Merge pull request #57 from LoicVeirman/2.9.5-dev

Removing of BitLocker GPO and scripts

Author: kdvhh

Configs/TasksSequence_HardenAD.xml

@@ -646,13 +646,6 @@
 		<GpoLink Path="RootDN" Enabled="No" Enforced="No"/>
     </GPO>
 	  -->
-
-    <!-- <GPO BackupID="{4D872198-701E-4D42-B7D0-7ADE946DB2C8}" Validation="Yes" Name="HAD-Anonymous-SAM-Blocked" Description="Harden AD ===================
-Blocks anonymous access to SAM database.">
-      <GpoMode Mode="BOTH" Tier="Tier0"/>
-      <GpoFilter WMI="Windows-2016-and-Newer"/>
-      <GpoLink Path="RootDN" Enabled="Yes" Enforced="Yes"/>
-    </GPO> -->
     <GPO BackupID="{3B8C8687-8779-4042-AFF9-83F88BB4B894}" Validation="Yes" Name="HAD-Auto-Update-S1-Thu-0h-Srv" Description="Harden AD ===================
 Scheduling of updates and reboot after 15min of the machine in W1 on Wednesday at 00:00 AM">
       <GpoMode Mode="BOTH" Tier="Tier0" />
@@ -701,19 +694,6 @@ Setting up Windows Update on Windows 7/8 machines according to the recommendatio
       <GpoFilter WMI="Windows-Legacy-OS-Clients" />
       <GpoLink Path="OU=Harden_TL,RootDN" Enabled="Yes" Enforced="Yes" />
     </GPO>
-    <GPO BackupID="{B547F05F-E600-48BA-92BB-8B9DB98570F0}" Validation="Yes" Name="HAD-Bitlocker-TpmOnly-Win10-11" Description="Harden AD ===================
-Enable BitLocker encryption with Trusted Platform Module.">
-      <GpoMode Mode="BOTH" Tier="Tier0" />
-      <GpoFilter WMI="Windows-Supported-OS-Clients" />
-      <GpoLink Path="RootDN" Enabled="Yes" Enforced="Yes" />
-    </GPO>
-    <GPO BackupID="{C1325B52-6705-47B9-BDE8-0C47BE25EF6A}" Validation="Yes" Name="HAD-Bitlocker-TpmPin-Win10-11" Description="Harden AD ===================
-Enable BitLocker encryption with Trusted Platform Module. 6-digit PIN code required.">
-      <GpoMode Mode="BOTH" Tier="Tier0" />
-      <GpoFilter WMI="Windows-Supported-OS-Clients" />
-      <GpoLink Path="OU=Workstations,OU=Harden_T12,RootDN" Enabled="Yes" Enforced="Yes" />
-      <GpoLink Path="OU=Users,OU=Harden_T12,RootDN" Enabled="Yes" Enforced="Yes" />
-    </GPO>
     <GPO BackupID="{651CC04C-B863-4346-B90F-7D97B42020BC}" Validation="Yes" Name="HAD-BloodHound-Mitigation" Description="Harden AD ===================
 Disable Net Session enumeration - Bloodhound / NetCease.">
       <GpoMode Mode="BOTH" Tier="Tier0" />
@@ -907,7 +887,7 @@ Blocks connections to tier 1 machines from other tier accounts">
       <GpoMode Mode="BOTH" Tier="Tier0" />
       <GpoFilter WMI="Windows-Supported-OS-Servers-NoDC" />
       <GpoLink Path="OU=Harden_T12,RootDN" Enabled="Yes" Enforced="Yes" />
-          </GPO>
+    </GPO>
     <GPO BackupID="{DA57EB62-4947-4D5B-B2B8-C46DEEDE846B}" Validation="Yes" Name="HAD-LoginRestrictions-T1L" Description="Harden AD ===================
 Blocks connections to tier legacy servers from other tier accounts">
       <GpoMode Mode="BOTH" Tier="Tier0" />
@@ -982,7 +962,7 @@ Disables the print spooler service on windows system.">
     <GPO BackupID="{AA731818-2050-4EE5-A0A1-088E75A458D8}" Validation="Yes" Name="HAD-Reset-KRBTGT-Password" Description="Harden AD ===================
 Reset the password of the krbtgt account every 30 days">
       <GpoMode Mode="BOTH" Tier="Tier0" />
-      <GpoLink Path="OU=Domain Controllers,RootDN" Enabled="Yes" Enforced="Yes" /> 
+      <GpoLink Path="OU=Domain Controllers,RootDN" Enabled="Yes" Enforced="Yes" />
       <GpoFilter WMI="Windows-PDC" />
     </GPO>
 
@@ -1137,33 +1117,33 @@ Configure default search provider.">
       <GpoLink Path="OU=Workstations,OU=Harden_T12,RootDN" Enabled="Yes" Enforced="Yes" />
     </GPO>
 
-  <GPO BackupID="{37624146-725D-4C9D-812A-64980DEA40B4}" Validation="Yes" Name="HAD-LDAP-Audit-Disabled" Description="Harden AD ===================
+    <GPO BackupID="{37624146-725D-4C9D-812A-64980DEA40B4}" Validation="Yes" Name="HAD-LDAP-Audit-Disabled" Description="Harden AD ===================
 Configure default search provider.">
       <GpoMode Mode="BOTH" Tier="Tier0" />
     </GPO>
-  
-  <GPO BackupID="{5C8FC2E1-4D88-4DE1-ABAC-EADDFAB774EC}" Validation="Yes" Name="HAD-TLS-1_0-Disabled" Description="Harden AD ===================
+
+    <GPO BackupID="{5C8FC2E1-4D88-4DE1-ABAC-EADDFAB774EC}" Validation="Yes" Name="HAD-TLS-1_0-Disabled" Description="Harden AD ===================
 Configure default search provider.">
       <GpoMode Mode="BOTH" Tier="Tier0" />
       <GpoLink Path="RootDN" Enabled="Yes" Enforced="Yes" />
     </GPO>
-  <GPO BackupID="{A3A7B599-37C0-484F-9560-8ED89D0B4C16}" Validation="Yes" Name="HAD-TLS-1_0-Enabled" Description="Harden AD ===================
+    <GPO BackupID="{A3A7B599-37C0-484F-9560-8ED89D0B4C16}" Validation="Yes" Name="HAD-TLS-1_0-Enabled" Description="Harden AD ===================
 Configure default search provider.">
       <GpoMode Mode="BOTH" Tier="Tier0" />
     </GPO>
-  <GPO BackupID="{E00C5E60-64BD-43AD-840F-CB1AFC59E264}" Validation="Yes" Name="HAD-TLS-1_1-Disabled" Description="Harden AD ===================
+    <GPO BackupID="{E00C5E60-64BD-43AD-840F-CB1AFC59E264}" Validation="Yes" Name="HAD-TLS-1_1-Disabled" Description="Harden AD ===================
 Configure default search provider.">
       <GpoMode Mode="BOTH" Tier="Tier0" />
     </GPO>
-  <GPO BackupID="{AFD12E92-B9D1-4139-9C5A-E8BD5C5B71A8}" Validation="Yes" Name="HAD-TLS-1_1-Enabled" Description="Harden AD ===================
+    <GPO BackupID="{AFD12E92-B9D1-4139-9C5A-E8BD5C5B71A8}" Validation="Yes" Name="HAD-TLS-1_1-Enabled" Description="Harden AD ===================
 Configure default search provider.">
       <GpoMode Mode="BOTH" Tier="Tier0" />
     </GPO>
-  <GPO BackupID="{DC5E5873-959B-422A-9FC5-2D88576ED9AB}" Validation="Yes" Name="HAD-TLS-1_2-Disabled" Description="Harden AD ===================
+    <GPO BackupID="{DC5E5873-959B-422A-9FC5-2D88576ED9AB}" Validation="Yes" Name="HAD-TLS-1_2-Disabled" Description="Harden AD ===================
 Configure default search provider.">
       <GpoMode Mode="BOTH" Tier="Tier0" />
     </GPO>
-  <GPO BackupID="{CBEE8835-3DB2-42E7-9497-9C1B70710342}" Validation="Yes" Name="HAD-TLS-1_2-Enabled" Description="Harden AD ===================
+    <GPO BackupID="{CBEE8835-3DB2-42E7-9497-9C1B70710342}" Validation="Yes" Name="HAD-TLS-1_2-Enabled" Description="Harden AD ===================
 Configure default search provider.">
       <GpoMode Mode="BOTH" Tier="Tier0" />
     </GPO>
@@ -1451,7 +1431,7 @@ Configure default search provider.">
     <!--
     ################################################################################################################################### -->
     <!-- flushing Sensible groups with MCS-GroupsFlushing.ps1 -->
-    
+
     <SchedTask Name="MCS - Sensitive Groups Flushing" Xml="MCS-GroupsFlushing.xml">
       <SchedCmd>powershell.exe</SchedCmd>
       <SchedArg>-windowstyle hidden -file .\MCS-GroupsFlushing.ps1</SchedArg>