Hardening and Auditing Windows Operating System

Table of Contents

• Introduction
• Tools Used
• Approach to Problem
• Learning Outcomes
• References

Introduction

The premise of this project is to first harden Windows based OS (Windows 10) through screenshots and written instructions. The second part is to enable auditing and interact with a small number of files to generate audit events. The final report will be linked in the References section.

Tools Used

The tools used here are the following:

1. Oracle VM VirtualBox
2. Windows 10 ISO
3. Windows Defender Firewall
4. Local Group Policy Editor
5. Local Computer Policy
6. Windows Defender Credential Guard
7. Bitlocker
8. auditpol
9. PowerShell
10. Splunk

Approach to Problem

1. Used multiple tools as listed above to harden the Windows system (refer to written report for full details).
2. Enabled auditing for Windows 10 via command line tool auditpol or Local Group Policy Editor (gpedit.msc) to edit audit policies.
3. Forwarded it to Splunk by using the Splunk Universal Forwarder.
4. Ran a search in Splunk to show data was successfully forwarded (see references for output).

Learning Outcomes

1. Learned how to use the tools listed in the Tools Used section to harden Windows OS.
2. Learned how to enable auditing for Windows OS through command line or Local Group Policy Editor.
3. Learned how to generate a report through Splunk after the data has been aggregated.

References

1. Written report linked here
2. Splunk output