Suggestions - "settings managed by adminstrator" and ms baseline flexibility/value editor

[sirjeannot]

Hello,

is there a way to apply hardening without having the windows interface disabling controls with the charming warning : "this setting is managed by your administrator". (in this case me)
I know this appears because these settings managed by gpo, but still wondering if it is feasible. It would also greatly help to be able to find options based on the exact same phrasing as the windows settings options.

also

would it be possible in the ms security baseline to have

• a button so remove selected measures
• a value editor to tweak settings which are value based. ex: audit log size

and finally, thanks for making such a tool. even if the mid profile (3 stars) is too agressive on some aspects (mostly because of ms sec baseline, and disabling sleep because of bitlocker) and too lax for others (ex: aslr, depth of scan).
But I guess this is to be expected as everyone has different expectations. 👍

[HotCakeX]

Hi, i don't think it's possible, if it is i'm not aware of it but i can keep looking for you.

Yes, you can already do that. right-click or tap + hold on items in the baseline pages to remove them.

Everywhere else there is also a separate Remove/Apply/Verify button. You could also use the Group policy Editor page for more customizations but currently there isn't a way to manually change policy values to any custom value. But Group Policy Editor shows the exact values. I could make them editable by user in a future update, would it be useful to you?

You're very welcome. Yes, the presets are just my opinion of a recommended/middle ground for quick usage. For more customization you should definitely visit each category's page and make further customizations and once you're done, you could create a backup in the Protect page which will save the states in a file and then you can use the file to quickly change any system's security to match yours.

So essentially you only have to configure your settings once and reuse as many times as you want :)

[sirjeannot]

Hello.

Thank you for your message.
For the admin settings message, I'm not sure it's feasible so no need to waste time. i've quickly looked into it but we enter enterprise grade computer management.
It would help to have an editor for the values set in the registry! the remove button removes all entries. and deleting an entry (tested on PasswordHistorySize) doesn't reset/remove the value. After a new "verify all" (and also a reboot), the value is still there.
As for the profile, indeed I'll end up making one that fits my expectations and environment. :)

This is a very welcome tool that give finally a push to break with outdated backward compatibility.

Thank you!

[HotCakeX]

You're right, PasswordHistorySize is System Access type. Currently, only Group Policy and Audit Policy types are supported for removals when it comes to Microsoft Security baseline. Group Policies are deleted from the system, setting them to "Not Configured" state and Audit Policies are set to "No Auditing".

System Access is different because it's not a policy but rather a secure configuration for the system set via API calls and each OS version can have a different default value. For example, 22H2 might have 12 as default whereas 25H2 might have 20 as default.

I will definitely implement modifying values directly in the Group Policy Editor page. I'll also add support for removing System Access types for Microsoft Security baseline by recording what the default configuration is on a clean Windows 11 25H2 installation and saving it in the app as default values for each of them.

I'm glad you think so, thank you!

[HotCakeX]

Hi @sirjeannot
I implemented both of the features you requested: https://github.com/HotCakeX/Harden-Windows-Security/releases/tag/HardenSystemSecurity-v1.0.41.0

Please update to the latest version to use them. Don't hesitate to open new threads for more changes or features you'd like to see in Harden System Security app. 😊

[sirjeannot]

just updated and indeed, it's all there. thank you very much for the addition!

[HotCakeX]

Awesome, my pleasure!