ADMX Templates vs Registry files

[w1r3d]

Hi all,

I'm working on hardening a Windows 7 host. I was given a spreadsheet with all the settings that it needs to be hardened with, so I went ahead and applied those. However, it sounds like in the future we will have more Win7 hosts that will also need to be hardened, so I'd like to try and automate/streamline this process somehow.

What I've done so far (and now I'm not sure I'm doing the right thing) is create a Security Template (.inf file) using MMC. For the rest of the settings, I've downloaded the ADMX templates from the Microsoft website, and I've been "configuring" those with the settings that are outlined in the spreadsheet given to me.

That said, I haven't actually tested the templates. I'm currently working on converting an old .adm file to .admx. Then it hit me: is this even the best way to go about this? Should I just create a big .reg file containing all these keys, and then run them on the target boxes?

What do y'all think? What has been your experience with Windows 7 hardening? Am I going down the right path?


Thanks in advance!
Pedro

 

[Dwarf]

Hi Pedro and welcome to W7 Forums

It all depends. Many of the settings will have an equivalent in the Registry, but not all. In addition, some Registry settings will need to be applied from an administrative account whereas others will need applying separately for each user. Without knowing the settings you're working with, we cannot say for sure what your best cause of action will be.

 

[w1r3d]

I see. Well, it is comforting to know that there's a chance I didn't waste ~4 hours today setting up templates. I'll test out the templates I've been working on and see if they work, and depending on how that goes I may just try to "automate" as much as I can using registry values (since, to my current knowledge, are easier to apply than a template).

That makes sense that some values may need to be set for individual users. I believe all of what I'm dealing with are admin-side policies/settings, so I think I'm off the hook on that.


Y'know, it's taken me a lot of time to try and "automate" all this. I hope that whenever I'm done, the amount of time it took me to work on this is still less than the amount of time that it would take to configure the computers manually! :/

Thanks for your reply, and for welcoming me to the forums
Pedro