35 lines
3.3 KiB
Markdown
35 lines
3.3 KiB
Markdown
# Comitari Windows hardening safe v1 (WAPT source)
|
||
|
||
SOURCE ONLY: must build and sign with the organization's WAPT tooling. Not yet Windows/WAPT-tested.
|
||
|
||
## Scope
|
||
Five HKLM registry settings: disable AutoRun and AutoPlay (including non-volume devices), disable lock-screen camera and slideshows. No account / password / LAPS change. No WAPT, firewall, network, SMB, BitLocker, Microsoft Defender, antivirus, remote desktop, printing or power settings change.
|
||
|
||
## Implementation
|
||
- `setup.py` now contains the complete install, audit and conditional rollback logic.
|
||
- Registry reads and writes use WAPT 2.6 `setuphelpers` (`reg_key_exists`, `reg_value_exists`, `reg_openkey_noredir`, `reg_getvalue`, `registry_set`, and `reg_delvalue`). No PowerShell process or external command is launched.
|
||
- The approved setting table is centralized in `SETTINGS`. A future `update_package.py` can validate operator-selected settings and serialize them as package data; this refactor keeps the current five-setting policy fixed.
|
||
- If a future package configuration changes a setting’s target, its update flow must migrate the saved uninstall target while preserving the original pre-install value. That migration is not part of this refactor.
|
||
- The WAPT package source currently has no `WAPT/control` or `update_package.py`; it is code-only and is not yet a complete buildable WAPT package.
|
||
|
||
## Safeguards
|
||
- Initial values are saved once in `%ProgramData%\Comitari\HardeningSafe\original-values.json` before any modifications. The JSON layout remains compatible with the prior PowerShell package.
|
||
- If the baseline is absent, malformed or incomplete, uninstall refuses to make registry changes.
|
||
- Reinstallation idempotent; uninstall conditional: restores only values still equal to package target, leaving externally modified values unchanged.
|
||
- No reboot forced. Audit implemented.
|
||
- State persists after uninstall intentionally, so repeated uninstall does not overwrite third-party edits.
|
||
- Audit is read-only. A non-compliant or unreadable setting returns `WARNING`; successful collection with all five values at target returns `OK`.
|
||
|
||
## Deployment
|
||
1. Inspect `setup.py` and the five `SETTINGS` entries in an isolated preproduction repository.
|
||
2. Validate registry settings and resulting behavior on a Windows 11 25H2 representative workstation, especially AutoPlay workflow.
|
||
3. Build/sign WAPT package with organization's key. Do not distribute unsigned sources as a ready-to-deploy binary.
|
||
4. Deploy to 1 test PC, verify WAPT agent/check-in, LapsByWAPT password rotation and recovery, business apps, USB workflows.
|
||
5. Expand to 3-5 devices for 48h and later to waves. Remove machine dependency before `wapt-get remove`; see WAPT docs on remove vs uninstall.
|
||
6. Verify rollback in pilot via `wapt-get uninstall comitari-hardening-safe` (function call) and validate state.
|
||
|
||
IMPORTANT: `wapt-get remove` is NOT assured to execute a custom uninstall() function. Follow your WAPT version's verified removal workflow and audit this before promotion.
|
||
|
||
## Deliberately deferred
|
||
Windows LAPS controls 10701-10703 (LapsByWAPT alternative); firewall enforcement; VBS/HVCI/Credential Guard; ASR; NTLM/SMB guest/signing; SMBv1 removal; BitLocker; print drivers; user rights; audit logging and command-line collection; remote admin; LLMNR and NetBIOS. These require separate pilot checks.
|