这是来自 Michael Schneider 的 Windows Hardening 项目 的 HardeningKitty 稳定版本。HardeningKitty 的稳定版本使用 scip AG 的代码签名证书进行签名。由于这是稳定版本，我们不在本仓库接受拉取请求，请将其发送至开发仓库。
HardeningKitty 支持对 Windows 系统进行加固。系统配置通过查找列表（finding list）进行检索和评估。此外，还可以根据预定义值对系统进行加固。HardeningKitty 从注册表读取设置，并使用其他模块读取注册表之外的配置。
该脚本是为英文系统开发的。在其他语言环境下，分析结果可能不正确。如果出现这种情况，请创建一个 issue。
以管理员权限运行脚本以访问计算机设置。对于用户设置，最好使用普通用户帐户执行。理想情况下，该用户帐户用于日常办公。
下载 HardeningKitty 并复制到目标系统（脚本和列表）。然后即可导入并执行 HardeningKitty：```powershell PS C:\tmp> Import-Module .\HardeningKitty.psm1 PS C:\tmp> Invoke-HardeningKitty -EmojiSupport
=^._.^=
_( )/ HardeningKitty 0.9.0-1662273740
[*] 9/4/2022 8:54:12 AM - Starting HardeningKitty
[] 9/4/2022 8:54:12 AM - Getting user information [] Hostname: DESKTOP-DG83TOD [*] Domain: WORKGROUP
...
[] [] 9/4/2022 8:54:12 AM - Starting Category Account Policies [😺] ID 1103, Store passwords using reversible encryption, Result=0, Severity=Passed [😺] ID 1100, Account lockout threshold, Result=10, Severity=Passed [😺] ID 1101, Account lockout duration, Result=30, Severity=Passed
...
[*] 9/4/2022 8:54:12 AM - Starting Category User Rights Assignment [😿] ID 1200, Access this computer from the network, Result=BUILTIN\Administrators;BUILTIN\Users, Recommended=BUILTIN\Administrators, Severity=Medium
...
[*] 9/4/2022 8:54:14 AM - Starting Category Administrative Templates: Printer [🙀] ID 1764, Point and Print Restrictions: When installing drivers for a new connection (CVE-2021-34527), Result=1, Recommended=0, Severity=High [🙀] ID 1765, Point and Print Restrictions: When updating drivers for an existing connection (CVE-2021-34527), Result=2, Recommended=0, Severity=High
...
[*] 9/4/2022 8:54:19 AM - Starting Category MS Security Guide [😿] ID 2200, LSA Protection, Result=, Recommended=1, Severity=Medium [😼] ID 2201, Lsass.exe audit mode, Result=, Recommended=8, Severity=Low
...
[] 9/4/2022 8:54:25 AM - HardeningKitty is done [] 9/4/2022 8:54:25 AM - Your HardeningKitty score is: 4.82. HardeningKitty Statistics: Total checks: 325 - Passed: 213, Low: 33, Medium: 76, High: 3.
## 如何安装
首先，在 *PSModulePath* 环境变量列出的路径中创建目录 *HardeningKitty*，并为每个版本创建子目录，如 *0.9.3*。
将模块 *HardeningKitty.psm1*、*HardeningKitty.psd1* 以及 *lists* 目录复制到此新目录。```powershell
PS C:\tmp> $Version = "0.9.3"
PS C:\tmp> New-Item -Path $Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty\$Version -ItemType Directory
PS C:\tmp> Copy-Item -Path .\HardeningKitty.psd1,.\HardeningKitty.psm1,.\lists\ -Destination $Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty\$Version\ -Recurse
有关详细信息，请参阅 Microsoft 的文章 安装 PowerShell 模块。
你可以使用下面的脚本下载并安装 HardeningKitty 的最新版本。```powershell Function InstallHardeningKitty() { $Version = (((Invoke-WebRequest "https://api.github.com/repos/0x6d69636b/windows_hardening/releases/latest" -UseBasicParsing) | ConvertFrom-Json).Name).SubString(2) $HardeningKittyLatestVersionDownloadLink = ((Invoke-WebRequest "https://api.github.com/repos/0x6d69636b/windows_hardening/releases/latest" -UseBasicParsing) | ConvertFrom-Json).zipball_url $ProgressPreference = 'SilentlyContinue' Invoke-WebRequest $HardeningKittyLatestVersionDownloadLink -Out HardeningKitty$Version.zip Expand-Archive -Path ".\HardeningKitty$Version.zip" -Destination ".\HardeningKitty$Version" -Force $Folder = Get-ChildItem .\HardeningKitty$Version | Select-Object Name -ExpandProperty Name Move-Item ".\HardeningKitty$Version$Folder*" ".\HardeningKitty$Version" Remove-Item ".\HardeningKitty$Version$Folder" New-Item -Path $Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty$Version -ItemType Directory Set-Location .\HardeningKitty$Version Copy-Item -Path .\HardeningKitty.psd1,.\HardeningKitty.psm1,.\lists\ -Destination $Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty$Version\ -Recurse Import-Module "$Env:ProgramFiles\WindowsPowerShell\Modules\HardeningKitty$Version\HardeningKitty.psm1" } InstallHardeningKitty
## 示例
### 审计
默认模式是 _audit_。HardeningKitty 执行审计，将结果保存为 CSV 文件，并创建日志文件。文件会自动命名并添加时间戳。使用参数 _ReportFile_ 或 _LogFile_，也可以指定自己的名称和路径。
_Filter_ 参数可用于过滤加固列表。为此，必须使用 PowerShell ScriptBlock 语法，例如 `{ $_.ID -eq 4505 }`。以下元素可用于过滤：ID、Category、Name、Method 和 Severity。```powershell
Invoke-HardeningKitty -Mode Audit -Log -Report
HardeningKitty 可以使用由参数 FileFindingList 定义的特定列表来执行。如果在同一系统上多次运行 HardeningKitty，隐藏机器信息可能会很有用。参数 SkipMachineInformation 即用于此目的。```powershell Invoke-HardeningKitty -FileFindingList .\lists\finding_list_0x6d69636b_user.csv -SkipMachineInformation
HardeningKitty 使用默认列表，并且仅检查严重性为 Medium 的测试。```powershell
Invoke-HardeningKitty -Filter { $_.Severity -eq "Medium" }
模式 config 会检索系统的所有当前设置。如果某项设置尚未配置，HardeningKitty 将使用查找列表中存储的默认值。此模式可以与其他功能结合使用，例如创建备份。
HardeningKitty 获取当前设置并将其存储在报告中：```powershell Invoke-HardeningKitty -Mode Config -Report -ReportFile C:\tmp\my_hardeningkitty_report.csv
### 备份
备份很重要。非常重要。因此，HardeningKitty 也提供了一项功能，用于检索当前配置并将其保存为可部分还原的形式。
**免责声明：** HardeningKitty 会尽力还原原始配置。对于注册表项，这一功能运行得相当不错，而且 Hardening Kitty 确实已尽力而为。但备份功能并非快照，也不能替代真正的系统备份。仅靠 HardeningKitty 无法在 HailMary 之后将系统 1:1 还原。如果有此需求，请创建镜像或系统备份并进行还原。
_Backup_ 开关用于指定以查找列表形式写入文件，因此可用于 _HailMary_ 模式。备份的名称和路径可以通过参数 _BackupFile_ 指定。```powershell
Invoke-HardeningKitty -Mode Config -Backup
请先测试此功能，确认它在目标系统上确实正常工作，然后再进行任何重大更改。薛定谔的备份是危险的。
请注意，如果未指定 -FileFindingList，则备份将引用默认的发现列表。在 HailMary 模式下部署 特定 列表之前，始终创建一份 引用该特定列表 的备份。```powershell Invoke-HardeningKitty -Mode Config -Backup -BackupFile ".\myBackup.csv" -FileFindingList ".\list{list}.csv"
#### 恢复备份
_Backup_ 开关会创建一个查找列表形式的文件，要恢复备份，请像加载任何查找列表一样，在 _HailMary_ 模式下加载它：```powershell
Invoke-HardeningKitty -Mode HailMary -Log -Report -FileFindingList ".\myBackup.csv"
HailMary 方法非常强大。它可用于在系统上部署发现列表。所有发现都按照列表中的建议设置在系统上。能力越大，责任越大。请仅在您清楚自己在做什么的情况下使用此模式。请务必备份系统。
目前，过滤功能仅在 Audit 和 Config 模式下受支持。由于 HailMary 模式是一个棘手的问题，请创建自己的文件并删除所有要过滤的行。```powershell Invoke-HardeningKitty -Mode HailMary -Log -Report -FileFindingList .\lists\finding_list_0x6d69636b_machine.csv
在运行 HailMary 之前，必须选择一个发现列表。重要的是检查设置是否会对系统的稳定性和功能产生影响。在运行 HailMary 之前，应进行备份。
### 创建组策略（实验性）
感谢 [@gderybel](https://github.com/gderybel)，HardeningKitty 可以将发现列表转换为组策略。基本要求是必须安装 Group Policy Management PowerShell 模块。目前只能转换注册表设置，且并非所有内容都经过全面测试。只要新策略未分配给对象，就不会对系统进行任何更改。请谨慎使用。```powershell
Invoke-HardeningKitty -Mode GPO -FileFindingList .\lists\finding_list_0x6d69636b_machine.csv -GPOName HardeningKitty-Machine-01
在写入模式（HailMary 和 GPO）下，查找列表完全控制将应用于系统的内容。为确保列表在到达操作员手中之前未被篡改（例如被投毒的仓库、共享的基线、下载或通过电子邮件发送的"运行此列表"），HardeningKitty 可以验证列表是否为由维护者发布的真实且未经更改的版本。
官方列表由 lists\ 目录中随附的签名清单进行认证：
lists\hardeningkitty_lists_manifest.psd1 - 一个可读文件，将每个官方列表映射到其 SHA-256 哈希lists\hardeningkitty_lists_manifest.psd1.p7s - 对该清单的分离签名，使用维护者证书创建在运行时，HardeningKitty 会验证分离签名，并检查签名者的证书是否与模块中固定的指纹（$HardeningKittyListSigningThumbprint）匹配。它还将已加载列表的哈希与清单进行比较。其哈希包含在签名清单中的列表为 官方 / 已验证。任何其他列表均为 自定义 / 未验证。这是来源证明，而非允许列表——完全支持自定义列表。
各模式下的行为：
-AllowCustomList 开关明确接受风险，否则自定义或修改过的列表将被拒绝```powershellInvoke-HardeningKitty -Mode HailMary -FileFindingList .\my_custom_list.csv -AllowCustomList
Note that verification only confirms that a list has not been altered by the publisher. It cannot guarantee that the settings in a list are safe. It also does not protect against a malicious administrator - someone with administrator privileges can change the system directly. However, it does protect the honest operator against running a tampered or incorrect list.
### Running Your Own Lists
Building and running your own custom lists is fully supported. An unsigned custom list simply runs in Audit/Config and requires the `-AllowCustomList` switch in write mode. To get the same 'verified' experience for your own lists, sign your list content with your code-signing certificate and pin your thumbprint locally. HardeningKitty's trust anchor is a single thumbprint.
### Why RSA and not ECC?
The manifest is signed and verified as a PKCS#7/CMS structure (`System.Security.Cryptography.Pkcs.SignedCms`). On Windows PowerShell 5.1 (.NET Framework 4.x, still the default on Windows) CMS signing/verification with ECDSA keys is unreliable, whereas RSA works across both Windows PowerShell 5.1 and PowerShell 7. Since HardeningKitty must run on both, RSA-4096 is the interoperable choice.
## HardeningKitty Score
Each Passed finding gives 4 points, a Low finding gives 2 points, a Medium finding gives 1 point and a High Finding gives 0 points.
The formula for the HardeningKitty Score is _(Points achieved / Maximum points) * 5 + 1_.
### Rating
| Score | Rating Casual | Rating Professional |
| :---- | :------------ | :------------------ |
| 6 | 😹 Excellent | Excellent |
| 5 | 😺 Well done | Good |
| 4 | 😼 Sufficient | Sufficient |
| 3 | 😿 You should do better | Insufficient |
| 2 | 🙀 Weak | Insufficient |
| 1 | 😾 Bogus | Insufficient |
## HardeningKitty Interface
[@ataumo](https://github.com/ataumo) build a web based interface for HardeningKitty. The tool can be used to create your own lists and provides additional information on the hardening settings. The [source code](https://github.com/ataumo/policies_hardening_interface) is under AGPL license and there is a [demo site](https://phi.cryptonit.fr/policies_hardening_interface/).
## KittyPorter - Make Hardening Kitty Reports Great Again
[Yair](https://github.com/Y8765) took care of presenting HardeningKitty results for sysadmins and even management in the form of a beautiful Excel spreadsheet containing Security Assessment Dashboards and a Dashboard with Dynamic Updates based on the status of findings, as well as an HTML Report Overview. He publishes his work in the [KittyPorter](https://github.com/Y8765/KittyPorter) repo.
## Last Update
HardeningKitty can be used to audit systems against the following baselines / benchmarks:
| Name | System Version | Version |
| :--- | :---------------- | :------ |
| 0x6d69636b Windows 11 (Machine) | 25H2 | |
| 0x6d69636b Windows 11 (User) | 25H2 | |
| BSI SiSyPHuS Windows 10 hoher Schutzbedarf Domänenmitglied (Machine) | 1809 | 1.0 |
| BSI SiSyPHuS Windows 10 hoher Schutzbedarf Domänenmitglied (User) | 1809| 1.0
| BSI SiSyPHuS Windows 10 normaler Schutzbedarf Domänenmitglied (Machine) | 1809| 1.0 |
| BSI SiSyPHuS Windows 10 normaler Schutzbedarf Domänenmitglied (User) | 1809| 1.0 |
| BSI SiSyPHuS Windows 10 normaler Schutzbedarf Einzelrechner (Machine) | 1809| 1.0 |
| BSI SiSyPHuS Windows 10 normaler Schutzbedarf Einzelrechner (User) | 1809 | 1.0 |
| CIS Microsoft Windows 10 Enterprise (Machine) | 1809 | 1.6.1 |
| CIS Microsoft Windows 10 Enterprise (User) | 1809 | 1.6.1 |
| CIS Microsoft Windows 10 Enterprise (Machine) | 1903 | 1.7.1 |
| CIS Microsoft Windows 10 Enterprise (User) | 1903 | 1.7.1 |
| CIS Microsoft Windows 10 Enterprise (Machine) | 1909 | 1.8.1 |
| CIS Microsoft Windows 10 Enterprise (User) | 1909 | 1.8.1 |
| CIS Microsoft Windows 10 Enterprise (Machine) | 2004 | 1.9.1 |
| CIS Microsoft Windows 10 Enterprise (User) | 2004 | 1.9.1 |
| CIS Microsoft Windows 10 Enterprise (Machine) | 20H2 | 1.10.1 |
| CIS Microsoft Windows 10 Enterprise (User) | 20H2 | 1.10.1 |
| CIS Microsoft Windows 10 Enterprise (Machine) | 21H1 | 1.11.0 |
| CIS Microsoft Windows 10 Enterprise (User) | 21H1 | 1.11.0 |
| CIS Microsoft Windows 10 Enterprise (Machine) | 21H2 | 1.12.0 |
| CIS Microsoft Windows 10 Enterprise (User) | 21H2 | 1.12.0 |
| CIS Microsoft Windows 10 Enterprise (Machine) | 22H2 | 2.0.0 |
| CIS Microsoft Windows 10 Enterprise (User) | 22H2 | 2.0.0 |
| CIS Microsoft Windows 10 Enterprise (Machine) | 22H2 | 3.0.0 |
| CIS Microsoft Windows 10 Enterprise (User) | 22H2 | 3.0.0 |
| CIS Microsoft Windows 11 Enterprise (Machine) | 21H2 | 1.0.0 |
| CIS Microsoft Windows 11 Enterprise (User) | 21H2 | 1.0.0 |
| CIS Microsoft Windows 11 Enterprise (Machine) | 22H2 | 2.0.0 |
| CIS Microsoft Windows 11 Enterprise (User) | 22H2 | 2.0.0 |
| CIS Microsoft Windows 11 Enterprise (Machine) | 23H2 | 3.0.0 |
| CIS Microsoft Windows 11 Enterprise (User) | 23H2 | 3.0.0 |
| CIS Microsoft Windows 11 Enterprise (Machine) | 24H2 | 4.0.0 |
| CIS Microsoft Windows 11 Enterprise (User) | 24H2 | 4.0.0 |
| CIS Microsoft Windows Server 2012 R2 (Machine) | R2 | 2.4.0 |
| CIS Microsoft Windows Server 2012 R2 (User) | R2 | 2.4.0 |
| CIS Microsoft Windows Server 2012 R2 (Machine) | R2 | 2.6.0 |
| CIS Microsoft Windows Server 2012 R2 (User) | R2 | 2.6.0 |
| CIS Microsoft Windows Server 2012 R2 (Machine) | R2 | 3.0.0 |
| CIS Microsoft Windows Server 2012 R2 (User) | R2 | 3.0.0 |
| CIS Microsoft Windows Server 2016 (Machine) | 1607 | 1.2.0 |
| CIS Microsoft Windows Server 2016 (User) | 1607 | 1.2.0 |
| CIS Microsoft Windows Server 2016 (Machine) | 1607 | 1.3.0 |
| CIS Microsoft Windows Server 2016 (User) | 1607 | 1.3.0 |
| CIS Microsoft Windows Server 2016 (Machine) | 1607 | 2.0.0 |
| CIS Microsoft Windows Server 2016 (User) | 1607 | 2.0.0 |
| CIS Microsoft Windows Server 2016 (Machine) | 1607 | 3.0.0 |
| CIS Microsoft Windows Server 2016 (User) | 1607 | 3.0.0 |
| CIS Microsoft Windows Server 2019 (Machine) | 1809 | 1.1.0 |
| CIS Microsoft Windows Server 2019 (User) | 1809 | 1.1.0 |
| CIS Microsoft Windows Server 2019 (Machine) | 1809 | 1.2.1 |
| CIS Microsoft Windows Server 2019 (User) | 1809 | 1.2.1 |
| CIS Microsoft Windows Server 2019 (Machine) | 1809 | 2.0.0 |
| CIS Microsoft Windows Server 2019 (User) | 1809 | 2.0.0 |
| CIS Microsoft Windows Server 2019 (Machine) | 1809 | 3.0.0 |
| CIS Microsoft Windows Server 2019 (User) | 1809 | 3.0.0 |
| CIS Microsoft Windows Server 2022 (Machine) | 21H2 | 1.0.0 |
| CIS Microsoft Windows Server 2022 (User) | 21H2 | 1.0.0 |
| CIS Microsoft Windows Server 2022 (Machine) | 22H2 | 2.0.0 |
| CIS Microsoft Windows Server 2022 (User) | 22H2 | 2.0.0 |
| CIS Microsoft Windows Server 2022 (Machine) | 22H2 | 3.0.0 |
| CIS Microsoft Windows Server 2022 (User) | 22H2 | 3.0.0 |
| CIS Microsoft Windows Server 2022 (Machine) | 22H2 | 4.0.0 |
| CIS Microsoft Windows Server 2022 (User) | 22H2 | 4.0.0 |
| CIS Microsoft Windows Server 2025 (Machine) | 24H2 | 1.0.0 |
| CIS Microsoft Windows Server 2025 (User) | 24H2 | 1.0.0 |
| DoD Microsoft Windows 10 STIG (Machine) | 20H2 | v2r1 |
| DoD Microsoft Windows 10 STIG (User) | 20H2 | v2r1 |
| DoD Windows Server 2019 Domain Controller STIG (Machine) | 20H2 | v2r1 |
| DoD Windows Server 2019 Domain Controller STIG (User) | 20H2 | v2r1 |
| DoD Windows Server 2019 Member Server STIG (Machine) | 20H2 | v2r1 |
| DoD Windows Server 2019 Member Server STIG (User) | 20H2 | v2r1 |
| DoD Windows Defender Antivirus STIG | 20H2 | v2r1 |
| DoD Windows Firewall STIG | 20H2 | v1r7 |
| Microsoft Security baseline for Microsoft Edge | 87 | Final |
| Microsoft Security baseline for Microsoft Edge | 88, 89, 90, 91 | Final |
| Microsoft Security baseline for Microsoft Edge | 92 | Final |
| Microsoft Security baseline for Microsoft Edge | 93, 94 | Final |
| Microsoft Security baseline for Microsoft Edge | 95 | Final |
| Microsoft Security baseline for Microsoft Edge | 96 | Final |
| Microsoft Security baseline for Microsoft Edge | 97 | Final |
| Microsoft Security baseline for Microsoft Edge | 98, 99, 100, 101, 102, 103, 104, 105, 106 | Final |
| Microsoft Security baseline for Microsoft Edge | 107, 108, 109, 110, 111 | Final |
| Microsoft Security baseline for Microsoft Edge | 112, 113 | Final |
| Microsoft Security baseline for Microsoft Edge | 114, 115, 116 | Final |
| Microsoft Security baseline for Microsoft Edge | 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127 | Final |
| Microsoft Security baseline for Microsoft Edge | 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138 | Final |
| Microsoft Security baseline for Microsoft Edge | 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149 | Final |
| Microsoft Security baseline for Windows 10 | 2004 | Final |
| Microsoft Security baseline for Windows 10 | 20H2, 21H1 | Final |
| Microsoft Security baseline for Windows 10 | 21H2 | Final |
| Microsoft Security baseline for Windows 10 (Machine) | 22H2 | Final |
| Microsoft Security baseline for Windows 10 (User) | 22H2 | Final |
| Microsoft Security baseline for Windows 11 | 21H2 | Final |
| Microsoft Security baseline for Windows 11 (Machine) | 22H2 | Final |
| Microsoft Security baseline for Windows 11 (User) | 22H2 | Final |
| Microsoft Security baseline for Windows 11 (Machine) | 23H2 | Final |
| Microsoft Security baseline for Windows 11 (User) | 23H2 | Final |
| Microsoft Security baseline for Windows 11 (Machine) | 24H2 | Final |
| Microsoft Security baseline for Windows 11 (User) | 24H2 | Final |
| Microsoft Security baseline for Windows 11 (Machine) | 25H2 | Final |
| Microsoft Security baseline for Windows 11 (User) | 25H2 | Final |
| Microsoft Security baseline for Windows Server (DC) | 2004 | Final |
| Microsoft Security baseline for Windows Server (Member) | 2004 | Final |
| Microsoft Security baseline for Windows Server (DC) | 20H2 | Final |
| Microsoft Security baseline for Windows Server (Member) | 20H2 | Final |
| Microsoft Security baseline for Windows Server 2022 (DC) | 21H2 | Final |
| Microsoft Security baseline for Windows Server 2022 (Member) | 21H2 | Final |
| Microsoft Security baseline for Windows Server 2025 (DC) | 24H2 | Final |
| Microsoft Security baseline for Windows Server 2025 (Member) | 24H2 | Final |
| Microsoft Security baseline for Windows Server 2025 (DC) | 2506 | Final |
| Microsoft Security baseline for Windows Server 2025 (Member) | 2506 | Final |
| Microsoft Security baseline for Windows Server 2025 (DC) | 2602 | Final |
| Microsoft Security baseline for Windows Server 2025 (Member) | 2602 | Final |
| Microsoft Security baseline for Office 365 ProPlus (Machine) | Sept 2019 | Final |
| Microsoft Security baseline for Office 365 ProPlus (User) | Sept 2019 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (Machine) | v2104, v2106 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (User) | v2104, v2106 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (Machine) | v2112 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (User) | v2112 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (Machine) | v2206 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (User) | v2206 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (Machine) | v2306, v2312 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (User) | v2306, v2312 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (Machine) | v2412 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (User) | v2412 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (Machine) | v2512 | Final |
| Microsoft Security Baseline for Microsoft 365 Apps for enterprise (User) | v2512 | Final |
| Microsoft Windows Server TLS Settings | 1809 | 1.0 |
| Microsoft Windows Server TLS Settings (Future Use with TLSv1.3) | 1903 | 1.0 |
## Sources* [CIS 基准](https://www.cisecurity.org/cis-benchmarks/)
* [安全基线（最终版）：Windows 10 和 Windows Server 版本 2004](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-windows-10-and-windows-server-version/ba-p/1543631)
* [Windows 10 和 Windows Server 版本 20H2 的安全基线（最终版）](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-and-windows-server/ba-p/1999393)
* [Windows 10 版本 21H1 的安全基线（最终版）](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-version-21h1/ba-p/2362353)
* [Windows 10 版本 21H2 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-windows-10-version-21h2/ba-p/3042703)
* [Windows Server 2022 安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-server-2022-security-baseline/ba-p/2724685)
* [Windows Server 2025 的安全基线，安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/windows-server-2025-security-baseline/4358733)
* [Windows Server 2025 版本 2506 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-baseline-for-windows-server-2025-version-2506/4426431)
* [Windows Server 2025 版本 2602 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-baseline-for-windows-server-2025-version-2602/4496468)
* [Windows 11 安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-security-baseline/ba-p/2810772)
* [Windows 11 版本 22H2 安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-22h2-security-baseline/ba-p/3632520)
* [Windows 11 版本 23H2 安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-23h2-security-baseline/ba-p/3967618)
* [Windows 11 版本 24H2 安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows-11-version-24h2-security-baseline/ba-p/4252801)
* [Windows 11 版本 25H2 安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/windows-11-version-25h2-security-baseline/4456231)
* [适用于 Thunderbolt 3 的内核 DMA 保护](https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)
* [BitLocker 对策](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-countermeasures)
* [阻止 SBP-2 驱动程序和 Thunderbolt 控制器以减少 1394 DMA 和 Thunderbolt DMA 对 BitLocker 的威胁](https://support.microsoft.com/en-us/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d)
* [管理 Windows Defender Credential Guard](https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage)
* [使用攻击面减少规则减少攻击面](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)
* [配置额外的 LSA 保护](https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)
* [安全打开包含动态数据交换 (DDE) 字段的 Microsoft Office 文档](https://docs.microsoft.com/en-us/security-updates/securityadvisories/2017/4053440)
* [DDE 注册表设置](https://gist.githubusercontent.com/wdormann/732bb88d9b5dd5a66c9f1e1498f31a1b/raw/69c9d9d14b386d8f178e59a046804501ec1ee304/disable_ddeauto.reg)
* [Sysmon](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon)
* [SwiftOnSecurity/sysmon-config](https://github.com/SwiftOnSecurity/sysmon-config)
* [Dane Stuckey - @cryps1s 使用 Windows 防火墙实现端点隔离](https://medium.com/@cryps1s/endpoint-isolation-with-the-windows-firewall-462a795f4cfb)
* [Microsoft 安全合规工具包 1.0](https://www.microsoft.com/en-us/download/details.aspx?id=55319)
* [策略分析器](https://blogs.technet.microsoft.com/secguide/2016/01/22/new-tool-policy-analyzer/)
* [Office 365 ProPlus 的安全基线（v1908，2019 年 9 月）- 最终版](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-office-365-proplus-v1908-sept-2019-final/ba-p/873084)
* [Microsoft 365 企业应用版 v2104 的安全基线 - 最终版](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-365-apps-for-enterprise-v2104/ba-p/2307695)
* [Microsoft 365 企业应用版 v2106 的安全基线 - 最终版](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-365-apps-for-enterprise-v2106/ba-p/2492355)
* [Microsoft 365 企业应用版 v2112 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-365-apps-for-enterprise-v2112/ba-p/3038172)
* [Microsoft 365 企业应用版 v2206 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-m365-apps-for-enterprise-v2306/ba-p/3858702)
* [Microsoft 365 企业应用版 v2306 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-m365-apps-for-enterprise-v2306/ba-p/3858702)
* [Microsoft 365 企业应用版 v2312 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-m365-apps-for-enterprise-v2312/ba-p/4009591)
* [M365 企业应用版 v2412 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-baseline-for-m365-apps-for-enterprise-v2412/4357320)
* [M365 企业应用版 v2512 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-baseline-for-m365-apps-for-enterprise-v2512/4487213)
* [mackwage/windows_hardening.cmd](https://gist.github.com/mackwage/08604751462126599d7e52f233490efe)
* [Microsoft Edge 版本 87 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-87/ba-p/1950297)
* [Microsoft Edge 版本 89 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-89/ba-p/2186265)
* [Microsoft Edge v92 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v92/ba-p/2563679)
* [Microsoft Edge v93 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v93/ba-p/2744505)
* [Microsoft Edge v95 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v95/ba-p/2897269)
* [Microsoft Edge v96 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v96/ba-p/2997665)
* [Microsoft Edge v97 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v97/ba-p/3062252)
* [Microsoft Edge v98 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v98/ba-p/3165443)
* [Microsoft Edge v99 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v99/ba-p/3249241)
* [Microsoft Edge v100 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v100/ba-p/3281982)
* [Microsoft Edge v101 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v101/ba-p/3298140)
* [Microsoft Edge v102 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v102/ba-p/3465195)
* [Microsoft Edge v103 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v103/ba-p/3548236)
* [Microsoft Edge v104 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v104/ba-p/3593826)
* [Microsoft Edge v105 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v105/ba-p/3615904)
* [Microsoft Edge v106 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-106/ba-p/3643958)
* [Microsoft Edge v107 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v107/ba-p/3678903)
* [Microsoft Edge v108 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-108/ba-p/3691250)
* [Microsoft Edge v109 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-109/ba-p/3713981)
* [Microsoft Edge v110 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-110/ba-p/3740900)
* [Microsoft Edge v111 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-111/ba-p/3767483)
* [Microsoft Edge v112 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-112/ba-p/3789975)
* [Microsoft Edge v113 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-113/ba-p/3814398)
* [Microsoft Edge v114 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-114/ba-p/3839728)
* [Microsoft Edge v115 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-115/ba-p/3882420)
* [Microsoft Edge v116 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-116/ba-p/3905425)
* [Microsoft Edge v117 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-117/ba-p/3930862)
* [Microsoft Edge v118 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-118/ba-p/3955123)
* [Microsoft Edge v119 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-119/ba-p/3978427)
* [Microsoft Edge v120 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-120/ba-p/4009561)
* [Microsoft Edge v121 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-121/ba-p/4057135)
* [Microsoft Edge v122 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-122/ba-p/4073142)
* [Microsoft Edge v123 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-123/ba-p/4098458)
* [Microsoft Edge v124 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-124/ba-p/4124826)
* [Microsoft Edge v125 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-125/ba-p/4146218)
* [Microsoft Edge v126 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-126/ba-p/4168263)
* [Microsoft Edge v127 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-127/ba-p/4205820)
* [Microsoft Edge v128 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-128/ba-p/4237524)
* [Microsoft Edge v129 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-129/ba-p/4250551)
* [Microsoft Edge v130 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-130/ba-p/4273981)
* [Microsoft Edge v131 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-131/4298314)
* [Microsoft Edge v132 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-132/4358734)
* [Microsoft Edge v133 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-133/4376048)
* [Microsoft Edge v134 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-134/4393674)
* [Microsoft Edge v135 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-135/4406195)
* [Microsoft Edge v136 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-136/4410797)
* [Microsoft Edge v137 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-137/4420095)
* [Microsoft Edge v138 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-138/4427877)
* [Microsoft Edge v139 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-baseline-for-microsoft-edge-version-139/4441251)
* [Microsoft Edge v140 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-140/ba-p/4452553)
* [Microsoft Edge v141 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-141/ba-p/4460481)
* [Microsoft Edge v142 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-142/ba-p/4466598)
* [Microsoft Edge v143 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-143/ba-p/4474871)
* [Microsoft Edge v144 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-144/ba-p/4486065)
* [Microsoft Edge v145 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-145/ba-p/4494968)
* [Microsoft Edge v146 的安全基线](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-review-for-microsoft-edge-version-146/ba-p/4502057)
* [Microsoft Edge v147 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-147/4509974)
* [Microsoft Edge v148 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-148/4521209)
* [Microsoft Edge v149 的安全基线](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/security-review-for-microsoft-edge-version-149/4526371)
* [Microsoft Edge - 策略](https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies)
* [关于 Office 365 遥测的提示](https://twitter.com/milenkowski/status/1326865844215934979)
* [BSI：Microsoft Office 遥测分析报告](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Studien/Office_Telemetrie/Office_Telemetrie.pdf?__blob=publicationFile&v=5)
* [使用策略设置管理 Microsoft 365 企业应用版的隐私控制](https://docs.microsoft.com/en-us/deployoffice/privacy/manage-privacy-controls)
* [DoD Cyber Exchange Public - 安全技术实施指南 (STIG) - 组策略对象](https://public.cyber.mil/stigs/gpo/)
* [BSI SiSyPHuS Win10：Windows 10 加固指南](https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendations/SiSyPHuS_Win10/AP11/SiSyPHuS_AP11.html)
* [为 SSL 完全前向保密和 TLS 1.2 配置 Microsoft Windows 或 IIS](https://www.hass.de/content/setup-microsoft-windows-or-iis-ssl-perfect-forward-secrecy-and-tls-12)
* [Nartac Software - IIS Crypto](https://www.nartac.com/Products/IISCrypto/)
* [.NET Framework 的传输层安全 (TLS) 最佳实践](https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls)
* [Windows Server 2022 中的 TLS 密码套件](https://docs.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022)
* [传输层安全 (TLS) 注册表设置](https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings)
* [Windows Defender 防病毒软件现在可以在沙盒中运行](https://www.microsoft.com/security/blog/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/)
* [KB5005010：应用 2021 年 7 月 6 日更新后限制新打印机驱动程序的安装](https://support.microsoft.com/en-us/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7)
* [admx.help - 组策略管理模板目录](https://admx.help/)
* [如何通过 SMB 客户端防御保护用户免受拦截攻击](https://techcommunity.microsoft.com/t5/itops-talk-blog/how-to-defend-users-from-interception-attacks-via-smb-client/ba-p/1494995)
* [从 Windows PowerShell 5.1 迁移到 PowerShell 7](https://learn.microsoft.com/en-us/powershell/scripting/whats-new/migrating-from-windows-powershell-51-to-powershell-7)
* [Excel 中的数据安全与 Python](https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327)
* [Windows 客户端已弃用的功能](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features)
* [Windows 客户端管理 - Policy CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider)