Agent skill
windows-hardening
Harden Windows servers per security baselines and CIS benchmarks. Configure Group Policy, Windows Defender, and security features. Use when securing Windows Server environments.
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/windows-hardening
Metadata
Additional technical details for this skill
- author
- devops-skills
- version
- 1.0
SKILL.md
Windows Hardening
Secure Windows servers following Microsoft security baselines and CIS benchmarks.
When to Use This Skill
Use this skill when:
- Hardening Windows servers
- Implementing security baselines
- Meeting compliance requirements
- Configuring Windows security features
Security Baseline
# Download Microsoft Security Baseline
# Apply via Group Policy or LGPO tool
# Install Security Compliance Toolkit
Install-Module -Name SecurityPolicyDsc
Account Policies
# Password policy via Group Policy
# Computer Configuration > Policies > Windows Settings > Security Settings
# PowerShell alternative
net accounts /minpwlen:14 /maxpwage:90 /minpwage:1 /uniquepw:24
# Disable Administrator account
Rename-LocalUser -Name "Administrator" -NewName "LocalAdmin"
Disable-LocalUser -Name "Guest"
Windows Firewall
# Enable firewall
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
# Default deny
Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow
# Allow specific rules
New-NetFirewallRule -DisplayName "Allow RDP" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow
Audit Configuration
# Enable advanced audit policy
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
auditpol /set /subcategory:"Security Group Management" /success:enable
# Enable PowerShell logging
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
Windows Defender
# Enable real-time protection
Set-MpPreference -DisableRealtimeMonitoring $false
# Enable cloud protection
Set-MpPreference -MAPSReporting Advanced
# Configure scans
Set-MpPreference -ScanScheduleDay Everyday
Set-MpPreference -ScanScheduleTime 02:00:00
Best Practices
- Apply security baselines
- Enable Windows Defender ATP
- Configure AppLocker
- Disable SMBv1
- Enable Credential Guard
- Regular Windows updates
- Implement LAPS for local admin passwords
Related Skills
- cis-benchmarks - Compliance scanning
- windows-server - Server administration
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?