Advanced Windows Security: A Guide to Netsh Commands and Password Management

Securing Windows systems is a crucial aspect of cybersecurity. This guide explores advanced configuration and protection techniques.

1. Configuring the Firewall with Netsh

Basic Configuration

# Enable the firewall
netsh advfirewall set allprofiles state on

# Configure the profiles
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound

# Configure notifications
netsh advfirewall set allprofiles notifications on

Advanced Rules

# Create a rule for a specific service
netsh advfirewall firewall add rule name="Allow RDP" dir=in action=allow protocol=TCP localport=3389

# Rule to block an IP address
netsh advfirewall firewall add rule name="Block Malicious IP" dir=in action=block remoteip=192.168.1.100

# Rule for a specific program
netsh advfirewall firewall add rule name="Allow Chrome" dir=out action=allow program="C:\Program Files\Google\Chrome\Application\chrome.exe"

2. Password Management

Password Policy

# Configure the password policy
net accounts /minpwlen:12 /maxpwage:90 /minpwage:1 /uniquepw:24

# Enable password complexity
secedit /configure /cfg C:\Windows\Security\templates\secsetup.inf /areas SECURITYPOLICY

Account Management

# Create an account with a complex password
$password = ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force
New-LocalUser -Name "User1" -Password $password -PasswordNeverExpires $false

# Change the password
Set-LocalUser -Name "User1" -Password $password

3. Securing the Network

IPsec Configuration

# Create an IPsec policy
netsh ipsec static add policy name="SecurePolicy" description="Politique sécurisée"

# Add a filter rule
netsh ipsec static add filterlist name="SecureList"
netsh ipsec static add filter filterlist="SecureList" srcaddr=any dstaddr=any protocol=TCP srcport=0 dstport=0

# Configure the security action
netsh ipsec static add filteraction name="SecureAction" qmsecmethods=esp:sha1+3des

DNS Configuration

# Secure DNS configuration
netsh interface ipv4 set dns name="Ethernet" static 8.8.8.8
netsh interface ipv4 add dns name="Ethernet" 8.8.4.4 index=2

# Enable DNSSEC
netsh interface ipv4 set dnssec name="Ethernet" enable

4. Securing Services

Service Management

# Disable non-essential services
sc config RemoteRegistry start= disabled
sc config Telnet start= disabled
sc config TFTP start= disabled

# Configure permissions
sc sdset RemoteRegistry D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

Port Configuration

# Block unused ports
netsh advfirewall firewall add rule name="Block Port 445" dir=in action=block protocol=TCP localport=445
netsh advfirewall firewall add rule name="Block Port 3389" dir=in action=block protocol=TCP localport=3389

5. Auditing and Monitoring

Audit Configuration

# Enable event auditing
auditpol /set /category:"Account Logon" /success:enable /failure:enable
auditpol /set /category:"Logon Events" /success:enable /failure:enable
auditpol /set /category:"Object Access" /success:enable /failure:enable

# Configure logs
wevtutil sl Security /maxsize:4294967296 /retention:true

Event Monitoring

# Create a monitoring task
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-File C:\Scripts\MonitorEvents.ps1"
$trigger = New-ScheduledTaskTrigger -Daily -At 9AM
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "Security Monitoring"

6. Security Scripts

Security Check

# Security check script
function Test-SecuritySettings {
    # Check the firewall
    $firewall = Get-NetFirewallProfile
    Write-Host "État du pare-feu:"
    $firewall | Format-Table Name, Enabled

    # Check the services
    $services = Get-Service | Where-Object {$_.Status -eq "Running"}
    Write-Host "Services en cours d'exécution:"
    $services | Format-Table Name, Status

    # Check open ports
    $ports = netstat -an | findstr "LISTENING"
    Write-Host "Ports en écoute:"
    $ports
}

Security Maintenance

# Maintenance script
function Update-SecuritySettings {
    # Update the firewall rules
    netsh advfirewall firewall delete rule name=all
    netsh advfirewall firewall add rule name="Allow RDP" dir=in action=allow protocol=TCP localport=3389

    # Check the accounts
    $accounts = Get-LocalUser | Where-Object {$_.Enabled -eq $true}
    foreach ($account in $accounts) {
        if ($account.PasswordRequired -eq $false) {
            Set-LocalUser -Name $account.Name -PasswordRequired $true
        }
    }
}

7. Best Practices

System Configuration

# Disable non-essential features
Disable-WindowsOptionalFeature -Online -FeatureName "Windows Media Player"
Disable-WindowsOptionalFeature -Online -FeatureName "Internet Explorer"

# Configure the security policy
secedit /configure /cfg C:\Windows\Security\templates\secsetup.inf /areas SECURITYPOLICY

Update Management

# Configure Windows Update
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" -Name "AUOptions" -Value 4

# Schedule updates
$action = New-ScheduledTaskAction -Execute "wuauclt.exe" -Argument "/detectnow"
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 3AM
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "Windows Update"

Conclusion

Securing Windows requires:

• Proper firewall configuration
• Strict password management
• Constant monitoring
• Regular updates
• Accurate documentation

Key takeaways:

• Use complex passwords
• Keep the firewall enabled
• Monitor security events
• Perform regular audits
• Follow security best practices