{"id":1128,"date":"2025-03-19T11:19:31","date_gmt":"2025-03-19T11:19:31","guid":{"rendered":"https:\/\/virtualall.sk\/?p=1128"},"modified":"2026-09-11T14:45:13","modified_gmt":"2026-09-11T14:45:13","slug":"cis-benchmark","status":"publish","type":"post","link":"https:\/\/virtualall.sk\/en\/2025\/03\/cis-benchmark\/","title":{"rendered":"CIS Benchmark"},"content":{"rendered":"\n

V s\u00fa\u010dasnom digit\u00e1lnom svete je kybernetick\u00e1 bezpe\u010dnos\u0165 nevyhnutnou s\u00fa\u010das\u0165ou ochrany firemn\u00fdch aj individu\u00e1lnych IT syst\u00e9mov. Neust\u00e1le rast\u00face mno\u017estvo kybernetick\u00fdch hrozieb, ako s\u00fa ransomv\u00e9r, phishingov\u00e9 \u00fatoky \u010di zneu\u017eitie bezpe\u010dnostn\u00fdch zranite\u013enost\u00ed, si vy\u017eaduje systematick\u00fd a efekt\u00edvny pr\u00edstup k ochrane IT infra\u0161trukt\u00fary<\/strong>.<\/p>\n\n\n\n

Jedn\u00fdm z najuzn\u00e1vanej\u0161\u00edch bezpe\u010dnostn\u00fdch \u0161tandardov v tejto oblasti je CIS Benchmark<\/strong> \u2013 s\u00fabor osved\u010den\u00fdch postupov a odpor\u00fa\u010dan\u00ed na posilnenie bezpe\u010dnosti opera\u010dn\u00fdch syst\u00e9mov, siet\u00ed, aplik\u00e1ci\u00ed a cloudov\u00fdch prostred\u00ed<\/strong>.<\/p>\n\n\n\n

\u010co je CIS Benchmark?<\/strong><\/h2>\n\n\n\n

CIS Benchmark<\/strong> je s\u00e9ria bezpe\u010dnostn\u00fdch odpor\u00fa\u010dan\u00ed<\/strong> vypracovan\u00fdch Center for Internet Security (CIS)<\/strong> \u2013 neziskovou organiz\u00e1ciou, ktor\u00e1 sa \u0161pecializuje na kybernetick\u00fa ochranu a v\u00fdvoj bezpe\u010dnostn\u00fdch \u0161tandardov<\/strong>. Tieto odpor\u00fa\u010dania pom\u00e1haj\u00fa organiz\u00e1ci\u00e1m konfigurova\u0165 svoje IT syst\u00e9my tak, aby minimalizovali bezpe\u010dnostn\u00e9 rizik\u00e1<\/strong>.<\/p>\n\n\n\n

CIS Benchmarky pokr\u00fdvaj\u00fa \u0161irok\u00e9 spektrum technol\u00f3gi\u00ed vr\u00e1tane:
\u2714 Windows a Linux opera\u010dn\u00fdch syst\u00e9mov<\/strong>
\u2714 Sie\u0165ov\u00fdch zariaden\u00ed (Cisco, Palo Alto, Juniper, at\u010f.)<\/strong>
\u2714 Cloudov\u00fdch platforiem (Microsoft Azure, AWS, Google Cloud)<\/strong>
\u2714 Datab\u00e1zov\u00fdch syst\u00e9mov (MSSQL, MySQL, Oracle, PostgreSQL)<\/strong>
\u2714 Aplika\u010dn\u00fdch a webov\u00fdch serverov (IIS, Apache, Nginx, Tomcat, at\u010f.)<\/strong><\/p>\n\n\n\n

Ka\u017ed\u00fd CIS Benchmark obsahuje konkr\u00e9tne konfigura\u010dn\u00e9 odpor\u00fa\u010dania<\/strong>, ktor\u00e9 s\u00fa rozdelen\u00e9 do dvoch \u00farovn\u00ed:<\/p>\n\n\n\n

    \n
  • Level 1<\/strong> \u2013 Z\u00e1kladn\u00e9 odpor\u00fa\u010dania, ktor\u00e9 minimalizuj\u00fa bezpe\u010dnostn\u00e9 rizik\u00e1 bez z\u00e1sadn\u00e9ho vplyvu na funkcionalitu.<\/li>\n\n\n\n
  • Level 2<\/strong> \u2013 Pokro\u010dil\u00e9 odpor\u00fa\u010dania ur\u010den\u00e9 pre vysoko bezpe\u010dn\u00e9 prostredia, ktor\u00e9 m\u00f4\u017eu vy\u017eadova\u0165 zmeny v spr\u00e1ve IT infra\u0161trukt\u00fary.<\/li>\n<\/ul>\n\n\n\n

    Implement\u00e1cia<\/h2>\n\n\n\n

    NTP (Network Time Protocol)<\/strong> je protokol, ktor\u00fd umo\u017e\u0148uje synchroniz\u00e1ciu syst\u00e9mov\u00fdch hod\u00edn medzi po\u010d\u00edta\u010dmi a servermi v sieti. Bez presn\u00e9ho \u010dasu m\u00f4\u017ee doch\u00e1dza\u0165 k v\u00e1\u017enym probl\u00e9mom, ako s\u00fa:<\/p>\n\n\n\n

      \n
    1. Nespr\u00e1vne \u010dasov\u00e9 zna\u010dky v logoch<\/strong>\n
        \n
      • Ak syst\u00e9my nie s\u00fa spr\u00e1vne synchronizovan\u00e9, \u010dasov\u00e9 pe\u010diatky v logoch sa nezhoduj\u00fa, \u010do komplikuje anal\u00fdzu bezpe\u010dnostn\u00fdch incidentov a forenzn\u00fa anal\u00fdzu.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
      • Probl\u00e9my s autentiz\u00e1ciou a \u0161ifrovan\u00edm<\/strong>\n
          \n
        • Mnoho autentiza\u010dn\u00fdch protokolov (napr. Kerberos v Active Directory<\/strong>) je citliv\u00fdch na \u010dasov\u00fa odch\u00fdlku. Ak \u010das nie je presn\u00fd, m\u00f4\u017ee to vies\u0165 k ne\u00faspe\u0161n\u00fdm pokusom o prihl\u00e1senie.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
        • Nezhody pri replik\u00e1cii a z\u00e1lohovan\u00ed<\/strong>\n
            \n
          • Datab\u00e1zy a synchroniza\u010dn\u00e9 slu\u017eby ako Active Directory, DNS, DFS a datab\u00e1zov\u00e9 clustre<\/strong> vy\u017eaduj\u00fa presn\u00fd \u010das na spr\u00e1vnu koordin\u00e1ciu oper\u00e1ci\u00ed.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
          • Ochrana proti replay \u00fatokom<\/strong>\n
              \n
            • V niektor\u00fdch sie\u0165ov\u00fdch bezpe\u010dnostn\u00fdch mechanizmoch m\u00f4\u017ee \u00fato\u010dn\u00edk vyu\u017ei\u0165 star\u00e9 (neaktu\u00e1lne) pakety, ak syst\u00e9m nespr\u00e1vne sprac\u00fava \u010dasov\u00e9 pe\u010diatky.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n

              CIS odpor\u00fa\u010dania pre spr\u00e1vne nastavenie NTP<\/strong><\/h2>\n\n\n\n

              CIS Benchmark odpor\u00fa\u010da nieko\u013eko best practices<\/strong> pri nastavovan\u00ed NTP:<\/p>\n\n\n\n

              1\ufe0f\u20e3 Pou\u017eitie spo\u013eahliv\u00fdch NTP serverov<\/strong><\/h3>\n\n\n\n

              CIS odpor\u00fa\u010da nastavi\u0165 manu\u00e1lny zoznam NTP serverov<\/strong> s d\u00f4veryhodn\u00fdmi zdrojmi \u010dasu. Odpor\u00fa\u010dan\u00fd pr\u00edkaz na konfigur\u00e1ciu v syst\u00e9me Windows:<\/p>\n\n\n\n

              CIS odpor\u00fa\u010dania pre spr\u00e1vne nastavenie NTP

              CIS Benchmark odpor\u00fa\u010da nieko\u013eko best practices pri nastavovan\u00ed NTP:
              Pou\u017eitie spo\u013eahliv\u00fdch NTP serverov

              CIS odpor\u00fa\u010da nastavi\u0165 manu\u00e1lny zoznam NTP serverov s d\u00f4veryhodn\u00fdmi zdrojmi \u010dasu. Odpor\u00fa\u010dan\u00fd pr\u00edkaz na konfigur\u00e1ciu v syst\u00e9me Windows:
              <\/p>\n\n\n\n

              # Set NTP servers\n# Define NTP servers\n$NTSpeerList = \"ntp.mhite.sk,ntp2.mhite.sk\"\n# Configure NTP\nw32tm \/config \/syncfromflags:manual \/manualpeerlist:\"$NTSpeerList\" \/update \/reliable:yes\n\n# Set NTP service startup type to Automatic\nSet-Service -Name w32time -StartupType Automatic\n\n# Restart the NTP service to apply changes\nRestart-Service w32time -Force\n<\/code><\/pre>\n\n\n\n
                  syncfromflags:manual \u2013 nastav\u00ed manu\u00e1lne synchronizovan\u00e9 servery
                  manualpeerlist \u2013 zoznam d\u00f4veryhodn\u00fdch serverov
                  update \u2013 aplikuje zmeny okam\u017eite
                  reliable:yes \u2013 ozna\u010d\u00ed server ako spo\u013eahliv\u00fd zdroj \u010dasu

              \ud83d\udca1 D\u00f4le\u017eit\u00e9: Pou\u017e\u00edvanie intern\u00fdch NTP serverov v organiz\u00e1cii pom\u00e1ha zabezpe\u010di\u0165 presnos\u0165 a zni\u017euje z\u00e1vislos\u0165 od extern\u00fdch zdrojov, ktor\u00e9 m\u00f4\u017eu by\u0165 nedostupn\u00e9 alebo kompromitovan\u00e9.<\/p>\n\n\n\n
              Allow log on through Remote Desktop Services’ (RDP)<\/h2>\n\n\n\n
              V r\u00e1mci bezpe\u010dnostn\u00fdch odpor\u00fa\u010dan\u00ed CIS (Center for Internet Security) Benchmark<\/strong> patr\u00ed obmedzenie vzdialen\u00e9ho pr\u00edstupu cez Remote Desktop Services (RDP)<\/strong> medzi k\u013e\u00fa\u010dov\u00e9 opatrenia na ochranu syst\u00e9mov pred neopr\u00e1vnen\u00fdm pr\u00edstupom. Tento skript zabezpe\u010duje, \u017ee skupina Administrators<\/strong> strat\u00ed opr\u00e1vnenie na priame prihl\u00e1senie cez RDP, \u010d\u00edm sa v\u00fdrazne zvy\u0161uje bezpe\u010dnos\u0165 syst\u00e9mu.<\/p>\n\n\n\n
              \"C:\\Install\\ntrights.exe\" -u \"Administrators\" -r SeRemoteInteractiveLogonRight<\/code><\/pre>\n\n\n\n
              High Performance\u201c Power Pl\u00e1n<\/h2>\n\n\n\n
              V r\u00e1mci bezpe\u010dnostn\u00fdch odpor\u00fa\u010dan\u00ed CIS (Center for Internet Security) Benchmark<\/strong> sa kladie d\u00f4raz nielen na bezpe\u010dnos\u0165, ale aj na optim\u00e1lne nastavenie v\u00fdkonu a stability syst\u00e9mu<\/strong>. Aktiv\u00e1cia High Performance (Vysok\u00fd v\u00fdkon)<\/strong> re\u017eimu nap\u00e1jania je odpor\u00fa\u010dan\u00e1 pre servery, kritick\u00e9 syst\u00e9my a zariadenia, ktor\u00e9 vy\u017eaduj\u00fa maxim\u00e1lny v\u00fdkon<\/strong> bez oh\u013eadu na spotrebu energie.<\/p>\n\n\n\n
              # Activate the \"High Performance\" Power Plan\n$HighPerfGUID = \"8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c\"\npowercfg -setactive $HighPerfGUID\n# Optional: Verify that the High Performance plan is active\n$currentPlan = powercfg -getactivescheme\nWrite-Log \"Active Power Plan: $currentPlan\"<\/code><\/pre>\n\n\n\n
              Pre\u010do je d\u00f4le\u017eit\u00e9 spr\u00e1vne nastavi\u0165 lok\u00e1lne \u00fa\u010dty vo Windows?<\/h2>\n\n\n\n
              V r\u00e1mci bezpe\u010dnostn\u00fdch odpor\u00fa\u010dan\u00ed CIS (Center for Internet Security) Benchmark<\/strong> je spr\u00e1vne nastavenie lok\u00e1lnych \u00fa\u010dtov nevyhnutn\u00e9 na ochranu syst\u00e9mu pred neopr\u00e1vnen\u00fdm pr\u00edstupom. Tento skript vykon\u00e1va tri d\u00f4le\u017eit\u00e9 bezpe\u010dnostn\u00e9 opatrenia<\/strong>, ktor\u00e9 minimalizuj\u00fa riziko zneu\u017eitia lok\u00e1lnych \u00fa\u010dtov<\/strong> a zvy\u0161uj\u00fa celkov\u00fa bezpe\u010dnos\u0165 syst\u00e9mu<\/strong>.<\/p>\n\n\n\n
              # Accounts Section\n# Block Microsoft accounts\nSet-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' -Name 'NoConnectedUser' -Type DWord -Value 3\n# Disable Guest account\nnet user guest \/active:no\n# Limit local account use of blank passwords to console logon only\nSet-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa' -Name 'limitblankpassworduse' -Type DWord -Value 1<\/code><\/pre>\n\n\n\n
              Nastavenie auditn\u00fdch polit\u00edk vo Windows<\/h2>\n\n\n\n
              V r\u00e1mci bezpe\u010dnostn\u00fdch odpor\u00fa\u010dan\u00ed CIS (Center for Internet Security) Benchmark<\/strong> je spr\u00e1vna konfigur\u00e1cia auditn\u00fdch polit\u00edk<\/strong> k\u013e\u00fa\u010dov\u00fdm prvkom ochrany syst\u00e9mov. Auditovanie udalost\u00ed umo\u017e\u0148uje organiz\u00e1ci\u00e1m monitorova\u0165 aktivity, detegova\u0165 bezpe\u010dnostn\u00e9 incidenty a vykon\u00e1va\u0165 forenzn\u00fa anal\u00fdzu v pr\u00edpade \u00fatoku.<\/strong><\/p>\n\n\n\n
              # Audit Section\n\nauditpol \/set \/subcategory:\"Credential Validation\" \/success:enable \/failure:enable\nauditpol \/set \/subcategory:\"Application Group Management\" \/success:enable \/failure:enable\nauditpol \/set \/subcategory:\"Security Group Management\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"User Account Management\" \/success:enable \/failure:enable\nauditpol \/set \/subcategory:\"Plug and Play Events\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"Process Creation\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"Account Lockout\" \/success:disable \/failure:enable\nauditpol \/set \/subcategory:\"Group Membership\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"Logoff\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"Logon\" \/success:enable \/failure:enable\nauditpol \/set \/subcategory:\"Other Logon\/Logoff Events\" \/success:enable \/failure:enable\nauditpol \/set \/subcategory:\"Special Logon\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"Audit Policy Change\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"Authentication Policy Change\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"Authorization Policy Change\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"Other Policy Change Events\" \/success:disable \/failure:enable\nauditpol \/set \/subcategory:\"Sensitive Privilege Use\" \/success:enable \/failure:enable\nauditpol \/set \/subcategory:\"IPsec Driver\" \/success:enable \/failure:enable\nauditpol \/set \/subcategory:\"Other System Events\" \/success:enable \/failure:enable\n\nauditpol \/set \/subcategory:\"Security State Change\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"Security System Extension\" \/success:enable \/failure:disable\nauditpol \/set \/subcategory:\"System Integrity\" \/success:enable \/failure:enable\n<\/code><\/pre>\n\n\n\n
              Tento skript aktivuje a konfiguruje kritick\u00e9 auditn\u00e9 politiky<\/strong>, ktor\u00e9 zabezpe\u010duj\u00fa:
              \u2714 Monitorovanie prihl\u00e1sen\u00ed a odhl\u00e1sen\u00ed pou\u017e\u00edvate\u013eov<\/strong>
              \u2714 Detekciu zmien v \u00fa\u010dtoch a skupin\u00e1ch<\/strong>
              \u2714 Auditovanie pokusov o eskal\u00e1ciu opr\u00e1vnen\u00ed<\/strong>
              \u2714 Zaznamen\u00e1vanie zmien v bezpe\u010dnostn\u00fdch politik\u00e1ch<\/strong>
              \u2714 Sledovanie udalost\u00ed s\u00favisiacich s autentifik\u00e1ciou a pr\u00edstupom k syst\u00e9mu<\/strong><\/p>\n\n\n\n
              Zabr\u00e1nenie pou\u017e\u00edvate\u013eom v in\u0161tal\u00e1cii ovl\u00e1da\u010dov tla\u010diarn\u00ed<\/h2>\n\n\n\n
              V r\u00e1mci bezpe\u010dnostn\u00fdch odpor\u00fa\u010dan\u00ed CIS (Center for Internet Security) Benchmark<\/strong> je kontrola in\u0161tal\u00e1cie ovl\u00e1da\u010dov tla\u010diarn\u00ed<\/strong> d\u00f4le\u017eit\u00fdm opatren\u00edm na ochranu syst\u00e9mov pred neopr\u00e1vnen\u00fdmi zmenami a potenci\u00e1lnymi zranite\u013enos\u0165ami. Tento skript zabra\u0148uje be\u017en\u00fdm pou\u017e\u00edvate\u013eom in\u0161talova\u0165 ovl\u00e1da\u010de tla\u010diarn\u00ed<\/strong>, \u010d\u00edm eliminuje riziko zavle\u010denia \u0161kodliv\u00fdch alebo neautorizovan\u00fdch ovl\u00e1da\u010dov<\/strong> do syst\u00e9mu.<\/p>\n\n\n\n
              # Prevent users from installing printer drivers\n$printerPolicyPath = 'HKLM:\\Software\\Policies\\Microsoft\\Windows NT\\Printers'\nif (-not (Test-Path $printerPolicyPath)) {\n    New-Item -Path $printerPolicyPath -Force | Out-Null\n}\nSet-ItemProperty -Path $printerPolicyPath -Name 'PreventUserInstall' -Type DWord -Value 1\n<\/code><\/pre>\n\n\n\n
              Interakt\u00edvne prihl\u00e1senie vo Windows<\/h2>\n\n\n\n
              Interakt\u00edvne prihl\u00e1senie v opera\u010dnom syst\u00e9me Windows predstavuje sp\u00f4sob, ak\u00fdm pou\u017e\u00edvatelia zad\u00e1vaj\u00fa svoje prihlasovacie \u00fadaje pri fyzickom alebo vzdialenom pr\u00edstupe k syst\u00e9mu. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da zavedenie bezpe\u010dnostn\u00fdch polit\u00edk, ktor\u00e9 minimalizuj\u00fa rizik\u00e1 spojen\u00e9 s neopr\u00e1vnen\u00fdm pr\u00edstupom, soci\u00e1lnym in\u017einierstvom<\/strong> a odcudzen\u00edm prihlasovac\u00edch \u00fadajov<\/strong>.<\/p>\n\n\n\n
              Tento skript implementuje nieko\u013eko z\u00e1sad interakt\u00edvneho prihl\u00e1senia<\/strong>, ktor\u00e9 posil\u0148uj\u00fa bezpe\u010dnos\u0165 syst\u00e9mu a chr\u00e1nia citliv\u00e9 inform\u00e1cie pou\u017e\u00edvate\u013eov.<\/p>\n\n\n\n
              Spr\u00e1vne nastavenie interakt\u00edvneho prihl\u00e1senia:<\/p>\n\n\n\n
              \u2714 Chr\u00e1ni prihlasovacie \u00fadaje pred odcudzen\u00edm<\/strong>
              \u2714 Zabra\u0148uje soci\u00e1lnemu in\u017einierstvu a phishingu<\/strong>
              \u2714 Minimalizuje fyzick\u00e9 bezpe\u010dnostn\u00e9 rizik\u00e1<\/strong>
              \u2714 Zvy\u0161uje kontrolu nad prihlasovac\u00edmi politikami<\/strong><\/p>\n\n\n\n
              # Interactive logon Section\n# Do not require CTRL+ALT+DEL\nSet-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' -Name 'DisableCAD' -Type DWord -Value 0\n\n# Don't display last signed-in user name\nSet-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' -Name 'DontDisplayLastUserName' -Type DWord -Value 1\n\n# Machine inactivity limit\nSet-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' -Name 'InactivityTimeoutSecs' -Type DWord -Value 900\n\n# Number of previous logons to cache\n$winlogonPath = 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon'\nif (-not (Test-Path $winlogonPath)) {\n    New-Item -Path $winlogonPath -Force | Out-Null\n}\nSet-ItemProperty -Path $winlogonPath -Name 'CachedLogonsCount' -Type String -Value \"3\"<\/code><\/pre>\n\n\n\n
              Nastavenie Microsoft Network Server<\/h2>\n\n\n\n
              Microsoft Network Server (LanmanServer)<\/strong> je slu\u017eba v syst\u00e9me Windows, ktor\u00e1 umo\u017e\u0148uje zdie\u013eanie s\u00faborov a tla\u010diarn\u00ed cez sie\u0165<\/strong>. Nespr\u00e1vna konfigur\u00e1cia tejto slu\u017eby m\u00f4\u017ee sp\u00f4sobi\u0165 zv\u00fd\u0161en\u00e9 bezpe\u010dnostn\u00e9 riziko<\/strong>, najm\u00e4 ak s\u00fa neakt\u00edvne pripojenia udr\u017eiavan\u00e9 pr\u00edli\u0161 dlho.<\/p>\n\n\n\n
              V r\u00e1mci odpor\u00fa\u010dan\u00ed CIS (Center for Internet Security) Benchmark<\/strong> sa automatick\u00e9 odpojenie neakt\u00edvnych pripojen\u00ed<\/strong> pova\u017euje za k\u013e\u00fa\u010dov\u00e9 bezpe\u010dnostn\u00e9 opatrenie, ktor\u00e9 minimalizuje riziko neopr\u00e1vnen\u00e9ho pr\u00edstupu a zneu\u017eitia sie\u0165ov\u00fdch zdrojov<\/strong>.<\/p>\n\n\n\n
              Tento skript nastavuje \u010dasov\u00fd limit ne\u010dinn\u00fdch sie\u0165ov\u00fdch rel\u00e1ci\u00ed na 15 min\u00fat<\/strong>, \u010d\u00edm zabezpe\u010duje, \u017ee neakt\u00edvne spojenia bud\u00fa automaticky ukon\u010den\u00e9.<\/p>\n\n\n\n
              # Microsoft network server Section\n\nWrite-Log \"Configuring Microsoft Network Server settings...\"\n$lanmanPath = 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters'\nif (-not (Test-Path $lanmanPath)) {\n    New-Item -Path $lanmanPath -Force | Out-Null\n}\nSet-ItemProperty -Path $lanmanPath -Name 'AutoDisconnect' -Type DWord -Value 15\n<\/code><\/pre>\n\n\n\n
              Nastavenie sie\u0165ov\u00e9ho pr\u00edstupu vo Windows<\/h2>\n\n\n\n
              Spr\u00e1vna konfigur\u00e1cia sie\u0165ov\u00e9ho pr\u00edstupu<\/strong> je nevyhnutn\u00e1 pre zabezpe\u010denie syst\u00e9mu pred neopr\u00e1vnen\u00fdm pr\u00edstupom a zneu\u017eit\u00edm zdie\u013ean\u00fdch zdrojov. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da vypn\u00fa\u0165 anonymn\u00fd pr\u00edstup k sie\u0165ov\u00fdm zdrojom<\/strong>, \u010d\u00edm sa zamedz\u00ed potenci\u00e1lnym \u00fatokom a neopr\u00e1vnen\u00e9mu pr\u00edstupu.<\/p>\n\n\n\n
              Tento skript implementuje z\u00e1sady kontroly sie\u0165ov\u00e9ho pr\u00edstupu<\/strong>, ktor\u00e9 chr\u00e1nia syst\u00e9m pred \u00fatokmi, ako s\u00fa:<\/p>\n\n\n\n
                \n
              • Neautorizovan\u00fd anonymn\u00fd pr\u00edstup<\/strong><\/li>\n\n\n\n
              • Zneu\u017eitie zdie\u013ean\u00fdch prie\u010dinkov bez autentifik\u00e1cie<\/strong><\/li>\n\n\n\n
              • Nedostato\u010dn\u00e1 ochrana miestnych \u00fa\u010dtov v sieti<\/strong><\/li>\n<\/ul>\n\n\n\n
                Skript vykon\u00e1va nasledovn\u00e9 bezpe\u010dnostn\u00e9 opatrenia pre sie\u0165ov\u00fd pr\u00edstup:<\/p>\n\n\n\n
                \u2705 Zakazuje, aby sa opr\u00e1vnenia “Everyone” vz\u0165ahovali aj na anonymn\u00fdch pou\u017e\u00edvate\u013eov<\/strong>
                \u2705 Blokuje anonymn\u00fd pr\u00edstup k sie\u0165ov\u00fdm zdie\u013eaniam<\/strong>
                \u2705 Vynucuje bezpe\u010dn\u00fd model zdie\u013eania pre lok\u00e1lne \u00fa\u010dty<\/strong><\/p>\n\n\n\n
                # Network access Section\n\n# Let Everyone permissions apply to anonymous users\nSet-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa' -Name 'EveryoneIncludesAnonymous' -Type DWord -Value 0\n\n# Shares that can be accessed anonymously\n$nullSessionSharesPath = 'HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters'\nif (-not (Test-Path $nullSessionSharesPath)) {\n    New-Item -Path $nullSessionSharesPath -Force | Out-Null\n}\nSet-ItemProperty -Path $nullSessionSharesPath -Name 'NullSessionShares' -Type MultiString -Value @()\n\n# Sharing and security model for local accounts\nSet-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa' -Name 'ForceGuest' -Type DWord -Value 0\n<\/code><\/pre>\n\n\n\n
                Spr\u00e1vne nastavenie vyp\u00ednania syst\u00e9mu<\/h2>\n\n\n\n
                Spr\u00e1vne nastavenie vyp\u00ednania syst\u00e9mu<\/strong> je k\u013e\u00fa\u010dov\u00e9 pre zabezpe\u010denie neautorizovan\u00fdch z\u00e1sahov do syst\u00e9mu. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da zak\u00e1za\u0165 mo\u017enos\u0165 vypnutia syst\u00e9mu bez predch\u00e1dzaj\u00faceho prihl\u00e1senia<\/strong>, \u010d\u00edm sa zabr\u00e1ni neopr\u00e1vnen\u00fdm pou\u017e\u00edvate\u013eom manipulova\u0165 so syst\u00e9mom<\/strong> alebo sp\u00f4sobi\u0165 jeho nedostupnos\u0165<\/strong>.<\/p>\n\n\n\n
                Tento skript zabra\u0148uje mo\u017enosti vypnutia syst\u00e9mu bez prihl\u00e1senia<\/strong>, \u010d\u00edm sa zni\u017euje riziko potenci\u00e1lnych bezpe\u010dnostn\u00fdch incidentov a v\u00fdpadkov<\/strong>.<\/p>\n\n\n\n
                # Shutdown Section\n# Allow system to be shut down without having to log on\nSet-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System' -Name 'ShutdownWithoutLogon' -Type DWord -Value 0\n<\/code><\/pre>\n\n\n\n
                Spr\u00e1vne nastavenie syst\u00e9mov\u00fdch objektov<\/h2>\n\n\n\n
                Syst\u00e9mov\u00e9 objekty<\/strong> v opera\u010dnom syst\u00e9me Windows s\u00fa kritick\u00e9 intern\u00e9 \u0161trukt\u00fary<\/strong>, ktor\u00e9 riadia spr\u00e1vu procesov, pam\u00e4te a zdrojov. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da posilni\u0165 predvolen\u00e9 opr\u00e1vnenia pre intern\u00e9 syst\u00e9mov\u00e9 objekty<\/strong>, aby sa zabr\u00e1nilo ich zneu\u017eitiu \u0161kodliv\u00fdmi procesmi alebo neopr\u00e1vnen\u00fdmi pou\u017e\u00edvate\u013emi<\/strong>.<\/p>\n\n\n\n
                Tento skript implementuje zv\u00fd\u0161en\u00fa ochranu pre syst\u00e9mov\u00e9 objekty<\/strong>, \u010d\u00edm zabezpe\u010duje:
                \u2705 Obmedzenie pr\u00edstupu neautorizovan\u00fdm pou\u017e\u00edvate\u013eom<\/strong>
                \u2705 Prevenciu pred nebezpe\u010dn\u00fdmi \u00fapravami syst\u00e9mov\u00fdch objektov<\/strong>
                \u2705 Zv\u00fd\u0161en\u00fa stabilitu a ochranu pred malv\u00e9rom a exploitmi<\/strong><\/p>\n\n\n\n
                # System objects Section\n# Strengthen default permissions of internal system objects\n$sessionManagerPath = 'HKLM:\\System\\CurrentControlSet\\Control\\Session Manager'\nif (-not (Test-Path $sessionManagerPath)) {\n    New-Item -Path $sessionManagerPath -Force | Out-Null\n}\nSet-ItemProperty -Path $sessionManagerPath -Name 'ProtectionMode' -Type DWord -Value 1<\/code><\/pre>\n\n\n\n
                Nastavenie syst\u00e9mov\u00fdch slu\u017eieb<\/h2>\n\n\n\n
                Syst\u00e9mov\u00e9 slu\u017eby<\/strong> vo Windows zabezpe\u010duj\u00fa k\u013e\u00fa\u010dov\u00e9 funkcionality opera\u010dn\u00e9ho syst\u00e9mu. Av\u0161ak, niektor\u00e9 slu\u017eby m\u00f4\u017eu predstavova\u0165 bezpe\u010dnostn\u00e9 riziko<\/strong>, ak s\u00fa nespr\u00e1vne nakonfigurovan\u00e9 alebo ponechan\u00e9 akt\u00edvne bez potreby. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da zak\u00e1zanie zbyto\u010dn\u00fdch a zranite\u013en\u00fdch slu\u017eieb<\/strong>, aby sa zn\u00ed\u017eilo riziko \u00fatokov a neautorizovan\u00e9ho pr\u00edstupu.<\/p>\n\n\n\n
                Tento skript deaktivuje slu\u017ebu Print Spooler<\/strong>, ktor\u00e1 je zn\u00e1ma svojimi bezpe\u010dnostn\u00fdmi zranite\u013enos\u0165ami a predstavuje potenci\u00e1lny vektor \u00fatokov.<\/p>\n\n\n\n
                Skript vykon\u00e1va nasledovn\u00e9 bezpe\u010dnostn\u00e9 opatrenia:<\/p>\n\n\n\n
                \u2705 Zastavenie slu\u017eby Print Spooler, ak je akt\u00edvna<\/strong>
                \u2705 Zak\u00e1zanie automatick\u00e9ho sp\u00fa\u0161\u0165ania slu\u017eby Print Spooler pri \u0161tarte syst\u00e9mu<\/strong><\/p>\n\n\n\n
                # Print Spooler: disabled\nStop-Service -Name Spooler -Force\nSet-Service -Name Spooler -StartupType Disabled<\/code><\/pre>\n\n\n\n
                Nastavenie Windows Firewall<\/h2>\n\n\n\n
                Windows Firewall<\/strong> je kritick\u00e1 bezpe\u010dnostn\u00e1 komponenta<\/strong>, ktor\u00e1 chr\u00e1ni syst\u00e9m pred neopr\u00e1vnen\u00fdm pr\u00edstupom a sie\u0165ov\u00fdmi hrozbami. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da povoli\u0165 a spr\u00e1vne nakonfigurova\u0165 firewallov\u00e9 profily<\/strong>, aby sa zabr\u00e1nilo neopr\u00e1vnen\u00fdm pripojeniam, \u0161kodliv\u00e9mu sie\u0165ov\u00e9mu prenosu a neautorizovan\u00e9mu vzdialen\u00e9mu pr\u00edstupu<\/strong>.<\/p>\n\n\n\n
                Tento skript zap\u00edna Windows Firewall pre v\u0161etky sie\u0165ov\u00e9 profily<\/strong> a konfiguruje logovanie blokovan\u00fdch pripojen\u00ed<\/strong>, \u010d\u00edm zvy\u0161uje \u00farove\u0148 ochrany a umo\u017e\u0148uje monitorovanie podozriv\u00fdch aktiv\u00edt.<\/p>\n\n\n\n
                Skript vykon\u00e1va nasledovn\u00e9 bezpe\u010dnostn\u00e9 opatrenia:<\/p>\n\n\n\n
                \u2705 Zapnutie Windows Firewall pre dom\u00e9nov\u00fd, priv\u00e1tny a verejn\u00fd profil<\/strong>
                \u2705 Konfigur\u00e1cia logovania blokovan\u00fdch pripojen\u00ed do samostatn\u00fdch logov pre ka\u017ed\u00fd profil<\/strong>
                \u2705 Obmedzenie ve\u013ekosti firewallov\u00fdch logov na 16 MB<\/strong><\/p>\n\n\n\n
                # Windows Firewall\n# Windows Defender Firewall with Advanced Security settings\n# Domain Profile\nSet-NetFirewallProfile -Name Domain -Enabled True -LogFileName '%SystemRoot%\\System32\\logfiles\\firewall\\domainfw.log' -LogMaxSizeKilobytes 16384 -LogBlocked True\n\n# Private Profile\nSet-NetFirewallProfile -Name Private -Enabled True -LogFileName '%SystemRoot%\\System32\\logfiles\\firewall\\privatefw.log' -LogMaxSizeKilobytes 16384 -LogBlocked True\n\n# Public Profile\nSet-NetFirewallProfile -Name Public -Enabled True -LogFileName '%SystemRoot%\\System32\\logfiles\\firewall\\publicfw.log' -LogMaxSizeKilobytes 16384 -LogBlocked True<\/code><\/pre>\n\n\n\n
                Nastavenie GPO Administrative Templates<\/h2>\n\n\n\n
                Group Policy Objects (GPO)<\/strong> umo\u017e\u0148uj\u00fa administr\u00e1torom kontrolova\u0165 a zabezpe\u010di\u0165 syst\u00e9mov\u00e9 nastavenia<\/strong> vo Windows prostredn\u00edctvom polit\u00edk aplikovan\u00fdch na \u00farovni registru<\/strong>. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da konfigur\u00e1ciu polit\u00edk zabezpe\u010denia<\/strong>, aby sa minimalizovali bezpe\u010dnostn\u00e9 rizik\u00e1 spojen\u00e9 so s\u00fakrom\u00edm, autentifik\u00e1ciou, sie\u0165ovou bezpe\u010dnos\u0165ou, ochranou RPC, a kontrolou perif\u00e9ri\u00ed<\/strong>.<\/p>\n\n\n\n
                Tento skript aplikuje k\u013e\u00fa\u010dov\u00e9 bezpe\u010dnostn\u00e9 politiky<\/strong>, ktor\u00e9 posil\u0148uj\u00fa zabezpe\u010denie syst\u00e9mu<\/strong>, zabra\u0148uj\u00fa neautorizovan\u00e9mu pr\u00edstupu a exploitom<\/strong> a zlep\u0161uj\u00fa ochranu \u00fadajov<\/strong>.<\/p>\n\n\n\n
                Skript vykon\u00e1va komplexn\u00fa konfigur\u00e1ciu<\/strong> bezpe\u010dnostn\u00fdch nastaven\u00ed v GPO Administrative Templates<\/strong> t\u00fdm, \u017ee:<\/p>\n\n\n\n
                \u2705 Zabra\u0148uje zneu\u017eitiu kamery a slideshow na uzamknutej obrazovke<\/strong>
                \u2705 Blokuje online slu\u017eby Microsoftu pre ochranu s\u00fakromia<\/strong>
                \u2705 Zakazuje zastaran\u00e9 protokoly (napr. SMBv1) a slab\u00e9 autentifika\u010dn\u00e9 met\u00f3dy<\/strong>
                \u2705 Posil\u0148uje sie\u0165ov\u00e9 nastavenia a zabra\u0148uje exploitom na \u00farovni TCP\/IP<\/strong>
                \u2705 Zlep\u0161uje kontrolu nad Windows slu\u017ebami ako Print Spooler, RPC, a Windows Connect Now<\/strong>
                \u2705 Zabra\u0148uje pou\u017e\u00edvate\u013eom in\u0161talova\u0165 ovl\u00e1da\u010de tla\u010diarn\u00ed bez administr\u00e1torsk\u00fdch pr\u00e1v<\/strong><\/p>\n\n\n\n
                # GPO: Administrative Templates (Computer)\n\nfunction Set-RegistryValue {\n    param (\n        [string]$Path,\n        [string]$Name,\n        [string]$Type,\n        $Value\n    )\n    if (-not (Test-Path $Path)) {\n        New-Item -Path $Path -Force | Out-Null\n    }\n    Set-ItemProperty -Path $Path -Name $Name -Type $Type -Value $Value\n}\n\n# Prevent enabling lock screen camera: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization\" `\n                 -Name \"NoLockScreenCamera\" `\n                 -Type DWord `\n                 -Value 1\n\n# Prevent enabling lock screen slideshow: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization\" `\n                 -Name \"NoLockScreenSlideshow\" `\n                 -Type DWord `\n                 -Value 1\n\n# Allow users to enable online speech recognition services: disabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Speech\" `\n                 -Name \"AllowOnlineSpeechRecognition\" `\n                 -Type DWord `\n                 -Value 0\n\n# Allow online tips: disabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent\" `\n                 -Name \"DisableSoftLanding\" `\n                 -Type DWord `\n                 -Value 1\n\n# Configure SMB v1 server: disabled\nSet-RegistryValue -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\" `\n                 -Name \"SMB1\" `\n                 -Type DWord `\n                 -Value 0\n\n# Enable certificate padding: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Cryptography\" `\n                 -Name \"EnableCertificatePaddingCheck\" `\n                 -Type DWord `\n                 -Value 1\n\n# WDigest authentication: disabled\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\" `\n                 -Name \"UseLogonCredential\" `\n                 -Type DWord `\n                 -Value 0\n\n# MSS - Enable automatic logon: disabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" `\n                 -Name \"AutoAdminLogon\" `\n                 -Type String `\n                 -Value \"0\"\n\n# MSS - DisableIPSourceRouting (IPv6): Highest protection\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\" `\n                 -Name \"DisableIPSourceRouting\" `\n                 -Type DWord `\n                 -Value 2\n\n# MSS - DisableIPSourceRouting (IPv4): Highest protection\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" `\n                 -Name \"DisableIPSourceRouting\" `\n                 -Type DWord `\n                 -Value 2\n\n# MSS - (EnableICMPRedirect): disabled\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" `\n                 -Name \"EnableICMPRedirect\" `\n                 -Type DWord `\n                 -Value 0\n\n# MSS - (KeepAliveTime): 300,000 ms\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" `\n                 -Name \"KeepAliveTime\" `\n                 -Type DWord `\n                 -Value 300000\n\n# MSS - (NoNameReleaseOnDemand): enabled\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Services\\NetBT\\Parameters\" `\n                 -Name \"NoNameReleaseOnDemand\" `\n                 -Type DWord `\n                 -Value 1\n\n# MSS - (PerformRouterDiscovery): disabled\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" `\n                 -Name \"PerformRouterDiscovery\" `\n                 -Type DWord `\n                 -Value 0\n\n# MSS - (SafeDllSearchMode): enabled\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Session Manager\" `\n                 -Name \"SafeDllSearchMode\" `\n                 -Type DWord `\n                 -Value 1\n\n# MSS - (ScreenSaverGracePeriod): enabled (example: 5 seconds)\nSet-RegistryValue -Path \"HKLM:\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" `\n                 -Name \"ScreenSaverGracePeriod\" `\n                 -Type String `\n                 -Value \"5\"\n\n# MSS - (TcpMaxDataRetransmissions IPv6): enabled (3)\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Services\\Tcpip6\\Parameters\" `\n                 -Name \"TcpMaxDataRetransmissions\" `\n                 -Type DWord `\n                 -Value 3\n\n# MSS - (TcpMaxDataRetransmissions IPv4): enabled - 3\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\" `\n                 -Name \"TcpMaxDataRetransmissions\" `\n                 -Type DWord `\n                 -Value 3\n\n# MSS - (WarningLevel): enabled - 90%\nSet-RegistryValue -Path \"HKLM:\\System\\CurrentControlSet\\Services\\Eventlog\\Security\" `\n                 -Name \"WarningLevel\" `\n                 -Type DWord `\n                 -Value 90\n\n# Turn off multicast name resolution: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\" `\n                 -Name \"EnableMulticast\" `\n                 -Type DWord `\n                 -Value 0\n\n# Enable font providers: disabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                 -Name \"EnableFontProviders\" `\n                 -Type DWord `\n                 -Value 0\n\n# Enable insecure guest logons: disabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\LanmanWorkstation\" `\n                 -Name \"AllowInsecureGuestAuth\" `\n                 -Type DWord `\n                 -Value 0\n\n# Turn off Microsoft Peer-to-Peer networking services: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Peernet\" `\n                 -Name \"Disabled\" `\n                 -Type DWord `\n                 -Value 1\n\n# Prohibit installation and configuration of network bridge on your DNS domain network: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Network Connections\" `\n                 -Name \"NC_AllowNetBridge_NLA\" `\n                 -Type DWord `\n                 -Value 0\n\n# Prohibit use of internet connection sharing on your DNS domain network: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Network Connections\" `\n                 -Name \"NC_AllowICS_NLA\" `\n                 -Type DWord `\n                 -Value 0\n\n# Require domain users to elevate when setting a network's location: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Network Connections\" `\n                 -Name \"NC_StdDomainUserSetLocation\" `\n                 -Type DWord `\n                 -Value 1\n\n# Hardened UNC paths: enabled with mutual auth, integrity, privacy\n$hardenedPathsPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths\"\nif (-not (Test-Path $hardenedPathsPath)) {\n    New-Item -Path $hardenedPathsPath -Force | Out-Null\n}\nSet-ItemProperty -Path $hardenedPathsPath -Name \"\\\\*\\NETLOGON\" -Type String -Value \"RequireMutualAuthentication=1,RequireIntegrity=1,RequirePrivacy=1\"\nSet-ItemProperty -Path $hardenedPathsPath -Name \"\\\\*\\SYSVOL\" -Type String -Value \"RequireMutualAuthentication=1,RequireIntegrity=1,RequirePrivacy=1\"\n\n# TCPIP6 parameter \"DisabledComponents\": 0xFF (255)\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\" `\n                 -Name \"DisabledComponents\" `\n                 -Type DWord `\n                 -Value 0xFF\n\n# Configuration of wireless settings using Windows Connect Now: disabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WCN\\UI\" `\n                 -Name \"DisableWcnUi\" `\n                 -Type DWord `\n                 -Value 1\n\n# Prohibit access of the Windows Connect Now wizards: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WCN\\UI\" `\n                 -Name \"DisableWcnUi\" `\n                 -Type DWord `\n                 -Value 1\n\n# Minimize the number of simultaneous connections: enabled (Prevent Wi-Fi when on Ethernet)\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WcmSvc\\GroupPolicy\" `\n                 -Name \"fMinimizeConnections\" `\n                 -Type DWord `\n                 -Value 1\n\n# Allow print spooler to accept client connections: disabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\" `\n                 -Name \"RegisterSpoolerRemoteRpcEndPoint\" `\n                 -Type DWord `\n                 -Value 2\n\n# Configure Redirection Guard: enabled\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                 -Name \"fBlockRedirectedEndpoints\" `\n                 -Type DWord `\n                 -Value 1\n\n# Configure RPC connection settings: Protocol to use for outgoing RPC: RPC over TCP\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Rpc\" `\n                 -Name \"DefaultProtocol\" `\n                 -Type String `\n                 -Value \"ncacn_tcp\"\n\n# Configure RPC connection settings: Use authentication for outgoing RPC: default\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Rpc\" `\n                 -Name \"EnableAuthEpResolution\" `\n                 -Type DWord `\n                 -Value 1\n\n# Configure RPC listener settings: Protocols for incoming RPC: RPC over TCP\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Rpc\" `\n                 -Name \"EnabledProtocols\" `\n                 -Type String `\n                 -Value \"ncacn_tcp\"\n\n# Configure RPC listener settings: Authentication protocol for incoming RPC: negotiate\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Rpc\" `\n                 -Name \"DefaultAuthServices\" `\n                 -Type DWord `\n                 -Value 9\n\n# Configure RPC over TCP port: 0\nSet-RegistryValue -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Rpc\" `\n                 -Name \"ServerTcpPort\" `\n                 -Type DWord `\n                 -Value 0\n\n# Limits print driver installation to Administrators: enabled\n$pointAndPrintPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\PointAndPrint\"\nif (-not (Test-Path $pointAndPrintPath)) {\n    New-Item -Path $pointAndPrintPath -Force | Out-Null\n}\nSet-ItemProperty -Path $pointAndPrintPath -Name \"RestrictDriverInstallationToAdministrators\" -Type DWord -Value 1\n\n# Point and Print restrictions - Show warning and elevation prompt\nSet-ItemProperty -Path $pointAndPrintPath -Name \"NoWarningNoElevationOnInstall\" -Type DWord -Value 0\nSet-ItemProperty -Path $pointAndPrintPath -Name \"UpdatePromptSettings\" -Type DWord -Value 2<\/code><\/pre>\n\n\n\n
                Vypnatie cloudov\u00e9 notifik\u00e1cie vo Windows<\/h2>\n\n\n\n
                Windows Push Notifications<\/strong> umo\u017e\u0148uje aplik\u00e1ci\u00e1m a syst\u00e9mov\u00fdm procesom prij\u00edma\u0165 ozn\u00e1menia v re\u00e1lnom \u010dase<\/strong> prostredn\u00edctvom cloudov\u00fdch slu\u017eieb Microsoftu. Hoci t\u00e1to funkcionalita m\u00f4\u017ee by\u0165 u\u017eito\u010dn\u00e1, m\u00f4\u017ee predstavova\u0165 bezpe\u010dnostn\u00e9 riziko<\/strong>, ak \u00fato\u010dn\u00edk zneu\u017eije tento mechanizmus na odosielanie \u0161kodliv\u00e9ho obsahu alebo sledovanie aktivity pou\u017e\u00edvate\u013eov.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da zak\u00e1za\u0165 cloudov\u00e9 notifik\u00e1cie<\/strong>, aby sa minimalizovalo riziko \u00faniku d\u00e1t, naru\u0161enia s\u00fakromia a nadmernej sie\u0165ovej aktivity<\/strong>.<\/p>\n\n\n\n
                Skript zakazuje cloudov\u00e9 notifik\u00e1cie vo Windows<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Ochranu s\u00fakromia t\u00fdm, \u017ee zabra\u0148uje aplik\u00e1ci\u00e1m pou\u017e\u00edva\u0165 Microsoft Push Notification Service (MPNS)<\/strong>
                \u2705 Zn\u00ed\u017eenie sie\u0165ovej aktivity, \u010do m\u00f4\u017ee zlep\u0161i\u0165 v\u00fdkon syst\u00e9mu<\/strong>
                \u2705 Minimaliz\u00e1ciu rizika exfiltr\u00e1cie \u00fadajov cez cloudov\u00e9 notifik\u00e1cie<\/strong><\/p>\n\n\n\n
                # Turn off notifications network usage: enabled\n$pushNotificationsPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\"\nif (-not (Test-Path $pushNotificationsPath)) {\n    New-Item -Path $pushNotificationsPath -Force | Out-Null\n}\nSet-ItemProperty -Path $pushNotificationsPath -Name \"DisableCloudNotifications\" -Type DWord -Value 1<\/code><\/pre>\n\n\n\n
                zaznamen\u00e1vanie pr\u00edkazov\u00e9ho riadku pri spusten\u00ed procesu<\/h2>\n\n\n\n
                Auditovanie procesov v opera\u010dnom syst\u00e9me Windows<\/strong> je d\u00f4le\u017eitou s\u00fa\u010das\u0165ou detekcie hrozieb a forenznej anal\u00fdzy incidentov<\/strong>. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da povoli\u0165 zaznamen\u00e1vanie pr\u00edkazov\u00e9ho riadka pri spusten\u00ed procesov<\/strong>, aby bolo mo\u017en\u00e9 sledova\u0165 \u0161kodliv\u00e9 skripty, neopr\u00e1vnen\u00e9 pr\u00edkazy a podozriv\u00e9 aktivity<\/strong>.<\/p>\n\n\n\n
                Tento skript aktivuje auditovanie pr\u00edkazov\u00e9ho riadka pri vytv\u00e1ran\u00ed procesov<\/strong>, \u010d\u00edm umo\u017e\u0148uje:<\/p>\n\n\n\n
                \u2705 Lep\u0161iu detekciu \u0161kodliv\u00e9ho k\u00f3du a ne\u017eiaducich skriptov<\/strong>
                \u2705 Forenzn\u00fa anal\u00fdzu v pr\u00edpade bezpe\u010dnostn\u00fdch incidentov<\/strong>
                \u2705 Zaznamenanie cel\u00e9ho pr\u00edkazov\u00e9ho riadka procesu, \u010do pom\u00e1ha pri vy\u0161etrovan\u00ed kybernetick\u00fdch \u00fatokov<\/strong><\/p>\n\n\n\n
                # Include command line in process creation events: enabled\n$auditPath = \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit\"\nif (-not (Test-Path $auditPath)) {\n    New-Item -Path $auditPath -Force | Out-Null\n}\nSet-ItemProperty -Path $auditPath -Name \"ProcessCreationIncludeCmdLine_Enabled\" -Type DWord -Value 1<\/code><\/pre>\n\n\n\n
                Spr\u00e1vne nastavenie Encryption Oracle Remediation<\/h2>\n\n\n\n
                Encryption Oracle Remediation<\/strong> je bezpe\u010dnostn\u00e1 politika v Windows CredSSP (Credential Security Support Provider)<\/strong>, ktor\u00e1 chr\u00e1ni vzdialen\u00e9 pripojenia cez RDP (Remote Desktop Protocol)<\/strong> pred \u00fatokmi typu man-in-the-middle (MITM)<\/strong>. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da vyn\u00fati\u0165 aktualizovan\u00fdch klientov a zabr\u00e1ni\u0165 pou\u017e\u00edvaniu zranite\u013en\u00fdch verzi\u00ed CredSSP<\/strong>, \u010d\u00edm sa minimalizuje riziko \u00faniku poveren\u00ed a vzdialen\u00fdch \u00fatokov<\/strong>.<\/p>\n\n\n\n
                Tento skript zabezpe\u010duje, \u017ee iba aktualizovan\u00ed klienti m\u00f4\u017eu komunikova\u0165 cez CredSSP<\/strong>, \u010d\u00edm sa predch\u00e1dza zneu\u017eitiu zastaran\u00fdch autentifika\u010dn\u00fdch mechanizmov.<\/p>\n\n\n\n
                Skript nastavuje bezpe\u010dnostn\u00fa politiku Encryption Oracle Remediation<\/strong> tak, aby:<\/p>\n\n\n\n
                \u2705 Blokoval zastaran\u00e9 klienty, ktor\u00e9 pou\u017e\u00edvaj\u00fa nezabezpe\u010den\u00e9 CredSSP verzie<\/strong>
                \u2705 Zabra\u0148oval downgrade \u00fatokom, pri ktor\u00fdch sa \u00fato\u010dn\u00edk sna\u017e\u00ed prin\u00fati\u0165 klienta pou\u017e\u00edva\u0165 slab\u0161iu verziu \u0161ifrovania<\/strong>
                \u2705 Vyn\u00fatil bezpe\u010dn\u00fa komunik\u00e1ciu pre vzdialen\u00e9 pripojenia cez RDP<\/strong><\/p>\n\n\n\n
                # Encryption Oracle Remediation: force updated clients\n$credSSPPath = \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters\"\nif (-not (Test-Path $credSSPPath)) {\n    New-Item -Path $credSSPPath -Force | Out-Null\n}\nSet-ItemProperty -Path $credSSPPath -Name \"AllowEncryptionOracle\" -Type DWord -Value 2<\/code><\/pre>\n\n\n\n
                Nastavenie deleg\u00e1cie neprenosite\u013en\u00fdch poveren\u00ed<\/h2>\n\n\n\n
                Deleg\u00e1cia poveren\u00ed<\/strong> vo Windows umo\u017e\u0148uje, aby overen\u00e9 rel\u00e1cie mohli odosiela\u0165 autentifika\u010dn\u00e9 \u00fadaje<\/strong> na vzdialen\u00e9 servery a slu\u017eby. Toto spr\u00e1vanie v\u0161ak m\u00f4\u017ee predstavova\u0165 bezpe\u010dnostn\u00e9 riziko, ak sa nespr\u00e1vne konfiguruje. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da povoli\u0165 deleg\u00e1ciu len neprenosite\u013en\u00fdch poveren\u00ed<\/strong>, \u010d\u00edm sa zabra\u0148uje \u00faniku autentifika\u010dn\u00fdch \u00fadajov a neopr\u00e1vnen\u00e9mu pr\u00edstupu<\/strong>.<\/p>\n\n\n\n
                Tento skript umo\u017e\u0148uje deleg\u00e1ciu neprenosite\u013en\u00fdch (non-exportable) poveren\u00ed<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zv\u00fd\u0161en\u00fa ochranu prihlasovac\u00edch \u00fadajov v sie\u0165ovom prostred\u00ed<\/strong>
                \u2705 Prevenciu pred kr\u00e1de\u017eou poveren\u00ed a neopr\u00e1vnen\u00fdm pr\u00edstupom<\/strong>
                \u2705 Zn\u00ed\u017eenie rizika Pass-the-Hash a Pass-the-Ticket \u00fatokov<\/strong><\/p>\n\n\n\n
                # Remote host allows delegation of non-exportable credentials: enabled\n$credDelegationPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CredentialsDelegation\"\nif (-not (Test-Path $credDelegationPath)) {\n    New-Item -Path $credDelegationPath -Force | Out-Null\n}\nSet-ItemProperty -Path $credDelegationPath -Name \"AllowProtectedCreds\" -Type DWord -Value 1<\/code><\/pre>\n\n\n\n
                Virtualization-Based Security (VBS)<\/h2>\n\n\n\n
                Virtualization-Based Security (VBS)<\/strong> je pokro\u010dil\u00e1 bezpe\u010dnostn\u00e1 technol\u00f3gia v syst\u00e9moch Windows<\/strong>, ktor\u00e1 vyu\u017e\u00edva hardv\u00e9rov\u00fa virtualiz\u00e1ciu<\/strong> na vytvorenie izolovan\u00e9ho prostredia pre bezpe\u010dnostn\u00e9 mechanizmy<\/strong>. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da povoli\u0165 VBS, preto\u017ee zni\u017euje riziko malv\u00e9ru, \u00fatokov na pam\u00e4\u0165, a neopr\u00e1vnen\u00fdch zmien v kritick\u00fdch \u010dastiach syst\u00e9mu<\/strong>.<\/p>\n\n\n\n
                Tento skript zap\u00edna VBS a nastavuje bezpe\u010dnostn\u00e9 parametre<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Ochranu pred \u00fatokmi zneu\u017e\u00edvaj\u00facimi pam\u00e4\u0165ov\u00e9 zranite\u013enosti<\/strong>
                \u2705 Prevenciu proti \u00fatokom na jadro syst\u00e9mu a eskal\u00e1cii opr\u00e1vnen\u00ed<\/strong>
                \u2705 Vyu\u017eitie hardv\u00e9rov\u00fdch bezpe\u010dnostn\u00fdch prvkov na ochranu pred exploitmi<\/strong><\/p>\n\n\n\n
                # Virtualization based security\n$deviceGuardPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\"\nif (-not (Test-Path $deviceGuardPath)) {\n    New-Item -Path $deviceGuardPath -Force | Out-Null\n}\nSet-ItemProperty -Path $deviceGuardPath -Name \"EnableVirtualizationBasedSecurity\" -Type DWord -Value 1\nSet-ItemProperty -Path $deviceGuardPath -Name \"PlatformSecurityLevel\" -Type DWord -Value 1\nSet-ItemProperty -Path $deviceGuardPath -Name \"RequireSecureLaunch\" -Type DWord -Value 1<\/code><\/pre>\n\n\n\n
                zak\u00e1zanie s\u0165ahovania metad\u00e1t zariaden\u00ed z internetu<\/h2>\n\n\n\n
                Windows automaticky s\u0165ahuje metad\u00e1ta zariaden\u00ed z internetu<\/strong>, aby poskytol inform\u00e1cie ako ikony, popisy, ovl\u00e1da\u010de a konfigur\u00e1cie perif\u00e9rnych zariaden\u00ed<\/strong>. Hoci t\u00e1to funkcionalita m\u00f4\u017ee by\u0165 u\u017eito\u010dn\u00e1, predstavuje potenci\u00e1lne bezpe\u010dnostn\u00e9 riziko<\/strong>, preto\u017ee m\u00f4\u017ee umo\u017eni\u0165 s\u0165ahovanie neoveren\u00e9ho obsahu alebo vystavi\u0165 syst\u00e9m extern\u00fdm hrozb\u00e1m<\/strong>.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da zak\u00e1za\u0165 s\u0165ahovanie metad\u00e1t zariaden\u00ed z internetu<\/strong>, aby sa minimalizovalo riziko malv\u00e9ru, manipul\u00e1cie s ovl\u00e1da\u010dmi a neopr\u00e1vnen\u00e9ho odosielania \u00fadajov o zariadeniach<\/strong>.<\/p>\n\n\n\n
                Tento skript zabra\u0148uje opera\u010dn\u00e9mu syst\u00e9mu Windows v z\u00edskavan\u00ed metad\u00e1t zariaden\u00ed zo siete<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zv\u00fd\u0161en\u00fa bezpe\u010dnos\u0165 a kontrolu nad perif\u00e9rnymi zariadeniami<\/strong>
                \u2705 Zabr\u00e1nenie s\u0165ahovania potenci\u00e1lne nebezpe\u010dn\u00fdch alebo falo\u0161n\u00fdch metad\u00e1t<\/strong>
                \u2705 Minimaliz\u00e1ciu extern\u00e9ho sie\u0165ov\u00e9ho prenosu s\u00favisiaceho so spr\u00e1vou zariaden\u00ed<\/strong><\/p>\n\n\n\n
                # Prevent device metadata retrieval from the internet: enabled\n$deviceMetadataPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata\"\nif (-not (Test-Path $deviceMetadataPath)) {\n    New-Item -Path $deviceMetadataPath -Force | Out-Null\n}\nSet-ItemProperty -Path $deviceMetadataPath -Name \"PreventDeviceMetadataFromNetwork\" -Type DWord -Value 1<\/code><\/pre>\n\n\n\n
                Politika inicializ\u00e1cie boot-start ovl\u00e1da\u010dov<\/h2>\n\n\n\n
                Boot-Start Driver Initialization Policy<\/strong> riadi sp\u00f4sob na\u010d\u00edtania ovl\u00e1da\u010dov pri \u0161tarte syst\u00e9mu Windows<\/strong>. T\u00e1to politika ur\u010duje, ktor\u00e9 ovl\u00e1da\u010de m\u00f4\u017eu by\u0165 na\u010d\u00edtan\u00e9 predt\u00fdm, ne\u017e sa syst\u00e9m \u00faplne spust\u00ed<\/strong>, a t\u00fdm pom\u00e1ha chr\u00e1ni\u0165 pred bootkitmi, rootkitmi a \u0161kodliv\u00fdmi ovl\u00e1da\u010dmi<\/strong>, ktor\u00e9 sa m\u00f4\u017eu pok\u00fasi\u0165 vykona\u0165 neautorizovan\u00e9 oper\u00e1cie u\u017e po\u010das bootovania.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nastavi\u0165 t\u00fato politiku tak, aby umo\u017enila na\u010d\u00edta\u0165 iba overen\u00e9 a nevyhnutn\u00e9 ovl\u00e1da\u010de<\/strong>, \u010d\u00edm sa minimalizuje riziko kompromit\u00e1cie syst\u00e9mu<\/strong> e\u0161te pred jeho spusten\u00edm.<\/p>\n\n\n\n
                Tento skript povo\u013euje na\u010d\u00edtanie iba bezpe\u010dn\u00fdch ovl\u00e1da\u010dov<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Ochranu pred malv\u00e9rom, ktor\u00fd sa pok\u00fa\u0161a spusti\u0165 po\u010das bootovania syst\u00e9mu<\/strong>
                \u2705 Prevenciu pred \u0161kodliv\u00fdmi ovl\u00e1da\u010dmi, ktor\u00e9 m\u00f4\u017eu manipulova\u0165 s kernelom Windows<\/strong>
                \u2705 Zachovanie kompatibility s kritick\u00fdmi ovl\u00e1da\u010dmi, ktor\u00e9 s\u00fa potrebn\u00e9 na spr\u00e1vnu funk\u010dnos\u0165 syst\u00e9mu<\/strong><\/p>\n\n\n\n
                # Boot-Start driver initialization policy: good, unknown, bad but critical\n$earlyLaunchPath = \"HKLM:\\SYSTEM\\CurrentControlSet\\Policies\\EarlyLaunch\"\nif (-not (Test-Path $earlyLaunchPath)) {\n    New-Item -Path $earlyLaunchPath -Force | Out-Null\n}\nSet-ItemProperty -Path $earlyLaunchPath -Name \"DriverLoadPolicy\" -Type DWord -Value 3<\/code><\/pre>\n\n\n\n
                Spracovanie registra a bezpe\u010dnostn\u00fdch polit\u00edk<\/h2>\n\n\n\n
                Spracovanie Group Policy Object (GPO) polit\u00edk<\/strong> v syst\u00e9me Windows je k\u013e\u00fa\u010dov\u00e9 pre zachovanie konzistentn\u00e9ho a bezpe\u010dn\u00e9ho konfigura\u010dn\u00e9ho prostredia<\/strong>. Tieto politiky ovplyv\u0148uj\u00fa spracovanie registra a bezpe\u010dnostn\u00fdch nastaven\u00ed<\/strong>, ktor\u00e9 sa aplikuj\u00fa na syst\u00e9m po\u010das spustenia a v pravideln\u00fdch intervaloch<\/strong>.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da zabezpe\u010di\u0165, aby:<\/p>\n\n\n\n
                \u2705 Registra\u010dn\u00e9 politiky boli aplikovan\u00e9 nielen pri \u0161tarte, ale aj v pravideln\u00fdch intervaloch<\/strong>
                \u2705 GPO bolo aplikovan\u00e9, aj ke\u010f v \u0148om neboli vykonan\u00e9 \u017eiadne zmeny<\/strong>
                \u2705 Bezpe\u010dnostn\u00e9 politiky boli vyn\u00faten\u00e9 aj bez nutnosti ru\u010dn\u00e9ho z\u00e1sahu administr\u00e1tora<\/strong><\/p>\n\n\n\n
                Tento skript konfiguruje spr\u00e1vne spracovanie registra a bezpe\u010dnostn\u00fdch polit\u00edk<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Pravideln\u00e9 a konzistentn\u00e9 aplikovanie bezpe\u010dnostn\u00fdch polit\u00edk<\/strong>
                \u2705 Vyn\u00fatenie polit\u00edk aj v pr\u00edpadoch, ke\u010f neboli vykonan\u00e9 \u017eiadne zmeny<\/strong>
                \u2705 Zabr\u00e1nenie obch\u00e1dzaniu bezpe\u010dnostn\u00fdch nastaven\u00ed syst\u00e9mom alebo pou\u017e\u00edvate\u013emi<\/strong><\/p>\n\n\n\n
                # Registry and security policy processing\n# Configure registry policy processing - Do not apply during periodic background: false\n$groupPolicyPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\GroupPolicy\"\nif (-not (Test-Path $groupPolicyPath)) {\n    New-Item -Path $groupPolicyPath -Force | Out-Null\n}\n\nSet-ItemProperty -Path $groupPolicyPath -Name \"DisableBkGndRegistryPolicy\" -Type DWord -Value 0\n# Process even if GPO not changed: true\nSet-ItemProperty -Path $groupPolicyPath -Name \"NoGPOListChanges\" -Type DWord -Value 0\n\n# Security policy processing\n$secEditPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\GroupPolicy\\SecEdit\"\nif (-not (Test-Path $secEditPath)) {\n    New-Item -Path $secEditPath -Force | Out-Null\n}<\/code><\/pre>\n\n\n\n
                Nastavenia spracovania bezpe\u010dnostn\u00fdch polit\u00edk a ochrany s\u00fakromia<\/h2>\n\n\n\n
                Windows umo\u017e\u0148uje automatick\u00e9 aplikovanie bezpe\u010dnostn\u00fdch polit\u00edk a nastaven\u00ed<\/strong>, pri\u010dom niektor\u00e9 funkcie m\u00f4\u017eu zni\u017eova\u0165 bezpe\u010dnos\u0165 alebo ohrozova\u0165 s\u00fakromie. CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da zabezpe\u010di\u0165 pravideln\u00e9 aplikovanie bezpe\u010dnostn\u00fdch polit\u00edk<\/strong>, zak\u00e1za\u0165 ne\u017eiaduce funkcie s\u00favisiace so zberom \u00fadajov<\/strong> a obmedzi\u0165 s\u0165ahovanie ovl\u00e1da\u010dov z ned\u00f4veryhodn\u00fdch zdrojov<\/strong>.<\/p>\n\n\n\n
                Tento skript konfiguruje pravideln\u00e9 spracovanie Group Policy, vyp\u00edna ne\u017eiaduce funkcie s\u00favisiace so s\u00fakrom\u00edm a zabezpe\u010duje bezpe\u010dn\u00e9 spracovanie tla\u010dov\u00fdch ovl\u00e1da\u010dov<\/strong>.<\/p>\n\n\n\n
                Skript posil\u0148uje bezpe\u010dnos\u0165 a ochranu s\u00fakromia v syst\u00e9me Windows<\/strong> t\u00fdm, \u017ee:<\/p>\n\n\n\n
                \u2714 Umo\u017e\u0148uje aplikovanie bezpe\u010dnostn\u00fdch polit\u00edk aj v pravideln\u00fdch intervaloch, nielen pri re\u0161tarte<\/strong>
                \u2714 Vynucuje aplikovanie GPO aj vtedy, ke\u010f neboli vykonan\u00e9 \u017eiadne zmeny<\/strong>
                \u2714 Zakazuje automatick\u00e9 s\u0165ahovanie tla\u010dov\u00fdch ovl\u00e1da\u010dov cez HTTP<\/strong>
                \u2714 Vyp\u00edna zdie\u013eanie a reportovanie \u00fadajov o rukopise na ochranu s\u00fakromia<\/strong><\/p>\n\n\n\n
                # Do not apply during periodic background: false\nSet-ItemProperty -Path $secEditPath -Name \"DisableBkGndSecurityPolicy\" -Type DWord -Value 0\n# Process even if GPO not changed: true\nSet-ItemProperty -Path $secEditPath -Name \"NoGPOListChanges\" -Type DWord -Value 0\n\n# Continue experiences on this device: disabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" -Name \"EnableCdp\" -Type DWord -Value 0\n\n# Turn off background refresh of Group Policy: disabled (set to 0 to allow)\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\GroupPolicy\" -Name \"DisableBkGndPolicy\" -Type DWord -Value 0\n\n# Turn off downloading of print drivers over HTTP: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\" -Name \"DisableWebPnPDownload\" -Type DWord -Value 1\n\n# Turn off handwriting personalization data sharing: enabled\n$handwritingErrorReportsPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\HandwritingErrorReports\"\nif (-not (Test-Path $handwritingErrorReportsPath)) {\n    New-Item -Path $handwritingErrorReportsPath -Force | Out-Null\n}\nSet-ItemProperty -Path $handwritingErrorReportsPath -Name \"PreventHandwritingDataSharing\" -Type DWord -Value 1\n\n# Turn off handwriting recognition error reporting: enabled\nSet-ItemProperty -Path $handwritingErrorReportsPath -Name \"PreventHandwritingErrorReports\" -Type DWord -Value 1\n<\/code><\/pre>\n\n\n\n
                Nastavenia na vypnutie online funkci\u00ed Microsoftu a ochranu s\u00fakromia<\/h2>\n\n\n\n
                Windows obsahuje r\u00f4zne slu\u017eby a asistenty<\/strong>, ktor\u00e9 komunikuj\u00fa so servermi Microsoftu. Niektor\u00e9 z t\u00fdchto funkci\u00ed s\u00fa bezpe\u010dnostn\u00fdm rizikom<\/strong>, preto\u017ee m\u00f4\u017eu odosiela\u0165 \u00fadaje mimo organiz\u00e1cie<\/strong>, automaticky s\u0165ahova\u0165 obsah<\/strong> alebo umo\u017eni\u0165 ne\u017eelan\u00fa interakciu s internetov\u00fdmi slu\u017ebami<\/strong>.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da vypn\u00fa\u0165 tieto slu\u017eby, aby sa:<\/p>\n\n\n\n
                \u2705 Zabr\u00e1nilo odosielaniu \u00fadajov na servery Microsoftu<\/strong>
                \u2705 Zv\u00fd\u0161ila ochrana s\u00fakromia a zabr\u00e1nilo sa online registr\u00e1ci\u00e1m<\/strong>
                \u2705 Minimalizovalo riziko neautorizovan\u00e9ho prenosu d\u00e1t<\/strong><\/p>\n\n\n\n
                Tento skript zakazuje internetov\u00e9 asistenty a automatick\u00e9 s\u0165ahovanie obsahu<\/strong> v syst\u00e9me Windows, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zv\u00fd\u0161en\u00fa kontrolu nad d\u00e1tami, ktor\u00e9 syst\u00e9m odosiela na internet<\/strong>
                \u2705 Zabr\u00e1nenie s\u0165ahovaniu neautorizovan\u00e9ho obsahu a webov\u00fdch slu\u017eieb<\/strong>
                \u2705 Zlep\u0161enie bezpe\u010dnosti obmedzen\u00edm funkci\u00ed publikovania na web a tla\u010de cez HTTP<\/strong><\/p>\n\n\n\n
                # Turn off Internet Connection Wizard if referring to Microsoft.com: enabled\n$icwPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Internet Connection Wizard\"\nif (-not (Test-Path $icwPath)) {\n    New-Item -Path $icwPath -Force | Out-Null\n}\nSet-ItemProperty -Path $icwPath -Name \"DisableICW\" -Type DWord -Value 1\n\n# Turn off Internet download for Web publishing wizards: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" -Name \"DisableWebPublishingWizard\" -Type DWord -Value 1\n\n# Turn off printing over HTTP: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\" -Name \"DisableHTTPPrinting\" -Type DWord -Value 1\n\n# Turn off Registration if URL referring to Microsoft.com: enabled\n$registrationWizardPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\RegistrationWizard\"\nif (-not (Test-Path $registrationWizardPath)) {\n    New-Item -Path $registrationWizardPath -Force | Out-Null\n}\nSet-ItemProperty -Path $registrationWizardPath -Name \"DisableRegistration\" -Type DWord -Value 1\n\n# Turn off Search Companion content file updates: enabled\n$searchCompanionPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\SearchCompanion\"\nif (-not (Test-Path $searchCompanionPath)) {\n    New-Item -Path $searchCompanionPath -Force | Out-Null\n}\nSet-ItemProperty -Path $searchCompanionPath -Name \"DisableContentFileUpdates\" -Type DWord -Value 1\n\n# Turn off the \"Order Prints\": enabled\n$photoPrintingWizardPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PhotoPrintingWizard\"\nif (-not (Test-Path $photoPrintingWizardPath)) {\n    New-Item -Path $photoPrintingWizardPath -Force | Out-Null\n}\nSet-ItemProperty -Path $photoPrintingWizardPath -Name \"DisableOnlinePrints\" -Type DWord -Value 1\n\n# Turn off the \"Publish to Web\" task: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" -Name \"DisablePublishToWebTask\" -Type DWord -Value 1\n<\/code><\/pre>\n\n\n\n
                Nastavenia na vypnutie Windows CEIP, Windows Messenger CEIP a Windows Error Reporting<\/h2>\n\n\n\n
                Windows obsahuje telemetrick\u00e9 a diagnostick\u00e9 funkcie<\/strong>, ktor\u00e9 zbieraj\u00fa \u00fadaje o pou\u017e\u00edvan\u00ed syst\u00e9mu a odosielaj\u00fa ich do Microsoftu. Program Customer Experience Improvement Program (CEIP)<\/strong> a Windows Error Reporting (WER)<\/strong> s\u00fa medzi t\u00fdmito funkciami a m\u00f4\u017eu predstavova\u0165 bezpe\u010dnostn\u00e9 riziko, preto\u017ee odosielaj\u00fa inform\u00e1cie o syst\u00e9me, aplik\u00e1ci\u00e1ch a chyb\u00e1ch na servery Microsoftu<\/strong>.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da tieto funkcie vypn\u00fa\u0165<\/strong>, aby sa:<\/p>\n\n\n\n
                \u2705 Zabr\u00e1nilo odosielaniu diagnostick\u00fdch \u00fadajov na servery Microsoftu<\/strong>
                \u2705 Zv\u00fd\u0161ila ochrana s\u00fakromia a citliv\u00fdch syst\u00e9mov\u00fdch inform\u00e1ci\u00ed<\/strong>
                \u2705 Minimalizovalo riziko, \u017ee \u00fato\u010dn\u00edk m\u00f4\u017ee zneu\u017ei\u0165 mechanizmus chybov\u00fdch hl\u00e1sen\u00ed na z\u00edskanie detailov o syst\u00e9me<\/strong><\/p>\n\n\n\n
                Tento skript zakazuje CEIP, Windows Messenger CEIP a Windows Error Reporting<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zv\u00fd\u0161en\u00fa ochranu s\u00fakromia a zn\u00ed\u017eenie telemetrickej aktivity<\/strong>
                \u2705 Minimaliz\u00e1ciu mo\u017en\u00e9ho \u00faniku citliv\u00fdch \u00fadajov<\/strong>
                \u2705 Zlep\u0161enie v\u00fdkonu syst\u00e9mu odstr\u00e1nen\u00edm nepotrebn\u00e9ho odosielania \u00fadajov<\/strong><\/p>\n\n\n\n
                # Turn off the Windows Messenger CEIP: enabled\n$messengerCEIPPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Messenger\\CEIP\"\nif (-not (Test-Path $messengerCEIPPath)) {\n    New-Item -Path $messengerCEIPPath -Force | Out-Null\n}\nSet-ItemProperty -Path $messengerCEIPPath -Name \"DisableCEIP\" -Type DWord -Value 1\n\n# Turn off Windows CEIP: enabled\n$sqmClientPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\"\nif (-not (Test-Path $sqmClientPath)) {\n    New-Item -Path $sqmClientPath -Force | Out-Null\n}\nSet-ItemProperty -Path $sqmClientPath -Name \"CEIPEnable\" -Type DWord -Value 0\n\n# Turn off Windows Error Reporting: enabled\n$errorReportingPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting\"\nif (-not (Test-Path $errorReportingPath)) {\n    New-Item -Path $errorReportingPath -Force | Out-Null\n}\nSet-ItemProperty -Path $errorReportingPath -Name \"Disabled\" -Type DWord -Value 1\n<\/code><\/pre>\n\n\n\n
                Posilnenie bezpe\u010dnosti hesiel, prihlasovacej obrazovky a vzdialen\u00e9ho pr\u00edstupu<\/h2>\n\n\n\n
                Windows umo\u017e\u0148uje r\u00f4zne nastavenia na posilnenie bezpe\u010dnosti hesiel, prihlasovania, vzdialen\u00e9ho pr\u00edstupu a spr\u00e1vy RPC<\/strong>. Tieto nastavenia s\u00fa k\u013e\u00fa\u010dov\u00e9 pre minimalizovanie rizika neopr\u00e1vnen\u00e9ho pr\u00edstupu, ochranu hesiel a zabezpe\u010denie spr\u00e1vy politiky autentifik\u00e1cie<\/strong>.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zabezpe\u010denie hesiel pomocou zlo\u017eitosti a d\u013a\u017eky<\/strong>
                \u2705 Obmedzenie zobrazovania citliv\u00fdch \u00fadajov na prihlasovacej obrazovke<\/strong>
                \u2705 Vy\u017eadovanie hesla pri prebuden\u00ed syst\u00e9mu<\/strong>
                \u2705 Zak\u00e1zanie vzdialenej pomoci (Remote Assistance) a neoveren\u00fdch RPC klientov<\/strong>
                \u2705 Zamedzenie interakt\u00edvnej komunik\u00e1cie s podporn\u00fdmi slu\u017ebami cez MSDT<\/strong><\/p>\n\n\n\n
                Tento skript konfiguruje bezpe\u010dnostn\u00e9 politiky pre hesl\u00e1, prihlasovaciu obrazovku, vzdialen\u00fd pr\u00edstup a RPC<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Posilnenie hesiel a ich ochranu pred reverzn\u00fdm \u0161ifrovan\u00edm<\/strong>
                \u2705 Zv\u00fd\u0161en\u00fa ochranu s\u00fakromia na prihlasovacej obrazovke<\/strong>
                \u2705 Zabr\u00e1nenie neopr\u00e1vnen\u00e9mu pr\u00edstupu cez vzdialen\u00fa pomoc<\/strong>
                \u2705 Zabezpe\u010denie autentifik\u00e1cie pre RPC a obmedzenie pr\u00edstupu neoveren\u00fdm klientom<\/strong><\/p>\n\n\n\n
                # Password Policies (Complexity and Length)\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" -Name \"PasswordComplexity\" -Type DWord -Value 1\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters\" -Name \"MinimumPasswordLength\" -Type DWord -Value 15\n# Enable password encryption (no reversible encryption):\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" -Name \"ClearTextPassword\" -Type DWord -Value 0\n\n# Allow Custom SSPs and APs: disabled\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" -Name \"DisableCustomSSPs\" -Type DWord -Value 1\n\n# LSASS as a protected process: enabled\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\" -Name \"RunAsPPL\" -Type DWord -Value 1\n\n# Disallow copying user input methods to system account for sign-in: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" -Name \"DisallowCopyingInputMethodsToSystemAccount\" -Type DWord -Value 1\n\n# Sign-in UI Settings\n\n# Block user from showing account details: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                -Name \"BlockUserFromShowingAccountDetailsOnSignin\" `\n                -Type DWord `\n                -Value 1\n\n# Do not display network selection UI: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                -Name \"DontDisplayNetworkSelectionUI\" `\n                -Type DWord `\n                -Value 1\n\n# Turn off app notifications on lock screen: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                -Name \"DisableLockScreenAppNotifications\" `\n                -Type DWord `\n                -Value 1\n\n# Turn off picture password sign-in: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                -Name \"BlockDomainPicturePassword\" `\n                -Type DWord `\n                -Value 1\n\n# Turn on convenience PIN sign-in: disabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                -Name \"AllowDomainPINLogon\" `\n                -Type DWord `\n                -Value 0\n\n# Require a password when a computer wakes:\npowercfg \/SETDCVALUEINDEX SCHEME_CURRENT SUB_NONE CONSOLELOCK 1\npowercfg \/SETACVALUEINDEX SCHEME_CURRENT SUB_NONE CONSOLELOCK 1\n\n# Remote Assistance settings: disabled\n\n$terminalServicesPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\"\nif (-not (Test-Path $terminalServicesPath)) {\n    New-Item -Path $terminalServicesPath -Force | Out-Null\n}\nSet-ItemProperty -Path $terminalServicesPath -Name \"fAllowToGetHelp\" -Type DWord -Value 0\nSet-ItemProperty -Path $terminalServicesPath -Name \"fAllowUnsolicited\" -Type DWord -Value 0\n\n# Enable RPC Endpoint Mapper Client Auth: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Rpc\" `\n                -Name \"EnableAuthEpResolution\" `\n                -Type DWord `\n                -Value 1\n\n# Restrict Unauthenticated RPC clients: authenticated\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Rpc\" `\n                -Name \"RestrictRemoteClients\" `\n                -Type DWord `\n                -Value 1\n\n# MSDT interactive communication with support provider: disabled\n\n$msdtPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\ScriptedDiagnosticsProvider\\Policy\"\nif (-not (Test-Path $msdtPath)) {\n    New-Item -Path $msdtPath -Force | Out-Null\n}\nSet-ItemProperty -Path $msdtPath -Name \"DisableQueryRemoteServer\" -Type DWord -Value 1\n\n# PerfTrack: disabled\n$perfTrackPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WDI\\{9C5A3C52-EE91-4AFA-9A20-101346A0F8A3}\"\nif (-not (Test-Path $perfTrackPath)) {\n    New-Item -Path $perfTrackPath -Force | Out-Null\n}\nSet-ItemProperty -Path $perfTrackPath -Name \"ScenarioExecutionEnabled\" -Type DWord -Value 0\n<\/code><\/pre>\n\n\n\n
                Konfigur\u00e1cia Windows NTP klienta a NTP servera<\/h2>\n\n\n\n
                Presn\u00e1 synchroniz\u00e1cia syst\u00e9mov\u00e9ho \u010dasu je kritick\u00e1 pre bezpe\u010dnos\u0165, spr\u00e1vu logov a autentifik\u00e1ciu v syst\u00e9me Windows<\/strong>.<\/p>\n\n\n\n
                Skript povo\u013euje Windows NTP klienta a zakazuje NTP server<\/strong>, aby Windows mohol synchronizova\u0165 \u010das, ale neposkytoval ho in\u00fdm zariadeniam<\/strong>.<\/p>\n\n\n\n
                # Windows NTP Client: enabled, Windows NTP Server: disabled\n$ntpClientPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient\"\n$ntpServerPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpServer\"\nif (-not (Test-Path $ntpClientPath)) {\n    New-Item -Path $ntpClientPath -Force | Out-Null\n}\nif (-not (Test-Path $ntpServerPath)) {\n    New-Item -Path $ntpServerPath -Force | Out-Null\n}\nSet-ItemProperty -Path $ntpClientPath -Name \"Enabled\" -Type DWord -Value 1\nSet-ItemProperty -Path $ntpServerPath -Name \"Enabled\" -Type DWord -Value 0<\/code><\/pre>\n\n\n\n
                Obmedzenie Microsoft \u00fa\u010dtov a vypnutie funkcie AutoRun\/AutoPlay<\/h2>\n\n\n\n
                Windows umo\u017e\u0148uje automatick\u00e9 pripojenie a sp\u00fa\u0161\u0165anie zariaden\u00ed<\/strong>, ako aj integrovan\u00e9 prihl\u00e1senie pomocou Microsoft \u00fa\u010dtu<\/strong>.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Obmedzi\u0165 povinn\u00e9 pou\u017e\u00edvanie Microsoft \u00fa\u010dtov<\/strong>
                \u2705 Zak\u00e1za\u0165 AutoRun a AutoPlay na v\u0161etk\u00fdch zariadeniach<\/strong>
                \u2705 Zabezpe\u010di\u0165, aby AutoRun nesp\u00fa\u0161\u0165al \u017eiadne neautorizovan\u00e9 skripty<\/strong><\/p>\n\n\n\n
                Tento skript zabezpe\u010duje bezpe\u010dnos\u0165 prihlasovania a ochranu pred \u0161kodliv\u00fdmi extern\u00fdmi zariadeniami<\/strong> t\u00fdm, \u017ee:<\/p>\n\n\n\n
                \u2705 Umo\u017e\u0148uje pou\u017e\u00edva\u0165 Windows bez Microsoft \u00fa\u010dtu<\/strong>
                \u2705 Zakazuje AutoPlay na v\u0161etk\u00fdch typoch m\u00e9di\u00ed<\/strong>
                \u2705 Zakazuje AutoRun, \u010d\u00edm zabra\u0148uje automatick\u00e9mu sp\u00fa\u0161\u0165aniu \u0161kodliv\u00e9ho softv\u00e9ru<\/strong><\/p>\n\n\n\n
                # Allow Microsoft accounts to be optional: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                -Name \"MSAOptional\" `\n                -Type DWord `\n                -Value 1\n\n# Disallow Autoplay for non-volume devices: enabled\n$explorerPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer\"\nif (-not (Test-Path $explorerPath)) {\n    New-Item -Path $explorerPath -Force | Out-Null\n}\nSet-ItemProperty -Path $explorerPath -Name \"NoAutoplayfornonVolume\" -Type DWord -Value 1\n\n# Turn off Autoplay: all drives\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" `\n                -Name \"NoDriveTypeAutoRun\" `\n                -Type DWord `\n                -Value 255\n\n# Set default behavior for AutoRun: do not execute any autorun commands\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" `\n                -Name \"NoAutorun\" `\n                -Type DWord `\n                -Value 1\n<\/code><\/pre>\n\n\n\n
                Posilnenie biometrickej autentifik\u00e1cie, ochrany s\u00fakromia a bezpe\u010dnostn\u00fdch nastaven\u00ed<\/h2>\n\n\n\n
                Windows umo\u017e\u0148uje biometrick\u00e9 overovanie, kamerov\u00e9 funkcie a cloudov\u00e9 slu\u017eby<\/strong>, ktor\u00e9 m\u00f4\u017eu ovplyvni\u0165 bezpe\u010dnos\u0165 a s\u00fakromie pou\u017e\u00edvate\u013eov. Zranite\u013enosti v t\u00fdchto oblastiach m\u00f4\u017eu by\u0165 zneu\u017eit\u00e9 \u00fato\u010dn\u00edkmi na fal\u0161ovanie identity, neopr\u00e1vnen\u00fd pr\u00edstup alebo ne\u017eiaduce zdie\u013eanie d\u00e1t so slu\u017ebami Microsoftu.<\/strong><\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Povoli\u0165 roz\u0161\u00edren\u00fa ochranu proti podvodom pri rozpozn\u00e1van\u00ed tv\u00e1re (anti-spoofing)<\/strong>
                \u2705 Zak\u00e1za\u0165 kameru pre zv\u00fd\u0161enie bezpe\u010dnosti v citliv\u00fdch prostrediach<\/strong>
                \u2705 Zak\u00e1za\u0165 cloudovo optimalizovan\u00fd obsah a spotrebite\u013esk\u00e9 funkcie Microsoftu<\/strong>
                \u2705 Vy\u017eadova\u0165 PIN pri p\u00e1rovan\u00ed Bluetooth zariaden\u00ed<\/strong>
                \u2705 Zak\u00e1za\u0165 zobrazovanie administr\u00e1torsk\u00fdch \u00fa\u010dtov pri zv\u00fd\u0161en\u00ed opr\u00e1vnen\u00ed<\/strong><\/p>\n\n\n\n
                Skript posil\u0148uje biometrick\u00fa autentifik\u00e1ciu, vyp\u00edna nepotrebn\u00e9 cloudov\u00e9 slu\u017eby a obmedzuje pou\u017eitie kamery<\/strong>, aby sa:<\/p>\n\n\n\n
                \u2714 Zv\u00fd\u0161ila bezpe\u010dnos\u0165 biometrick\u00e9ho overovania a zabr\u00e1nilo sa podvodom pri rozpozn\u00e1van\u00ed tv\u00e1re<\/strong>
                \u2714 Zak\u00e1zala kamera v prostrediach, kde je ne\u017eiaduca (napr. v podnikov\u00fdch sie\u0165ach)<\/strong>
                \u2714 Obmedzil pr\u00edstup k cloudov\u00fdm slu\u017eb\u00e1m, ktor\u00e9 m\u00f4\u017eu ohrozi\u0165 s\u00fakromie<\/strong>
                \u2714 Zv\u00fd\u0161ila bezpe\u010dnos\u0165 p\u00e1rovania Bluetooth zariaden\u00ed pomocou PIN k\u00f3du<\/strong>
                \u2714 Zak\u00e1zalo zobrazovanie administr\u00e1torsk\u00fdch \u00fa\u010dtov pri UAC v\u00fdzvach<\/strong><\/p>\n\n\n\n
                # Configure enhanced anti-spoofing: enabled\n$facialFeaturesPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Biometrics\\FacialFeatures\"\nif (-not (Test-Path $facialFeaturesPath)) {\n    New-Item -Path $facialFeaturesPath -Force | Out-Null\n}\nSet-ItemProperty -Path $facialFeaturesPath -Name \"EnhancedAntiSpoofing\" -Type DWord -Value 1\n\n# Allow Use of Camera: disabled\n$cameraPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Camera\"\nif (-not (Test-Path $cameraPath)) {\n    New-Item -Path $cameraPath -Force | Out-Null\n}\nSet-ItemProperty -Path $cameraPath -Name \"AllowCamera\" -Type DWord -Value 0\n\n# Turn off cloud consumer account state content: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent\" `\n                -Name \"DisableConsumerAccountStateContent\" `\n                -Type DWord `\n                -Value 1\n\n# Turn off cloud optimized content: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent\" `\n                -Name \"DisableCloudOptimizedContent\" `\n                -Type DWord `\n                -Value 1\n\n# Turn off Microsoft consumer experiences: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent\" `\n                -Name \"DisableWindowsConsumerFeatures\" `\n                -Type DWord `\n                -Value 1\n\n# Require pin for pairing: enabled - always\n$connectPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Connect\"\nif (-not (Test-Path $connectPath)) {\n    New-Item -Path $connectPath -Force | Out-Null\n}\nSet-ItemProperty -Path $connectPath -Name \"RequirePinForPairing\" -Type DWord -Value 1\n\n# Enumerate administrator accounts on elevation: disabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" `\n                -Name \"FilterAdministratorToken\" `\n                -Type DWord `\n                -Value 1\n<\/code><\/pre>\n\n\n\n
                Obmedzenie diagnostick\u00fdch \u00fadajov a ochrana pred neautorizovan\u00fdm zberom d\u00e1t<\/h2>\n\n\n\n
                Windows \u0161tandardne zhroma\u017e\u010fuje diagnostick\u00e9 \u00fadaje a odosiela ich spolo\u010dnosti Microsoft<\/strong>, \u010do m\u00f4\u017ee predstavova\u0165 bezpe\u010dnostn\u00e9 riziko. Tento mechanizmus je ur\u010den\u00fd na zlep\u0161enie stability syst\u00e9mu<\/strong>, av\u0161ak m\u00f4\u017ee obsahova\u0165 citliv\u00e9 inform\u00e1cie, ktor\u00e9 organiz\u00e1cie nechc\u00fa zdie\u013ea\u0165<\/strong>.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 diagnostick\u00fd zber \u00fadajov (telemetriu)<\/strong>
                \u2705 Zak\u00e1za\u0165 s\u0165ahovanie aktualiz\u00e1ci\u00ed nastaven\u00ed OneSettings<\/strong>
                \u2705 Zak\u00e1za\u0165 notifik\u00e1cie sp\u00e4tnej v\u00e4zby<\/strong>
                \u2705 Obmedzi\u0165 diagnostick\u00e9 a pam\u00e4\u0165ov\u00e9 v\u00fdpisy (dump files)<\/strong>
                \u2705 Zak\u00e1za\u0165 App Installer a experiment\u00e1lne funkcie in\u0161tal\u00e1cie aplik\u00e1ci\u00ed<\/strong><\/p>\n\n\n\n
                Tento skript zakazuje telemetriu a obmedzuje diagnostick\u00e9 funkcie Windows<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Minimaliz\u00e1ciu rizika \u00faniku citliv\u00fdch \u00fadajov cez diagnostick\u00e9 kan\u00e1ly<\/strong>
                \u2705 Zv\u00fd\u0161enie s\u00fakromia a kontroly nad syst\u00e9mov\u00fdmi inform\u00e1ciami<\/strong>
                \u2705 Obmedzenie automatick\u00fdch s\u0165ahovan\u00ed konfigur\u00e1ci\u00ed, ktor\u00e9 m\u00f4\u017eu zmeni\u0165 nastavenia syst\u00e9mu<\/strong><\/p>\n\n\n\n
                # Allow Diagnostic Data: enabled - diagnostic data off\n$dataCollectionPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection\"\nif (-not (Test-Path $dataCollectionPath)) {\n    New-Item -Path $dataCollectionPath -Force | Out-Null\n}\nSet-ItemProperty -Path $dataCollectionPath -Name \"AllowTelemetry\" -Type DWord -Value 0\n\n# Configure Authenticated Proxy usage for Telemetry: disable authenticated proxy usage\nSet-ItemProperty -Path $dataCollectionPath -Name \"DisableEnterpriseAuthProxy\" -Type DWord -Value 1\n\n# Disable OneSettings Downloads: enabled\nSet-ItemProperty -Path $dataCollectionPath -Name \"DisableOneSettingsDownloads\" -Type DWord -Value 1\n\n# Do not show feedback notifications: enabled\n$siufPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\SIUF\"\nif (-not (Test-Path $siufPath)) {\n    New-Item -Path $siufPath -Force | Out-Null\n}\nSet-ItemProperty -Path $siufPath -Name \"DisableNotifications\" -Type DWord -Value 1\n\n# Enable OneSettings Auditing: enabled\nSet-ItemProperty -Path $dataCollectionPath -Name \"EnableOneSettingsAuditing\" -Type DWord -Value 1\n\n# Limit Diagnostic Log Collection: enabled\nSet-ItemProperty -Path $dataCollectionPath -Name \"LimitDiagnosticLogCollection\" -Type DWord -Value 1\n\n# Limit Dump Collection: enabled\nSet-ItemProperty -Path $dataCollectionPath -Name \"LimitDumpCollection\" -Type DWord -Value 1\n\n# App Installer settings: disabled\n$appInstallerPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppInstaller\"\nif (-not (Test-Path $appInstallerPath)) {\n    New-Item -Path $appInstallerPath -Force | Out-Null\n}\nSet-ItemProperty -Path $appInstallerPath -Name \"EnableAppInstaller\" -Type DWord -Value 0\nSet-ItemProperty -Path $appInstallerPath -Name \"EnableAppInstallerExpFeatures\" -Type DWord -Value 0\nSet-ItemProperty -Path $appInstallerPath -Name \"EnableHashOverride\" -Type DWord -Value 0\nSet-ItemProperty -Path $appInstallerPath -Name \"EnableAppInstallerProtocol\" -Type DWord -Value 0\n<\/code><\/pre>\n\n\n\n
                Nastavenie ve\u013ekosti a spr\u00e1vania Event Logov<\/h2>\n\n\n\n
                Windows Event Logy s\u00fa k\u013e\u00fa\u010dov\u00e9 pre detekciu bezpe\u010dnostn\u00fdch incidentov, forenzn\u00fa anal\u00fdzu a spr\u00e1vu syst\u00e9mu<\/strong>. Ak s\u00fa logy pr\u00edli\u0161 mal\u00e9, m\u00f4\u017eu sa r\u00fdchlo prep\u00edsa\u0165 a strati\u0165 d\u00f4le\u017eit\u00e9 z\u00e1znamy<\/strong>, \u010do znemo\u017en\u00ed anal\u00fdzu bezpe\u010dnostn\u00fdch incidentov.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Nastavi\u0165 primeran\u00fa ve\u013ekos\u0165 logov, aby obsahovali dostatok historick\u00fdch z\u00e1znamov<\/strong>
                \u2705 Zabezpe\u010di\u0165, \u017ee bezpe\u010dnostn\u00e9 logy (Security Log) maj\u00fa dostato\u010dn\u00fa kapacitu<\/strong>
                \u2705 Zabr\u00e1ni\u0165 strate d\u00f4le\u017eit\u00fdch udalost\u00ed v d\u00f4sledku obmedzenej ve\u013ekosti logov<\/strong><\/p>\n\n\n\n
                Tento skript zv\u00e4\u010d\u0161uje ve\u013ekos\u0165 Event Logov a zais\u0165uje, \u017ee kritick\u00e9 udalosti nebud\u00fa straten\u00e9<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Mo\u017enos\u0165 sp\u00e4tn\u00e9ho doh\u013eadania bezpe\u010dnostn\u00fdch incidentov<\/strong>
                \u2705 Dostato\u010dn\u00e9 uchov\u00e1vanie \u00fadajov o prihl\u00e1seniach, zlyhaniach a syst\u00e9mov\u00fdch chyb\u00e1ch<\/strong>
                \u2705 Prevenciu proti r\u00fdchlemu prepisovaniu logov pri ve\u013ekom objeme udalost\u00ed<\/strong><\/p>\n\n\n\n
                # Event log size and behavior (Application, Security, Setup, System)\nWrite-Progress -Activity \"System Hardening\" -Status \"Step 28\/38: Configuring Event Log sizes\" -PercentComplete ([int](($CurrentStep \/ $TotalSteps) * 100))\n$CurrentStep++\nWrite-Log \"Configuring Event Log sizes...\"\n\nfunction Set-EventLogMaxSize {\n    param (\n        [string]$LogName,\n        [int]$MaxSizeKB\n    )\n    $eventLogPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\EventLog\\$LogName\"\n    if (-not (Test-Path $eventLogPath)) {\n        New-Item -Path $eventLogPath -Force | Out-Null\n    }\n    Set-ItemProperty -Path $eventLogPath -Name \"MaxSize\" -Type DWord -Value $MaxSizeKB\n}\n\n# Application Log\nSet-EventLogMaxSize -LogName \"Application\" -MaxSizeKB 32768\n\n# Security Log\nSet-EventLogMaxSize -LogName \"Security\" -MaxSizeKB 196608\n\n# Setup Log\nSet-EventLogMaxSize -LogName \"Setup\" -MaxSizeKB 32768\n\n# System Log\nSet-EventLogMaxSize -LogName \"System\" -MaxSizeKB 32768\n<\/code><\/pre>\n\n\n\n
                Zak\u00e1zanie slu\u017eieb ur\u010dovania polohy vo Windows<\/h2>\n\n\n\n
                Windows \u0161tandardne umo\u017e\u0148uje ur\u010dovanie polohy zariadenia<\/strong> pomocou GPS, Wi-Fi a IP adries. T\u00e1to funkcia je u\u017eito\u010dn\u00e1 pre aplik\u00e1cie, ale m\u00f4\u017ee predstavova\u0165 v\u00e1\u017ene bezpe\u010dnostn\u00e9 riziko<\/strong>, najm\u00e4 v podnikov\u00fdch a citliv\u00fdch prostrediach.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 slu\u017eby ur\u010dovania polohy, ak nie s\u00fa nevyhnutn\u00e9 pre \u010dinnos\u0165 organiz\u00e1cie<\/strong>
                \u2705 Zabr\u00e1ni\u0165 aplik\u00e1ci\u00e1m v pr\u00edstupe k \u00fadajom o polohe<\/strong>
                \u2705 Minimalizova\u0165 \u00fanik \u00fadajov a ochranu s\u00fakromia v podnikov\u00fdch prostrediach<\/strong><\/p>\n\n\n\n
                Tento skript zakazuje slu\u017eby ur\u010dovania polohy vo Windows<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zamedzenie neopr\u00e1vnen\u00e9mu sledovaniu zariadenia<\/strong>
                \u2705 Zv\u00fd\u0161en\u00fa ochranu s\u00fakromia a d\u00e1tov\u00fdch \u00fadajov<\/strong>
                \u2705 Prevenciu proti potenci\u00e1lnym hrozb\u00e1m spojen\u00fdm s \u00fanikom polohy<\/strong><\/p>\n\n\n\n
                # Turn off location: enabled\nWrite-Progress -Activity \"System Hardening\" -Status \"Step 29\/38: Disabling location services\" -PercentComplete ([int](($CurrentStep \/ $TotalSteps) * 100))\n$CurrentStep++\nWrite-Log \"Disabling location services...\"\n$locationAndSensorsPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\LocationAndSensors\"\nif (-not (Test-Path $locationAndSensorsPath)) {\n    New-Item -Path $locationAndSensorsPath -Force | Out-Null\n}\nSet-ItemProperty -Path $locationAndSensorsPath -Name \"DisableLocation\" -Type DWord -Value 1\n<\/code><\/pre>\n\n\n\n
                Zak\u00e1zanie cloud synchroniz\u00e1cie spr\u00e1v a obmedzenie Microsoft \u00fa\u010dtov<\/h2>\n\n\n\n
                Windows umo\u017e\u0148uje synchroniz\u00e1ciu spr\u00e1v cez Microsoft cloud a umo\u017e\u0148uje pou\u017e\u00edvate\u013eom prihl\u00e1si\u0165 sa pomocou osobn\u00fdch Microsoft \u00fa\u010dtov<\/strong>. Tieto funkcie v\u0161ak m\u00f4\u017eu predstavova\u0165 v\u00e1\u017ene bezpe\u010dnostn\u00e9 riziko<\/strong> v podnikov\u00fdch prostrediach a pri spr\u00e1ve citliv\u00fdch \u00fadajov.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 synchroniz\u00e1ciu spr\u00e1v cez cloud (Message Service Cloud Sync)<\/strong>
                \u2705 Blokova\u0165 mo\u017enos\u0165 prihl\u00e1senia pou\u017e\u00edvate\u013eov cez spotrebite\u013esk\u00e9 Microsoft \u00fa\u010dty<\/strong>
                \u2705 Obmedzi\u0165 prepojenie Windows \u00fa\u010dtov s Microsoft cloudom, \u010d\u00edm sa zn\u00ed\u017ei riziko \u00faniku d\u00e1t<\/strong><\/p>\n\n\n\n
                Tento skript zakazuje cloudov\u00fa synchroniz\u00e1ciu spr\u00e1v a blokuje spotrebite\u013esk\u00e9 Microsoft \u00fa\u010dty<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zv\u00fd\u0161en\u00fa ochranu citliv\u00fdch \u00fadajov pred \u00fanikom cez cloudov\u00e9 slu\u017eby<\/strong>
                \u2705 Zn\u00ed\u017eenie rizika neopr\u00e1vnen\u00e9ho pr\u00edstupu cez osobn\u00e9 Microsoft \u00fa\u010dty<\/strong>
                \u2705 Zv\u00fd\u0161enie kontroly nad autentifik\u00e1ciou a spr\u00e1vou pou\u017e\u00edvate\u013esk\u00fdch \u00fa\u010dtov v organiz\u00e1cii<\/strong><\/p>\n\n\n\n
                # Allow Message Service Cloud Sync: disabled\n$messagingPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Messaging\"\nif (-not (Test-Path $messagingPath)) {\n    New-Item -Path $messagingPath -Force | Out-Null\n}\nSet-ItemProperty -Path $messagingPath -Name \"AllowMessageSync\" -Type DWord -Value 0\n\n# Block all consumer Microsoft account user authentication: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                -Name \"NoConnectedUser\" `\n                -Type DWord `\n                -Value 3\n<\/code><\/pre>\n\n\n\n
                Ochrana syst\u00e9mu \u2013 Zak\u00e1zanie MAPS, Defender nastaven\u00ed a OneDrive<\/h2>\n\n\n\n
                Windows \u0161tandardne umo\u017e\u0148uje zdie\u013eanie \u00fadajov o \u0161kodliv\u00fdch s\u00faboroch cez Microsoft MAPS<\/strong>, \u010do m\u00f4\u017ee predstavova\u0165 bezpe\u010dnostn\u00e9 riziko v podnikov\u00fdch prostrediach. Okrem toho, neautorizovan\u00fd pr\u00edstup na nebezpe\u010dn\u00e9 weby, pou\u017eitie OneDrive na ukladanie firemn\u00fdch s\u00faborov a vypnutie kritick\u00fdch Defender funkci\u00ed m\u00f4\u017eu zv\u00fd\u0161i\u0165 riziko kybernetick\u00fdch \u00fatokov<\/strong>.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 MAPS (Microsoft Active Protection Service) pre zv\u00fd\u0161enie s\u00fakromia<\/strong>
                \u2705 Povoli\u0165 Attack Surface Reduction (ASR) na blokovanie \u0161kodliv\u00fdch aplik\u00e1ci\u00ed<\/strong>
                \u2705 Blokova\u0165 pr\u00edstup na nebezpe\u010dn\u00e9 webov\u00e9 str\u00e1nky pomocou SmartScreen<\/strong>
                \u2705 Povoli\u0165 Microsoft Defender Antivirus (AV) pre ochranu pred malware<\/strong>
                \u2705 Zak\u00e1za\u0165 OneDrive na podnikov\u00fdch zariadeniach, aby sa zabr\u00e1nilo \u00faniku d\u00e1t<\/strong><\/p>\n\n\n\n
                Tento skript chr\u00e1ni syst\u00e9m pred zbyto\u010dn\u00fdm zdie\u013ean\u00edm \u00fadajov, zabezpe\u010duje ochranu pred exploitmi a br\u00e1ni pou\u017e\u00edvate\u013eom v ukladan\u00ed citliv\u00fdch firemn\u00fdch \u00fadajov na neautorizovan\u00e9 cloudov\u00e9 \u00falo\u017eisk\u00e1<\/strong>.<\/p>\n\n\n\n
                # Configure local setting override for Microsoft MAPS: disabled\n$spyNetPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\"\nif (-not (Test-Path $spyNetPath)) {\n    New-Item -Path $spyNetPath -Force | Out-Null\n}\nSet-ItemProperty -Path $spyNetPath -Name \"LocalSettingOverride\" -Type DWord -Value 0\n\n# Join Microsoft MAPS: disabled\nSet-ItemProperty -Path $spyNetPath -Name \"SpyNetReporting\" -Type DWord -Value 0\n\n# Configure Attack Surface Reduction rules: enabled\n$asrPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\"\nif (-not (Test-Path $asrPath)) {\n    New-Item -Path $asrPath -Force | Out-Null\n}\nSet-ItemProperty -Path $asrPath -Name \"ASRRules\" -Type DWord -Value 1\n\n# Prevent users and apps from accessing dangerous websites: block\n$smartScreenPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SmartScreen\"\nif (-not (Test-Path $smartScreenPath)) {\n    New-Item -Path $smartScreenPath -Force | Out-Null\n}\nSet-ItemProperty -Path $smartScreenPath -Name \"ConfigureAppInstallControl\" -Type DWord -Value 2\n\n# Turn off Microsoft Defender AntiVirus: disabled (AV on)\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" `\n                -Name \"DisableAntiSpyware\" `\n                -Type DWord `\n                -Value 0\n\n# Prevent usage of OneDrive for file storage: enabled\n$oneDrivePath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\OneDrive\"\nif (-not (Test-Path $oneDrivePath)) {\n    New-Item -Path $oneDrivePath -Force | Out-Null\n}\nSet-ItemProperty -Path $oneDrivePath -Name \"DisableFileSyncNGSC\" -Type DWord -Value 1\n<\/code><\/pre>\n\n\n\n
                Posilnenie bezpe\u010dnosti RDP (Remote Desktop Protocol)<\/h2>\n\n\n\n
                Vzdialen\u00e1 pracovn\u00e1 plocha (Remote Desktop Protocol \u2013 RDP)<\/strong> je jedn\u00fdm z naj\u010dastej\u0161ie zneu\u017e\u00edvan\u00fdch vektorov \u00fatokov. Ak nie je spr\u00e1vne nakonfigurovan\u00e1, m\u00f4\u017ee \u00fato\u010dn\u00edkom umo\u017eni\u0165 neautorizovan\u00fd pr\u00edstup do syst\u00e9mu<\/strong>.<\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Obmedzi\u0165 ka\u017ed\u00e9ho pou\u017e\u00edvate\u013ea na jednu RDP rel\u00e1ciu (Single Session Mode)<\/strong>
                \u2705 Zak\u00e1za\u0165 UI Automation redirection, aby sa zabr\u00e1nilo automatizovan\u00fdm \u00fatokom cez RDP<\/strong><\/p>\n\n\n\n
                Tento skript posil\u0148uje bezpe\u010dnos\u0165 RDP t\u00fdm, \u017ee obmedzuje po\u010det rel\u00e1ci\u00ed na jedn\u00e9ho pou\u017e\u00edvate\u013ea a zakazuje UI Automation redirection<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zv\u00fd\u0161en\u00fa kontrolu nad vzdialen\u00fdmi rel\u00e1ciami a zn\u00ed\u017eenie rizika zneu\u017eitia<\/strong>
                \u2705 Minimaliz\u00e1ciu automatizovan\u00fdch \u00fatokov na RDP pomocou UI Automation<\/strong>
                \u2705 Ochranu pred neautorizovan\u00fdm pr\u00edstupom a zn\u00ed\u017eenie mo\u017enosti RDP brute-force \u00fatokov<\/strong><\/p>\n\n\n\n
                # RDP Settings\nWrite-Progress -Activity \"System Hardening\" -Status \"Step 30\/38: Configuring RDP settings\" -PercentComplete ([int](($CurrentStep \/ $TotalSteps) * 100))\n$CurrentStep++\nWrite-Log \"Configuring RDP Settings...\"\n# Restrict RDS users to a single session: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"fSingleSessionPerUser\" `\n                -Type DWord `\n                -Value 1\n\n# Allow UI Automation redirection: disabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"fDisableUARedirection\" `\n                -Type DWord `\n                -Value 1\n<\/code><\/pre>\n\n\n\n
                Posilnenie bezpe\u010dnosti RDP \u2013 Ochrana proti presmerovaniu zariaden\u00ed a zv\u00fd\u0161enie \u0161ifrovania<\/h2>\n\n\n\n
                Vzdialen\u00e1 pracovn\u00e1 plocha (Remote Desktop Protocol \u2013 RDP)<\/strong> poskytuje pou\u017e\u00edvate\u013eom mo\u017enos\u0165 vzdialen\u00e9ho pr\u00edstupu k syst\u00e9mom. Ak nie je spr\u00e1vne nakonfigurovan\u00e1, m\u00f4\u017ee sa sta\u0165 hlavn\u00fdm vektorom \u00fatoku<\/strong>, umo\u017e\u0148uj\u00fac presmerovanie zariaden\u00ed, slab\u00e9 \u0161ifrovanie a neautorizovan\u00fd pr\u00edstup.<\/p>\n\n\n\n
                \ud83d\udd34 \u00dato\u010dn\u00edci m\u00f4\u017eu zneu\u017ei\u0165 presmerovanie lok\u00e1lnych zariaden\u00ed (USB, LPT, COM porty) na exfiltr\u00e1ciu d\u00e1t<\/strong>
                \ud83d\udd34 Nezabezpe\u010den\u00e1 RDP komunik\u00e1cia m\u00f4\u017ee by\u0165 zachyten\u00e1 pomocou \u00fatokov typu “Man-in-the-Middle”<\/strong>
                \ud83d\udd34 Nedostato\u010dn\u00e9 \u0161ifrovanie umo\u017e\u0148uje \u00fato\u010dn\u00edkom de\u0161ifrova\u0165 komunik\u00e1ciu medzi klientom a serverom<\/strong>
                \ud83d\udd34 Neautorizovan\u00e9 prihl\u00e1senia m\u00f4\u017eu by\u0165 mo\u017en\u00e9, ak syst\u00e9m nevy\u017eaduje v\u017edy heslo pri RDP rel\u00e1cii<\/strong><\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 presmerovanie USB, LPT, COM, Plug-and-Play a WebAuthn zariaden\u00ed<\/strong>
                \u2705 V\u017edy vy\u017eadova\u0165 heslo pri RDP pripojen\u00ed<\/strong>
                \u2705 Vy\u017eadova\u0165 \u0161ifrovan\u00fa komunik\u00e1ciu cez SSL a zabezpe\u010den\u00fd RPC<\/strong>
                \u2705 Povoli\u0165 sie\u0165ov\u00fa autentifik\u00e1ciu (Network Level Authentication \u2013 NLA)<\/strong>
                \u2705 Nastavi\u0165 \u010dasov\u00e9 limity pre neakt\u00edvne a odpojen\u00e9 rel\u00e1cie, aby sa zn\u00ed\u017eilo riziko neopr\u00e1vnen\u00e9ho pr\u00edstupu<\/strong><\/p>\n\n\n\n
                Tento skript posil\u0148uje bezpe\u010dnos\u0165 RDP obmedzen\u00edm presmerovania zariaden\u00ed, zv\u00fd\u0161en\u00edm \u00farovne \u0161ifrovania a zaveden\u00edm bezpe\u010dnostn\u00fdch obmedzen\u00ed na ne\u010dinn\u00e9 rel\u00e1cie<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zn\u00ed\u017eenie rizika exfiltr\u00e1cie \u00fadajov cez RDP rel\u00e1ciu<\/strong>
                \u2705 Ochranu pred \u00fatokmi na neza\u0161ifrovan\u00fa RDP komunik\u00e1ciu<\/strong>
                \u2705 Prevenciu proti neopr\u00e1vnen\u00e9mu pr\u00edstupu cez slab\u00e9 autentifika\u010dn\u00e9 mechanizmy<\/strong><\/p>\n\n\n\n
                # Do not allow COM\/LPT\/drive\/location\/PlugAndPlay\/WebAuthn redirection: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"fDisableCcm\" `\n                -Type DWord `\n                -Value 1\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"fDisableLPT\" `\n                -Type DWord `\n                -Value 1\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"fDisableCdm\" `\n                -Type DWord `\n                -Value 1\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"fDisablePNPRedir\" `\n                -Type DWord `\n                -Value 1\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"fDisableWebAuthnRedir\" `\n                -Type DWord `\n                -Value 1\n\n# Always prompt for password upon connection: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"fPromptForPassword\" `\n                -Type DWord `\n                -Value 1\n\n# Require secure RPC communication: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"fEncryptRPCTraffic\" `\n                -Type DWord `\n                -Value 1\n\n# Require specific security layer: SSL (2)\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"SecurityLayer\" `\n                -Type DWord `\n                -Value 2\n\n# Require NLA: enabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"UserAuthentication\" `\n                -Type DWord `\n                -Value 1\n\n# Set client connection encryption level: High (3)\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"MinEncryptionLevel\" `\n                -Type DWord `\n                -Value 3\n\n# Set time limit for active but idle sessions: 15 minutes\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"MaxIdleTime\" `\n                -Type DWord `\n                -Value 900000\n\n# Set time limit for disconnected sessions: 1 minute\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\" `\n                -Name \"MaxDisconnectionTime\" `\n                -Type DWord `\n                -Value 60000<\/code><\/pre>\n\n\n\n
                Zak\u00e1zanie KMS AVS valid\u00e1cie a posilnenie SmartScreen<\/h2>\n\n\n\n
                Windows obsahuje viacero bezpe\u010dnostn\u00fdch mechanizmov, ktor\u00e9 m\u00f4\u017eu zlep\u0161i\u0165 ochranu pred \u0161kodliv\u00fdm softv\u00e9rom a podvodn\u00fdmi aplik\u00e1ciami. CIS Benchmark odpor\u00fa\u010da zak\u00e1zanie online AVS valid\u00e1cie pre KMS klientov a posilnenie Microsoft Defender SmartScreen, aby sa minimalizovalo riziko \u0161kodliv\u00fdch aktiv\u00edt v syst\u00e9me.<\/strong><\/p>\n\n\n\n
                \ud83d\udd34 Online valid\u00e1cia KMS m\u00f4\u017ee predstavova\u0165 bezpe\u010dnostn\u00e9 riziko, preto\u017ee syst\u00e9m komunikuje s extern\u00fdmi servermi<\/strong>
                \ud83d\udd34 Ak nie je SmartScreen spr\u00e1vne nakonfigurovan\u00fd, pou\u017e\u00edvatelia m\u00f4\u017eu nevedomky sp\u00fa\u0161\u0165a\u0165 \u0161kodliv\u00fd softv\u00e9r<\/strong>
                \ud83d\udd34 \u00dato\u010dn\u00edci m\u00f4\u017eu ob\u00eds\u0165 ochranu syst\u00e9mu, ak SmartScreen umo\u017e\u0148uje \u013eahk\u00e9 obch\u00e1dzanie varovan\u00ed<\/strong><\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 KMS Client Online AVS Valid\u00e1ciu, aby sa minimalizovalo riziko zneu\u017eitia licen\u010dn\u00e9ho mechanizmu<\/strong>
                \u2705 Povoli\u0165 Windows Defender SmartScreen, aby varoval pred \u0161kodliv\u00fdmi aplik\u00e1ciami<\/strong>
                \u2705 Zak\u00e1za\u0165 mo\u017enos\u0165 ob\u00eds\u0165 varovanie SmartScreen, aby pou\u017e\u00edvatelia nevedomky nespustili \u0161kodliv\u00fd softv\u00e9r<\/strong><\/p>\n\n\n\n
                Tento skript zlep\u0161uje bezpe\u010dnos\u0165 Windows syst\u00e9mu zak\u00e1zan\u00edm nebezpe\u010dnej KMS valid\u00e1cie a posilnen\u00edm SmartScreen ochrany<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Prevenciu pred neautorizovanou online licen\u010dnou valid\u00e1ciou<\/strong>
                \u2705 Blokovanie potenci\u00e1lne \u0161kodliv\u00fdch aplik\u00e1ci\u00ed a ochr\u00e1nenie pou\u017e\u00edvate\u013eov pred soci\u00e1lnym in\u017einierstvom<\/strong>
                \u2705 Zv\u00fd\u0161enie kontroly nad bezpe\u010dnostn\u00fdmi nastaveniami, aby sa predi\u0161lo chyb\u00e1m pou\u017e\u00edvate\u013eov<\/strong><\/p>\n\n\n\n
                # Turn off KMS Client Online AVS Validation: enabled\n$KMSOnlineAVSValid = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform\"\nif (-not (Test-Path $KMSOnlineAVSValid)) {\n    New-Item -Path $KMSOnlineAVSValid -Force | Out-Null\n}\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform\" `\n                -Name \"NoCbsAvsValidation\" `\n                -Type DWord `\n                -Value 1\n\n# Configure Windows Defender SmartScreen: warn and prevent bypass\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                -Name \"EnableSmartScreen\" `\n                -Type DWord `\n                -Value 1\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\" `\n                -Name \"ConfigureAppInstallControl\" `\n                -Type DWord `\n                -Value 2<\/code><\/pre>\n\n\n\n
                Posilnenie bezpe\u010dnosti Windows Ink Workspace, PowerShell a prihl\u00e1senia<\/h2>\n\n\n\n
                Windows poskytuje viacero funkci\u00ed, ktor\u00e9 m\u00f4\u017eu by\u0165 potenci\u00e1lnymi bezpe\u010dnostn\u00fdmi rizikami, ak nie s\u00fa spr\u00e1vne nakonfigurovan\u00e9. Windows Ink Workspace<\/strong> umo\u017e\u0148uje pou\u017e\u00edvate\u013eom pou\u017e\u00edva\u0165 digit\u00e1lne pero a aplik\u00e1cie na p\u00edsanie pozn\u00e1mok, pri\u010dom m\u00f4\u017ee zobrazova\u0165 odpor\u00fa\u010dan\u00e9 aplik\u00e1cie, ktor\u00e9 nie s\u00fa v\u017edy bezpe\u010dn\u00e9. PowerShell skriptovanie<\/strong> je v\u00fdkonn\u00fd n\u00e1stroj pre administr\u00e1torov, no m\u00f4\u017ee by\u0165 zneu\u017eit\u00fd \u00fato\u010dn\u00edkmi na vykon\u00e1vanie \u0161kodliv\u00fdch pr\u00edkazov. Automatick\u00e9 prihl\u00e1senie po re\u0161tarte<\/strong> m\u00f4\u017ee zv\u00fd\u0161i\u0165 riziko neautorizovan\u00e9ho pr\u00edstupu k syst\u00e9mu.<\/p>\n\n\n\n
                \ud83d\udd34 Odpor\u00fa\u010dan\u00e9 aplik\u00e1cie vo Windows Ink Workspace m\u00f4\u017eu obsahova\u0165 bezpe\u010dnostn\u00e9 rizik\u00e1<\/strong>
                \ud83d\udd34 PowerShell m\u00f4\u017ee by\u0165 pou\u017eit\u00fd na vykon\u00e1vanie \u0161kodliv\u00fdch skriptov, ak nie je spr\u00e1vne monitorovan\u00fd<\/strong>
                \ud83d\udd34 Automatick\u00e9 prihl\u00e1senie po re\u0161tarte m\u00f4\u017ee umo\u017eni\u0165 \u00fato\u010dn\u00edkom pr\u00edstup k syst\u00e9mu bez zadania hesla<\/strong><\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 odpor\u00fa\u010dan\u00e9 aplik\u00e1cie a samotn\u00fd Windows Ink Workspace<\/strong>
                \u2705 Zak\u00e1za\u0165 automatick\u00e9 prihl\u00e1senie po re\u0161tarte, aby bol vy\u017eadovan\u00fd login<\/strong>
                \u2705 Povoli\u0165 PowerShell Script Block Logging a Transcription pre monitorovanie skriptovania<\/strong><\/p>\n\n\n\n
                Tento skript zlep\u0161uje bezpe\u010dnos\u0165 syst\u00e9mu odstr\u00e1nen\u00edm nepotrebn\u00fdch funkcional\u00edt, zv\u00fd\u0161en\u00edm transparentnosti PowerShell skriptov a zabr\u00e1nen\u00edm automatick\u00e9mu prihl\u00e1seniu<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zn\u00ed\u017eenie rizika in\u0161tal\u00e1cie ne\u017eiaducich alebo \u0161kodliv\u00fdch aplik\u00e1ci\u00ed<\/strong>
                \u2705 Zv\u00fd\u0161enie kontroly nad sp\u00fa\u0161\u0165an\u00edm PowerShell skriptov a potenci\u00e1lne \u0161kodliv\u00fdm k\u00f3dom<\/strong>
                \u2705 Minimalizovanie neautorizovan\u00e9ho pr\u00edstupu k syst\u00e9mu po re\u0161tarte<\/strong><\/p>\n\n\n\n
                # Allow suggested apps in Windows Ink Workspace: disabled\n$WindowsInkWSPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\WindowsInkWorkspace\"\nif (-not (Test-Path $WindowsInkWSPath)) {\n    New-Item -Path $WindowsInkWSPath -Force | Out-Null\n}\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\WindowsInkWorkspace\" `\n                -Name \"AllowSuggestedAppsInWindowsInkWorkspace\" `\n                -Type DWord `\n                -Value 0\n\n# Allow Windows Ink Workspace: disabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\WindowsInkWorkspace\" `\n                -Name \"AllowWindowsInkWorkspace\" `\n                -Type DWord `\n                -Value 0\n\n# Prevent IE security prompt for Windows Installer scripts: disabled (no registry needed if default)\n\n# Sign-in and lock last interactive user automatically after a restart: disabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" `\n                -Name \"DisableAutomaticRestartSignOn\" `\n                -Type DWord `\n                -Value 1\n\n# Turn on PowerShell Script Block Logging: enabled\n$scriptBlockLoggingPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\"\nif (-not (Test-Path $scriptBlockLoggingPath)) {\n    New-Item -Path $scriptBlockLoggingPath -Force | Out-Null\n}\nSet-ItemProperty -Path $scriptBlockLoggingPath -Name \"EnableScriptBlockLogging\" -Type DWord -Value 1\n\n# Turn on PowerShell Transcription: enabled\n$transcriptionPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription\"\nif (-not (Test-Path $transcriptionPath)) {\n    New-Item -Path $transcriptionPath -Force | Out-Null\n}\nSet-ItemProperty -Path $transcriptionPath -Name \"EnableTranscripting\" -Type DWord -Value 1\n<\/code><\/pre>\n\n\n\n
                Posilnenie bezpe\u010dnosti Windows Remote Management (WinRM) a Windows Remote Shell (WinRS)<\/h2>\n\n\n\n
                Windows Remote Management (WinRM)<\/strong> a Windows Remote Shell (WinRS)<\/strong> umo\u017e\u0148uj\u00fa vzdialen\u00fa spr\u00e1vu syst\u00e9mov cez PowerShell a pr\u00edkazov\u00fd riadok. Hoci tieto funkcie m\u00f4\u017eu by\u0165 u\u017eito\u010dn\u00e9 pre administr\u00e1torov, m\u00f4\u017eu by\u0165 tie\u017e zneu\u017eit\u00e9 \u00fato\u010dn\u00edkmi na vzdialen\u00fd pr\u00edstup k syst\u00e9mu<\/strong>.<\/p>\n\n\n\n
                \ud83d\udd34 Ak je povolen\u00fd z\u00e1kladn\u00fd (Basic) autentifika\u010dn\u00fd mechanizmus, \u00fato\u010dn\u00edci m\u00f4\u017eu z\u00edska\u0165 hesl\u00e1 v neza\u0161ifrovanej podobe<\/strong>
                \ud83d\udd34 Ne\u0161ifrovan\u00fd WinRM prenos m\u00f4\u017ee by\u0165 zachyten\u00fd a pou\u017eit\u00fd na z\u00edskanie citliv\u00fdch \u00fadajov<\/strong>
                \ud83d\udd34 Ak je povolen\u00e1 Windows Remote Shell (WinRS), \u00fato\u010dn\u00edci m\u00f4\u017eu vykon\u00e1va\u0165 pr\u00edkazy na dia\u013eku<\/strong><\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 Basic autentifik\u00e1ciu vo WinRM, aby sa zabr\u00e1nilo odosielaniu hesiel v neza\u0161ifrovanej podobe<\/strong>
                \u2705 Zak\u00e1za\u0165 neza\u0161ifrovan\u00fd prenos WinRM, aby sa zabr\u00e1nilo odpo\u010d\u00favaniu komunik\u00e1cie<\/strong>
                \u2705 Zak\u00e1za\u0165 Digest autentifik\u00e1ciu, aby sa zabr\u00e1nilo slab\u00fdm autentifika\u010dn\u00fdm met\u00f3dam<\/strong>
                \u2705 Zak\u00e1za\u0165 Windows Remote Shell (WinRS), aby sa zabr\u00e1nilo neautorizovan\u00e9mu vzdialen\u00e9mu vykon\u00e1vaniu pr\u00edkazov<\/strong>
                \u2705 Zak\u00e1za\u0165 RunAs vo WinRM, aby sa zabr\u00e1nilo eskal\u00e1cii opr\u00e1vnen\u00ed<\/strong><\/p>\n\n\n\n
                Tento skript zabezpe\u010duje vzdialen\u00fa spr\u00e1vu syst\u00e9mu t\u00fdm, \u017ee zakazuje nebezpe\u010dn\u00e9 autentifika\u010dn\u00e9 met\u00f3dy, zakazuje ne\u0161ifrovan\u00fa komunik\u00e1ciu a vyp\u00edna Windows Remote Shell (WinRS)<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Prevenciu pred odpo\u010d\u00favan\u00edm neza\u0161ifrovanej WinRM komunik\u00e1cie<\/strong>
                \u2705 Ochranu proti neautorizovan\u00e9mu vzdialen\u00e9mu vykon\u00e1vaniu pr\u00edkazov cez WinRS<\/strong>
                \u2705 Minimalizovanie rizika eskal\u00e1cie opr\u00e1vnen\u00ed cez WinRM<\/strong><\/p>\n\n\n\n
                # WinRM Client settings\n\n$winrmClientPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\Client\"\nif (-not (Test-Path $winrmClientPath)) {\n    New-Item -Path $winrmClientPath -Force | Out-Null\n}\nSet-ItemProperty -Path $winrmClientPath -Name \"AllowBasic\" -Type DWord -Value 0\nSet-ItemProperty -Path $winrmClientPath -Name \"AllowUnencryptedTraffic\" -Type DWord -Value 0\nSet-ItemProperty -Path $winrmClientPath -Name \"AllowDigest\" -Type DWord -Value 0\n\n# WinRM Service\n\n$winrmServicePath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\Service\"\nif (-not (Test-Path $winrmServicePath)) {\n    New-Item -Path $winrmServicePath -Force | Out-Null\n}\nSet-ItemProperty -Path $winrmServicePath -Name \"AllowBasic\" -Type DWord -Value 0\nSet-ItemProperty -Path $winrmServicePath -Name \"AllowUnencryptedTraffic\" -Type DWord -Value 0\nSet-ItemProperty -Path $winrmServicePath -Name \"DisableRunAs\" -Type DWord -Value 1\nSet-ItemProperty -Path $winrmServicePath -Name \"DisableAutoConfig\" -Type DWord -Value 1\n\n# Windows Remote Shell: disabled\n\n$winrsPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WinRM\\WinRS\"\nif (-not (Test-Path $winrsPath)) {\n    New-Item -Path $winrsPath -Force | Out-Null\n}\nSet-ItemProperty -Path $winrsPath -Name \"AllowRemoteShellAccess\" -Type DWord -Value 0\n<\/code><\/pre>\n\n\n\n
                Ochrana aplik\u00e1ci\u00ed, prehliada\u010dov, aktualiz\u00e1ci\u00ed a vzdialenej spr\u00e1vy<\/h2>\n\n\n\n
                Windows obsahuje viacero bezpe\u010dnostn\u00fdch mechanizmov, ktor\u00e9 je potrebn\u00e9 spr\u00e1vne nakonfigurova\u0165 na ochranu syst\u00e9mu pred exploitmi, \u0161kodliv\u00fdmi aplik\u00e1ciami a neopr\u00e1vnen\u00fdm vzdialen\u00fdm pr\u00edstupom. App and Browser Protection<\/strong> chr\u00e1ni syst\u00e9m pred nebezpe\u010dn\u00fdmi webov\u00fdmi str\u00e1nkami a aplik\u00e1ciami. Spr\u00e1vna konfigur\u00e1cia Windows Update<\/strong> zabra\u0148uje nechcen\u00fdm preru\u0161eniam pr\u00e1ce a zabezpe\u010duje, \u017ee syst\u00e9m zost\u00e1va aktu\u00e1lny. Vzdialen\u00e1 UAC autentifik\u00e1cia (Remote UAC)<\/strong> m\u00f4\u017ee ovplyvni\u0165 bezpe\u010dnos\u0165 v pr\u00edpade vzdialenej spr\u00e1vy.<\/p>\n\n\n\n
                \ud83d\udd34 Ak je povolen\u00e9 obch\u00e1dzanie Exploit Protection, \u0161kodliv\u00fd k\u00f3d m\u00f4\u017ee \u013eah\u0161ie vykon\u00e1va\u0165 \u00fatoky na syst\u00e9m<\/strong>
                \ud83d\udd34 Ak nie s\u00fa spr\u00e1vne nastaven\u00e9 Windows aktualiz\u00e1cie, syst\u00e9m m\u00f4\u017ee zosta\u0165 zranite\u013en\u00fd vo\u010di hrozb\u00e1m<\/strong>
                \ud83d\udd34 Ak je UAC deaktivovan\u00fd pre vzdialen\u00fdch pou\u017e\u00edvate\u013eov, \u00fato\u010dn\u00edci m\u00f4\u017eu \u013eah\u0161ie eskalova\u0165 opr\u00e1vnenia<\/strong><\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 obch\u00e1dzanie Exploit Protection v App and Browser Protection<\/strong>
                \u2705 Nastavi\u0165 pl\u00e1n aktualiz\u00e1ci\u00ed tak, aby boli prij\u00edman\u00e9 v bezpe\u010dnom \u010dasovom r\u00e1mci<\/strong>
                \u2705 Zabr\u00e1ni\u0165 automatick\u00e9mu re\u0161tartu syst\u00e9mu s prihl\u00e1sen\u00fdmi pou\u017e\u00edvate\u013emi<\/strong>
                \u2705 Zak\u00e1za\u0165 vzdialen\u00fa UAC autentifik\u00e1ciu pre bezpe\u010dnej\u0161ie spracovanie syst\u00e9mov\u00fdch po\u017eiadaviek<\/strong><\/p>\n\n\n\n
                Tento skript posil\u0148uje bezpe\u010dnos\u0165 syst\u00e9mu nastaven\u00edm Exploit Protection, konfigur\u00e1ciou aktualiz\u00e1ci\u00ed a ochranou vzdialenej spr\u00e1vy<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zlep\u0161en\u00fa ochranu pred exploitmi a \u00fatokmi na aplik\u00e1cie a prehliada\u010de<\/strong>
                \u2705 Bezpe\u010dn\u00fd proces aktualiz\u00e1ci\u00ed bez naru\u0161enia pr\u00e1ce pou\u017e\u00edvate\u013eov<\/strong>
                \u2705 Minimalizovanie mo\u017enosti eskal\u00e1cie opr\u00e1vnen\u00ed pri vzdialenom pr\u00edstupe<\/strong><\/p>\n\n\n\n
                # App and browser protection:\n\n$appBrowserProtectionPath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Security Center\\App And Browser Protection\"\nif (-not (Test-Path $appBrowserProtectionPath)) {\n    New-Item -Path $appBrowserProtectionPath -Force | Out-Null\n}\nSet-ItemProperty -Path $appBrowserProtectionPath -Name \"DisallowExploitProtectionOverride\" -Type DWord -Value 1\n\n# Legacy Policies:\n\n# No auto-restart with logged on users: disabled\nSet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\" `\n                -Name \"NoAutoRebootWithLoggedOnUsers\" `\n                -Type DWord `\n                -Value 0\n\n# Select when Preview Builds and Feature Updates are received: enabled - 180 days\n$deferUpgradePath = \"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DeferUpgrade\"\nif (-not (Test-Path $deferUpgradePath)) {\n    New-Item -Path $deferUpgradePath -Force | Out-Null\n}\nSet-ItemProperty -Path $deferUpgradePath -Name \"DeferFeatureUpdates\" -Type DWord -Value 1\nSet-ItemProperty -Path $deferUpgradePath -Name \"DeferFeatureUpdatesPeriodInDays\" -Type DWord -Value 180\n\n# Select when Quality Updates are received: enabled - 0 days\nSet-ItemProperty -Path $deferUpgradePath -Name \"DeferQualityUpdates\" -Type DWord -Value 1\nSet-ItemProperty -Path $deferUpgradePath -Name \"DeferQualityUpdatesPeriodInDays\" -Type DWord -Value 0\n\n# Disable remote UAC to be able to use the service account for Veeam services\n\n$remoteUACPath = \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\"\nif (-not (Test-Path $remoteUACPath)) {\n    New-Item -Path $remoteUACPath -Force | Out-Null\n}\nSet-ItemProperty -Path $remoteUACPath -Name \"LocalAccountTokenFilterPolicy\" -Type DWord -Value 1\n<\/code><\/pre>\n\n\n\n
                Odstr\u00e1nenie obnovovacej part\u00edcie a roz\u0161\u00edrenie disku C:<\/h2>\n\n\n\n
                Windows obsahuje Windows Recovery Environment (WinRE)<\/strong>, ktor\u00fd umo\u017e\u0148uje obnovu syst\u00e9mu v pr\u00edpade zlyhania. Hoci je to u\u017eito\u010dn\u00e9, v niektor\u00fdch pr\u00edpadoch m\u00f4\u017ee by\u0165 bezpe\u010dnostn\u00fdm rizikom<\/strong>, najm\u00e4 ak je syst\u00e9m nasaden\u00fd v podnikov\u00fdch prostrediach s oddelen\u00fdm z\u00e1lohovan\u00edm.<\/p>\n\n\n\n
                \ud83d\udd34 Obnovovacia part\u00edcia m\u00f4\u017ee by\u0165 cie\u013eom \u0161kodliv\u00e9ho softv\u00e9ru alebo zneu\u017eit\u00e1 na neautorizovan\u00fd pr\u00edstup<\/strong>
                \ud83d\udd34 Ak je vo\u013en\u00e9 miesto nevyu\u017eit\u00e9, m\u00f4\u017ee by\u0165 efekt\u00edvnej\u0161ie alokovan\u00e9 na prim\u00e1rny disk C:<\/strong>
                \ud83d\udd34 Niektor\u00e9 bezpe\u010dnostn\u00e9 politiky vy\u017eaduj\u00fa odstr\u00e1nenie WinRE na minimaliz\u00e1ciu riz\u00edk<\/strong><\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 Windows Recovery Environment (WinRE), ak sa nepou\u017e\u00edva<\/strong>
                \u2705 Odstr\u00e1ni\u0165 obnovovaciu part\u00edciu, ak nie je potrebn\u00e1<\/strong>
                \u2705 Zabr\u00e1ni\u0165 zneu\u017eitiu obnovovacej part\u00edcie na eskal\u00e1ciu opr\u00e1vnen\u00ed<\/strong>
                \u2705 Roz\u0161\u00edri\u0165 prim\u00e1rny disk C: na maximaliz\u00e1ciu dostupn\u00e9ho priestoru<\/strong><\/p>\n\n\n\n
                Tento skript zabezpe\u010duje syst\u00e9m odstr\u00e1nen\u00edm obnovovacej part\u00edcie a roz\u0161\u00edren\u00edm hlavn\u00e9ho disku C:<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Minimalizovanie bezpe\u010dnostn\u00fdch riz\u00edk spojen\u00fdch s WinRE<\/strong>
                \u2705 Zlep\u0161enie efekt\u00edvnosti vyu\u017eitia disku<\/strong>
                \u2705 Predch\u00e1dzanie mo\u017en\u00e9mu zneu\u017eitiu obnovovacej part\u00edcie<\/strong><\/p>\n\n\n\n
                # Deleting recovery partition and stopping required service\n\nreagentc \/disable\nStart-Sleep -Seconds 3  # Allow time for the operation\n\n# Identify the Recovery Partition\n\n$recoveryPartition = Get-Partition | Where-Object { $_.Type -eq 'Recovery' }\n\nif ($recoveryPartition) {\n    $diskNumber = $recoveryPartition.DiskNumber\n    $partitionNumber = $recoveryPartition.PartitionNumber\n\n    Write-Log \"Recovery Partition Found on Disk $diskNumber, Partition $partitionNumber\"\n    Write-Log \"Creating diskpart script to remove partition...\"\n    # Create a diskpart script to remove the partition\n    $diskpartScript = @\"\nselect disk $diskNumber\nselect partition $partitionNumber\ndelete partition override\n\"@\n    # Save the diskpart script to a temporary file\n    $scriptPath = \"$env:TEMP\\delete_recovery_partition.txt\"\n    $diskpartScript | Set-Content -Path $scriptPath -Encoding ASCII\n\n    # Execute Diskpart to delete the recovery partition\n    Write-Log \"Running diskpart to delete the Recovery Partition...\"\n    Start-Process -FilePath \"diskpart.exe\" -ArgumentList \"\/s $scriptPath\" -Wait -WindowStyle Hidden\n\n    # Cleanup\n    Remove-Item -Path $scriptPath -Force\n    Write-Log \"Recovery Partition deleted successfully!\", \"success\"\n} else {\n    Write-Log \"No Recovery Partition found. Skipping removal of recovery partition.\"\n}\n\n# Find C: partition to extend\nWrite-Log \"Finding C: Partition to extend...\"\n$cPartition = Get-Partition | Where-Object { $_.DriveLetter -eq \"C\" }\n\nif ($cPartition) {\n    $cDiskNumber = $cPartition.DiskNumber\n    $cPartitionNumber = $cPartition.PartitionNumber\n\n    Write-Log \"C: Partition Found on Disk $cDiskNumber, Partition $cPartitionNumber\"\n    Write-Log \"Extending C: partition with freed space...\"\n    # Create a diskpart script to extend C: drive\n    $diskpartScript = @\"\nselect disk $cDiskNumber\nselect partition $cPartitionNumber\nextend\n\"@\n    # Save the diskpart script to a temporary file\n    $scriptPath = \"$env:TEMP\\extend_c_partition.txt\"\n    $diskpartScript | Set-Content -Path $scriptPath -Encoding ASCII\n\n    # Execute Diskpart to extend the C: partition\n    Start-Process -FilePath \"diskpart.exe\" -ArgumentList \"\/s $scriptPath\" -Wait -WindowStyle Hidden\n\n    # Cleanup\n    Remove-Item -Path $scriptPath -Force\n    Write-Log \"C: partition extended successfully!\", \"success\"\n} else {\n    Write-Log \"C: Partition not found! Please check manually.\", \"error\"\n}\n<\/code><\/pre>\n\n\n\n
                Zak\u00e1zanie slu\u017eieb obnovy syst\u00e9mu a automatick\u00e9ho pripojenia diskov<\/h2>\n\n\n\n
                Windows obsahuje viacero slu\u017eieb na obnovu syst\u00e9mu a automatick\u00e9 prip\u00e1janie nov\u00fdch diskov. Ak tieto slu\u017eby nie s\u00fa potrebn\u00e9, m\u00f4\u017eu predstavova\u0165 bezpe\u010dnostn\u00e9 riziko<\/strong>, preto\u017ee m\u00f4\u017eu by\u0165 zneu\u017eit\u00e9 na eskal\u00e1ciu opr\u00e1vnen\u00ed alebo neopr\u00e1vnen\u00e9 modifik\u00e1cie syst\u00e9mu.<\/p>\n\n\n\n
                \ud83d\udd34 Slu\u017eby Windows Error Reporting (WER) m\u00f4\u017eu posiela\u0165 citliv\u00e9 syst\u00e9mov\u00e9 \u00fadaje spolo\u010dnosti Microsoft, \u010do m\u00f4\u017ee predstavova\u0165 riziko \u00faniku inform\u00e1ci\u00ed<\/strong>
                \ud83d\udd34 Automount automaticky prip\u00e1ja nov\u00e9 disky, \u010do m\u00f4\u017ee by\u0165 zneu\u017eit\u00e9 na vykonanie \u0161kodliv\u00e9ho k\u00f3du z prenosn\u00fdch zariaden\u00ed<\/strong>
                \ud83d\udd34 Zak\u00e1zan\u00edm t\u00fdchto funkci\u00ed sa eliminuje riziko neopr\u00e1vnen\u00e9ho z\u00e1pisu do syst\u00e9mov\u00fdch oblast\u00ed<\/strong><\/p>\n\n\n\n
                CIS (Center for Internet Security) Benchmark<\/strong> odpor\u00fa\u010da nasleduj\u00face opatrenia:<\/p>\n\n\n\n
                \u2705 Zak\u00e1za\u0165 slu\u017eby Windows Error Reporting (WER), ktor\u00e9 nie s\u00fa nevyhnutn\u00e9<\/strong>
                \u2705 Zak\u00e1za\u0165 automatick\u00e9 prip\u00e1janie nov\u00fdch diskov, aby sa zabr\u00e1nilo neopr\u00e1vnen\u00e9mu spusteniu k\u00f3du<\/strong>
                \u2705 Zabr\u00e1ni\u0165 vytv\u00e1raniu nov\u00fdch obnovovac\u00edch part\u00edci\u00ed<\/strong>
                \u2705 Minimalizova\u0165 riziko zneu\u017eitia extern\u00fdch zariaden\u00ed na modifik\u00e1ciu syst\u00e9mu<\/strong><\/p>\n\n\n\n
                Tento skript zabezpe\u010duje syst\u00e9m vypnut\u00edm nepotrebn\u00fdch obnovovac\u00edch slu\u017eieb a zak\u00e1zan\u00edm automount<\/strong>, \u010d\u00edm zabezpe\u010duje:<\/p>\n\n\n\n
                \u2705 Zv\u00fd\u0161enie kontroly nad pripojen\u00fdmi zariadeniami<\/strong>
                \u2705 Zamedzenie neopr\u00e1vnen\u00e9mu z\u00e1pisu do syst\u00e9mov\u00fdch oblast\u00ed<\/strong>
                \u2705 Minimalizovanie bezpe\u010dnostn\u00fdch riz\u00edk spojen\u00fdch s WER a automount<\/strong><\/p>\n\n\n\n
                # Disable related services\n\n\n$services = @(\"wercplsupport\", \"werSvc\")\n\nforeach ($service in $services) {\n    Write-Log \"Disabling service: $service\"\n    Stop-Service -Name $service -Force -ErrorAction SilentlyContinue\n    Set-Service -Name $service -StartupType Disabled\n}\n\n\n\n# Run diskpart to disable automount\n$scriptPath = \"$env:TEMP\\disable_automount.txt\"\n@\"\nautomount disable\nexit\n\"@ | Set-Content -Path $scriptPath -Encoding ASCII\n\nStart-Process -FilePath \"diskpart.exe\" -ArgumentList \"\/s $scriptPath\" -Wait -WindowStyle Hidden\nRemove-Item -Path $scriptPath -Force -ErrorAction SilentlyContinue<\/code><\/pre>\n\n\n\n
                <\/p>\n\n\n\n
                \n\n\n\n
                Cel\u00e1 s\u00e9ria: CIS Benchmark<\/h2>\n\n\n\n
                  \n\n
                1. CIS Benchmark<\/strong> — tento \u010dl\u00e1nok<\/li>\n\n\n
                2. CIS Benchmark: \u0160tandard pre posilnenie kybernetickej bezpe\u010dnosti 2<\/a><\/li>\n\n<\/ol>\n\n\n\n
                  \n\n\n\n
                  S\u00favisiace n\u00e1vody<\/h2>\n\n\n\n