All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Github Action - Work In Progress
- IE - disable legacy jscript engine
- repository: pre-commit config
- appveyor: update ansible pypi to 4.3.0/3.4.0
- repository: gitignore, lint
- travis-ci
- Github Action - Work In Progress
- IE - disable legacy jscript engine
- defaults: harden flash off - to remove as Flash EOL
- github action: lint as separated workflow
- appveyor: update ansible pypi to 2.10.7/2.9.19/3.1.0, enforce cryptography 3.3.2 (no rust)
- repository: lint
- s/travis-ci.org/travis-ci.com/
- AMSI registry setting
- disable remote management of Service Control Manager
- References
- WSH: separate task file, TrustPolicy option to enforce signed
- lint
- external references
- github.com/caseysmithrc/MimkatzCollider: repository 404
- Github: rename tags to match semantic versioning: 0.7.0, 0.7.1, 0.8.0
- Appveyor: use cygwin python36-cryptography
- Appveyor: update ansible to 2.8.1/2.7.11/2.6.17
- Travis: default to xenial and python3
- more linting
- testing speculative: add SpecuCheck
- DeviceGuard CodeIntegrity: microsoft recommended policy
- packer: Azure configuration
- Heavy lint following galaxy new rules following adoption of ansible-lint https://groups.google.com/forum/#!topic/ansible-project/ehrb6AEptzA https://docs.ansible.com/ansible-lint/rules/default_rules.html https://github.com/ansible/ansible-lint
- Galaxy dependency naming evolution (juju4.redhat_epel, harden_sysctl...)
- appveyor: update ansible to 2.7.5/2.6.11/2.5.14
- Shadow Copy: disable vssadmin.exe on Win10
- Hardened UNC paths: RequirePrivacy option
- Custom LSASS AuditLevel
- appveyor: update ansible to 2.7.0/2.6.5/2.5.10
- TaskScheduler hardening (optional)
- STIG/IADgov settings enforcement (mostly general stuff, registry-based)
- SAMRi10 hardening remote
- Cryptography settings: enable TLS1.2, disable SSL2-3
- test/full: test suite with extra ansible roles
- testing: Intel-SA-00086 Detection Tool for Intel ME
- testing: IAD Secure-Host-Baseline
- testing: speculative execution
- testing: mimikatz and variants
- win10b1709 ASR options
- Disable sticky keys
- AppLocker template
- packer: Virtualbox, Vmware configurations
- Windows Event Forwarding (WEF) configuration (without GPO)
- Configure Windows Error Reporting (WER)
- Disable Admin Shares
- test/full: disable nxlog - upstream chocolatey package issue
- harden_win_acl: defaults disabled
- Win privilege: ansible syntax for Nobody = 'Null SID'
- Cortana: disabled
- Review permissions for ansible and inspec folders
- Move to separate ansible roles: juju4.win-ad-monitor, win-services, win-powershell, win-applocker, win-osquery...
- fix some path escaping, bad merge
- Initial commit on Github, include simple travis, kitchen and vagrant tests