900 machine\software\policies\microsoft\windows\control panel\personalization\ScreenSaveActive=4,1 ; FORTRESS-AUTH-014: Limite de sessoes simultaneas machine\system\currentcontrolset\control\terminal server\fSingleSessionPerUser=4,1 ; FORTRESS-AUTH-015: Credential Guard machine\system\currentcontrolset\control\lsa\LsaCfgFlags=4,1 ; FORTRESS-AUTH-016: Remote Credential Guard machine\system\currentcontrolset\control\lsa\DisableRestrictedAdmin=4,0 machine\system\currentcontrolset\control\lsa\DisableRestrictedAdminOutboundCreds=4,0 ; ========== SISTEMA DE ARQUIVOS ========== ; FORTRESS-FILE-001: Limpar arquivo de paginacao machine\system\currentcontrolset\control\session manager\memory management\ClearPageFileAtShutdown=4,1 ; FORTRESS-FILE-002: Desabilitar cache de thumbnails machine\software\microsoft\windows\currentversion\explorer\advanced\DisableThumbnailCache=4,1 ; FORTRESS-FILE-003: Desabilitar arquivos offline machine\software\policies\microsoft\windows\offlinefiles\Enabled=4,0 ; FORTRESS-FILE-004: Limpar temp ao sair machine\software\microsoft\windows\currentversion\explorer\smartcleanuptemp=4,1 ; FORTRESS-FILE-005: Desabilitar NTFS last access machine\system\currentcontrolset\control\filesystem\NtfsDisableLastAccessUpdate=4,1 ; FORTRESS-FILE-006: Desabilitar 8.3 filenames machine\system\currentcontrolset\control\filesystem\NtfsDisable8dot3NameCreation=4,1 ; FORTRESS-FILE-007: Limpar recent docs machine\software\microsoft\windows\currentversion\policies\explorer\NoRecentDocsHistory=4,1 ; FORTRESS-FILE-008: Desabilitar compressao diferencial machine\software\policies\microsoft\windows\system\EnableSmartScreen=4,1 ; ========== REDE AVANCADA ========== ; FORTRESS-NET-001: Firewall ativo todos perfis machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\enablefirewall=4,1 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\publicprofile\enablefirewall=4,1 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\enablefirewall=4,1 ; FORTRESS-NET-002: Firewall bloqueia inbound machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\defaultinboundaction=4,1 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\publicprofile\defaultinboundaction=4,1 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\defaultinboundaction=4,1 ; FORTRESS-NET-003: Firewall log habilitado machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\logging\EnableFileLogging=4,1 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\publicprofile\logging\EnableFileLogging=4,1 ; FORTRESS-NET-004: SMBv1 desabilitado machine\system\currentcontrolset\services\lanmanserver\parameters\smb1=4,0 machine\system\currentcontrolset\services\mrxsmb10\start=4,4 ; FORTRESS-NET-005: SMB assinatura obrigatoria machine\system\currentcontrolset\services\lanmanserver\parameters\requiresecuritysignature=4,1 machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature=4,1 machine\system\currentcontrolset\services\lanmanserver\parameters\enablesecuritysignature=4,1 machine\system\currentcontrolset\services\lanmanworkstation\parameters\enablesecuritysignature=4,1 ; FORTRESS-NET-006: SMB criptografia machine\system\currentcontrolset\services\lanmanserver\parameters\EnableSMB2Protocol=4,1 ; FORTRESS-NET-007: RDP com NLA machine\system\currentcontrolset\control\terminal server\winstations\rdp-tcp\UserAuthentication=4,1 ; FORTRESS-NET-008: RDP desabilitado ; FORTRESS-NET-009: RDP encryption level machine\system\currentcontrolset\control\terminal server\winstations\rdp-tcp\MinEncryptionLevel=4,3 ; FORTRESS-NET-010: RDP sem armazenar senhas machine\software\policies\microsoft\windows nt\terminal services\DisablePasswordSaving=4,1 ; FORTRESS-NET-011: Anonymous enumeration desabilitado machine\system\currentcontrolset\control\lsa\restrictanonymous=4,2 machine\system\currentcontrolset\control\lsa\restrictanonymoussam=4,1 machine\system\currentcontrolset\control\lsa\everyoneincludesanonymous=4,0 machine\system\currentcontrolset\control\lsa\RestrictRemoteSAM=4,"O:BAG:BAD:(A;;RC;;;BA)" ; FORTRESS-NET-012: LSA Protection machine\system\currentcontrolset\control\lsa\RunAsPPL=4,1 machine\system\currentcontrolset\control\lsa\RunAsPPLBootKey=4,1 ; FORTRESS-NET-013: WinRM restrito machine\software\policies\microsoft\windows\winrm\client\AllowUnencryptedTraffic=4,0 machine\software\policies\microsoft\windows\winrm\service\AllowUnencryptedTraffic=4,0 machine\software\policies\microsoft\windows\winrm\client\AllowBasic=4,0 machine\software\policies\microsoft\windows\winrm\service\AllowBasic=4,0 ; FORTRESS-NET-014: PowerShell remoting restrito machine\software\policies\microsoft\windows\powershell\enablemodulelogging=4,1 machine\software\policies\microsoft\windows\powershell\enablescriptblocklogging=4,1 ; FORTRESS-NET-015: Desabilitar IPv6 se nao usado machine\system\currentcontrolset\services\tcpip6\parameters\DisabledComponents=4,255 ; FORTRESS-NET-016: Desabilitar source routing machine\system\currentcontrolset\services\tcpip\parameters\DisableIPSourceRouting=4,1 ; FORTRESS-NET-017: Desabilitar ICMP redirect machine\system\currentcontrolset\services\tcpip\parameters\EnableICMPRedirect=4,0 ; FORTRESS-NET-018: Protecao SYN flood machine\system\currentcontrolset\services\tcpip\parameters\SynAttackProtect=4,1 ; FORTRESS-NET-019: Desabilitar DNS dynamic update machine\system\currentcontrolset\services\tcpip\parameters\DisableDynamicUpdate=4,1 ; FORTRESS-NET-020: Desabilitar nome NetBIOS machine\system\currentcontrolset\services\netbt\parameters\NoNameReleaseOnDemand=4,1 ; ========== SISTEMA AVANCADO ========== ; FORTRESS-SYS-001: Windows Update automatico machine\software\policies\microsoft\windows\windowsupdate\au\AUOptions=4,4 machine\software\policies\microsoft\windows\windowsupdate\au\NoAutoUpdate=4,0 machine\software\policies\microsoft\windows\windowsupdate\au\ScheduledInstallDay=4,0 machine\software\policies\microsoft\windows\windowsupdate\au\ScheduledInstallTime=4,3 machine\software\policies\microsoft\windows\windowsupdate\au\AutoInstallMinorUpdates=4,1 ; FORTRESS-SYS-002: Servicos desabilitados machine\system\currentcontrolset\services\telnet\start=4,4 machine\system\currentcontrolset\services\remoteregistry\start=4,4 machine\system\currentcontrolset\services\ssdpsrv\start=4,4 machine\system\currentcontrolset\services\upnphost\start=4,4 machine\system\currentcontrolset\services\snmp\start=4,4 machine\system\currentcontrolset\services\simptcp\start=4,4 machine\system\currentcontrolset\services\fax\start=4,4 machine\system\currentcontrolset\services\irmon\start=4,4 machine\system\currentcontrolset\services\algg\start=4,4 machine\system\currentcontrolset\services\browser\start=4,4 machine\system\currentcontrolset\services\lanmanworkstation\start=4,2 ; FORTRESS-SYS-003: PowerShell v2 desabilitado machine\software\microsoft\powershell\1\powershellengine\ApplicationBase=4,0 ; FORTRESS-SYS-004: PowerShell logging machine\software\policies\microsoft\windows\powershell\modulelogging\enablemodulelogging=4,1 machine\software\policies\microsoft\windows\powershell\scriptblocklogging\enablescriptblocklogging=4,1 machine\software\policies\microsoft\windows\powershell\transcription\enabletranscripting=4,1 ; FORTRESS-SYS-005: Telemetria minima machine\software\policies\microsoft\windows\datacollection\AllowTelemetry=4,0 ; FORTRESS-SYS-006: Windows Error Reporting desabilitado machine\software\policies\microsoft\windows\windows error reporting\Disabled=4,1 ; FORTRESS-SYS-007: Customer Experience Improvement desabilitado machine\software\policies\microsoft\sqmclient\windows\ceipenable=4,0 ; FORTRESS-SYS-008: Desabilitar Cortana machine\software\policies\microsoft\windows\windows search\AllowCortana=4,0 ; FORTRESS-SYS-009: Desabilitar localizacao machine\software\policies\microsoft\windows\location and sensors\DisableLocation=4,1 machine\software\policies\microsoft\windows\location and sensors\DisableSensors=4,1 ; FORTRESS-SYS-010: Desabilitar camera para apps machine\software\policies\microsoft\windows\appprivacy\LetAppsAccessCamera=4,2 ; FORTRESS-SYS-011: Desabilitar microfone para apps machine\software\policies\microsoft\windows\appprivacy\LetAppsAccessMicrophone=4,2 ; FORTRESS-SYS-012: Desabilitar notificacoes lock screen machine\software\policies\microsoft\windows\currentversion\pushnotifications\NoToastApplicationNotificationOnLockScreen=4,1 ; FORTRESS-SYS-013: Desabilitar downloads de drivers machine\software\policies\microsoft\windows\driver searching\SearchOrderConfig=4,0 ; FORTRESS-SYS-014: Desabilitar assistencia remota machine\software\policies\microsoft\windows nt\terminal services\fAllowToGetHelp=4,0 ; FORTRESS-SYS-015: Desabilitar armazenamento de credenciais machine\software\policies\microsoft\windows\credssp\AllowDefCredentials=4,0 machine\software\policies\microsoft\windows\credssp\AllowSavedCredentials=4,0 ; ========== MONITORAMENTO AVANCADO ========== ; FORTRESS-MON-001: Windows Defender completo machine\software\policies\microsoft\windows defender\DisableAntiSpyware=4,0 machine\software\policies\microsoft\windows defender\real-time protection\DisableRealtimeMonitoring=4,0 machine\software\policies\microsoft\windows defender\real-time protection\DisableIOAVProtection=4,0 machine\software\policies\microsoft\windows defender\real-time protection\DisableBehaviorMonitoring=4,0 machine\software\policies\microsoft\windows defender\real-time protection\DisableOnAccessProtection=4,0 ; FORTRESS-MON-002: Defender Cloud Protection machine\software\policies\microsoft\windows defender\spynet\SpynetReporting=4,2 machine\software\policies\microsoft\windows defender\spynet\SubmitSamplesConsent=4,3 ; FORTRESS-MON-003: Defender PUA Protection machine\software\policies\microsoft\windows defender\MpEngine\MpEnablePus=4,1 ; FORTRESS-MON-004: Defender Network Protection machine\software\policies\microsoft\windows defender\Windows Defender Exploit Guard\Network Protection\EnableNetworkProtection=4,1 ; FORTRESS-MON-005: Defender Controlled Folder Access machine\software\policies\microsoft\windows defender\Windows Defender Exploit Guard\Controlled Folder Access\EnableControlledFolderAccess=4,1 ; FORTRESS-MON-006: Defender Attack Surface Reduction machine\software\policies\microsoft\windows defender\Windows Defender Exploit Guard\ASR\ExploitGuard_ASR_Rules=4,1 ; FORTRESS-MON-007: Windows Firewall logging machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\logging\LogFileSize=4,4096 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\logging\LogDroppedPackets=4,1 machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\logging\LogSuccessfulConnections=4,1 ; ========== APLICATIVOS AVANCADOS ========== ; FORTRESS-APP-001: UAC maximo machine\software\microsoft\windows\currentversion\policies\system\EnableLUA=4,1 machine\software\microsoft\windows\currentversion\policies\system\ConsentPromptBehaviorAdmin=4,2 machine\software\microsoft\windows\currentversion\policies\system\EnableVirtualization=4,1 machine\software\microsoft\windows\currentversion\policies\system\EnableInstallerDetection=4,1 ; FORTRESS-APP-002: SmartScreen completo machine\software\policies\microsoft\windows\system\EnableSmartScreen=4,1 machine\software\policies\microsoft\microsoftedge\phishingfilter\EnabledV9=4,1 machine\software\policies\microsoft\internet explorer\phishingfilter\EnabledV9=4,1 machine\software\policies\microsoft\windows\explorer\SmartScreenEnabled=4,1 ; FORTRESS-APP-003: AutoRun desabilitado completo machine\software\microsoft\windows\currentversion\policies\explorer\NoDriveTypeAutoRun=4,255 machine\software\microsoft\windows\currentversion\policies\explorer\NoAutoRun=4,1 machine\software\microsoft\windows\currentversion\policies\explorer\NoDriveAutoRun=4,255 machine\software\microsoft\windows nt\currentversion\ini file mapping\Autorun.inf=4,"@SYS:DoesNotExist" ; FORTRESS-APP-004: Windows Script Host restrito machine\software\microsoft\windows script host\settings\TrustPolicy=4,2 machine\software\microsoft\windows script host\settings\Remote=4,0 ; FORTRESS-APP-005: Office macros desabilitado machine\software\policies\microsoft\office\16.0\access\security\VBAWarnings=4,4 machine\software\policies\microsoft\office\16.0\excel\security\VBAWarnings=4,4 machine\software\policies\microsoft\office\16.0\word\security\VBAWarnings=4,4 machine\software\policies\microsoft\office\16.0\powerpoint\security\VBAWarnings=4,4 machine\software\policies\microsoft\office\16.0\outlook\security\level=4,4 machine\software\policies\microsoft\office\16.0\excel\security\accessvbom=4,0 machine\software\policies\microsoft\office\16.0\word\security\accessvbom=4,0 ; FORTRESS-APP-006: Adobe Flash desabilitado machine\software\microsoft\windows\currentversion\control panel\adminui\eset\browser\DisableFlash=4,1 ; FORTRESS-APP-007: Edge restrito machine\software\policies\microsoft\edge\PopupsAllowedForUrls=4,0 machine\software\policies\microsoft\edge\DefaultPopupsSetting=4,2 ; FORTRESS-APP-008: Internet Explorer restrito machine\software\policies\microsoft\windows\currentversion\internet settings\zones\3\1200=4,3 machine\software\policies\microsoft\windows\currentversion\internet settings\zones\3\1201=4,3 machine\software\policies\microsoft\windows\currentversion\internet settings\zones\3\1400=4,3 ; FORTRESS-APP-009: Desabilitar instalacao de apps machine\software\policies\microsoft\windows\installer\DisableMSI=4,2 ; FORTRESS-APP-010: Desabilitar download de fontes machine\software\policies\microsoft\windows\datacollection\AllowFontProviders=4,0 ; ========== CRIPTOGRAFIA ========== ; FORTRESS-CRYPTO-001: BitLocker (verificar via script) ; FORTRESS-CRYPTO-002: Desabilitar autorun BitLocker To Go machine\software\policies\microsoft\fve\DisableExternalKeyUnderLock=4,1 ; FORTRESS-CRYPTO-003: FIPS compliance machine\system\currentcontrolset\control\lsa\fipsalgorithmpolicy\enabled=4,1 ; FORTRESS-CRYPTO-004: SSL/TLS forte machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 2.0\client\enabled=4,0 machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 2.0\server\enabled=4,0 machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 3.0\client\enabled=4,0 machine\system\currentcontrolset\control\securityproviders\schannel\protocols\ssl 3.0\server\enabled=4,0 machine\system\currentcontrolset\control\securityproviders\schannel\protocols\tls 1.0\client\enabled=4,0 machine\system\currentcontrolset\control\securityproviders\schannel\protocols\tls 1.0\server\enabled=4,0 ; PSS-001: Carimbo de identificacao da baseline aplicada MACHINE\Software\PSS\Baseline=1,"Skyfort Fortress v2.0.0 - Windows 11" [Profile Description] Description=Skyfort Fortress - Windows 11 Maximum Security (150+ controles)