; ============================================================
; SKYFORT SHIELD - WINDOWS 11
; Nivel 1 - Protecao Essencial (20 controles)
; Versao: 1.0.0 | Data: 2026-03-01
; Aplicar: secedit /configure /db secedit.sdb /cfg Skyfort_Shield_Windows11.inf
; ============================================================

[Unicode]
Unicode=yes

[Version]
signature="$CHICAGO$"
Revision=1
ProfileString=Skyfort Shield - Windows 11

; ============================================================
; AUTENTICACAO - 4 controles
; ============================================================
[System Access]
; SHIELD-AUTH-001: Senha minima 14 caracteres
MinimumPasswordLength = 14

; SHIELD-AUTH-002: Bloqueio apos 5 falhas
LockoutBadCount = 5
ResetLockoutCount = 15
LockoutDuration = 15

; SHIELD-AUTH-003: Conta Guest desabilitada
EnableGuestAccount = 0

; SHIELD-AUTH-004: Complexidade de senha
PasswordComplexity = 1
PasswordHistorySize = 24
MinimumPasswordAge = 1
MaximumPasswordAge = 90

; ============================================================
; AUDITORIA - 2 controles
; ============================================================
[Event Audit]
; SHIELD-AUDIT-001: Auditoria de logon
AuditLogonEvents = 3
AuditAccountLogon = 3

; SHIELD-AUDIT-002: Auditoria de sistema
AuditSystemEvents = 3
AuditObjectAccess = 2
AuditPrivilegeUse = 2
AuditPolicyChange = 3
AuditAccountManage = 3

; ============================================================
; REGISTRO - 14 controles
; ============================================================
[Registry Values]
; SHIELD-FILE-002: Permissao pasta Windows
machine\software\microsoft\windows\currentversion\policies\system\EnableLUA=4,1

; SHIELD-NET-001: Firewall ativo
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\enablefirewall=4,1
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\publicprofile\enablefirewall=4,1
machine\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\enablefirewall=4,1

; SHIELD-NET-002: SMBv1 desabilitado
machine\system\currentcontrolset\services\lanmanserver\parameters\smb1=4,0
machine\system\currentcontrolset\services\mrxsmb10\start=4,4

; SHIELD-NET-003: RDP com NLA
machine\system\currentcontrolset\control\terminal server\winstations\rdp-tcp\UserAuthentication=4,1

; SHIELD-NET-004: RDP nao exposto (desabilitado por default)

; SHIELD-SYS-001: Windows Update automatico
machine\software\policies\microsoft\windows\windowsupdate\au\AUOptions=4,4
machine\software\policies\microsoft\windows\windowsupdate\au\NoAutoUpdate=4,0

; SHIELD-SYS-002: Telnet desabilitado
machine\system\currentcontrolset\services\telnet\start=4,4

; SHIELD-SYS-003: PowerShell v2 desabilitado
machine\software\microsoft\powershell\1\powershellengine\ApplicationBase=4,0

; SHIELD-APP-001: UAC habilitado
machine\software\microsoft\windows\currentversion\policies\system\EnableLUA=4,1
machine\software\microsoft\windows\currentversion\policies\system\ConsentPromptBehaviorAdmin=4,2

; SHIELD-APP-002: SmartScreen habilitado
machine\software\policies\microsoft\windows\system\EnableSmartScreen=4,1
machine\software\policies\microsoft\microsoftedge\phishingfilter\EnabledV9=4,1

; SHIELD-APP-003: AutoRun desabilitado
machine\software\microsoft\windows\currentversion\policies\explorer\NoDriveTypeAutoRun=4,255
machine\software\microsoft\windows\currentversion\policies\explorer\NoAutoRun=4,1

; SHIELD-MON-002: Windows Defender ativo
machine\software\policies\microsoft\windows defender\DisableAntiSpyware=4,0
machine\software\policies\microsoft\windows defender\real-time protection\DisableRealtimeMonitoring=4,0

; PSS-001: Carimbo de identificacao da baseline aplicada
MACHINE\Software\PSS\Baseline=1,"Skyfort Top15 v2.0.0 - Windows 11"

[Profile Description]
Description=Skyfort Shield - Windows 11 Essential Security (20 controles)