Table of Contents

STIGing Standalone Windows Servers

Download all the required files from the GitHub Repository

Introduction:

Windows Server 2012, 2016, and 2019 are insecure operating systems out of the box and requires many changes to insure FISMA compliance. Microsoft, Cyber.mil, the Department of Defense, and the National Security Agency have recommended and required configuration changes to lockdown, harden, and secure the operating system and ensure government compliance. These changes cover a wide range of mitigations including blocking telemetry, macros, removing bloatware, and preventing many physical attacks on a system.

Standalone systems are some of the most difficult and annoying systems to secure. When not automated, they require manual changes of each STIG/SRG. Totalling over 1000 configuration changes on a typical deployment and an average of 5 minutes per change equaling 3.5 days worth of work. This script aims to speed up that process significantly.

Notes:

  • This script is designed for operation in Enterprise environments and assumes you have hardware support for all the requirements.
  • This script is not designed to bring a system to 100% compliance, rather it should be used as a stepping stone to complete most, if not all, the configuration changes that can be scripted.
    • Minus system documentation, this collection should bring you up to about 95% compliance on all the STIGS/SRGs applied.

Requirements:

A list of scripts and tools this collection utilizes:

Additional configurations were considered from:

STIGS/SRGs Applied:

How to run the script

The script may be launched from the extracted GitHub download like this:

.\sos-secure-standalone-server.ps1

The script we will be must be launched from the directory containing all the files from the GitHub Repository